diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index c15ece28..536d9bbc 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -24,6 +24,8 @@ jobs:
         run: python3 tools/strings.py check app/src/main/res
       - name: the network has one door, and it goes through the proxy
         run: bash tools/check-network-doors.sh
+      - name: every other way to the network fails that check
+        run: bash tools/tests/network-doors/run.sh
       - name: core tests
         run: ./gradlew --no-daemon :core:test
       - name: the page of the handoff seals what the device opens
diff --git a/CHANGELOG.md b/CHANGELOG.md
index cdd55a83..891eec65 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,118 +1,134 @@
 # Changelog
 
-## Unreleased
+## 0.2.0, 2026-09-30
 
-Everything Obtainium does, and more.
+Nearly everything Obtainium does, done in a way Tern can stand behind, and
+more.
 
-- Reads the stores and sites Obtainium reads: APKPure, Aptoide, Uptodown,
-  APKCombo, APKMirror (tracking only), Farsroid, Huawei AppGallery, Samsung
-  Galaxy Store, vivo, Tencent, CoolApk, RuStore, itch.io, Telegram,
-  NeutronCode, LiteAPKs, Apk4Free and RockMods (tracking only). The Add screen
-  says when a store offers again what developers publish elsewhere, and when a
-  site offers apps changed by someone else. Every file is still held to the
-  certificate of the first install.
+Sources
+- Reads itch.io, Telegram and Neutron Code. Behind a setting that starts off,
+  it also reads the third-party stores APKPure, Aptoide, APKCombo, APKMirror
+  (tracking only), Tencent, Huawei AppGallery, Samsung Galaxy Store and vivo.
+  While the setting is off, a pasted store address says what the stores are
+  and offers to turn them on, a search leaves them out, and apps from them
+  wait in the list, paused.
+- Every source is asked as Tern, with its own User-Agent, and nothing is
+  borrowed from another app. Tern does not read Uptodown, RuStore or CoolApk,
+  which answer only their own apps, or LiteAPKs, Apk4Free, RockMods and
+  Farsroid, which offer modified apps. An Obtainium import keeps everything
+  else and names each app it left out, with the reason.
+- The Add screen, an app's page and an import say where a store's files come
+  from and what the first install decides. A store's checksum is called the
+  store's, not the developer's.
+- The certificates Tern carries for well-known apps are found by package too,
+  so such an app added from a store, a mirror or a web page is held to its
+  developer's certificate from the first install.
 - Fetches each file from where its source says it is at the moment of the
-  download, for stores whose addresses expire.
-- Searches F-Droid, Aptoide, Uptodown, AppGallery, the vivo store and RuStore
-  as well as GitHub, Codeberg and GitLab, in the places ticked under "Search in".
-- Installs through Shizuku, Dhizuku, root or another installer app. Google
-  Play can be named as the installer, for every app or for one, and with Let Me
-  Downgrade installed an older version can go in over a newer one.
+  download, for sources whose addresses expire.
+- Searches F-Droid as well as GitHub, Codeberg and GitLab, and Aptoide,
+  AppGallery and the vivo store once the stores are on, in the places ticked
+  under "Search in".
+
+Installing
+- Installs through Shizuku, Dhizuku, root or another installer app, and the
+  log says when Android's installer stood in for one that was not ready.
+  Shizuku and Dhizuku installed and updated apps without a prompt on an
+  Android 13 emulator; root has not been tried on a device yet.
+  Every install, whichever installer made it, counts only when the installed
+  app carries the certificate the checks verified. Shizuku's library asks Sui
+  for anything only once Shizuku is the chosen installer.
+- Dhizuku's state shows in Settings: not installed, not the device owner, not
+  allowed yet, or ready. The installer app is picked from a list with icons.
+- Google Play can be named as the installer, for every app or for one. With
+  Let Me Downgrade installed, an older version can go in over a newer one,
+  only for a release picked from an app's history, and never when the file is
+  older than the version its source named.
+- Zip and tar archives, with gzip, bzip2 and xz, and a filter for the file
+  inside them.
+- New apps can be shown to Verified Apps or AppVerifier first, only when that
+  app carries the certificate its makers publish. Off until turned on.
+
+Options and checks
 - Every per-app option Obtainium has: pre-releases, falling back to older
   releases, a minimum age, filters on titles, notes and versions, the version
   read from the tag, the title or the date with a match group, the order of
-  releases, staying some releases behind the newest, zip and tar archives with a filter
-  inside them, a name and author of your own, muted notifications, refreshing
-  before a download, and the options of each source, from the steps through a
-  web page to the device model the Galaxy Store is asked as. Both import and
-  export carry all of them.
-- Checks as often as every 15 minutes or as seldom as every 30 days, on start
-  and on opening an app if wanted, only installed apps if wanted, with a filter
-  for every app's files, and forgets apps removed from the phone if wanted.
+  releases, staying some releases behind the newest, a name and author of your
+  own, muted notifications, refreshing before a download, and the options of
+  each source, from the steps through a web page to the phone model the Galaxy
+  Store is asked for. Import and export carry all of them.
+- How often to check is a slider from 15 minutes to 30 days. Checks can run on
+  start and on opening an app, cover only installed apps, and filter every
+  app's files.
+- Checks and installs each have their own Wi-Fi and charging switches, and a
+  copy that held checks back for Wi-Fi or charging on 0.1.0 still does. One
+  switch pauses every install the background would make. An install held for
+  Wi-Fi or a charger goes in from the last check once they are there. A check
+  that failed on the network is tried again, later each time, and a rate limit
+  is waited out.
+- Web page apps saved by 0.1.0 offer what they offered before, and a switch
+  moves one to Obtainium's way of reading a page.
+- Apps removed from the phone can be forgotten if you want. Their pinned
+  certificates are kept for when their source is added again, and apps Android
+  15 archives stay in the list.
+
+The list and the screens
 - The list can be sorted, grouped by category or source with groups that fold,
-  filtered, and swiped. Favourites stay on top, each app's categories show as
-  a coloured stripe, and a double tap on an icon opens the app. A minimal
-  density, haptics and an always-phone layout are settings.
-- Categories have colours, and can be renamed or deleted for every app at once.
-- Notifications carry Update and Update all buttons. Releases of tracked apps
-  have their own channel, and a quiet notification can show a check running.
-- Imports a list of addresses from any text, and `obtainium://apps` links of
-  several apps. `tern://refresh` and `obtainium://refresh` check from a link.
-- Keeps an export up to date in a folder you pick, can carry settings in it,
-  and writes a file Obtainium can import.
+  filtered, and swiped. Favourites stay on top, each app's categories show as a
+  coloured stripe, and a double tap on an icon opens the app. A minimal
+  density, haptics and an always-phone layout are settings. Categories have
+  colours of their own and can be renamed or deleted for every app at once.
+- With a remote, a grouped list opens on its first app and back returns to the
+  row that was opened, rows of chips walk in order, and the buttons beside the
+  interval slider say when a press turns checks off. Select all picks only the
+  apps the list shows.
+- From one and a half times the text size, a television shows the list and an
+  app's page one at a time, and a screen's title that does not fit beside its
+  buttons goes under them whole.
 - A home-screen widget with the number of updates and Check and Update all
-  buttons, a Quick Settings tile, and launcher shortcuts.
-- Saves any file a release offers to Downloads, and the source code of GitHub,
-  GitLab and Forgejo releases, from an app's page, one of its versions or many
-  apps at once. Saving goes on after the page is left and says when each file
-  is saved; sizes are asked of the server where a source lists none. Many
-  tracked releases can be marked as seen at once.
-- The notification after an install names the version, and one about problems
-  names each app with its reason, a tap away from what went wrong.
-- New apps can be shown to Verified Apps first, as in Obtainium. The installer
-  app is picked from a list with icons, with the way in it takes.
-- Dhizuku's state shows in Settings: not installed, not the device owner, not
-  allowed yet, or ready. Every install, whichever installer made it, counts
-  only when the installed app carries the certificate the checks verified.
-- The activity log can keep Tern's own messages: warnings, errors, and each
-  check's start and end, with what started it, how many apps, what it found and
-  how long it took. Off at first. They are marked and coloured by level, have a
-  filter of their own, and lose addresses' queries, tokens, passwords and email
-  addresses before they are kept.
+  buttons, a Quick Settings tile, and launcher shortcuts. Only Tern's own
+  shortcuts can start Update all, Add or a check. A `tern://refresh` or
+  `obtainium://refresh` link from a web page or another app asks first, at
+  most once a minute, and never installs.
+- The well known apps say when one is already in your list or on the phone,
+  and when the copy on the phone is signed by someone else, so this address
+  could not update it.
+- Notifications carry Update and Update all buttons, name the version an app
+  was updated to, and name each app with a problem and its reason.
 - Notes of your own and category chips on an app's page, and the project's
-  README, read from the forge when you ask for it.
-- The activity log can be shared as text, and Tern offers to keep itself up to
-  date.
+  README, read from the forge when you ask for it, a private one included.
 - The top of an app's page takes the colour of its icon, and a deeper screen
-  slides in from the side text runs to.
+  slides in from the side text runs to. Your own colour can be typed as a
+  colour code, and the scheme can be standard, vibrant or expressive, each
+  measured for contrast.
 - The language can be chosen in Tern on every Android version.
-- How often to check is a slider from 15 minutes to 30 days. Install only on
-  Wi-Fi and only while charging hold back installs, not checks, and a switch
-  pauses every install the background would make. A check that failed on the
-  network is tried again, later each time, and a rate limit is waited out.
-- Your own colour can be typed as a colour code, and the scheme can be
-  standard, vibrant or expressive, each measured for contrast. A category's
-  colour can be any colour.
-- The kept export can be written in Obtainium's format under a name of your
-  own, and the export for Obtainium works on a TV too.
-- Certificate pinning for GitHub, GitLab and Codeberg, off by default as in
-  Obtainium. RuStore's addresses that use Russia's national authority work.
-- After an unexpected stop the next start shows what Tern was doing, to copy
-  or share. The log can be cut to its last days and is copied where nothing
-  takes a share.
-- About links to how Tern works, how it keeps you safe and its privacy page,
-  with a note on Android's developer verification.
-- The list's filters combine: name, developer, package, sources, several
-  categories, up to date, not installed, tracked only. Each row shows when its
-  release came out with its changes a tap away, dims the icon of an app not
-  installed, marks a tracked release as seen, and says when a project moved.
-- Many apps can be installed, filed under categories or shared at once. Update
-  all can take first installs too, or be hidden, and can ask first. A check of
-  the whole list shows how far it got.
-- An app's settings can be shared as a link that Obtainium opens too, and Tern
-  reads such links back; they never carry a token.
-- Read as: the Add screen can force how an address is read, with the source's
-  options and a package name set before adding. Search names what failed,
-  searches any Forgejo, takes a fewest-stars limit, filters its results and
-  searches a repository by words. Imports offer to replace apps already there
-  and never change them unasked.
-- Releases are picked as Obtainium picks them: web pages in its link order with
-  up to ten steps, the version from a link or the whole page, last matches,
-  tags for tracked projects without releases, a minimum age that can follow the
-  setting for all apps. Private GitHub projects download with their token, and
-  GitHub can be reached through a hubproxy.
-- Tar archives compressed with bzip2 or xz are opened. Downloads can be
-  cancelled from the list and the notification, are tried again on a network
-  failure, and can go one at a time. The file picked to install is kept for
-  later updates. Tern updates itself last.
-- RuStore apps that come as a base and splits install as one, every part held
-  to the base's signer. The OBB files of an XAPK are put in `Android/obb` with
-  Shizuku or root, under the package the checks verified.
-- F-Droid apps show their author and changelog, APKMirror apps what changed
-  and the size of the file, and a SourceForge project can be followed in one
-  folder. The package name can be set on an app's page as well as when adding.
-  An app without one leaves in Obtainium's format with an id Obtainium replaces
-  at the first install, and comes back without one.
+
+Import, export and sharing
+- Imports a list of addresses from any text, and `obtainium://apps` links.
+- Keeps an export up to date in a folder you pick, with settings if you want,
+  in Tern's format or Obtainium's under a name of your own.
+- Shared links keep the address or the app's settings after the # on
+  tern.munzzyy.dev, where no server sees them. "Share as an Obtainium link"
+  makes one Obtainium opens. Exports and shared files never carry a token or a
+  request header that could hold a key.
+- Saves any file a release offers to Downloads, and the source code of GitHub,
+  GitLab and Forgejo releases, from an app's page, one of its versions or many
+  apps at once.
+
+Privacy and safety
+- Certificate pinning for GitHub, GitLab and Codeberg, off by default. The
+  hubproxy setting says plainly that a hubproxy can change what GitHub seems to
+  publish, and a checksum that came through one names it.
+- The activity log can keep Tern's own warnings, errors and checks, off at
+  first. The shared log and the crash report shown after an unexpected stop
+  lose query strings, tokens, cookies, session ids and passwords first.
+- A copy of Tern that F-Droid installed follows its F-Droid entry for its own
+  updates. Following GitHub instead says it skips F-Droid's checks.
+- PRIVACY.md lists every host Tern can talk to and when, and the store listing
+  sums it up.
+- The network door check in CI also fails on the other ways an Android app can
+  reach the network, in the source and in the built APK.
+
+Every new string is in all 28 languages, machine-translated and checked.
 
 ## 0.1.0, 2026-09-29
 
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index d37d3f12..b25fc546 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -38,7 +38,19 @@ Use conditional requests, keep to HTTPS, and send a token only to the host it
 was stored for. Fixtures are synthetic: learn the real response shape, then
 write your own with invented names.
 
-Sources that republish other people's apps are out of scope.
+Add one real app of the new source to `LiveSourcesTest` and run it on a device:
+
+```sh
+bash tools/device-suite.sh <serial> -e live true -e class io.github.munzzyy.tern.enginetest.LiveSourcesTest
+```
+
+The JVM tests cannot stand in for this. Android compiles patterns with ICU, and a
+pattern Java takes can stop Tern on start on every device.
+
+A store that serves its own copies of other people's apps goes behind the
+Third-party stores setting, which starts off. Sites that offer modified apps,
+and stores that can only be read by pretending to be their own app, are out of
+scope.
 
 ## Looking at the screens
 
diff --git a/PRIVACY.md b/PRIVACY.md
index 658920ee..01d0dda4 100644
--- a/PRIVACY.md
+++ b/PRIVACY.md
@@ -5,50 +5,83 @@ sends no crash reports, because there is nobody for it to report to.
 
 ## What leaves the device
 
-Requests go to the sources you add, to check for releases and to download
-files: GitHub, GitLab, Codeberg, F-Droid, a repository, a developer's site, or
-a store such as APKPure or the Galaxy Store. Each of those sees what any web
-server sees, which is your address, the time, and the project you asked about.
-A search on the Add screen asks the places ticked under "Search in" for the
-words you typed: GitHub, Codeberg, gitlab.com and F-Droid until you choose
-others, and Aptoide, Uptodown, AppGallery, the vivo store or RuStore only when
-you tick them.
-
-A store serves a different file to different phones, so a few of them are told
-what the file has to run on. APKPure, RuStore and the Galaxy Store are told
-the Android version; RuStore also the processors, the screen density and
-whether this is a TV; the Galaxy Store and Tencent whether the phone runs
-64-bit code. None of them is told the phone's model, its name or any
-identifier of it. The Galaxy Store is asked as a fixed model, which you can
-change for an app, and RuStore as a made-up phone with an id drawn at random.
-
-For an app from F-Droid's own repository, a check that finds a new answer also
-reads the app's entry in F-Droid's data on gitlab.com, for its author and
-changes, and the changelog file on GitHub or GitLab when that entry names one.
-For an app from APKMirror it reads the pages of the newest releases on
-www.apkmirror.com, for what changed and the size of the file. None of these
-carries a token or a cookie.
+Tern asks a host only for something you set up: an app you added, a search
+you started, a page you pressed. Every request says it comes from Tern, with
+the User-Agent `Tern/` and the version, and none pretends to be a browser or
+another app. Each host sees what any web server sees: your address, the time,
+and what was asked. This is every host, by what makes Tern ask it.
+
+| What | Hosts |
+|---|---|
+| An app from GitHub | api.github.com, and github.com and hosts under githubusercontent.com for its files |
+| An app from GitLab, Codeberg or another Forgejo, Gitea, GitLab or Jenkins server | The server you added |
+| An app from SourceHut or SourceForge | git.sr.ht; sourceforge.net and the download mirror it sends you to |
+| An app from F-Droid or IzzyOnDroid | f-droid.org or apt.izzysoft.de. When a check of an F-Droid app finds something new, also gitlab.com/fdroid/fdroiddata for its author and changes, and the changelog file on GitHub or GitLab that the entry names |
+| An app from another repository in F-Droid's format | The repository you added |
+| An app from a web page or a direct link | The site you gave, and the hosts its links lead to over HTTPS |
+| An app from itch.io | The game's page on itch.io, and itchio-mirror.cb031a832f44726753d6267436f3b414.r2.cloudflarestorage.com for its file, only when you download it or open its size |
+| Telegram | telegram.org, t.me, and cdn1 to cdn5.telesco.pe for the file |
+| An app from Neutron Code | neutroncode.com |
+| A search on the Add screen | The places ticked under "Search in": api.github.com, codeberg.org (or the Forgejo you chose), gitlab.com and search.f-droid.org until you choose others |
+| Icons of apps not installed yet | For GitHub, raw.githubusercontent.com and avatars.githubusercontent.com; for a store, the one host it keeps its pictures on, named below; for every other source, the host the app comes from |
+| "Read the project's page" on an app's page | The forge's API, only when you press it |
+| An import from a link | The one address you typed |
+
+The eight third-party stores are off until you turn on Settings, Network,
+Third-party stores. While that is off Tern asks none of their hosts, a
+search leaves them out, and an app from one waits in the list. With it on,
+Tern asks a store only for the apps you add from it, and only searches the
+three that can be searched when you tick them.
+
+| Store | Hosts |
+|---|---|
+| APKPure | apkpure.com for the page of the app's versions, d.apkpure.com for the download, which sends you to data.winudf.com for the file, and image.winudf.com for the icon |
+| Aptoide | The app's page on aptoide.com, ws2.aptoide.com for the app and for a search, pool.apk.aptoide.com for the file, pool.img.aptoide.com for the icon |
+| APKCombo | apkcombo.com, and apks.39b7cb94d40914bac590886981b0ed6e.r2.cloudflarestorage.com for the file |
+| APKMirror | www.apkmirror.com for the feed and the pages of the newest releases, downloadr2.apkmirror.com for the icon. APKMirror offers no file to Tern |
+| Tencent App Store | a.app.qq.com for the app, imtt.dd.qq.com or dd.myapp.com for the file, pp.myapp.com for the icon |
+| Huawei AppGallery | store-dre.hispace.dbankcloud.com first for every app, whatever the region, then the host it names for yours: store-drcn or store-dra.hispace.dbankcloud.com, or store-drru.hispace.dbankcloud.ru; appdlc-*.hispace.dbankcloud.com and appdl-*.dbankcdn.com for the file; appimg-dra.dbankcdn.com or appimg-drcn.dbankcdn.com for the icon |
+| Galaxy Store | vas.samsungapps.com, and a host under samsungapps.com for the file |
+| vivo App Store | h5-api.appstore.vivo.com.cn for the app and for a search, appstore.vivo.com.cn for the download, which sends you to a host under vivo.com.cn for the file, imgwsdl.vivo.com.cn or appstoreimg-ipv6.vivo.com.cn for the icon |
+
+A store serves a different file to different phones, so two of them are told
+something about the device. The Galaxy Store is told the Android version and
+whether the phone runs 64-bit code, and it is asked for the model SM-S948B
+and the region DBT, MCC 425 and MNC 01. That model and region are the same for
+every copy of Tern and say nothing about your phone, unless you type another
+model or region into an app's page because the store only serves that app to
+your model. Huawei AppGallery wants a device id: Tern makes up a random one for
+each day's session, which names nothing. Tern never reads the phone's model,
+its name or any identifier of it to tell a store. Tencent offers a 64-bit and a 32-bit file, and Tern picks one itself.
 
 Where a source lists no size for a file, opening the app's page asks the file's
 host for one byte of it, to learn the size.
 
+With a hubproxy set for GitHub, the requests for GitHub go to that host
+instead, with no token.
+
+While the stores are off, an address under any of these domains is not read
+at all, not even as a web page: apkpure.com, apkpure.net, winudf.com,
+aptoide.com, apkcombo.com, apkmirror.com, sj.qq.com, a.app.qq.com, dd.qq.com,
+myapp.com, appgallery.huawei.com, appgallery.cloud.huawei.com,
+appgallery.huawei.ru, dbankcloud.com, dbankcloud.ru, dbankcdn.com,
+galaxystore.samsung.com, apps.samsung.com, apps.samsung.cn,
+galaxyappstore.com, samsungapps.com and vivo.com.cn.
+
+Two tests keep these lists true. `PrivacyHostsTest` fails when the code gives
+a store or an icon a host this page does not name, and `StoresLiveTest` fails
+when a store, asked for a real app, reaches a host outside its domains.
+
 The list of well known apps is part of Tern. Showing it asks nobody
 anything. A request goes out when you press Look on one of them, to that app's
 own address, the same as for a link you typed.
 
-Until an app is installed, its row shows the icon its source offers. For an app
-from GitHub that is a request to raw.githubusercontent.com, for the icon the
-project keeps with its store listing, and where there is none a second one to
-avatars.githubusercontent.com. For an app from GitLab, Codeberg, another
-Forgejo or Gitea server, F-Droid, IzzyOnDroid or a repository in F-Droid's
-format, the request goes to the host the app comes from, and follows a redirect
-from there only over HTTPS. For an app from a store it goes to the store, or to
-the one server the store keeps its pictures on, such as image.winudf.com for
-APKPure; `core/.../icon/IconAddresses.kt` lists each of them. It carries no token and no cookie, and an icon that
-was fetched is kept for seven days before it is asked for again. The setting
-for icons from the source turns all of this off, and rows then show a letter.
-
-An import from a link fetches the one address you typed, without a token.
+Until an app is installed, its row shows the icon its source offers, from the
+hosts in the tables above; `core/.../icon/IconAddresses.kt` lists them. A
+request for an icon follows a redirect only over HTTPS and carries no token
+and no cookie, and an icon that was fetched is kept for seven days before it
+is asked for again. The setting for icons from the source turns all of this
+off, and rows then show a letter.
 
 With a proxy set, every request goes through it, and host names are resolved
 by the proxy. While the proxy cannot be reached, Tern reaches nothing. It
@@ -58,6 +91,9 @@ older Orbot to start. That stays on the device.
 
 A stored access token is sent to the host it was stored for and to no other.
 
+With a hubproxy set for GitHub, that host sees every request Tern makes to
+GitHub and can change what comes back. It is never sent a token or a cookie.
+
 Links to VirusTotal, a release page or a project page open in your browser,
 under your browser's rules. "Read the project's page" on an app's page asks
 the forge's API for the project's README, with the token stored for that host
@@ -66,9 +102,10 @@ if there is one, and only when you press it.
 "Check with Verified Apps" hands the package name of an app and the certificate
 Tern holds it to to Verified Apps or AppVerifier, another app on this device,
 and only when you press it. With "Show new apps to Verified Apps first" on,
-which it is at first as in Obtainium, the checked file of an app's first install
-goes to that app too, read-only, before the installer gets it. Nothing goes
-over the network for that.
+which it is not at first, the checked file of an app's first install goes to
+that app too, read-only, before the installer gets it. Either one goes only to
+an app signed with the certificate its makers publish, never to another app
+that took the same name. Nothing goes over the network for that.
 
 With another app chosen as the installer, Tern hands that app each file once
 the file has passed its checks, and that app alone may read it. With Shizuku
diff --git a/README.md b/README.md
index 2b5e5806..c870aee6 100644
--- a/README.md
+++ b/README.md
@@ -4,7 +4,7 @@
 [![ci](https://github.com/munzzyy/tern/actions/workflows/ci.yml/badge.svg)](https://github.com/munzzyy/tern/actions/workflows/ci.yml)
 [![License: GPL-3.0-or-later](https://img.shields.io/badge/license-GPL--3.0--or--later-blue.svg)](LICENSE)
 
-Android apps, straight from where their developers publish them, checked before they install.
+Android apps from where their developers publish them, checked before they install.
 
 Most open source Android apps put their releases on GitHub, GitLab, Codeberg or a
 repository of their own, days before any store carries them, if a store ever does.
@@ -14,15 +14,17 @@ what it was handed: who signed the file, whether it is the app you asked for, an
 whether it matches the checksum the publisher gave. Only then does Android's
 installer see it.
 
-It is a native app of about 7 MB, with no analytics and no account. It talks to
-the sources you add and to nobody else. [PRIVACY.md](PRIVACY.md) says what
-leaves the device.
+It is a native app of about 7 MB, with no analytics and no account. It talks
+only to where your apps come from and to the places [PRIVACY.md](PRIVACY.md)
+lists, such as an icon host or the places you search, and to nobody on its own
+behalf. Every request says it comes from Tern.
 
 - Every signature is verified twice: by Tern's own verifier and by Android.
 - Each app stays tied to the certificate of its first install. For 15
   well-known apps Tern knows the certificate before that.
-- It reads every source Obtainium reads, from GitHub to the Galaxy Store, and
-  installs through Android, Shizuku, Dhizuku, root or another installer app.
+- It reads the forges, repositories and sites Obtainium reads, and eight
+  third-party stores once you turn them on, and installs through Android,
+  Shizuku, Dhizuku, root or another installer app.
 - A widget, a Quick Settings tile and launcher shortcuts check and update from
   outside the app.
 - Android TV works by remote, and a phone can send links to it sealed with a
@@ -31,7 +33,7 @@ leaves the device.
 - An Obtainium export brings your list and your settings along, and Tern can
   write one for Obtainium too.
 
-[<img src="site/badge.png" alt="Get it with Tern" height="80">](https://tern.munzzyy.dev/add/?url=https%3A%2F%2Fgithub.com%2Fmunzzyy%2Ftern)
+[<img src="site/badge.png" alt="Get it with Tern" height="80">](https://tern.munzzyy.dev/add/#url=https%3A%2F%2Fgithub.com%2Fmunzzyy%2Ftern)
 
 Or download `tern.apk` from the [latest release](https://github.com/munzzyy/tern/releases/latest).
 It runs on Android 10 and later, on phones, tablets and TVs. Once it is
@@ -90,20 +92,27 @@ page also offers a second check there, against AppVerifier's own list.
 | A web page | Links to installable files, with optional steps through other pages |
 | A direct link | One file at a fixed address, whether or not the address ends in a file name |
 | Jenkins, SourceHut, SourceForge | The last successful build, tags, the project's files or one folder of them |
-| Huawei AppGallery, Samsung Galaxy Store, vivo, Tencent, RuStore, CoolApk, itch.io | Each store's own app record; the Galaxy Store with the device model and CSC of your choice |
-| Telegram, NeutronCode | Their own release channels |
-| APKPure, Aptoide, Uptodown, APKCombo, APKMirror, Farsroid | Stores that offer again what developers publish elsewhere (APKMirror for tracking only) |
-| LiteAPKs, Apk4Free, RockMods | Sites that offer apps changed by someone else (RockMods for tracking only) |
+| itch.io, Telegram, Neutron Code | The developer's own page and files |
+| Huawei AppGallery, Samsung Galaxy Store, vivo | Third-party stores, off until you turn them on: each store's own app record |
+| APKPure, Aptoide, APKCombo, APKMirror, Tencent | Third-party stores, off until you turn them on, that offer again what developers publish elsewhere (APKMirror for tracking only) |
 
 Paste a link, or share one from the browser, and Tern works out which of
-these it is. Searching by name looks in the forges, F-Droid and the stores
-you pick.
-
-Tern follows the developer, so it says so before you add an app from a store
-that republishes other people's apps, and it says plainly when a site offers
-apps someone else changed. Whatever the source, a file is held to the
+these it is. Searching by name looks in the forges and F-Droid, and in the
+stores you pick once they are on.
+
+The stores sit behind one setting, Settings, Network, Third-party stores, which
+starts off. A store serves its own copies of apps, and Tern reads it through the
+interface the store made for its own app or site, as Tern and with nothing
+borrowed from that app. Pasting a store's address while the setting is off
+shows what that means and a button to turn it on. An app from a store says so
+on its page, and says what its first install decides: the certificate its
+updates must carry, unless the app is one whose developer's certificate Tern
+carries, or you pinned one. Whatever the source, a file is held to the
 certificate of the app you have, and to the pinned one.
 
+Some places Obtainium reads are left out on purpose.
+[docs/COMPARISON.md](docs/COMPARISON.md) says which and why.
+
 ## Updates without a prompt
 
 Before the very first install, Android wants to hear from you that Tern may
@@ -118,16 +127,20 @@ surprise. Android refuses a second silent update of the same app within 30
 seconds of the last one, and that is one of the cases where you are asked.
 
 With Shizuku, Dhizuku or root chosen under Settings, Installing, first installs
-and updates install without a prompt on any Android from 10 on. Android then
-names Dhizuku as the installer, and may show its own notice that an admin
-installed the app. You can also hand
+and updates install without a prompt. Shizuku 13.6 and Dhizuku 2.12 did that on
+an Android 13 emulator, for a first install and for an update. Root has not
+been tried yet: the su of Android's emulator images answers only adb, so Tern
+could not be given root there. With Dhizuku, Android names Dhizuku as the
+installer, and may show its own notice that an admin installed the app. You can
+also hand
 every checked file to another installer app; Tern then compares the signer of
 what it installed with the file it checked.
 
 Checks run every six hours by default, and anywhere from every 15 minutes to
 every 30 days, through Android's own job scheduler. The schedule is put back
 after a reboot and after Tern itself is updated. You can limit them to unmetered
-networks or to charging, check when Tern opens or when an app's page opens, and
+networks or to charging, and hold updates that install by themselves for Wi-Fi
+or a charger on their own. You can check when Tern opens or when an app's page opens, and
 choose per app between being told, updating automatically, and never checking
 in the background. If you force stop Tern, Android drops the schedule until you
 open the app again.
@@ -185,7 +198,7 @@ If you publish an Android app on GitHub or anywhere else Tern reads, a badge in
 your README lets people add it to Tern with one tap:
 
 ```markdown
-[<img src="https://tern.munzzyy.dev/badge.png" alt="Get it with Tern" height="80">](https://tern.munzzyy.dev/add/?url=https%3A%2F%2Fgithub.com%2FYOU%2FYOUR-APP)
+[<img src="https://tern.munzzyy.dev/badge.png" alt="Get it with Tern" height="80">](https://tern.munzzyy.dev/add/#url=https%3A%2F%2Fgithub.com%2FYOU%2FYOUR-APP)
 ```
 
 The [site](https://tern.munzzyy.dev/) writes this line for you from your
@@ -197,13 +210,15 @@ the page offers the download.
 
 Tern comes in English and 28 other languages, right-to-left ones included.
 The translations were made by a machine and checked by a second one; no native
-speaker has reviewed them yet, and corrections are welcome. On Android 13 and
-later you pick the language under Settings, apart from the phone's own.
+speaker has reviewed them yet, and corrections are welcome. Pick the language
+under Settings, Appearance, on any Android version; from Android 13 on,
+Android's own app language setting shows the same choice.
 
 Text at twice the normal size keeps each screen's main action on screen, on a
-phone and on a TV. The look is yours to change under Settings, Look: the theme,
-colours from the wallpaper, a palette or a colour of your own, contrast,
-density, corners and the shape of app icons.
+phone and on a TV. From one and a half times the size, a TV shows the list and
+an app's page one at a time, as a phone does. The look is yours to change under
+Settings, Look: the theme, colours from the wallpaper, a palette or a colour of
+your own, contrast, density, corners and the shape of app icons.
 
 ## How it compares
 
@@ -221,11 +236,11 @@ Obtainium does that Tern does not.
 - The translations are machine-made. Details of an error that come from a
   server or a parser stay in English, and an entry in the activity log stays in
   the language it was written in.
-- It has run on emulators: Android 10, 13 and 16 phones and Android TV 11 and
-  14. It has not yet run on a shelf of real devices. Vendor installers, Doze over
-  many hours and a reboot are untested. On the television image Play Protect
-  stopped the first install of an app it had not seen and offered "Install
-  anyway"; that answer is yours to give.
+- This version has run on emulators: phones with Android 10, 13 and 16, and a
+  television with Android TV 14. It has not yet run on a shelf of real devices.
+  Vendor installers, Doze over many hours and a reboot are untested. On the
+  television image Play Protect stopped the first install of an app it had not
+  seen and offered "Install anyway"; that answer is yours to give.
 - F-Droid and IzzyOnDroid are read through their per-app listings, which are
   protected by TLS and not by the index signature. Add either as a repository by
   its address if you want the signature checked; the first contact then downloads
@@ -256,6 +271,17 @@ package, version and certificate is `aapt2` and `apksigner` and not Tern.
 same code against GitHub, F-Droid, Codeberg and GitLab. It reads public data and
 sends no credentials.
 
+`bash tools/device-suite.sh <serial> -e live true -e class io.github.munzzyy.tern.enginetest.LiveSourcesTest`
+does the same on a device, through the real engine, with one real app from each
+of GitHub, GitLab, Codeberg, F-Droid, IzzyOnDroid, a web page, SourceForge,
+itch.io, Telegram, Neutron Code and the eight stores. It leaves out GitHub
+Actions, which needs a token, Jenkins, SourceHut, direct links and other F-Droid
+format repositories. Every request has to carry Tern's User-Agent, and a refused
+site, or a store while the stores are off, must not be asked anything. On an
+Android 16 phone emulator and an Android TV 14 emulator every source gave a
+listing. Where a store offers only ARM files that the emulator cannot run, Tern
+says there is no file for that device.
+
 `bash tools/device-suite.sh <serial>` runs the device tests on an emulator or a
 phone, after `./gradlew :app:assembleDebug :app:assembleDebugAndroidTest`. They
 install a test app through Tern, publish a new version, and check that the
@@ -272,7 +298,9 @@ real Chromium to a live handoff and checks that the page broke no rule of its
 Content-Security-Policy.
 
 `bash tools/check-network-doors.sh` fails if any code other than the one HTTP
-client opens a connection or resolves a name on the device.
+client opens a connection or resolves a name on the device, or uses anything
+else that fetches by itself. `bash tools/tests/network-doors/run.sh` proves it
+catches each of those ways.
 
 `bash tools/check-reproducible.sh <folder>` builds the release twice from two
 clones in different places and compares the files byte for byte.
diff --git a/app/build.gradle.kts b/app/build.gradle.kts
index b3aa44d1..d9825880 100644
--- a/app/build.gradle.kts
+++ b/app/build.gradle.kts
@@ -11,8 +11,8 @@ android {
         applicationId = "io.github.munzzyy.tern"
         minSdk = 29
         targetSdk = 36
-        versionCode = 100
-        versionName = "0.1.0"
+        versionCode = 200
+        versionName = "0.2.0"
         testInstrumentationRunner = "androidx.test.runner.AndroidJUnitRunner"
     }
 
@@ -72,6 +72,8 @@ tasks.withType<Test>().configureEach {
     ).withPropertyName("brandFiles").withPathSensitivity(PathSensitivity.RELATIVE)
     // SignerJudgeTest reads the parts of the test bundle from core.
     inputs.dir("../core/src/test/resources/fixtures/apk").withPropertyName("bundleParts").withPathSensitivity(PathSensitivity.RELATIVE)
+    // NetworkSecurityConfigTest reads the configs and looks for certificates anywhere under res.
+    inputs.dir("src/main/res").withPropertyName("resources").withPathSensitivity(PathSensitivity.RELATIVE)
 }
 
 dependencies {
diff --git a/app/src/androidTest/kotlin/io/github/munzzyy/tern/AddFlowTest.kt b/app/src/androidTest/kotlin/io/github/munzzyy/tern/AddFlowTest.kt
index 330c4142..d55794c6 100644
--- a/app/src/androidTest/kotlin/io/github/munzzyy/tern/AddFlowTest.kt
+++ b/app/src/androidTest/kotlin/io/github/munzzyy/tern/AddFlowTest.kt
@@ -65,7 +65,7 @@ class AddFlowTest {
             compose.onNodeWithText("Paste").performClick()
             compose.tagged(ADD_FIND_TAG).performClick()
             compose.waitForText("results for")
-            compose.onNodeWithText("Wren").performClick()
+            compose.onNodeWithText("Wren").performScrollTo().performClick()
             compose.waitForText("The newest release is a pre-release")
             compose.onNodeWithText("The publisher offers no checksum for this file").performScrollTo().assertIsDisplayed()
         }
diff --git a/app/src/androidTest/kotlin/io/github/munzzyy/tern/AppPageRemoteTest.kt b/app/src/androidTest/kotlin/io/github/munzzyy/tern/AppPageRemoteTest.kt
new file mode 100644
index 00000000..7b720ebe
--- /dev/null
+++ b/app/src/androidTest/kotlin/io/github/munzzyy/tern/AppPageRemoteTest.kt
@@ -0,0 +1,45 @@
+package io.github.munzzyy.tern
+
+import android.view.KeyEvent.KEYCODE_DPAD_CENTER
+import android.view.KeyEvent.KEYCODE_DPAD_DOWN
+import android.view.KeyEvent.KEYCODE_DPAD_RIGHT
+import androidx.compose.ui.semantics.SemanticsActions
+import androidx.compose.ui.test.SemanticsMatcher
+import androidx.compose.ui.test.hasText
+import androidx.compose.ui.test.junit4.createEmptyComposeRule
+import androidx.lifecycle.Lifecycle
+import androidx.test.ext.junit.runners.AndroidJUnit4
+import org.junit.After
+import org.junit.Assert.assertTrue
+import org.junit.Before
+import org.junit.Rule
+import org.junit.Test
+import org.junit.runner.RunWith
+
+/** An app's page, walked from top to bottom with the keys of a remote. */
+@RunWith(AndroidJUnit4::class)
+class AppPageRemoteTest {
+    @get:Rule val compose = createEmptyComposeRule()
+
+    private val row = SemanticsMatcher.keyIsDefined(SemanticsActions.CustomActions)
+
+    @Before fun keys() = keysOnly()
+
+    @After fun touch() = touchAgain()
+
+    @Test
+    fun downWalksThePageToItsLastSettingThroughTheCategoriesAndTheNote() {
+        launch("default").use { scenario ->
+            compose.assertFocusOn(row, "the list opens with focus on its first app")
+            compose.press(KEYCODE_DPAD_CENTER)
+            compose.expect("the page takes focus when it opens") { !compose.hasFocusOn(row) && compose.focusedLabel() != "nothing" }
+            val chip = hasText("Tools") or hasText("Security") or hasText("Writing") or hasText("Outdoors")
+            compose.moveTo(chip, KEYCODE_DPAD_DOWN)
+            compose.moveTo(hasText("New…"), KEYCODE_DPAD_RIGHT, max = 6)
+            compose.press(KEYCODE_DPAD_DOWN)
+            compose.assertFocusOn(hasText("Add a note"), "down from the categories goes on to the note")
+            compose.moveTo(hasText("Show filters", substring = true), KEYCODE_DPAD_DOWN, max = 60)
+            assertTrue(scenario.state.isAtLeast(Lifecycle.State.RESUMED))
+        }
+    }
+}
diff --git a/app/src/androidTest/kotlin/io/github/munzzyy/tern/ChipLinesRemoteTest.kt b/app/src/androidTest/kotlin/io/github/munzzyy/tern/ChipLinesRemoteTest.kt
new file mode 100644
index 00000000..7c1d2aef
--- /dev/null
+++ b/app/src/androidTest/kotlin/io/github/munzzyy/tern/ChipLinesRemoteTest.kt
@@ -0,0 +1,98 @@
+package io.github.munzzyy.tern
+
+import android.view.KeyEvent.KEYCODE_DPAD_DOWN
+import android.view.KeyEvent.KEYCODE_DPAD_RIGHT
+import android.view.KeyEvent.KEYCODE_DPAD_UP
+import androidx.activity.ComponentActivity
+import androidx.compose.foundation.layout.Column
+import androidx.compose.foundation.layout.Row
+import androidx.compose.foundation.layout.width
+import androidx.compose.runtime.LaunchedEffect
+import androidx.compose.runtime.remember
+import androidx.compose.runtime.withFrameNanos
+import androidx.compose.ui.Alignment
+import androidx.compose.ui.Modifier
+import androidx.compose.ui.focus.FocusRequester
+import androidx.compose.ui.focus.focusRequester
+import androidx.compose.ui.input.InputMode
+import androidx.compose.ui.platform.LocalInputModeManager
+import androidx.compose.ui.semantics.Role
+import androidx.compose.ui.test.getUnclippedBoundsInRoot
+import androidx.compose.ui.test.hasText
+import androidx.compose.ui.test.junit4.createAndroidComposeRule
+import androidx.compose.ui.test.onNodeWithText
+import androidx.compose.ui.unit.dp
+import androidx.test.ext.junit.runners.AndroidJUnit4
+import io.github.munzzyy.tern.ui.common.ChipLines
+import io.github.munzzyy.tern.ui.common.ChoiceChip
+import io.github.munzzyy.tern.ui.common.QuietButton
+import org.junit.After
+import org.junit.Assert.assertTrue
+import org.junit.Before
+import org.junit.Rule
+import org.junit.Test
+import org.junit.runner.RunWith
+import kotlin.math.abs
+
+/** Chips that wrap onto several lines, as the categories do, walked with the keys of a remote. */
+@RunWith(AndroidJUnit4::class)
+class ChipLinesRemoteTest {
+    @get:Rule val compose = createAndroidComposeRule<ComponentActivity>()
+
+    private val labels = List(12) { "Category ${it + 1}" }
+
+    @Before fun keys() = keysOnly()
+
+    @After fun touch() = touchAgain()
+
+    private fun chipLines() {
+        compose.host(television = true) {
+            val start = remember { FocusRequester() }
+            val input = LocalInputModeManager.current
+            // On a phone focus takes only out of touch mode and not on the first frame; Tern's screens land it the same way.
+            LaunchedEffect(Unit) {
+                input.requestInputMode(InputMode.Keyboard)
+                repeat(30) {
+                    withFrameNanos {}
+                    if (start.requestFocus()) return@LaunchedEffect
+                }
+            }
+            // What stands beside the chips and further down, like the example on the Look page, must not catch right at the end of a line.
+            Row(verticalAlignment = Alignment.Bottom) {
+                Column(Modifier.width(320.dp)) {
+                    QuietButton("Before", onClick = {})
+                    ChipLines(labels) { index, label, stop ->
+                        ChoiceChip(label, selected = false, onClick = {}, role = Role.Checkbox, modifier = (if (index == 0) Modifier.focusRequester(start) else Modifier).then(stop))
+                    }
+                    QuietButton("After", onClick = {})
+                }
+                QuietButton("Beside", onClick = {})
+            }
+        }
+        compose.assertFocusOn(hasText("Category 1"), "the first chip takes focus")
+    }
+
+    private fun top(label: String): Float = compose.onNodeWithText(label).getUnclippedBoundsInRoot().top.value
+
+    @Test
+    fun rightFromTheEndOfALineGoesOnToTheStartOfTheNext() {
+        chipLines()
+        // A focused chip grows a little, so its top moves a little.
+        val firstLine = labels.takeWhile { abs(top(it) - top(labels.first())) < 8f }
+        assertTrue("the chips wrap onto a second line", firstLine.size < labels.size)
+        compose.moveTo(hasText(firstLine.last()), KEYCODE_DPAD_RIGHT, max = firstLine.size)
+        compose.press(KEYCODE_DPAD_RIGHT)
+        compose.assertFocusOn(hasText(labels[firstLine.size]), "right from the end of the first line goes to the start of the second")
+    }
+
+    @Test
+    fun upAndDownLeaveTheChipsWhateverLineTheyAreOn() {
+        chipLines()
+        compose.press(KEYCODE_DPAD_DOWN)
+        compose.assertFocusOn(hasText("After"), "down from the first line leaves the chips")
+        compose.press(KEYCODE_DPAD_UP)
+        compose.assertFocusOn(hasText("Category", substring = true), "up comes back into the chips")
+        compose.press(KEYCODE_DPAD_UP)
+        compose.assertFocusOn(hasText("Before"), "up from the last line leaves the chips too")
+    }
+}
diff --git a/app/src/androidTest/kotlin/io/github/munzzyy/tern/GroupedListRemoteTest.kt b/app/src/androidTest/kotlin/io/github/munzzyy/tern/GroupedListRemoteTest.kt
new file mode 100644
index 00000000..40410128
--- /dev/null
+++ b/app/src/androidTest/kotlin/io/github/munzzyy/tern/GroupedListRemoteTest.kt
@@ -0,0 +1,90 @@
+package io.github.munzzyy.tern
+
+import android.content.Intent
+import android.view.KeyEvent.KEYCODE_DPAD_CENTER
+import android.view.KeyEvent.KEYCODE_DPAD_DOWN
+import android.view.KeyEvent.KEYCODE_DPAD_UP
+import androidx.compose.ui.semantics.SemanticsActions
+import androidx.compose.ui.semantics.SemanticsProperties
+import androidx.compose.ui.test.SemanticsMatcher
+import androidx.compose.ui.test.hasClickAction
+import androidx.compose.ui.test.hasContentDescription
+import androidx.compose.ui.test.hasText
+import androidx.compose.ui.test.junit4.createEmptyComposeRule
+import androidx.compose.ui.test.onNodeWithContentDescription
+import androidx.compose.ui.test.onNodeWithText
+import androidx.compose.ui.test.performSemanticsAction
+import androidx.test.core.app.ActivityScenario
+import androidx.test.ext.junit.runners.AndroidJUnit4
+import io.github.munzzyy.tern.engine.AppGrouping
+import kotlinx.coroutines.runBlocking
+import org.junit.After
+import org.junit.Assert.assertEquals
+import org.junit.Assert.fail
+import org.junit.Before
+import org.junit.Rule
+import org.junit.Test
+import org.junit.runner.RunWith
+
+/** The list grouped by category, walked with the keys of a remote. */
+@RunWith(AndroidJUnit4::class)
+class GroupedListRemoteTest {
+    @get:Rule val compose = createEmptyComposeRule()
+
+    private val row = SemanticsMatcher.keyIsDefined(SemanticsActions.CustomActions)
+    private val header = SemanticsMatcher.keyIsDefined(SemanticsProperties.Heading) and hasClickAction()
+    private val notes = row and hasContentDescription("Pocket Notes.", substring = true)
+
+    @Before fun keys() = keysOnly()
+
+    @After fun touch() = touchAgain()
+
+    /** Pocket Notes is filed under Outdoors and Writing, so the list draws it twice. */
+    private fun launchGrouped(folded: Boolean): ActivityScenario<MainActivity> {
+        launch("default").close()
+        runBlocking {
+            fake.saveSettings(fake.settings.value.copy(listGrouping = AppGrouping.CATEGORY, updatesFirst = false, collapseGroups = folded))
+            fake.configure("pocketnotes") { it.copy(categories = listOf("Outdoors", "Writing")) }
+        }
+        noteSeen(true)
+        return ActivityScenario.launch(Intent(appContext, MainActivity::class.java))
+    }
+
+    @Test
+    fun aGroupedListOpensOnItsFirstAppAndBackReturnsToTheRowThatWasOpened() {
+        launchGrouped(folded = false).use {
+            compose.assertFocusOn(notes, "the grouped list opens on the first app of its first group")
+            var left = false
+            var tries = 0
+            while (!(left && compose.hasFocusOn(notes))) {
+                if (++tries > 40) fail("Down never reached Pocket Notes a second time; focus is on ${compose.focusedLabel()}")
+                compose.press(KEYCODE_DPAD_DOWN)
+                if (!compose.hasFocusOn(notes)) left = true
+            }
+            compose.press(KEYCODE_DPAD_CENTER)
+            compose.expect("the detail takes focus when it opens") { !compose.hasFocusOn(row) && compose.focusedLabel() != "nothing" }
+
+            device.pressBack()
+            compose.assertFocusOn(notes, "back returns to Pocket Notes")
+            // Pocket Notes comes first in its groups, so the header right above it says which place it is.
+            compose.press(KEYCODE_DPAD_UP)
+            compose.assertFocusOn(header and hasText("Writing", substring = true), "the row focus came back to is the one under Writing, not its first place")
+        }
+    }
+
+    @Test
+    fun aListWithItsGroupsFoldedOpensOnTheFirstGroupAndSelectAllTakesOnlyWhatIsShown() {
+        launchGrouped(folded = true).use {
+            val outdoors = header and hasText("Outdoors", substring = true)
+            compose.assertFocusOn(outdoors, "with every group folded the list opens on the first group")
+            compose.press(KEYCODE_DPAD_CENTER)
+            compose.assertFocusOn(outdoors and SemanticsMatcher.expectValue(SemanticsProperties.StateDescription, "Open"), "the middle key opens the group and focus stays on its header")
+
+            compose.onNodeWithContentDescription("More options").performSemanticsAction(SemanticsActions.OnClick)
+            compose.onNodeWithText("Select").performSemanticsAction(SemanticsActions.OnClick)
+            compose.onNodeWithText("Select all").performSemanticsAction(SemanticsActions.OnClick)
+            compose.waitForText("selected")
+            assertEquals("only the two apps under Outdoors are picked, none from the folded groups", 1, compose.textCount("2 selected"))
+        }
+    }
+}
diff --git a/app/src/androidTest/kotlin/io/github/munzzyy/tern/IntervalRemoteTest.kt b/app/src/androidTest/kotlin/io/github/munzzyy/tern/IntervalRemoteTest.kt
new file mode 100644
index 00000000..97292147
--- /dev/null
+++ b/app/src/androidTest/kotlin/io/github/munzzyy/tern/IntervalRemoteTest.kt
@@ -0,0 +1,78 @@
+package io.github.munzzyy.tern
+
+import android.view.KeyEvent.KEYCODE_DPAD_CENTER
+import android.view.KeyEvent.KEYCODE_DPAD_DOWN
+import android.view.KeyEvent.KEYCODE_DPAD_LEFT
+import android.view.KeyEvent.KEYCODE_DPAD_RIGHT
+import android.view.KeyEvent.KEYCODE_DPAD_UP
+import androidx.activity.ComponentActivity
+import androidx.compose.foundation.layout.Column
+import androidx.compose.runtime.getValue
+import androidx.compose.runtime.mutableIntStateOf
+import androidx.compose.runtime.remember
+import androidx.compose.runtime.setValue
+import androidx.compose.ui.test.hasContentDescription
+import androidx.compose.ui.test.hasText
+import androidx.compose.ui.test.junit4.createAndroidComposeRule
+import androidx.compose.ui.test.onNodeWithContentDescription
+import androidx.test.ext.junit.runners.AndroidJUnit4
+import io.github.munzzyy.tern.ui.common.QuietButton
+import io.github.munzzyy.tern.ui.settings.IntervalRow
+import org.junit.After
+import org.junit.Assert.assertEquals
+import org.junit.Before
+import org.junit.Rule
+import org.junit.Test
+import org.junit.runner.RunWith
+
+/** How often Tern checks, set with the keys of a remote: the buttons step the slider and the arrows never get stuck in it. */
+@RunWith(AndroidJUnit4::class)
+class IntervalRemoteTest {
+    @get:Rule val compose = createAndroidComposeRule<ComponentActivity>()
+
+    private var minutes = 0
+
+    @Before fun keys() = keysOnly()
+
+    @After fun touch() = touchAgain()
+
+    private fun interval(start: Int) {
+        compose.host(television = true) {
+            var shown by remember { mutableIntStateOf(start) }
+            Column {
+                QuietButton("Above", onClick = {})
+                IntervalRow(shown) {
+                    shown = it
+                    minutes = it
+                }
+                QuietButton("Below", onClick = {})
+            }
+        }
+        compose.press(KEYCODE_DPAD_DOWN)
+        compose.moveTo(hasText("Above"), KEYCODE_DPAD_UP, max = 3)
+    }
+
+    @Test
+    fun theButtonsSayWhatTheyDoAndTheArrowsPassTheSliderBy() {
+        interval(20)
+        compose.press(KEYCODE_DPAD_DOWN)
+        val minus = hasContentDescription("Check more often")
+        compose.assertFocusOn(minus, "down from above lands on the minus button")
+        compose.press(KEYCODE_DPAD_RIGHT)
+        compose.assertFocusOn(hasContentDescription("Check less often"), "right goes past the slider to the plus button")
+        compose.press(KEYCODE_DPAD_LEFT)
+        compose.assertFocusOn(minus, "and left comes back")
+        compose.press(KEYCODE_DPAD_DOWN)
+        compose.assertFocusOn(hasText("Below"), "down leaves the row")
+        compose.press(KEYCODE_DPAD_UP)
+        compose.moveTo(minus, KEYCODE_DPAD_LEFT, max = 2)
+
+        compose.press(KEYCODE_DPAD_CENTER)
+        compose.waitUntil(3_000) { minutes == 15 }
+        compose.assertFocusOn(hasContentDescription("Turn background checks off"), "at 15 minutes the minus button says it turns the checks off")
+        compose.press(KEYCODE_DPAD_CENTER)
+        compose.waitUntil(3_000) { minutes == 0 }
+        compose.onNodeWithContentDescription("Turn background checks on").assertExists()
+        assertEquals(0, minutes)
+    }
+}
diff --git a/app/src/androidTest/kotlin/io/github/munzzyy/tern/LookLargeTextTest.kt b/app/src/androidTest/kotlin/io/github/munzzyy/tern/LookLargeTextTest.kt
index 99b218e4..b9536776 100644
--- a/app/src/androidTest/kotlin/io/github/munzzyy/tern/LookLargeTextTest.kt
+++ b/app/src/androidTest/kotlin/io/github/munzzyy/tern/LookLargeTextTest.kt
@@ -16,6 +16,7 @@ import androidx.compose.ui.test.click
 import androidx.compose.ui.test.hasContentDescription
 import androidx.compose.ui.test.junit4.ComposeTestRule
 import androidx.compose.ui.test.junit4.createAndroidComposeRule
+import androidx.compose.ui.test.onAllNodesWithText
 import androidx.compose.ui.test.onNodeWithTag
 import androidx.compose.ui.test.onNodeWithText
 import androidx.compose.ui.test.onRoot
@@ -85,10 +86,16 @@ class LookLargeTextTest {
     private fun everyChoiceCanBeReadAndReached() {
         compose.onNodeWithTag(LOOK_PREVIEW_TAG).assertIsDisplayed()
         assertFalse("a text of the example is cut", compose.drawn().cut)
-        val choices = if (dynamicColorSupported) CHOICES + "Wallpaper" else CHOICES
+        // The style of Tern's own colours shows unless Android's wallpaper colours are in use, and it has a Standard of its own.
+        val styles = fake.settings.value.colorSource != ColorSource.WALLPAPER || !dynamicColorSupported
+        val choices = (if (dynamicColorSupported) CHOICES + "Wallpaper" else CHOICES) + (if (styles) listOf("Vibrant", "Expressive") else emptyList())
         for (choice in choices) {
-            compose.onNodeWithText(choice).performScrollTo().assertIsDisplayed()
-            assertEquals("cut while $choice is on screen", emptyList<String>(), compose.cutTexts())
+            val found = compose.onAllNodesWithText(choice)
+            assertTrue("no $choice on the page", found.fetchSemanticsNodes().isNotEmpty())
+            for (i in found.fetchSemanticsNodes().indices) {
+                found[i].performScrollTo().assertIsDisplayed()
+                assertEquals("cut while $choice is on screen", emptyList<String>(), compose.cutTexts())
+            }
         }
         compose.pick("Own colour")
         compose.onNodeWithTag(LOOK_HUE_TAG).performScrollTo().assertIsDisplayed()
diff --git a/app/src/androidTest/kotlin/io/github/munzzyy/tern/LookRemoteTest.kt b/app/src/androidTest/kotlin/io/github/munzzyy/tern/LookRemoteTest.kt
index fa245760..b556b400 100644
--- a/app/src/androidTest/kotlin/io/github/munzzyy/tern/LookRemoteTest.kt
+++ b/app/src/androidTest/kotlin/io/github/munzzyy/tern/LookRemoteTest.kt
@@ -119,7 +119,7 @@ class LookRemoteTest {
             compose.assertFocusOn(slider, "the slider keeps focus while it moves")
 
             compose.press(KEYCODE_DPAD_DOWN)
-            compose.assertFocusOn(hasText("Standard") or hasText("Medium") or hasText("High"), "down leaves the slider")
+            compose.assertFocusOn(hasText("Colour code"), "down leaves the slider for the colour code under it")
             compose.press(KEYCODE_DPAD_UP)
             compose.assertFocusOn(slider, "and up comes back to it")
             compose.press(KEYCODE_DPAD_UP)
diff --git a/app/src/androidTest/kotlin/io/github/munzzyy/tern/Remote.kt b/app/src/androidTest/kotlin/io/github/munzzyy/tern/Remote.kt
index a24931bb..608c61e1 100644
--- a/app/src/androidTest/kotlin/io/github/munzzyy/tern/Remote.kt
+++ b/app/src/androidTest/kotlin/io/github/munzzyy/tern/Remote.kt
@@ -5,6 +5,7 @@ import androidx.compose.ui.semantics.Role
 import androidx.compose.ui.semantics.SemanticsProperties
 import androidx.compose.ui.semantics.getOrNull
 import androidx.compose.ui.test.SemanticsMatcher
+import androidx.compose.ui.test.hasContentDescription
 import androidx.compose.ui.test.hasText
 import androidx.compose.ui.test.isFocused
 import androidx.compose.ui.test.junit4.ComposeTestRule
@@ -50,6 +51,12 @@ fun ComposeTestRule.assertFocusOn(matcher: SemanticsMatcher, why: String, timeou
 
 val isTab = SemanticsMatcher.expectValue(SemanticsProperties.Role, Role.Tab)
 
+/** Where Settings opens under keys: the minus button of how often, which only a device without touch has, or else the slider itself. */
+val firstSetting: SemanticsMatcher get() = hasContentDescription(if (withoutTouch) "Check more often" else "How often")
+
+/** Enough presses of down to walk Settings from top to bottom; a phone has more of them than a television. */
+const val SETTINGS_STOPS = 60
+
 fun ComposeTestRule.expect(why: String, timeoutMs: Long = 3_000, condition: () -> Boolean) {
     try {
         waitUntil(timeoutMs, condition)
diff --git a/app/src/androidTest/kotlin/io/github/munzzyy/tern/RemoteDoorsTest.kt b/app/src/androidTest/kotlin/io/github/munzzyy/tern/RemoteDoorsTest.kt
index 0e8d10cf..b48dd24c 100644
--- a/app/src/androidTest/kotlin/io/github/munzzyy/tern/RemoteDoorsTest.kt
+++ b/app/src/androidTest/kotlin/io/github/munzzyy/tern/RemoteDoorsTest.kt
@@ -170,7 +170,7 @@ class RemoteDoorsTest {
             compose.assertFocusOn(row, "the list opens with focus on its first app")
             compose.openTab("Settings")
             val import = hasText("Import apps", substring = true)
-            compose.moveTo(import, KEYCODE_DPAD_DOWN)
+            compose.moveTo(import, KEYCODE_DPAD_DOWN, max = SETTINGS_STOPS)
             compose.press(KEYCODE_DPAD_CENTER)
             val files = hasTestTag(DOOR_FILES_TAG)
             compose.assertFocusOn(files, "Import opens on its first door")
@@ -213,7 +213,7 @@ class RemoteDoorsTest {
         launch(FakeEngine.BARE).use {
             compose.assertFocusOn(row, "the list opens with focus on its first app")
             compose.openTab("Settings")
-            compose.moveTo(hasText("Import apps", substring = true), KEYCODE_DPAD_DOWN)
+            compose.moveTo(hasText("Import apps", substring = true), KEYCODE_DPAD_DOWN, max = SETTINGS_STOPS)
             compose.press(KEYCODE_DPAD_CENTER)
             compose.assertFocusOn(hasTestTag(DOOR_FILES_TAG), "Import opens on its first door")
             compose.press(KEYCODE_DPAD_CENTER)
@@ -233,10 +233,10 @@ class RemoteDoorsTest {
             runBlocking { fake.saveSettings(fake.settings.value.copy(proxy = ProxyMode.ORBOT)) }
             compose.assertFocusOn(row, "the list opens with focus on its first app")
             compose.openTab("Settings")
-            compose.assertFocusOn(hasText("How often", substring = true), "Settings opens on its first setting")
+            compose.assertFocusOn(firstSetting, "Settings opens on its first setting, how often")
             val last = hasText("Source code", substring = true)
             val stops = mutableListOf<String>()
-            repeat(60) {
+            repeat(SETTINGS_STOPS) {
                 if (compose.hasFocusOn(last)) return@repeat
                 compose.press(KEYCODE_DPAD_DOWN)
                 val now = compose.focusedLabel()
diff --git a/app/src/androidTest/kotlin/io/github/munzzyy/tern/RemoteWalkTest.kt b/app/src/androidTest/kotlin/io/github/munzzyy/tern/RemoteWalkTest.kt
index 33a9c305..16dfabba 100644
--- a/app/src/androidTest/kotlin/io/github/munzzyy/tern/RemoteWalkTest.kt
+++ b/app/src/androidTest/kotlin/io/github/munzzyy/tern/RemoteWalkTest.kt
@@ -101,9 +101,9 @@ class RemoteWalkTest {
         launch("default").use { scenario ->
             compose.assertFocusOn(row, "the list opens with focus on its first app")
             compose.openTab("Settings")
-            compose.assertFocusOn(hasText("How often", substring = true), "Settings opens on its first setting")
+            compose.assertFocusOn(firstSetting, "Settings opens on its first setting, how often")
             val import = hasText("Import apps", substring = true)
-            compose.moveTo(import, KEYCODE_DPAD_DOWN)
+            compose.moveTo(import, KEYCODE_DPAD_DOWN, max = SETTINGS_STOPS)
             compose.press(KEYCODE_DPAD_CENTER)
             compose.assertFocusOn(hasText("Pick a file"), "Import opens on its first action")
             device.pressBack()
diff --git a/app/src/androidTest/kotlin/io/github/munzzyy/tern/Screens.kt b/app/src/androidTest/kotlin/io/github/munzzyy/tern/Screens.kt
index e83599d2..d31ba71d 100644
--- a/app/src/androidTest/kotlin/io/github/munzzyy/tern/Screens.kt
+++ b/app/src/androidTest/kotlin/io/github/munzzyy/tern/Screens.kt
@@ -75,3 +75,8 @@ fun ComposeTestRule.assertShown(text: String) {
     }
 }
 
+
+/** Whether the note about Android's developer verification counts as read; a launch without a scenario shows it otherwise. */
+fun noteSeen(seen: Boolean) {
+    appContext.getSharedPreferences("ui", Context.MODE_PRIVATE).edit().putBoolean("verification_note_shown", seen).commit()
+}
diff --git a/app/src/androidTest/kotlin/io/github/munzzyy/tern/SettingsCardsTest.kt b/app/src/androidTest/kotlin/io/github/munzzyy/tern/SettingsCardsTest.kt
index f555c7a6..6a9bfd68 100644
--- a/app/src/androidTest/kotlin/io/github/munzzyy/tern/SettingsCardsTest.kt
+++ b/app/src/androidTest/kotlin/io/github/munzzyy/tern/SettingsCardsTest.kt
@@ -175,7 +175,6 @@ class SettingsRowsScreenTest {
         val shown = compose.textCount("Be the only updater")
         assertEquals(if (Build.VERSION.SDK_INT >= 34) 1 else 0, shown)
         assertEquals(0, compose.textCount("Needs Android 14 or later."))
-        val language = compose.textCount("Language")
-        assertTrue(language == if (Build.VERSION.SDK_INT >= 33) 1 else 0)
+        assertEquals("Tern offers its own language setting on every version", 1, compose.textCount("Language"))
     }
 }
diff --git a/app/src/androidTest/kotlin/io/github/munzzyy/tern/StarsImportTest.kt b/app/src/androidTest/kotlin/io/github/munzzyy/tern/StarsImportTest.kt
index 7e06c3a8..f8be0f83 100644
--- a/app/src/androidTest/kotlin/io/github/munzzyy/tern/StarsImportTest.kt
+++ b/app/src/androidTest/kotlin/io/github/munzzyy/tern/StarsImportTest.kt
@@ -8,6 +8,8 @@ import androidx.compose.ui.test.hasTestTag
 import androidx.compose.ui.test.hasText
 import androidx.compose.ui.test.isToggleable
 import androidx.compose.ui.test.junit4.createEmptyComposeRule
+import androidx.compose.ui.test.performSemanticsAction
+import androidx.compose.ui.semantics.SemanticsActions
 import androidx.compose.ui.test.onNodeWithTag
 import androidx.compose.ui.test.onNodeWithText
 import androidx.compose.ui.test.performClick
@@ -40,7 +42,8 @@ class StarsImportTest {
 
     private fun tick(name: String) {
         compose.onNodeWithTag(IMPORT_LIST_TAG).performScrollToNode(hasText(name))
-        compose.onNodeWithText(name).performClick()
+        // A tap in the middle of a narrow row lands on its link, which asks before it opens; the row itself ticks.
+        compose.onNode(isToggleable() and hasText(name)).performSemanticsAction(SemanticsActions.OnClick)
     }
 
     @Test
diff --git a/app/src/androidTest/kotlin/io/github/munzzyy/tern/StoresNoteTest.kt b/app/src/androidTest/kotlin/io/github/munzzyy/tern/StoresNoteTest.kt
new file mode 100644
index 00000000..4da130f2
--- /dev/null
+++ b/app/src/androidTest/kotlin/io/github/munzzyy/tern/StoresNoteTest.kt
@@ -0,0 +1,69 @@
+package io.github.munzzyy.tern
+
+import androidx.activity.ComponentActivity
+import androidx.compose.runtime.CompositionLocalProvider
+import androidx.compose.runtime.rememberCoroutineScope
+import androidx.compose.ui.test.assertIsDisplayed
+import androidx.compose.ui.test.hasText
+import androidx.compose.ui.test.junit4.createAndroidComposeRule
+import androidx.compose.ui.test.onNodeWithTag
+import androidx.compose.ui.test.onNodeWithText
+import androidx.compose.ui.test.performClick
+import androidx.test.ext.junit.runners.AndroidJUnit4
+import io.github.munzzyy.tern.core.source.SourceTypes
+import io.github.munzzyy.tern.engine.ImportSummary
+import io.github.munzzyy.tern.engine.Settings
+import io.github.munzzyy.tern.ui.LocalActionScope
+import io.github.munzzyy.tern.ui.LocalEngine
+import io.github.munzzyy.tern.ui.add.STORES_ON_TAG
+import io.github.munzzyy.tern.ui.add.StoresOffCard
+import io.github.munzzyy.tern.ui.importing.CarriedNote
+import io.github.munzzyy.tern.ui.importing.IMPORT_STORES_ON_TAG
+import io.github.munzzyy.tern.ui.importing.ImportSummaryView
+import io.github.munzzyy.tern.ui.theme.TernTheme
+import kotlinx.coroutines.runBlocking
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertTrue
+import org.junit.Rule
+import org.junit.Test
+import org.junit.runner.RunWith
+
+@RunWith(AndroidJUnit4::class)
+class StoresNoteTest {
+    @get:Rule val compose = createAndroidComposeRule<ComponentActivity>()
+
+    @Test
+    fun aStoreAddressWhileStoresAreOffSaysWhatTheyAreAndOffersTheSwitch() {
+        var asked = 0
+        compose.setContent {
+            CompositionLocalProvider(LocalEngine provides fake, LocalActionScope provides rememberCoroutineScope()) {
+                TernTheme(Settings()) { StoresOffCard(SourceTypes.APKPURE) { asked++ } }
+            }
+        }
+        compose.onNodeWithText("APKPure is a third-party store").assertIsDisplayed()
+        compose.onNodeWithText("not files from the developer", substring = true).assertIsDisplayed()
+        compose.onNodeWithTag(STORES_ON_TAG).performClick()
+        assertEquals(1, asked)
+    }
+
+    @Test
+    fun anImportNamesTheAppsFromStoresAndWhyTheyArePaused() {
+        runBlocking { fake.saveSettings(fake.settings.value.copy(thirdPartyStores = false)) }
+        val summary = ImportSummary(2, 0, emptyList(), fromStores = listOf("Copy From A Store"))
+        compose.setContent {
+            CompositionLocalProvider(LocalEngine provides fake, LocalActionScope provides rememberCoroutineScope()) {
+                TernTheme(Settings()) {
+                    ImportSummaryView(summary.added, summary.alreadyPresent, summary.skipped) { CarriedNote(summary) {} }
+                }
+            }
+        }
+        compose.onNodeWithText("the first file Tern installs from its store decides", substring = true).assertIsDisplayed()
+        compose.onNodeWithText("so these apps are paused", substring = true).assertIsDisplayed()
+        compose.onNodeWithText("Copy From A Store").assertIsDisplayed()
+        compose.onNodeWithTag(IMPORT_STORES_ON_TAG).performClick()
+        compose.waitUntil(5_000) { fake.settings.value.thirdPartyStores }
+        assertTrue(fake.settings.value.thirdPartyStores)
+        compose.waitUntil(5_000) { compose.onAllNodes(hasText("so these apps are paused", substring = true)).fetchSemanticsNodes().isEmpty() }
+        runBlocking { fake.saveSettings(fake.settings.value.copy(thirdPartyStores = false)) }
+    }
+}
diff --git a/app/src/androidTest/kotlin/io/github/munzzyy/tern/TopLineTest.kt b/app/src/androidTest/kotlin/io/github/munzzyy/tern/TopLineTest.kt
new file mode 100644
index 00000000..963fd011
--- /dev/null
+++ b/app/src/androidTest/kotlin/io/github/munzzyy/tern/TopLineTest.kt
@@ -0,0 +1,74 @@
+package io.github.munzzyy.tern
+
+import androidx.activity.ComponentActivity
+import androidx.compose.foundation.layout.Box
+import androidx.compose.foundation.layout.width
+import androidx.compose.ui.Modifier
+import androidx.compose.ui.semantics.SemanticsActions
+import androidx.compose.ui.test.assertIsDisplayed
+import androidx.compose.ui.test.junit4.createAndroidComposeRule
+import androidx.compose.ui.test.onNodeWithContentDescription
+import androidx.compose.ui.test.onNodeWithText
+import androidx.compose.ui.text.TextLayoutResult
+import androidx.compose.ui.unit.dp
+import androidx.test.ext.junit.runners.AndroidJUnit4
+import io.github.munzzyy.tern.ui.common.GlyphButton
+import io.github.munzzyy.tern.ui.common.ScreenTop
+import io.github.munzzyy.tern.ui.icons.Glyphs
+import io.github.munzzyy.tern.ui.icons.More
+import io.github.munzzyy.tern.ui.icons.Search
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertTrue
+import org.junit.Rule
+import org.junit.Test
+import org.junit.runner.RunWith
+
+/** The top of a screen at double size in a pane as narrow as the list beside an app's page. */
+@RunWith(AndroidJUnit4::class)
+class TopLineTest {
+    @get:Rule val compose = createAndroidComposeRule<ComponentActivity>()
+
+    private fun top(title: String) {
+        compose.host(fontScale = 2f, television = true) {
+            Box(Modifier.width(390.dp)) {
+                ScreenTop(title) {
+                    GlyphButton(Glyphs.Search, "Search", onClick = {})
+                    GlyphButton(Glyphs.Filter, "Filter", onClick = {})
+                    GlyphButton(Glyphs.Busy, "Check", onClick = {})
+                    GlyphButton(Glyphs.More, "More", onClick = {})
+                }
+            }
+        }
+    }
+
+    private fun layoutOf(text: String): TextLayoutResult {
+        val layouts = mutableListOf<TextLayoutResult>()
+        compose.onNodeWithText(text).fetchSemanticsNode().config[SemanticsActions.GetTextLayoutResult].action?.invoke(layouts)
+        return layouts.single()
+    }
+
+    /** Where a line ends between two letters of one word. */
+    private fun splitWords(layout: TextLayoutResult): List<String> {
+        val text = layout.layoutInput.text.text
+        return (0 until layout.lineCount - 1).map { layout.getLineEnd(it) }
+            .filter { end -> end in 1 until text.length && text[end - 1].isLetterOrDigit() && text[end].isLetterOrDigit() }
+            .map { text.substring(0, it) + "/" + text.substring(it) }
+    }
+
+    @Test
+    fun aTitleThatDoesNotFitBesideTheButtonsGoesUnderThemWhole() {
+        top("Applications")
+        assertEquals(emptyList<String>(), splitWords(layoutOf("Applications")))
+        compose.onNodeWithText("Applications").assertIsDisplayed()
+        compose.onNodeWithContentDescription("More").assertIsDisplayed()
+    }
+
+    @Test
+    fun aTitleThatFitsStaysOnTheLineOfTheButtons() {
+        top("Apps")
+        val title = compose.onNodeWithText("Apps").fetchSemanticsNode().boundsInRoot
+        val more = compose.onNodeWithContentDescription("More").fetchSemanticsNode().boundsInRoot
+        assertEquals(1, layoutOf("Apps").lineCount)
+        assertTrue("Apps at $title, the buttons at $more", title.top < more.bottom && more.top < title.bottom)
+    }
+}
diff --git a/app/src/androidTest/kotlin/io/github/munzzyy/tern/TouchTargetTest.kt b/app/src/androidTest/kotlin/io/github/munzzyy/tern/TouchTargetTest.kt
new file mode 100644
index 00000000..3edfe9fd
--- /dev/null
+++ b/app/src/androidTest/kotlin/io/github/munzzyy/tern/TouchTargetTest.kt
@@ -0,0 +1,72 @@
+package io.github.munzzyy.tern
+
+import androidx.activity.ComponentActivity
+import androidx.compose.foundation.clickable
+import androidx.compose.foundation.layout.Column
+import androidx.compose.foundation.layout.Row
+import androidx.compose.foundation.layout.wrapContentSize
+import androidx.compose.material3.Text
+import androidx.compose.ui.Modifier
+import androidx.compose.ui.geometry.Offset
+import androidx.compose.ui.platform.testTag
+import androidx.compose.ui.test.assertHeightIsAtLeast
+import androidx.compose.ui.test.click
+import androidx.compose.ui.test.getUnclippedBoundsInRoot
+import androidx.compose.ui.test.hasText
+import androidx.compose.ui.test.junit4.createAndroidComposeRule
+import androidx.compose.ui.test.onNodeWithTag
+import androidx.compose.ui.test.onNodeWithText
+import androidx.compose.ui.test.performTouchInput
+import androidx.compose.ui.unit.dp
+import androidx.compose.ui.unit.height
+import androidx.test.ext.junit.runners.AndroidJUnit4
+import io.github.munzzyy.tern.engine.Density
+import io.github.munzzyy.tern.engine.Settings
+import io.github.munzzyy.tern.ui.apps.GroupHeader
+import io.github.munzzyy.tern.ui.common.pressRoom
+import kotlinx.coroutines.runBlocking
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertTrue
+import org.junit.Rule
+import org.junit.Test
+import org.junit.runner.RunWith
+
+/** What a finger presses is never under 48 dp, even where it looks smaller. */
+@RunWith(AndroidJUnit4::class)
+class TouchTargetTest {
+    @get:Rule val compose = createAndroidComposeRule<ComponentActivity>()
+
+    @Test
+    fun aGroupHeaderIsATouchTargetAtTheTightestDensity() {
+        runBlocking { fake.saveSettings(Settings(density = Density.COMPACT)) }
+        try {
+            compose.host { GroupHeader("Games", 3, folded = false, dot = null, focus = Modifier) {} }
+            compose.onNode(hasText("Games")).assertHeightIsAtLeast(48.dp)
+        } finally {
+            runBlocking { fake.saveSettings(Settings()) }
+        }
+    }
+
+    @Test
+    fun aSmallLinkTakesPressesOverATouchTargetWithoutMakingItsLineTaller() {
+        var row = 0
+        var link = 0
+        compose.host {
+            Column(Modifier.clickable { row++ }) {
+                Text("Status of the app")
+                Row(Modifier.testTag("line")) {
+                    Text("changes", Modifier.pressRoom(48.dp).clickable { link++ }.wrapContentSize())
+                }
+            }
+        }
+        val line = compose.onNodeWithTag("line", useUnmergedTree = true).getUnclippedBoundsInRoot().height
+        assertTrue("the line keeps the height of its text, not $line", line < 48.dp)
+        val target = compose.onNodeWithText("changes")
+        target.assertHeightIsAtLeast(48.dp)
+        target.performTouchInput { click(Offset(centerX, 2f)) }
+        target.performTouchInput { click(Offset(centerX, bottom - 2f)) }
+        compose.waitForIdle()
+        assertEquals("both near misses land on the link", 2, link)
+        assertEquals(0, row)
+    }
+}
diff --git a/app/src/androidTest/kotlin/io/github/munzzyy/tern/VerificationNoteTest.kt b/app/src/androidTest/kotlin/io/github/munzzyy/tern/VerificationNoteTest.kt
new file mode 100644
index 00000000..39205bd4
--- /dev/null
+++ b/app/src/androidTest/kotlin/io/github/munzzyy/tern/VerificationNoteTest.kt
@@ -0,0 +1,35 @@
+package io.github.munzzyy.tern
+
+import android.content.Intent
+import androidx.compose.ui.semantics.SemanticsActions
+import androidx.compose.ui.test.junit4.createEmptyComposeRule
+import androidx.compose.ui.test.onNodeWithText
+import androidx.compose.ui.test.performSemanticsAction
+import androidx.lifecycle.Lifecycle
+import androidx.test.core.app.ActivityScenario
+import androidx.test.ext.junit.runners.AndroidJUnit4
+import org.junit.After
+import org.junit.Assert.assertTrue
+import org.junit.Rule
+import org.junit.Test
+import org.junit.runner.RunWith
+
+/** The note shown once after the first run, over the whole app. */
+@RunWith(AndroidJUnit4::class)
+class VerificationNoteTest {
+    @get:Rule val compose = createEmptyComposeRule()
+
+    @After fun seen() = noteSeen(true)
+
+    @Test
+    fun theLinkInTheNoteAsksBeforeItOpensInsteadOfClosingTern() {
+        launch("default").close()
+        noteSeen(false)
+        ActivityScenario.launch<MainActivity>(Intent(appContext, MainActivity::class.java)).use { scenario ->
+            compose.waitForText("Android's developer verification")
+            compose.onNodeWithText("Google's page about it").performSemanticsAction(SemanticsActions.OnClick)
+            compose.waitForText("Open this link?")
+            assertTrue(scenario.state.isAtLeast(Lifecycle.State.RESUMED))
+        }
+    }
+}
diff --git a/app/src/androidTest/kotlin/io/github/munzzyy/tern/VersionDisplayTest.kt b/app/src/androidTest/kotlin/io/github/munzzyy/tern/VersionDisplayTest.kt
index 20608661..1634873f 100644
--- a/app/src/androidTest/kotlin/io/github/munzzyy/tern/VersionDisplayTest.kt
+++ b/app/src/androidTest/kotlin/io/github/munzzyy/tern/VersionDisplayTest.kt
@@ -23,7 +23,7 @@ class VersionDisplayTest {
     @Test
     fun upToDateAppWithAVTagShowsOnlyItsVersion() {
         launch("default").use {
-            compose.shownRow("Tagged Weather").assert(hasContentDescription("Tagged Weather. Up to date. Version 0.4.4.", substring = false))
+            compose.shownRow("Tagged Weather").assert(hasContentDescription("Tagged Weather. Up to date. Version 0.4.4. Released", substring = true))
             compose.row("Tagged Weather").performClick()
             compose.onNodeWithText("\u20680.4.4\u2069").assertIsDisplayed()
             assertEquals(0, compose.textCount("to v0.4.4"))
diff --git a/app/src/androidTest/kotlin/io/github/munzzyy/tern/enginetest/AdditionsTest.kt b/app/src/androidTest/kotlin/io/github/munzzyy/tern/enginetest/AdditionsTest.kt
index f29414f5..f16c31f6 100644
--- a/app/src/androidTest/kotlin/io/github/munzzyy/tern/enginetest/AdditionsTest.kt
+++ b/app/src/androidTest/kotlin/io/github/munzzyy/tern/enginetest/AdditionsTest.kt
@@ -4,6 +4,7 @@ import android.content.ComponentName
 import android.content.pm.PackageManager
 import android.net.ConnectivityManager
 import android.net.Uri
+import android.os.Build
 import androidx.test.ext.junit.runners.AndroidJUnit4
 import io.github.munzzyy.tern.core.json.Json
 import io.github.munzzyy.tern.engine.AppStatus
@@ -15,6 +16,7 @@ import kotlinx.coroutines.runBlocking
 import org.junit.After
 import org.junit.Assert.assertEquals
 import org.junit.Assert.assertFalse
+import org.junit.Assert.assertNotEquals
 import org.junit.Assert.assertNull
 import org.junit.Assert.assertTrue
 import org.junit.Assume
@@ -139,15 +141,39 @@ class AdditionsTest {
             waitUntil(30_000, "the install to wait for the user") { h.row(id).progress?.phase == Phase.WAITING_FOR_USER }
             assertTrue(h.engine.resumeInstall(id))
             assertTrue("the confirmation did not reopen", Prompt.appears(10_000))
-            val session = h.state(id).pending!!.sessionId
-            targetContext.packageManager.packageInstaller.abandonSession(session)
+            val pending = h.state(id).pending!!
+            targetContext.packageManager.packageInstaller.abandonSession(pending.sessionId)
             Prompt.dismiss()
 
+            // Android answers an abandoned session as aborted, as it answers a No in its installer: a cancel, not a problem.
+            waitUntil(10_000, "Android's answer to the abandoned session") { h.eventsFor(id).any { it.kind == EventKind.CANCELLED } }
             assertFalse(h.engine.resumeInstall(id))
             waitUntil(10_000, "the phase to settle") { h.state(id).pending == null && h.row(id).progress == null }
-            assertNull(h.state(id).pending)
-            assertNull(h.row(id).progress)
-            assertEquals(ProblemKind.INSTALL_FAILED, h.row(id).problem?.kind)
+            assertNull(h.describe(id), h.row(id).problem)
+
+            h.engine.saveState(id) { it.copy(pending = pending.copy(sessionId = GONE_SESSION)) }
+            assertFalse(h.engine.resumeInstall(id))
+            assertNull(h.describe(id), h.state(id).pending)
+            assertNull(h.describe(id), h.row(id).progress)
+            assertEquals(h.describe(id), ProblemKind.INSTALL_FAILED, h.row(id).problem?.kind)
+            assertEquals(h.describe(id), 1, h.eventsFor(id).count { it.kind == EventKind.CANCELLED })
+        }
+    }
+
+    @Test
+    fun anAppWithOnlyAPreReleaseFollowsPreReleasesEvenWithoutAFileForThisDevice() = runBlocking {
+        val foreign = listOf("x86_64", "x86", "arm64-v8a", "armeabi-v7a").first { it !in Build.SUPPORTED_ABIS }
+        Harness("prerelease-only").use { h ->
+            h.forge.releases = listOf(FakeForge.Release("v2.0-beta", listOf(FakeForge.File("app-$foreign.apk", asset("apk/app-v1.apk"))), prerelease = true))
+            val found = h.engine.detect(FakeForge.PROJECT) as Detection.Found
+            val id = h.engine.add(found, install = false)
+            assertTrue(h.describe(id), h.row(id).config.releases.includePrereleases)
+            assertNotEquals(h.describe(id), h.engine.texts.onlyPrereleases(), h.row(id).problem?.message)
         }
     }
+
+    private companion object {
+        /** A session Android never had, as one is after Tern stopped before Android answered. */
+        const val GONE_SESSION = 987_654
+    }
 }
diff --git a/app/src/androidTest/kotlin/io/github/munzzyy/tern/enginetest/AskFirstTest.kt b/app/src/androidTest/kotlin/io/github/munzzyy/tern/enginetest/AskFirstTest.kt
index d5ec7386..4e265b25 100644
--- a/app/src/androidTest/kotlin/io/github/munzzyy/tern/enginetest/AskFirstTest.kt
+++ b/app/src/androidTest/kotlin/io/github/munzzyy/tern/enginetest/AskFirstTest.kt
@@ -9,6 +9,7 @@ import io.github.munzzyy.tern.core.source.SourceTypes
 import io.github.munzzyy.tern.engine.AppStatus
 import io.github.munzzyy.tern.engine.EventKind
 import io.github.munzzyy.tern.engine.Received
+import io.github.munzzyy.tern.install.Downloader
 import kotlinx.coroutines.runBlocking
 import org.junit.After
 import org.junit.Assert.assertEquals
@@ -46,7 +47,7 @@ class AskFirstTest {
         assertNull(h.describe(id), h.state(id).record)
         assertNull(h.describe(id), h.row(id).progress)
         assertTrue(h.describe(id), h.eventsFor(id).none { it.kind == EventKind.DOWNLOADED || it.kind == EventKind.VERIFIED || it.kind == EventKind.INSTALLED })
-        assertNull("a file was downloaded", h.engine.downloader.kept(id, "${FakeForge.FILES}v2.0/app-v2.apk"))
+        assertNull("a file was downloaded", h.engine.downloader.kept(id, Downloader.key("v2.0", "${FakeForge.FILES}v2.0/app-v2.apk")))
         assertFalse("the system installer asked the user", Prompt.visible())
     }
 
diff --git a/app/src/androidTest/kotlin/io/github/munzzyy/tern/enginetest/GateTest.kt b/app/src/androidTest/kotlin/io/github/munzzyy/tern/enginetest/GateTest.kt
index 95c135c2..c11a9495 100644
--- a/app/src/androidTest/kotlin/io/github/munzzyy/tern/enginetest/GateTest.kt
+++ b/app/src/androidTest/kotlin/io/github/munzzyy/tern/enginetest/GateTest.kt
@@ -10,6 +10,7 @@ import io.github.munzzyy.tern.engine.AppStatus
 import io.github.munzzyy.tern.engine.ChecksumState
 import io.github.munzzyy.tern.engine.EventKind
 import io.github.munzzyy.tern.engine.ProblemKind
+import io.github.munzzyy.tern.install.Downloader
 import io.github.munzzyy.tern.install.Gate
 import io.github.munzzyy.tern.install.GatePass
 import io.github.munzzyy.tern.install.Installer
@@ -110,7 +111,7 @@ class GateTest {
             waitUntil(30_000, "the gate to decide") { h.state(id).block != null }
 
             assertEquals(ProblemKind.CHECKSUM_MISMATCH, h.state(id).block?.problem?.kind)
-            assertNull(h.engine.downloader.kept(id, "${FakeForge.FILES}v1.0/app-v1.apk"))
+            assertNull(h.engine.downloader.kept(id, Downloader.key("v1.0", "${FakeForge.FILES}v1.0/app-v1.apk")))
             assertTrue(h.engine.downloader.folder(id).listFiles().orEmpty().none { it.name.endsWith(".bin") || it.name.endsWith(".part") })
             waitUntil(5_000, "the row to show the block") { h.row(id).progress == null }
             assertEquals(AppStatus.BLOCKED, h.row(id).status)
diff --git a/app/src/androidTest/kotlin/io/github/munzzyy/tern/enginetest/HashRouteTest.kt b/app/src/androidTest/kotlin/io/github/munzzyy/tern/enginetest/HashRouteTest.kt
new file mode 100644
index 00000000..c9f6dd74
--- /dev/null
+++ b/app/src/androidTest/kotlin/io/github/munzzyy/tern/enginetest/HashRouteTest.kt
@@ -0,0 +1,34 @@
+package io.github.munzzyy.tern.enginetest
+
+import androidx.test.ext.junit.runners.AndroidJUnit4
+import io.github.munzzyy.tern.core.source.SourceTypes
+import io.github.munzzyy.tern.engine.Detection
+import kotlinx.coroutines.runBlocking
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertTrue
+import org.junit.Test
+import org.junit.runner.RunWith
+
+/** Store pages that route after a '#', pasted into the Add screen. */
+@RunWith(AndroidJUnit4::class)
+class HashRouteTest {
+    private fun typeOf(found: Detection): String? = when (found) {
+        is Detection.Found -> found.spec.type
+        is Detection.Failed -> found.spec?.type
+        else -> null
+    }
+
+    @Test
+    fun aStorePageThatRoutesAfterTheHashIsReadAsThatStore() = runBlocking {
+        val detail = "https://h5-api.appstore.vivo.com.cn/detailInfo?appId=40413"
+        val routes = Routes(FakeForge()).json(detail, """{"id":40413,"title_zh":"Example","package_name":"org.example.app","version_name":"1.0","version_code":1}""")
+        Harness("hashroute", http = routes).use { h ->
+            h.engine.saveSettings(h.engine.settings.value.copy(thirdPartyStores = true))
+            val vivo = h.engine.detect("https://h5.appstore.vivo.com.cn/#/details?appId=40413")
+            assertEquals("vivo read as $vivo", SourceTypes.VIVO, typeOf(vivo))
+            assertTrue(routes.requests.any { it.url == detail })
+            val huawei = h.engine.detect("https://appgallery.huawei.com/#/app/C100336075")
+            assertEquals("AppGallery read as $huawei", SourceTypes.HUAWEI, typeOf(huawei))
+        }
+    }
+}
diff --git a/app/src/androidTest/kotlin/io/github/munzzyy/tern/enginetest/InstalledTruthTest.kt b/app/src/androidTest/kotlin/io/github/munzzyy/tern/enginetest/InstalledTruthTest.kt
index 825d6926..a3f36365 100644
--- a/app/src/androidTest/kotlin/io/github/munzzyy/tern/enginetest/InstalledTruthTest.kt
+++ b/app/src/androidTest/kotlin/io/github/munzzyy/tern/enginetest/InstalledTruthTest.kt
@@ -19,6 +19,7 @@ import io.github.munzzyy.tern.engine.EventKind
 import io.github.munzzyy.tern.engine.Phase
 import io.github.munzzyy.tern.engine.ProblemKind
 import io.github.munzzyy.tern.engine.real.RealEngine
+import io.github.munzzyy.tern.install.Downloader
 import io.github.munzzyy.tern.install.Gate
 import io.github.munzzyy.tern.install.GatePass
 import java.io.File
@@ -110,7 +111,7 @@ class InstalledTruthTest {
             assertEquals(h.describe(id), AppStatus.UPDATE_AVAILABLE, h.row(id).status)
             assertNull(h.describe(id), h.row(id).problem)
             assertTrue(h.eventsFor(id).none { it.kind == EventKind.FAILED })
-            assertNotNull("the file stays for the next try", h.engine.downloader.kept(id, h.row(id).file!!.asset.url))
+            assertNotNull("the file stays for the next try", h.engine.downloader.kept(id, Downloader.key(h.row(id).latest!!.id, h.row(id).file!!.asset.url)))
         }
     }
 
diff --git a/app/src/androidTest/kotlin/io/github/munzzyy/tern/enginetest/LiveSourcesTest.kt b/app/src/androidTest/kotlin/io/github/munzzyy/tern/enginetest/LiveSourcesTest.kt
new file mode 100644
index 00000000..e7c152ac
--- /dev/null
+++ b/app/src/androidTest/kotlin/io/github/munzzyy/tern/enginetest/LiveSourcesTest.kt
@@ -0,0 +1,203 @@
+package io.github.munzzyy.tern.enginetest
+
+import android.util.Log
+import androidx.test.ext.junit.runners.AndroidJUnit4
+import androidx.test.platform.app.InstrumentationRegistry
+import io.github.munzzyy.tern.core.net.HttpClient
+import io.github.munzzyy.tern.core.net.HttpRequest
+import io.github.munzzyy.tern.core.net.HttpResponse
+import io.github.munzzyy.tern.core.net.Urls
+import io.github.munzzyy.tern.core.source.SourceTypes
+import io.github.munzzyy.tern.engine.Detection
+import io.github.munzzyy.tern.engine.ProblemKind
+import io.github.munzzyy.tern.engine.real.RealEngine
+import io.github.munzzyy.tern.net.UrlConnectionHttp
+import java.util.Collections
+import kotlinx.coroutines.runBlocking
+import org.junit.After
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertTrue
+import org.junit.Assert.fail
+import org.junit.Assume.assumeTrue
+import org.junit.Before
+import org.junit.Test
+import org.junit.runner.RunWith
+
+/** One real app from each source, through the real engine on the network. Off unless run with -e live true. */
+@RunWith(AndroidJUnit4::class)
+class LiveSourcesTest {
+    private val args = InstrumentationRegistry.getArguments()
+    private val counting = RecordingHttp(UrlConnectionHttp(connectTimeoutMs = 30_000, readTimeoutMs = 60_000))
+    private lateinit var engine: RealEngine
+
+    @Before
+    fun onlyWhenAsked() {
+        assumeTrue("live tests are off; pass -e live true", args.getString("live") == "true")
+        targetContext.deleteDatabase(STORE)
+        engine = RealEngine(targetContext, counting, storeName = STORE, prefsPrefix = PREFS)
+        runBlocking { engine.ready() }
+    }
+
+    @After
+    fun close() {
+        if (::engine.isInitialized) engine.close()
+        targetContext.deleteDatabase(STORE)
+        for (name in listOf("settings", "kept-pins")) targetContext.getSharedPreferences(PREFS + name, 0).edit().clear().commit()
+    }
+
+    private fun stores(on: Boolean) = runBlocking { engine.saveSettings(engine.settings.value.copy(thirdPartyStores = on)) }
+
+    /** A listing has to come back; after it only no file for this device, or a region's refusal where [regional], is let pass. */
+    private fun follow(type: String, address: String, regional: Boolean = false) = runBlocking {
+        val found = engine.detect(address)
+        val line = when (found) {
+            is Detection.Found -> {
+                assertEquals(address, type, found.spec.type)
+                val id = engine.add(found, install = false)
+                engine.check(id)
+                val row = engine.apps.value.first { it.id == id }
+                val said = "listing: ${found.name}, newest ${row.latest?.version ?: found.release?.version}, file ${row.file?.asset?.name ?: found.file?.asset?.name}, " +
+                    "package ${row.config.packageName}, status ${row.status}, problem ${row.problem?.kind} ${row.problem?.message ?: ""}"
+                val kind = row.problem?.kind
+                val allowed = setOf(ProblemKind.NO_FILE_FOR_DEVICE) + if (regional) setOf(ProblemKind.NETWORK, ProblemKind.NOT_FOUND) else emptySet()
+                assertTrue("$type: $said", kind == null || kind in allowed)
+                said
+            }
+            is Detection.Failed -> {
+                val said = "problem: ${found.problem.kind} ${found.problem.message}, read as ${found.spec?.type}"
+                if (!regional || found.problem.kind !in setOf(ProblemKind.NETWORK, ProblemKind.NOT_FOUND)) fail("$type: $said")
+                said
+            }
+            else -> fail("$type: $found").let { "" }
+        }
+        Log.i(TAG, "$type $address -> $line; ${counting.requests.size} requests to ${counting.hosts()}")
+        identity(type)
+    }
+
+    /** Every request carried Tern's own User-Agent and nothing that names another client. */
+    private fun identity(type: String) {
+        for (request in counting.requests.toList()) {
+            val agent = request.headers.entries.firstOrNull { it.key.equals("User-Agent", ignoreCase = true) }?.value
+            assertTrue("$type sent ${request.url.take(120)} as $agent", agent?.startsWith("Tern/") == true)
+            assertTrue("$type: ${request.headers.keys}", request.headers.keys.none { it.startsWith("X-App", ignoreCase = true) || it.startsWith("Ual-", ignoreCase = true) })
+        }
+    }
+
+    @Test
+    fun gitHub() = follow(SourceTypes.GITHUB, "https://github.com/munzzyy/magpie")
+
+    @Test
+    fun gitLab() = follow(SourceTypes.GITLAB, "https://gitlab.com/fdroid/fdroidclient")
+
+    @Test
+    fun codeberg() = follow(SourceTypes.FORGEJO, "https://codeberg.org/Starfish/TinyWeatherForecastGermany")
+
+    @Test
+    fun fDroid() = follow(SourceTypes.FDROID, "https://f-droid.org/en/packages/org.fdroid.fdroid/")
+
+    @Test
+    fun izzyOnDroid() = follow(SourceTypes.FDROID, "https://apt.izzysoft.de/fdroid/index/apk/io.github.muntashirakon.AppManager")
+
+    @Test
+    fun webPage() = follow(SourceTypes.HTML, "https://download.kiwix.org/release/kiwix-android/")
+
+    @Test
+    fun sourceForge() = follow(SourceTypes.SOURCEFORGE, "https://sourceforge.net/projects/newpipe.mirror/")
+
+    @Test
+    fun itchIo() = follow(SourceTypes.ITCHIO, "https://xlaucifer.itch.io/remember")
+
+    @Test
+    fun telegram() = follow(SourceTypes.TELEGRAM, "https://telegram.org/android")
+
+    @Test
+    fun neutronCode() = follow(SourceTypes.NEUTRONCODE, "https://neutroncode.com/downloads/file/2-neutronmpapkarm64")
+
+    @Test
+    fun apkPure() {
+        stores(true)
+        follow(SourceTypes.APKPURE, "https://apkpure.com/vlc-for-android/org.videolan.vlc", regional = true)
+    }
+
+    @Test
+    fun aptoide() {
+        stores(true)
+        follow(SourceTypes.APTOIDE, "https://videolabs-vlc.en.aptoide.com/app", regional = true)
+    }
+
+    @Test
+    fun apkCombo() {
+        stores(true)
+        follow(SourceTypes.APKCOMBO, "https://apkcombo.com/vlc/org.videolan.vlc", regional = true)
+    }
+
+    @Test
+    fun apkMirror() {
+        stores(true)
+        follow(SourceTypes.APKMIRROR, "https://www.apkmirror.com/apk/mozilla/firefox/", regional = true)
+    }
+
+    @Test
+    fun tencent() {
+        stores(true)
+        follow(SourceTypes.TENCENT, "https://sj.qq.com/appdetail/com.tencent.mm", regional = true)
+    }
+
+    @Test
+    fun huaweiAppGallery() {
+        stores(true)
+        follow(SourceTypes.HUAWEI, "https://appgallery.huawei.com/app/C100336075", regional = true)
+    }
+
+    @Test
+    fun galaxyStore() {
+        stores(true)
+        follow(SourceTypes.SAMSUNG, "https://galaxystore.samsung.com/detail/com.sec.android.app.sbrowser", regional = true)
+    }
+
+    @Test
+    fun vivo() {
+        stores(true)
+        follow(SourceTypes.VIVO, "https://h5.appstore.vivo.com.cn/#/details?appId=40413", regional = true)
+    }
+
+    @Test
+    fun refusedSitesAreNeverAsked() = runBlocking {
+        stores(true)
+        for (address in listOf("https://liteapks.com/spotify-music.html", "https://vlc.en.uptodown.com/android")) {
+            counting.requests.clear()
+            val found = engine.detect(address)
+            Log.i(TAG, "$address -> $found; ${counting.requests.size} requests")
+            assertTrue("$address -> $found", found is Detection.Failed && found.problem.kind == ProblemKind.UNSUPPORTED)
+            assertEquals("requests for $address: ${counting.hosts()}", 0, counting.requests.size)
+        }
+    }
+
+    @Test
+    fun aStoreWhileStoresAreOffIsNeverAsked() = runBlocking {
+        stores(false)
+        counting.requests.clear()
+        val found = engine.detect("https://apkpure.com/vlc-for-android/org.videolan.vlc")
+        Log.i(TAG, "APKPure with the stores off -> $found; ${counting.requests.size} requests")
+        assertEquals(Detection.StoresOff(SourceTypes.APKPURE), found)
+        assertEquals("requests: ${counting.hosts()}", 0, counting.requests.size)
+    }
+
+    /** Keeps every request that reached the network, after Tern added its own headers. */
+    private class RecordingHttp(private val real: HttpClient) : HttpClient {
+        val requests: MutableList<HttpRequest> = Collections.synchronizedList(ArrayList())
+
+        fun hosts(): List<String> = requests.toList().map { Urls.host(it.url) }.distinct()
+
+        override fun execute(request: HttpRequest): HttpResponse {
+            requests += request
+            return real.execute(request)
+        }
+    }
+
+    private companion object {
+        const val TAG = "LiveSources"
+        const val STORE = "enginetest-live.db"
+        const val PREFS = "enginetest-live-"
+    }
+}
diff --git a/app/src/androidTest/kotlin/io/github/munzzyy/tern/enginetest/NetTest.kt b/app/src/androidTest/kotlin/io/github/munzzyy/tern/enginetest/NetTest.kt
index 841d9aa6..f9f97136 100644
--- a/app/src/androidTest/kotlin/io/github/munzzyy/tern/enginetest/NetTest.kt
+++ b/app/src/androidTest/kotlin/io/github/munzzyy/tern/enginetest/NetTest.kt
@@ -149,7 +149,7 @@ class NetTest {
             out.write(content, from, content.size - from)
         }.use { server ->
             var free = Long.MAX_VALUE
-            val downloader = Downloader(local, dir, Texts(targetContext), freeBytes = { free })
+            val downloader = Downloader(local, dir, Texts(targetContext), freeBytes = { free }, pause = noSecondTry)
             val url = "http://127.0.0.1:${server.port}/app.apk"
             runCatching { downloader.fetch("full", url, url, null) { _, _ -> } }
             assertTrue(downloader.folder("full").listFiles().orEmpty().any { it.name.endsWith(".part") })
diff --git a/app/src/androidTest/kotlin/io/github/munzzyy/tern/enginetest/PausedStoreTest.kt b/app/src/androidTest/kotlin/io/github/munzzyy/tern/enginetest/PausedStoreTest.kt
new file mode 100644
index 00000000..db434b52
--- /dev/null
+++ b/app/src/androidTest/kotlin/io/github/munzzyy/tern/enginetest/PausedStoreTest.kt
@@ -0,0 +1,36 @@
+package io.github.munzzyy.tern.enginetest
+
+import androidx.test.ext.junit.runners.AndroidJUnit4
+import io.github.munzzyy.tern.R
+import io.github.munzzyy.tern.core.model.AppConfig
+import io.github.munzzyy.tern.core.model.SourceSpec
+import io.github.munzzyy.tern.core.source.SourceTypes
+import io.github.munzzyy.tern.data.AppState
+import io.github.munzzyy.tern.data.StoredApp
+import io.github.munzzyy.tern.engine.ProblemKind
+import kotlinx.coroutines.runBlocking
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertFalse
+import org.junit.Assert.assertTrue
+import org.junit.Test
+import org.junit.runner.RunWith
+
+@RunWith(AndroidJUnit4::class)
+class PausedStoreTest {
+    @Test
+    fun aPausedStoreAppSaysWhyWithoutSayingPausedTwice() = runBlocking {
+        Harness("paused").use { h ->
+            h.engine.saveSettings(h.engine.settings.value.copy(thirdPartyStores = true))
+            val config = AppConfig(id = "store", source = SourceSpec(SourceTypes.APKPURE, "https://apkpure.com/example/org.example.app"), name = "Store app")
+            h.engine.store.putApp(config, AppState())
+            h.engine.ready()
+            h.engine.stored["store"] = StoredApp(config, AppState())
+            h.engine.saveSettings(h.engine.settings.value.copy(thirdPartyStores = false))
+            val problem = h.row("store").problem
+            assertEquals(h.describe("store"), ProblemKind.STORES_OFF, problem?.kind)
+            val status = targetContext.getString(R.string.stores_status_paused)
+            assertFalse("the row reads \"$status. ${problem?.message}\"", problem!!.message.startsWith(status))
+            assertTrue(h.forge.requests.isEmpty())
+        }
+    }
+}
diff --git a/app/src/androidTest/kotlin/io/github/munzzyy/tern/enginetest/ProxyTest.kt b/app/src/androidTest/kotlin/io/github/munzzyy/tern/enginetest/ProxyTest.kt
index 897b34ed..8caff358 100644
--- a/app/src/androidTest/kotlin/io/github/munzzyy/tern/enginetest/ProxyTest.kt
+++ b/app/src/androidTest/kotlin/io/github/munzzyy/tern/enginetest/ProxyTest.kt
@@ -10,6 +10,7 @@ import io.github.munzzyy.tern.engine.EventKind
 import io.github.munzzyy.tern.engine.ProblemKind
 import io.github.munzzyy.tern.engine.ProxyMode
 import io.github.munzzyy.tern.enginetest.LoopbackServer.Companion.head
+import io.github.munzzyy.tern.install.Downloader
 import io.github.munzzyy.tern.install.Installer
 import io.github.munzzyy.tern.engine.real.Texts
 import io.github.munzzyy.tern.net.ProxyDoor
@@ -260,7 +261,7 @@ class ProxyTest {
                 assertEquals(h.describe(id), Texts(targetContext).proxySilent(), h.state(id).installProblem?.message)
                 assertEquals(h.describe(id), ProblemKind.NETWORK, h.row(id).problem?.kind)
                 assertEquals("requests arrived although the proxy did not answer", 0, wire.arrived)
-                assertNull(h.engine.downloader.kept(id, file))
+                assertNull(h.engine.downloader.kept(id, Downloader.key("v1.0", file)))
                 assertTrue(h.eventsFor(id).none { it.kind == EventKind.DOWNLOADED })
                 assertEquals(0, h.installer.prepared.get())
 
diff --git a/app/src/debug/kotlin/io/github/munzzyy/tern/fake/FakeCatalog.kt b/app/src/debug/kotlin/io/github/munzzyy/tern/fake/FakeCatalog.kt
index 74148351..1b634272 100644
--- a/app/src/debug/kotlin/io/github/munzzyy/tern/fake/FakeCatalog.kt
+++ b/app/src/debug/kotlin/io/github/munzzyy/tern/fake/FakeCatalog.kt
@@ -243,6 +243,7 @@ class Invent(private val now: Long) {
         ProblemKind.INSTALL_FAILED -> "Android said: the package conflicts with an existing package."
         ProblemKind.STORAGE -> "Only 40 MB free; the file needs 120 MB."
         ProblemKind.UNSUPPORTED -> "The app needs Android 17."
+        ProblemKind.STORES_OFF -> "Third-party stores are off, so Tern asks this store nothing."
     }
 
     fun manyRows(count: Int): List<AppRow> {
diff --git a/app/src/debug/kotlin/io/github/munzzyy/tern/fake/FakeEngine.kt b/app/src/debug/kotlin/io/github/munzzyy/tern/fake/FakeEngine.kt
index 9f4ffcf9..aae2ca78 100644
--- a/app/src/debug/kotlin/io/github/munzzyy/tern/fake/FakeEngine.kt
+++ b/app/src/debug/kotlin/io/github/munzzyy/tern/fake/FakeEngine.kt
@@ -647,7 +647,7 @@ class FakeEngine(private val context: Context) : Engine, Scenarios {
 
     override suspend fun fileSize(appId: String, releaseId: String, assetUrl: String): Long? = null
 
-    override val searchOrigins: List<String> = listOf("GitHub", "Codeberg", "GitLab", "F-Droid", "Aptoide", "Uptodown")
+    override val searchOrigins: List<String> = listOf("GitHub", "Codeberg", "GitLab", "F-Droid", "Aptoide", "vivo App Store")
 
     override fun renderNotes(text: String): List<NoteBlock> = io.github.munzzyy.tern.engine.real.NotesMapper.markdown(text)
 
diff --git a/app/src/main/AndroidManifest.xml b/app/src/main/AndroidManifest.xml
index 993e335c..d9fa65d2 100644
--- a/app/src/main/AndroidManifest.xml
+++ b/app/src/main/AndroidManifest.xml
@@ -71,6 +71,12 @@
             </intent-filter>
         </activity>
 
+        <!-- What the launcher shortcuts start. No other app can, so they may run Update all and a check without asking. -->
+        <activity-alias
+            android:name=".Shortcuts"
+            android:exported="false"
+            android:targetActivity=".MainActivity" />
+
         <!-- Off until the user turns on "Open Obtainium links" in settings. -->
         <activity-alias
             android:name=".ObtainiumLinks"
diff --git a/app/src/main/kotlin/io/github/munzzyy/tern/App.kt b/app/src/main/kotlin/io/github/munzzyy/tern/App.kt
index e8454c40..1d6c96c8 100644
--- a/app/src/main/kotlin/io/github/munzzyy/tern/App.kt
+++ b/app/src/main/kotlin/io/github/munzzyy/tern/App.kt
@@ -7,10 +7,17 @@ import io.github.munzzyy.tern.data.AppLanguage
 import io.github.munzzyy.tern.data.CrashReport
 import io.github.munzzyy.tern.engine.Engine
 import io.github.munzzyy.tern.widget.Surfaces
+import rikka.shizuku.ShizukuProvider
 
 class App : Application() {
     val engine: Engine by lazy { createEngine(this).also { Surfaces.start(this, it) } }
 
+    override fun attachBaseContext(base: Context) {
+        super.attachBaseContext(base)
+        // Runs before any provider starts. Sui is reached only once Shizuku is the chosen installer.
+        ShizukuProvider.disableAutomaticSuiInitialization()
+    }
+
     override fun onCreate() {
         super.onCreate()
         CrashReport.install(this)
diff --git a/app/src/main/kotlin/io/github/munzzyy/tern/MainActivity.kt b/app/src/main/kotlin/io/github/munzzyy/tern/MainActivity.kt
index 882a7a65..fa10ec61 100644
--- a/app/src/main/kotlin/io/github/munzzyy/tern/MainActivity.kt
+++ b/app/src/main/kotlin/io/github/munzzyy/tern/MainActivity.kt
@@ -23,14 +23,21 @@ import io.github.munzzyy.tern.engine.CheckCause
 import io.github.munzzyy.tern.log.TernLog
 import io.github.munzzyy.tern.ui.BackStack
 import io.github.munzzyy.tern.ui.EXTRA_SCENARIO
+import io.github.munzzyy.tern.ui.ACTION_ADD
+import io.github.munzzyy.tern.ui.ACTION_CHECK
+import io.github.munzzyy.tern.ui.ACTION_UPDATE_ALL
+import io.github.munzzyy.tern.ui.Asked
 import io.github.munzzyy.tern.ui.RefreshLink
+import io.github.munzzyy.tern.ui.SHORTCUTS
+import io.github.munzzyy.tern.ui.asked
+import io.github.munzzyy.tern.ui.common.LinkCheckDialog
+import io.github.munzzyy.tern.ui.linkCheckAllowed
 import io.github.munzzyy.tern.ui.SCENARIO_FIRST_RUN
 import io.github.munzzyy.tern.ui.Scenarios
 import io.github.munzzyy.tern.ui.TernApp
 import io.github.munzzyy.tern.ui.common.CrashDialog
 import io.github.munzzyy.tern.ui.common.ProblemsDialog
 import io.github.munzzyy.tern.ui.incomingAddInput
-import io.github.munzzyy.tern.ui.refreshLink
 import io.github.munzzyy.tern.ui.settings.VerificationNote
 import io.github.munzzyy.tern.ui.theme.TernTheme
 import io.github.munzzyy.tern.ui.theme.isDark
@@ -45,6 +52,8 @@ private const val KEY_VERIFICATION_NOTE_SHOWN = "verification_note_shown"
 private const val TAG = "TernMain"
 private const val MAX_APP_ID = 64
 private const val MAX_PROBLEMS = 50
+private const val NO_APP = "\u0000"
+private val SHORTCUT_ACTIONS = setOf(ACTION_ADD, ACTION_UPDATE_ALL, ACTION_CHECK)
 
 private data class Incoming(val text: String, val nonce: Long)
 
@@ -61,6 +70,12 @@ class MainActivity : ComponentActivity() {
     /** Shown once, on the first start after the first run, so it never stands in the way of that run. */
     private var verificationNote by mutableStateOf(false)
 
+    /** A check a link from outside asked for, until the person says yes or no. */
+    private var confirmCheck by mutableStateOf<RefreshLink?>(null)
+
+    /** When the person last let a link start a check, in this process. */
+    private var lastLinkCheckAtMs: Long? = null
+
     /** What Tern was doing when it last stopped unexpectedly, until the person has seen it. */
     private var crash by mutableStateOf<String?>(null)
 
@@ -107,10 +122,27 @@ class MainActivity : ComponentActivity() {
                     firstRunDone = firstRunDone,
                     onFirstRunDone = ::finishFirstRun,
                     reducedMotion = animationsOff(),
-                )
-                problems?.let { ids -> ProblemsDialog(engine, ids, onOpen = { openApp = it }, onDismiss = { problems = null }) }
-                crash?.let { report -> CrashDialog(report, onDismiss = ::sawCrash) }
-                if (crash == null && verificationNote) VerificationNote(onDismiss = ::sawVerificationNote)
+                ) {
+                    problems?.let { ids -> ProblemsDialog(engine, ids, onOpen = { openApp = it }, onDismiss = { problems = null }) }
+                    crash?.let { report -> CrashDialog(report, onDismiss = ::sawCrash) }
+                    confirmCheck?.let { link ->
+                        val rows by engine.apps.collectAsStateWithLifecycle()
+                        val one = (link as? RefreshLink.One)?.let { l ->
+                            rows.firstOrNull { it.config.packageName == l.packageName || it.installed?.packageName == l.packageName }?.config?.shownName
+                        }
+                        LinkCheckDialog(
+                            appName = one,
+                            count = rows.size,
+                            onCheck = {
+                                confirmCheck = null
+                                lastLinkCheckAtMs = System.currentTimeMillis()
+                                check(link, CheckCause.LINK)
+                            },
+                            onDismiss = { confirmCheck = null },
+                        )
+                    }
+                    if (crash == null && verificationNote) VerificationNote(onDismiss = ::sawVerificationNote)
+                }
             }
         }
     }
@@ -136,8 +168,8 @@ class MainActivity : ComponentActivity() {
     }
 
     private fun receive(intent: Intent) {
-        val shortcut = intent.getStringExtra(Surfaces.EXTRA_SHORTCUT)
-        shortcut?.let { Surfaces.used(this, it.take(MAX_APP_ID)) }
+        val ours = intent.component?.className == SHORTCUTS
+        if (ours) intent.getStringExtra(Surfaces.EXTRA_SHORTCUT)?.let { Surfaces.used(this, it.take(MAX_APP_ID)) }
         intent.getStringExtra(Notifier.EXTRA_OPEN_APP)?.let { id ->
             openApp = id.take(MAX_APP_ID)
             return
@@ -146,36 +178,35 @@ class MainActivity : ComponentActivity() {
             problems = ids.take(MAX_PROBLEMS).map { it.take(MAX_APP_ID) }
             return
         }
-        when (intent.action) {
-            Surfaces.ACTION_ADD -> {
+        val wish = try {
+            asked(intent.action, intent.dataString, ours)
+        } catch (_: RuntimeException) {
+            null
+        }
+        when (wish) {
+            Asked.Add -> {
                 finishFirstRun()
                 incoming = Incoming("", System.nanoTime())
                 return
             }
-            Surfaces.ACTION_UPDATE_ALL -> {
+            Asked.UpdateAll -> {
                 lifecycleScope.launch { engine.installAllUpdates() }
                 return
             }
-        }
-        if (intent.action == Intent.ACTION_VIEW) {
-            val refresh = try {
-                refreshLink(intent.dataString)
-            } catch (_: RuntimeException) {
-                null
+            is Asked.Check -> {
+                check(wish.link, CheckCause.SHORTCUT)
+                return
             }
-            if (refresh != null) {
-                lifecycleScope.launch {
-                    val id = when (refresh) {
-                        RefreshLink.All -> null
-                        is RefreshLink.One -> engine.apps.value.firstOrNull {
-                            it.config.packageName == refresh.packageName || it.installed?.packageName == refresh.packageName
-                        }?.id ?: return@launch
-                    }
-                    engine.check(id, if (shortcut != null) CheckCause.SHORTCUT else CheckCause.LINK)
+            is Asked.Confirm -> {
+                if (confirmCheck == null && linkCheckAllowed(lastLinkCheckAtMs, System.currentTimeMillis()) && appFor(wish.link) != NO_APP) {
+                    confirmCheck = wish.link
                 }
                 return
             }
+            null -> Unit
         }
+        // Update all, Add or a check from anywhere but Tern's own shortcuts only opens Tern.
+        if (intent.action in SHORTCUT_ACTIONS) return
         val text = try {
             incomingAddInput(intent.action, intent.dataString, intent.getCharSequenceExtra(Intent.EXTRA_TEXT)?.toString())
         } catch (_: RuntimeException) {
@@ -185,6 +216,20 @@ class MainActivity : ComponentActivity() {
         incoming = Incoming(text, System.nanoTime())
     }
 
+    /** The id of the app [link] names, null for all of them, or [NO_APP] when it names one Tern does not follow. */
+    private fun appFor(link: RefreshLink): String? = when (link) {
+        RefreshLink.All -> null
+        is RefreshLink.One -> engine.apps.value.firstOrNull {
+            it.config.packageName == link.packageName || it.installed?.packageName == link.packageName
+        }?.id ?: NO_APP
+    }
+
+    private fun check(link: RefreshLink, cause: CheckCause) {
+        val id = appFor(link)
+        if (id == NO_APP) return
+        lifecycleScope.launch { engine.check(id, cause) }
+    }
+
     private fun finishFirstRun() {
         firstRunDone = true
         prefs().edit().putBoolean(KEY_FIRST_RUN_DONE, true).apply()
diff --git a/app/src/main/kotlin/io/github/munzzyy/tern/data/CrashReport.kt b/app/src/main/kotlin/io/github/munzzyy/tern/data/CrashReport.kt
index dd5d3a69..cbc6d02b 100644
--- a/app/src/main/kotlin/io/github/munzzyy/tern/data/CrashReport.kt
+++ b/app/src/main/kotlin/io/github/munzzyy/tern/data/CrashReport.kt
@@ -4,6 +4,7 @@ import android.app.Application
 import android.content.Context
 import android.os.Build
 import io.github.munzzyy.tern.BuildConfig
+import io.github.munzzyy.tern.log.Scrub
 import java.io.File
 import java.io.IOException
 import java.time.Instant
@@ -29,16 +30,21 @@ object CrashReport {
         }
     }
 
-    /** The report of [error]: where it happened and the stack, cut to [MAX_CHARS]. */
-    fun text(thread: String, error: Throwable, version: String, sdk: Int, atMs: Long): String = buildString {
-        appendLine("Tern $version on Android API $sdk")
-        appendLine("${Instant.ofEpochMilli(atMs)}, thread $thread")
-        append(error.stackTraceToString())
-    }.take(MAX_CHARS)
+    /** The report of [error]: where it happened and the stack, scrubbed and cut to [MAX_CHARS]. */
+    fun text(thread: String, error: Throwable, version: String, sdk: Int, atMs: Long): String = scrubbed(
+        buildString {
+            appendLine("Tern $version on Android API $sdk")
+            appendLine("${Instant.ofEpochMilli(atMs)}, thread $thread")
+            append(error.stackTraceToString())
+        }.take(MAX_CHARS),
+    )
 
-    /** The report of the last unexpected stop, until it is dismissed. */
+    /** [report] with what could open an account taken out, a line at a time so the frames stay as they were. */
+    fun scrubbed(report: String): String = report.lineSequence().joinToString("\n") { Scrub.text(it) }
+
+    /** The report of the last unexpected stop, until it is dismissed. One an older Tern wrote is scrubbed here. */
     fun pending(context: Context): String? = try {
-        File(context.filesDir, FILE).takeIf { it.isFile }?.readText()?.take(MAX_CHARS)
+        File(context.filesDir, FILE).takeIf { it.isFile }?.readText()?.take(MAX_CHARS)?.let(::scrubbed)
     } catch (_: IOException) {
         null
     }
diff --git a/app/src/main/kotlin/io/github/munzzyy/tern/data/KeptPins.kt b/app/src/main/kotlin/io/github/munzzyy/tern/data/KeptPins.kt
new file mode 100644
index 00000000..64f86409
--- /dev/null
+++ b/app/src/main/kotlin/io/github/munzzyy/tern/data/KeptPins.kt
@@ -0,0 +1,84 @@
+package io.github.munzzyy.tern.data
+
+import android.content.Context
+import android.content.SharedPreferences
+import io.github.munzzyy.tern.core.json.Json
+import io.github.munzzyy.tern.core.json.JsonException
+import io.github.munzzyy.tern.core.model.AppConfig
+import io.github.munzzyy.tern.core.model.SourceSpec
+import io.github.munzzyy.tern.core.source.SourceOptions
+import io.github.munzzyy.tern.core.source.SourceTypes
+import io.github.munzzyy.tern.core.verify.Fingerprints
+
+/**
+ * The certificates an app was held to when Tern took it out of the list because it was
+ * uninstalled elsewhere, and its repository's key. Added again from the same source, the app is
+ * held to them again, so a reinstall does not let whatever is served next become the pin.
+ * Removing an app by hand forgets them: that is how a person lets an app change its signer.
+ */
+class KeptPins(context: Context, name: String = DEFAULT_NAME, private val nowMs: () -> Long = System::currentTimeMillis) {
+    private val prefs: SharedPreferences = context.applicationContext.getSharedPreferences(name, Context.MODE_PRIVATE)
+
+    fun keep(config: AppConfig) {
+        val kept = Kept.of(config, nowMs()) ?: return
+        val key = key(config.source)
+        val others = prefs.all.filterKeys { it != key }
+        val edit = prefs.edit()
+        if (others.size >= MAX) {
+            others.entries.sortedBy { Kept.decode(it.value as? String)?.atMs ?: 0L }.take(others.size - MAX + 1).forEach { edit.remove(it.key) }
+        }
+        edit.putString(key, kept.encode()).apply()
+    }
+
+    fun forget(spec: SourceSpec) {
+        prefs.edit().remove(key(spec)).apply()
+    }
+
+    /** [config] held again to what was kept for its source, where it holds nothing of its own. */
+    fun restore(config: AppConfig): AppConfig = Kept.decode(prefs.getString(key(config.source), null))?.onto(config) ?: config
+
+    data class Kept(val signers: List<String>, val fingerprint: String?, val atMs: Long = 0L) {
+        fun encode(): String = Json.write(Json.obj("signers" to signers, "fingerprint" to fingerprint, "at" to atMs))
+
+        fun onto(config: AppConfig): AppConfig {
+            val pins = config.pinnedSigners.ifEmpty { signers }
+            val source = if (fingerprint != null && config.source.option(SourceOptions.FINGERPRINT) == null) {
+                config.source.copy(options = config.source.options + (SourceOptions.FINGERPRINT to fingerprint))
+            } else {
+                config.source
+            }
+            return config.copy(pinnedSigners = pins, source = source)
+        }
+
+        companion object {
+            fun of(config: AppConfig, atMs: Long): Kept? {
+                val fingerprint = config.source.option(SourceOptions.FINGERPRINT)?.let(Fingerprints::normalize)
+                if (config.pinnedSigners.isEmpty() && fingerprint == null) return null
+                return Kept(config.pinnedSigners, fingerprint, atMs)
+            }
+
+            fun decode(text: String?): Kept? {
+                val obj = try {
+                    Json.parseObject(text ?: return null)
+                } catch (_: JsonException) {
+                    return null
+                }
+                val signers = obj.array("signers")?.strings().orEmpty().mapNotNull(Fingerprints::normalize).distinct().take(MAX_SIGNERS)
+                val fingerprint = obj.string("fingerprint")?.let(Fingerprints::normalize)
+                return Kept(signers, fingerprint, obj.long("at") ?: 0L).takeIf { signers.isNotEmpty() || fingerprint != null }
+            }
+        }
+    }
+
+    companion object {
+        const val DEFAULT_NAME = "kept-pins"
+        private const val MAX = 200
+        private const val MAX_SIGNERS = 32
+
+        /** One app's source: its kind, its address, and in a repository of many apps its package. */
+        fun key(spec: SourceSpec): String {
+            val pkg = spec.option(SourceOptions.PACKAGE)?.takeIf { spec.type == SourceTypes.FDROID_REPO }.orEmpty()
+            return "${spec.type}|${spec.url.lowercase()}|$pkg"
+        }
+    }
+}
diff --git a/app/src/main/kotlin/io/github/munzzyy/tern/data/SettingsJson.kt b/app/src/main/kotlin/io/github/munzzyy/tern/data/SettingsJson.kt
index 9af7cebd..de00dcc3 100644
--- a/app/src/main/kotlin/io/github/munzzyy/tern/data/SettingsJson.kt
+++ b/app/src/main/kotlin/io/github/munzzyy/tern/data/SettingsJson.kt
@@ -23,6 +23,8 @@ object SettingsJson {
         Field.flag("removeUninstalled", { it.removeUninstalled }) { s, v -> s.copy(removeUninstalled = v) },
         Field.flag("onlyOnUnmetered", { it.onlyOnUnmetered }) { s, v -> s.copy(onlyOnUnmetered = v) },
         Field.flag("onlyWhileCharging", { it.onlyWhileCharging }) { s, v -> s.copy(onlyWhileCharging = v) },
+        Field.flag("checkOnlyOnUnmetered", { it.checkOnlyOnUnmetered }) { s, v -> s.copy(checkOnlyOnUnmetered = v) },
+        Field.flag("checkOnlyWhileCharging", { it.checkOnlyWhileCharging }) { s, v -> s.copy(checkOnlyWhileCharging = v) },
         Field.choice("defaultUpdateMode", { it.defaultUpdateMode }) { s, v -> s.copy(defaultUpdateMode = v) },
         Field.flag("includePrereleasesByDefault", { it.includePrereleasesByDefault }) { s, v -> s.copy(includePrereleasesByDefault = v) },
         Field.number("minAgeDaysByDefault", { it.minAgeDaysByDefault }, 0..365) { s, v -> s.copy(minAgeDaysByDefault = v) },
diff --git a/app/src/main/kotlin/io/github/munzzyy/tern/data/SettingsStore.kt b/app/src/main/kotlin/io/github/munzzyy/tern/data/SettingsStore.kt
index 893d0746..37598cf3 100644
--- a/app/src/main/kotlin/io/github/munzzyy/tern/data/SettingsStore.kt
+++ b/app/src/main/kotlin/io/github/munzzyy/tern/data/SettingsStore.kt
@@ -12,10 +12,13 @@ class SettingsStore(context: Context, name: String = DEFAULT_NAME) {
 
     fun load(): Settings {
         val d = Settings()
+        val stored = prefs.all
         return Settings(
-            checkEveryMinutes = storedMinutes(d.checkEveryMinutes),
+            checkEveryMinutes = storedMinutes(stored, d.checkEveryMinutes),
             onlyOnUnmetered = prefs.getBoolean("onlyOnUnmetered", d.onlyOnUnmetered),
             onlyWhileCharging = prefs.getBoolean("onlyWhileCharging", d.onlyWhileCharging),
+            checkOnlyOnUnmetered = checkLimit(stored, "checkOnlyOnUnmetered", "onlyOnUnmetered"),
+            checkOnlyWhileCharging = checkLimit(stored, "checkOnlyWhileCharging", "onlyWhileCharging"),
             defaultUpdateMode = enumOr(prefs.getString("defaultUpdateMode", null), d.defaultUpdateMode),
             includePrereleasesByDefault = prefs.getBoolean("includePrereleasesByDefault", d.includePrereleasesByDefault),
             minAgeDaysByDefault = prefs.getInt("minAgeDaysByDefault", d.minAgeDaysByDefault).coerceIn(0, 365),
@@ -82,15 +85,10 @@ class SettingsStore(context: Context, name: String = DEFAULT_NAME) {
             otherInstallerActivity = prefs.getString("otherInstallerActivity", null)?.takeIf { CLASS.matches(it) },
             shareToVerifier = prefs.getBoolean("shareToVerifier", d.shareToVerifier),
             keepOwnMessages = prefs.getBoolean("keepOwnMessages", d.keepOwnMessages),
+            thirdPartyStores = prefs.getBoolean("thirdPartyStores", d.thirdPartyStores),
         )
     }
 
-    /** Tern kept hours before it kept minutes; a value stored as hours is read as that many minutes. */
-    private fun storedMinutes(fallback: Int): Int = when {
-        prefs.contains("checkEveryMinutes") -> cleanMinutes(prefs.getInt("checkEveryMinutes", fallback))
-        prefs.contains("checkEveryHours") -> cleanMinutes(prefs.getInt("checkEveryHours", 0) * 60)
-        else -> fallback
-    }
 
     fun save(s: Settings) {
         prefs.edit()
@@ -98,6 +96,8 @@ class SettingsStore(context: Context, name: String = DEFAULT_NAME) {
             .remove("checkEveryHours")
             .putBoolean("onlyOnUnmetered", s.onlyOnUnmetered)
             .putBoolean("onlyWhileCharging", s.onlyWhileCharging)
+            .putBoolean("checkOnlyOnUnmetered", s.checkOnlyOnUnmetered)
+            .putBoolean("checkOnlyWhileCharging", s.checkOnlyWhileCharging)
             .putString("defaultUpdateMode", s.defaultUpdateMode.name)
             .putBoolean("includePrereleasesByDefault", s.includePrereleasesByDefault)
             .putInt("minAgeDaysByDefault", s.minAgeDaysByDefault.coerceIn(0, 365))
@@ -163,6 +163,7 @@ class SettingsStore(context: Context, name: String = DEFAULT_NAME) {
             .putString("otherInstallerActivity", s.otherInstallerActivity?.takeIf { CLASS.matches(it) })
             .putBoolean("shareToVerifier", s.shareToVerifier)
             .putBoolean("keepOwnMessages", s.keepOwnMessages)
+            .putBoolean("thirdPartyStores", s.thirdPartyStores)
             .commit()
     }
 
@@ -182,6 +183,27 @@ class SettingsStore(context: Context, name: String = DEFAULT_NAME) {
         private const val MAX_ORIGINS = 40
         private const val OPAQUE = 0xFF000000.toInt()
 
+        /** What only v0.1.0 wrote: it kept hours, and save() has taken the key out since. */
+        private const val V010_HOURS = "checkEveryHours"
+
+        /** Tern kept hours before it kept minutes; a value stored as hours is read as that many minutes. */
+        internal fun storedMinutes(stored: Map<String, *>, fallback: Int): Int = when {
+            "checkEveryMinutes" in stored -> cleanMinutes(stored["checkEveryMinutes"] as? Int ?: fallback)
+            V010_HOURS in stored -> cleanMinutes((stored[V010_HOURS] as? Int ?: 0) * 60)
+            else -> fallback
+        }
+
+        /**
+         * A limit on background checks as stored under [key]. v0.1.0 had one switch for checks and
+         * installs alike and kept it under [v010Key], so settings it wrote keep holding the checks
+         * back as they did then.
+         */
+        internal fun checkLimit(stored: Map<String, *>, key: String, v010Key: String): Boolean = when {
+            key in stored -> stored[key] == true
+            V010_HOURS in stored -> stored[v010Key] == true
+            else -> false
+        }
+
         /** 0 stays off; anything else is taken to the range Android keeps to. */
         fun cleanMinutes(minutes: Int): Int = if (minutes <= 0) 0 else minutes.coerceIn(MIN_MINUTES, MAX_MINUTES)
 
diff --git a/app/src/main/kotlin/io/github/munzzyy/tern/engine/Models.kt b/app/src/main/kotlin/io/github/munzzyy/tern/engine/Models.kt
index 6be9cbc6..808869ad 100644
--- a/app/src/main/kotlin/io/github/munzzyy/tern/engine/Models.kt
+++ b/app/src/main/kotlin/io/github/munzzyy/tern/engine/Models.kt
@@ -43,6 +43,9 @@ enum class ProblemKind {
     INSTALL_FAILED,
     STORAGE,
     UNSUPPORTED,
+
+    /** The app comes from a third-party store while those are off, so nothing of it is asked for. */
+    STORES_OFF,
 }
 
 data class Problem(
@@ -91,6 +94,8 @@ data class Verification(
     val newPermissions: List<String>,
     /** SHA-256 of the file, lowercase hex: the publisher's digest before download, the measured hash after. */
     val fileSha256: String? = null,
+    /** The checksum is one a third-party store gives, which shows the file arrived as the store has it and says nothing of the developer. */
+    val checksumFromStore: Boolean = false,
 )
 
 enum class Phase { QUEUED, DOWNLOADING, VERIFYING, INSTALLING, WAITING_FOR_USER }
@@ -197,6 +202,8 @@ sealed interface Detection {
         val builtInPin: Boolean = false,
         /** The package name the person gave. The app is stored with it, and a file of another package is refused. */
         val packageName: String? = null,
+        /** True when only pre-releases are published, so the app is added following them even where none has a file for this device. */
+        val prereleases: Boolean = false,
     ) : Detection
 
     /**
@@ -219,6 +226,9 @@ sealed interface Detection {
 
     /** [spec] is the source that was read, when Tern got as far as knowing it, so that its options can be set and it can be read again. */
     data class Failed(val problem: Problem, val spec: SourceSpec? = null) : Detection
+
+    /** The address belongs to the third-party store [type], and those are off. Nothing was asked of it. */
+    data class StoresOff(val type: String) : Detection
 }
 
 enum class ThemeMode { SYSTEM, LIGHT, DARK }
@@ -289,8 +299,14 @@ enum class ProxyMode { NONE, ORBOT, CUSTOM }
 data class Settings(
     /** Minutes between background checks; 0 turns them off. Android runs them 15 minutes apart at the least. */
     val checkEveryMinutes: Int = 360,
+    /** Updates that would install by themselves wait for Wi-Fi or a cable. */
     val onlyOnUnmetered: Boolean = false,
+    /** Updates that would install by themselves wait for the charger. */
     val onlyWhileCharging: Boolean = false,
+    /** Background checks wait for Wi-Fi or a cable, as every check did in v0.1.0 with its one switch on. */
+    val checkOnlyOnUnmetered: Boolean = false,
+    /** Background checks wait for the charger. */
+    val checkOnlyWhileCharging: Boolean = false,
     val defaultUpdateMode: UpdateMode = UpdateMode.NOTIFY,
     val includePrereleasesByDefault: Boolean = false,
     val minAgeDaysByDefault: Int = 0,
@@ -394,10 +410,16 @@ data class Settings(
     val oneDownloadAtATime: Boolean = false,
     /** The activity of [otherInstaller] the file goes to, for an installer app with several; null leaves it to the app. */
     val otherInstallerActivity: String? = null,
-    /** Before the first install of an app, its checked file goes to Verified Apps or AppVerifier, where one is installed. */
-    val shareToVerifier: Boolean = true,
+    /** Before the first install of an app, its checked file goes to Verified Apps or AppVerifier, where a genuine one is installed. Off until the person turns it on. */
+    val shareToVerifier: Boolean = false,
     /** The activity log keeps Tern's own warnings and errors too, and when each check starts and ends, with nothing secret in them. */
     val keepOwnMessages: Boolean = false,
+    /**
+     * APKPure, Aptoide, APKCombo, APKMirror, Tencent, Huawei AppGallery, the Galaxy Store and vivo
+     * are read. Off, none of their hosts is asked: an address of theirs is not added, a search
+     * leaves them out, and their apps are paused. Only the person turns it on; no file or link does.
+     */
+    val thirdPartyStores: Boolean = false,
 ) {
     companion object {
         /** The forges and F-Droid; the stores are there to be picked. */
@@ -432,6 +454,8 @@ data class ImportSummary(
     val settingsOffered: Boolean = false,
     /** What [Engine.finishImport] is given to do what the file only offered; null when it offered nothing. */
     val offer: String? = null,
+    /** Names of added apps from third-party stores, whose first install decides the certificate unless they are pinned. */
+    val fromStores: List<String> = emptyList(),
 )
 
 /** Where the colours come from. [WALLPAPER] needs Android 12 and falls back to [PALETTE] before that. */
@@ -469,8 +493,12 @@ data class Suggestion(
     val forTelevision: Boolean,
     /** Tern carries the certificate this app has to be signed with, so its first install is checked against it too. */
     val pinned: Boolean = false,
+    val here: StarterHere = StarterHere.NONE,
 )
 
+/** Whether a well known app is already followed or on this device, so the list does not offer a second copy. */
+enum class StarterHere { NONE, IN_LIST, ON_PHONE, ON_PHONE_OTHER_SIGNER }
+
 /** A file the app can read or has written without a file picker. */
 data class SavedFile(
     val name: String,
diff --git a/app/src/main/kotlin/io/github/munzzyy/tern/engine/real/Arrivals.kt b/app/src/main/kotlin/io/github/munzzyy/tern/engine/real/Arrivals.kt
index 7588eb17..87c2e9ca 100644
--- a/app/src/main/kotlin/io/github/munzzyy/tern/engine/real/Arrivals.kt
+++ b/app/src/main/kotlin/io/github/munzzyy/tern/engine/real/Arrivals.kt
@@ -7,13 +7,13 @@ import io.github.munzzyy.tern.core.source.SourceOptions
 /** What is stored of an app that arrived in a file, where nobody looks at each app before it is stored. */
 internal object Arrivals {
     /**
-     * [imported] as it is stored under [id]. It is held to the certificates Tern carries for its
-     * address. And it is never set to install by itself: a file can come from anyone, and that an
+     * [imported] as it is stored under [id]. It is held to the certificates Tern carries for it,
+     * by its address or, from a store, by its package. And it is never set to install by itself: a file can come from anyone, and that an
      * app updates without being asked is for the user of this device to switch on.
      */
     fun stored(imported: AppConfig, id: String, builtIn: BuiltInPins): AppConfig = imported.copy(
         id = id,
-        pinnedSigners = builtIn.orElse(imported.source.url, imported.pinnedSigners),
+        pinnedSigners = builtIn.orElse(imported.source, imported.packageName, imported.pinnedSigners),
         updates = if (imported.updates == UpdateMode.AUTO) UpdateMode.NOTIFY else imported.updates,
     )
 
@@ -34,7 +34,7 @@ internal object Arrivals {
             name = existing.name,
             author = existing.author,
             packageName = existing.packageName ?: imported.packageName,
-            pinnedSigners = builtIn.orElse(existing.source.url, existing.pinnedSigners.ifEmpty { imported.pinnedSigners }),
+            pinnedSigners = builtIn.orElse(existing.source, existing.packageName ?: imported.packageName, existing.pinnedSigners.ifEmpty { imported.pinnedSigners }),
             updates = if (imported.updates == UpdateMode.AUTO && existing.updates != UpdateMode.AUTO) existing.updates else imported.updates,
             releases = imported.releases.copy(skippedReleaseId = existing.releases.skippedReleaseId),
         )
diff --git a/app/src/main/kotlin/io/github/munzzyy/tern/engine/real/BuiltInPins.kt b/app/src/main/kotlin/io/github/munzzyy/tern/engine/real/BuiltInPins.kt
index 8e827bfb..2d780ca4 100644
--- a/app/src/main/kotlin/io/github/munzzyy/tern/engine/real/BuiltInPins.kt
+++ b/app/src/main/kotlin/io/github/munzzyy/tern/engine/real/BuiltInPins.kt
@@ -1,26 +1,45 @@
 package io.github.munzzyy.tern.engine.real
 
 import io.github.munzzyy.tern.core.model.AppConfig
+import io.github.munzzyy.tern.core.model.SourceSpec
+import io.github.munzzyy.tern.core.source.SourceTypes
 import io.github.munzzyy.tern.core.suggest.Catalog
 import io.github.munzzyy.tern.core.suggest.SuggestedApp
 
 /**
- * The certificates Tern itself carries, by the address of the app. They come from the starter
- * list, which ships inside Tern, so they are known before the first file is.
+ * The certificates Tern itself carries, by the address of the app, and by its package for an app
+ * that comes from somewhere else. They come from the starter list, which ships inside Tern, so they
+ * are known before the first file is.
  */
 class BuiltInPins(private val catalog: List<SuggestedApp> = Catalog.all) {
     /** The certificates carried for the app at [url]. Empty for every other address. */
     fun of(url: String): List<String> = Catalog.entryAt(url, catalog)?.signers.orEmpty()
 
+    /** Every certificate carried for an entry that ships [packageName], which may come from several channels. */
+    fun ofPackage(packageName: String?): List<String> {
+        if (packageName.isNullOrEmpty()) return emptyList()
+        return catalog.filter { it.packageName == packageName }.flatMap { it.signers }.map { it.lowercase() }.distinct()
+    }
+
     /**
-     * What an app at [url] is held to: the certificates carried for it where there are any,
-     * whatever came with a link or a file, and [otherwise] everywhere else.
+     * What an app of [spec] that ships [packageName] is held to before its first install: the
+     * certificates carried for its address, else, from a store, a mirror or a web page, those
+     * carried for its package. A forge is left to its address, where a fork may keep the
+     * package, and so is an F-Droid repository, whose signed index names the signer.
      */
-    fun orElse(url: String, otherwise: List<String>): List<String> = of(url).ifEmpty { otherwise }
+    fun forApp(spec: SourceSpec, packageName: String?): List<String> =
+        of(spec.url).ifEmpty { if (spec.type in BY_PACKAGE) ofPackage(packageName) else emptyList() }
+
+    /** [forApp] where it names any certificate, whatever came with a link or a file, and [otherwise] everywhere else. */
+    fun orElse(spec: SourceSpec, packageName: String?, otherwise: List<String>): List<String> = forApp(spec, packageName).ifEmpty { otherwise }
 
-    /** True when [config] is held to certificates that are all among those carried for its address. */
+    /** True when [config] is held to certificates that are all among those carried for it. */
     fun hold(config: AppConfig): Boolean {
-        val carried = of(config.source.url)
+        val carried = forApp(config.source, config.packageName)
         return carried.isNotEmpty() && config.pinnedSigners.isNotEmpty() && config.pinnedSigners.all { pin -> carried.any { it.equals(pin, ignoreCase = true) } }
     }
+
+    private companion object {
+        val BY_PACKAGE: Set<String> = SourceTypes.THIRD_PARTY_STORES + setOf(SourceTypes.HTML, SourceTypes.DIRECT)
+    }
 }
diff --git a/app/src/main/kotlin/io/github/munzzyy/tern/engine/real/Checks.kt b/app/src/main/kotlin/io/github/munzzyy/tern/engine/real/Checks.kt
index 208cdd9e..fd3e229f 100644
--- a/app/src/main/kotlin/io/github/munzzyy/tern/engine/real/Checks.kt
+++ b/app/src/main/kotlin/io/github/munzzyy/tern/engine/real/Checks.kt
@@ -74,6 +74,10 @@ internal class Checks(private val e: RealEngine) {
 
     suspend fun checkOne(id: String): CheckOutcome? {
         val stored = e.stored[id] ?: return null
+        if (e.registry.paused(stored.config.source)) {
+            reevaluate(id, network = false)
+            return CheckOutcome(id, newRelease = false, failed = false)
+        }
         e.checking += id
         e.publish()
         try {
@@ -125,7 +129,7 @@ internal class Checks(private val e: RealEngine) {
                 config = config.copy(source = config.source.copy(options = config.source.options + listing.learnedOptions))
             }
             val listed = listing.packageName
-            if (config.packageName == null && listed != null && BinaryManifest.isValidName(listed)) config = config.copy(packageName = listed)
+            if (config.packageName == null && listed != null && BinaryManifest.isValidName(listed)) config = withPackage(config, listed)
             // While every release listed now is too young, the last ones that were old enough stay on offer.
             val kept = ReleaseSelector.keptUntilOldEnough(listing.releases, s.state.releases, e.evaluator.minAgeDays(config), now)
             val releases = kept.take(StateJson.MAX_RELEASES).map { it.copy(notes = it.notes?.take(StateJson.MAX_NOTES)) }
@@ -144,6 +148,10 @@ internal class Checks(private val e: RealEngine) {
         }
     }
 
+    /** [config] once its package is known, held to the certificates Tern carries for that package where it had no pin yet. */
+    private fun withPackage(config: AppConfig, packageName: String): AppConfig =
+        config.copy(packageName = packageName, pinnedSigners = config.pinnedSigners.ifEmpty { e.builtIn.forApp(config.source, packageName) })
+
     private val evaluating = ConcurrentHashMap<String, Any>()
 
     /**
@@ -156,7 +164,7 @@ internal class Checks(private val e: RealEngine) {
      * the main thread, so that reading happens before the turn and only fills the cache.
      */
     fun reevaluate(id: String, network: Boolean) {
-        if (network) readFilesFor(id)
+        if (network && e.stored[id]?.let { e.registry.paused(it.config.source) } == false) readFilesFor(id)
         synchronized(evaluating.getOrPut(id) { Any() }) { evaluate(id) }
     }
 
@@ -169,13 +177,17 @@ internal class Checks(private val e: RealEngine) {
 
     private fun evaluate(id: String) {
         val stored = e.stored[id] ?: return
+        if (e.registry.paused(stored.config.source)) {
+            e.evaluations[id] = paused(e.texts.storesOffPaused())
+            return
+        }
         val inspect: (Asset, String) -> FileFacts? = e.inspector::cached
         var config = stored.config
         var installed = e.readInstalled(config.packageName)
         var eval = e.evaluator.evaluate(config, stored.state, installed, inspect)
         val learned = eval.facts?.packageName
         if (config.packageName == null && learned != null) {
-            config = e.saveApp(id) { it.copy(config = it.config.copy(packageName = learned)) }?.config ?: config
+            config = e.saveApp(id) { it.copy(config = withPackage(it.config, learned)) }?.config ?: config
             installed = e.readInstalled(learned)
             eval = e.evaluator.evaluate(config, stored.state, installed, inspect)
         }
@@ -217,12 +229,15 @@ internal class Checks(private val e: RealEngine) {
         }
     }
 
-    private companion object {
-        const val MAX_PARALLEL = 4
-        const val PER_HOST = 2
-        const val MAX_ADDRESS = 2048
-        const val MAX_DETAIL = 200
-        const val MAX_VERSION = 100
-        const val TAG = "TernChecks"
+    companion object {
+        /** An app of a third-party store while those are off: kept as it is, and neither checked nor installed. */
+        fun paused(message: String) = Evaluation(AppStatus.ERROR, problem = Problem(ProblemKind.STORES_OFF, message))
+
+        private const val MAX_PARALLEL = 4
+        private const val PER_HOST = 2
+        private const val MAX_ADDRESS = 2048
+        private const val MAX_DETAIL = 200
+        private const val MAX_VERSION = 100
+        private const val TAG = "TernChecks"
     }
 }
diff --git a/app/src/main/kotlin/io/github/munzzyy/tern/engine/real/Detector.kt b/app/src/main/kotlin/io/github/munzzyy/tern/engine/real/Detector.kt
index 0a78dd19..e633e36e 100644
--- a/app/src/main/kotlin/io/github/munzzyy/tern/engine/real/Detector.kt
+++ b/app/src/main/kotlin/io/github/munzzyy/tern/engine/real/Detector.kt
@@ -15,7 +15,9 @@ import io.github.munzzyy.tern.core.source.CheckContext
 import io.github.munzzyy.tern.core.source.CheckResult
 import io.github.munzzyy.tern.core.source.SourceException
 import io.github.munzzyy.tern.core.source.SourceListing
+import io.github.munzzyy.tern.core.source.Refusal
 import io.github.munzzyy.tern.core.source.SourceOptions
+import io.github.munzzyy.tern.core.source.SourceRegistry
 import io.github.munzzyy.tern.core.source.SourceTypes
 import io.github.munzzyy.tern.core.source.fdroid.FDroidRepoSource
 import io.github.munzzyy.tern.core.text.Shown
@@ -34,7 +36,7 @@ import kotlinx.coroutines.withContext
 
 /** Turns what the user typed, pasted or shared into a source to add, or into search results. */
 internal class Detector(private val e: RealEngine) {
-    private val search = Search(e.http, e.tokens, e.registry.searchable) { e.sourceContext() }
+    private val search = Search(e.http, e.tokens, { e.registry.searchable }) { e.sourceContext() }
 
     /** Every place a search can look. */
     val searchOrigins: List<String> get() = search.origins
@@ -79,13 +81,14 @@ internal class Detector(private val e: RealEngine) {
 
     private suspend fun resolve(target: Target, reading: Reading): Detection {
         val normalized = Urls.normalize(target.url) ?: return Detection.Failed(Problem(ProblemKind.NOT_FOUND, e.texts.notASource()))
+        closed(target)?.let { return it }
         val context = e.checkContext(target.config)
         val forced = reading.type?.takeIf { it in SourceTypes.OVERRIDABLE && it != target.spec?.type }
         val known = if (forced != null) {
             runInterruptible { e.registry.readAs(target.url, forced, context) }
                 ?: return Detection.Failed(Problem(ProblemKind.UNSUPPORTED, e.texts.notReadableAs(SourceTypes.displayName(forced) ?: forced)))
         } else {
-            target.spec ?: e.registry.match(normalized)
+            target.spec ?: e.registry.match(target.url)
         }
         val chosen = known?.let { spec -> reading.options?.let { spec.copy(options = it) } ?: spec }
         if (chosen != null && chosen.type == SourceTypes.FDROID_REPO && chosen.option(SourceOptions.PACKAGE) == null) {
@@ -110,6 +113,17 @@ internal class Detector(private val e: RealEngine) {
         return found(learnedSpec, listing, carried, reading.packageName?.takeIf { BinaryManifest.isValidName(it) })
     }
 
+    /** What is said instead of reading [target] at all: a site Tern refuses, or a store while those are off. Nothing is asked of the network. */
+    private fun closed(target: Target): Detection? {
+        val spec = target.spec
+        spec?.type?.let(Refusal::ofType)?.let { return Detection.Failed(Problem(ProblemKind.UNSUPPORTED, e.texts.refused(it))) }
+        return when (val closed = e.registry.closed(target.url)) {
+            is SourceRegistry.Closed.Refused -> Detection.Failed(Problem(ProblemKind.UNSUPPORTED, e.texts.refused(closed.refusal)))
+            is SourceRegistry.Closed.StoresOff -> Detection.StoresOff(closed.type)
+            null -> if (spec != null && e.registry.paused(spec)) Detection.StoresOff(spec.type) else null
+        }
+    }
+
     /** A repository address with no app of its own: what it carries, or what of it has [words], as picks for the Add screen. */
     private fun repoResults(spec: SourceSpec, context: CheckContext, words: String?): Detection {
         val source = e.registry.get(SourceTypes.FDROID_REPO) as? FDroidRepoSource ?: return Detection.Failed(Problem(ProblemKind.UNSUPPORTED, e.texts.notASource()))
@@ -137,7 +151,7 @@ internal class Detector(private val e: RealEngine) {
     private fun found(spec: SourceSpec, listing: SourceListing, carried: AppConfig?, given: String?): Detection.Found {
         val settings = e.settings.value
         val listed = listing.packageName?.takeIf { BinaryManifest.isValidName(it) }
-        val builtIn = e.builtIn.of(spec.url)
+        var builtIn = e.builtIn.forApp(spec, given ?: carried?.packageName ?: listed)
         var config = carried?.copy(id = "detect", source = spec, packageName = given ?: carried.packageName ?: listed) ?: AppConfig(
             id = "detect",
             source = spec,
@@ -152,7 +166,8 @@ internal class Detector(private val e: RealEngine) {
         val warnings = ArrayList<String>()
 
         var eval = e.evaluator.evaluate(config, state, e.readInstalled(config.packageName), e.inspectorFor(config.source))
-        if (carried == null && eval.latest == null && eval.problem?.message == e.texts.onlyPrereleases()) {
+        val onlyPrereleases = carried == null && eval.latest == null && eval.problem?.message == e.texts.onlyPrereleases()
+        if (onlyPrereleases) {
             config = config.copy(releases = config.releases.copy(includePrereleases = true))
             eval = e.evaluator.evaluate(config, state, e.readInstalled(config.packageName), e.inspectorFor(config.source))
             warnings += e.texts.warnPrerelease()
@@ -160,6 +175,9 @@ internal class Detector(private val e: RealEngine) {
         val learned = eval.facts?.packageName
         if (config.packageName == null && learned != null) {
             config = config.copy(packageName = learned)
+            // A store that names no package is held to the developer's certificate once its file does.
+            if (builtIn.isEmpty()) builtIn = e.builtIn.forApp(spec, learned)
+            if (builtIn.isNotEmpty()) config = config.copy(pinnedSigners = builtIn)
             eval = e.evaluator.evaluate(config, state, e.readInstalled(learned), e.inspectorFor(config.source))
         }
         val installed = e.readInstalled(config.packageName)
@@ -193,6 +211,7 @@ internal class Detector(private val e: RealEngine) {
             iconUrls = IconAddresses.accepted(spec.url, listing.iconUrls),
             builtInPin = builtIn.isNotEmpty(),
             packageName = given,
+            prereleases = onlyPrereleases,
         )
     }
 
diff --git a/app/src/main/kotlin/io/github/munzzyy/tern/engine/real/Device.kt b/app/src/main/kotlin/io/github/munzzyy/tern/engine/real/Device.kt
index 0ba2d325..e11b8dee 100644
--- a/app/src/main/kotlin/io/github/munzzyy/tern/engine/real/Device.kt
+++ b/app/src/main/kotlin/io/github/munzzyy/tern/engine/real/Device.kt
@@ -68,6 +68,16 @@ class Device(context: Context) {
         )
     }
 
+    /** Whether [packageName] is archived: Android 15 took its code out and kept its data and its icon. */
+    fun archived(packageName: String): Boolean {
+        if (Build.VERSION.SDK_INT < Build.VERSION_CODES.VANILLA_ICE_CREAM) return false
+        return try {
+            pm.getPackageInfo(packageName, PackageManager.PackageInfoFlags.of(PackageManager.MATCH_ARCHIVED_PACKAGES)).applicationInfo?.isArchived == true
+        } catch (_: PackageManager.NameNotFoundException) {
+            false
+        }
+    }
+
     private fun installSource(packageName: String): Pair<String?, String?> = try {
         if (Build.VERSION.SDK_INT >= 30) {
             val source = pm.getInstallSourceInfo(packageName)
diff --git a/app/src/main/kotlin/io/github/munzzyy/tern/engine/real/Evaluator.kt b/app/src/main/kotlin/io/github/munzzyy/tern/engine/real/Evaluator.kt
index fb35b006..909f9556 100644
--- a/app/src/main/kotlin/io/github/munzzyy/tern/engine/real/Evaluator.kt
+++ b/app/src/main/kotlin/io/github/munzzyy/tern/engine/real/Evaluator.kt
@@ -10,12 +10,16 @@ import io.github.munzzyy.tern.core.model.Asset
 import io.github.munzzyy.tern.core.model.AssetKind
 import io.github.munzzyy.tern.core.model.DeviceProfile
 import io.github.munzzyy.tern.core.model.Release
+import io.github.munzzyy.tern.core.model.SourceSpec
+import io.github.munzzyy.tern.core.net.GitHubProxy
 import io.github.munzzyy.tern.core.select.AssetPicker
 import io.github.munzzyy.tern.core.select.AssetPolicyException
 import io.github.munzzyy.tern.core.select.FileOrigin
 import io.github.munzzyy.tern.core.select.Pick
 import io.github.munzzyy.tern.core.select.PreferredFile
+import io.github.munzzyy.tern.core.source.SourceOptions
 import io.github.munzzyy.tern.core.source.SourceTypes
+import io.github.munzzyy.tern.core.source.forge.GitHubSource
 import io.github.munzzyy.tern.core.text.PatternException
 import io.github.munzzyy.tern.core.verify.Checksums
 import io.github.munzzyy.tern.core.verify.Fingerprints
@@ -52,6 +56,8 @@ class Evaluator(
     private val globalFilter: () -> String? = { null },
     /** The wait of the settings, for apps that have none of their own. */
     private val globalMinAgeDays: () -> Int = { 0 },
+    /** The hubproxy GitHub is read through, or null. */
+    private val githubProxy: () -> String? = { null },
 ) {
     constructor(texts: Texts, device: DeviceProfile, nowMs: () -> Long) : this(texts, device, BuiltInPins(), nowMs)
 
@@ -63,7 +69,9 @@ class Evaluator(
     fun effective(given: AppConfig): AppConfig {
         var releases = given.releases
         if (releases.minAgeDays == null) releases = releases.copy(minAgeDays = globalMinAgeDays())
-        if (given.source.type in SourceTypes.READS_OWN_VERSIONS) releases = releases.copy(versionExtract = null, matchGroup = null)
+        if (given.source.type in SourceTypes.READS_OWN_VERSIONS && !given.source.flag(SourceOptions.HIGHEST_VERSION)) {
+            releases = releases.copy(versionExtract = null, matchGroup = null)
+        }
         val assets = given.assets
         val global = globalFilter()
         val files = if (assets.include != null || assets.exclude != null || global == null) assets else assets.copy(include = global)
@@ -205,12 +213,13 @@ class Evaluator(
             checksumSource = source,
             newPermissions = newPermissions,
             fileSha256 = facts?.fileSha256 ?: asset.sha256?.let(Fingerprints::normalize),
+            checksumFromStore = fromStore(config.source.type, checksum),
         )
     }
 
     /** Where the checksum will come from, judged without fetching anything. */
     fun expectedSourceLocally(config: AppConfig, release: Release, asset: Asset): String? {
-        if (asset.sha256 != null) return digestLabel(config.source.type)
+        if (asset.sha256 != null) return digestLabel(config.source)
         val siblings = setOf("${asset.name}.sha256", "${asset.name}.sha256sum")
         release.assets.firstOrNull { it.kind == AssetKind.CHECKSUM && it.name in siblings }?.let { return texts.checksumFile(it.name) }
         release.assets.firstOrNull { it.kind == AssetKind.CHECKSUM && it.name.lowercase() in SHARED_SUMS }?.let { return texts.checksumFile(it.name) }
@@ -218,10 +227,15 @@ class Evaluator(
         return if (Checksums.parse(notes).keys.any { it == asset.name || it.substringAfterLast('/') == asset.name }) texts.checksumNotes() else null
     }
 
-    fun digestLabel(type: String): String = when (type) {
-        SourceTypes.GITHUB, SourceTypes.GITHUB_ACTIONS -> texts.checksumGitHub()
-        SourceTypes.FDROID, SourceTypes.FDROID_REPO -> texts.checksumIndex()
-        else -> texts.checksumSource()
+    /** Who gave the digest of a file from [spec]: a hubproxy is named, since it could have changed it. */
+    fun digestLabel(spec: SourceSpec): String {
+        digestProxy(spec, githubProxy())?.let { return texts.checksumGitHubProxy(it) }
+        return when (spec.type) {
+            SourceTypes.GITHUB, SourceTypes.GITHUB_ACTIONS -> texts.checksumGitHub()
+            SourceTypes.FDROID, SourceTypes.FDROID_REPO -> texts.checksumIndex()
+            in SourceTypes.THIRD_PARTY_STORES -> texts.checksumStore(SourceTypes.displayName(spec.type) ?: spec.type)
+            else -> texts.checksumSource()
+        }
     }
 
     private fun noCandidate(reasons: List<Rejection>, state: AppState): Problem = when {
@@ -246,10 +260,17 @@ class Evaluator(
     }
 
     companion object {
+        /** The hubproxy that stood between [spec] and GitHub when [proxy] is set, or null when the source answered itself. */
+        internal fun digestProxy(spec: SourceSpec, proxy: String?): String? =
+            proxy?.takeIf { spec.type in setOf(SourceTypes.GITHUB, SourceTypes.GITHUB_ACTIONS) && GitHubProxy.through(GitHubSource.apiBase(spec.url), it) != null }
+
         const val MAX_CANDIDATES = 4
         private val SIGNER_BLOCKS = setOf(Block.SIGNER_MISMATCH, Block.PIN_MISMATCH)
         private val SHARED_SUMS = setOf("sha256sums", "sha256sums.txt", "checksums.txt", "checksums-sha256.txt")
 
+        /** A checksum of an app of a third-party store is the store's own, which is said as such. */
+        fun fromStore(type: String, checksum: ChecksumState): Boolean = checksum != ChecksumState.NOT_PUBLISHED && type in SourceTypes.THIRD_PARTY_STORES
+
         fun filtersKey(config: AppConfig): String = listOf(
             config.releases.tagFilter, config.releases.titleFilter, config.releases.notesFilter,
             config.releases.versionExtract, config.assets.include, config.assets.exclude,
diff --git a/app/src/main/kotlin/io/github/munzzyy/tern/engine/real/Installers.kt b/app/src/main/kotlin/io/github/munzzyy/tern/engine/real/Installers.kt
index 5c84fefe..3101e883 100644
--- a/app/src/main/kotlin/io/github/munzzyy/tern/engine/real/Installers.kt
+++ b/app/src/main/kotlin/io/github/munzzyy/tern/engine/real/Installers.kt
@@ -14,12 +14,14 @@ import io.github.munzzyy.tern.install.SessionInstaller
 import io.github.munzzyy.tern.install.ShellInstaller
 import io.github.munzzyy.tern.install.ShizukuShell
 import io.github.munzzyy.tern.install.ShizukuState
+import io.github.munzzyy.tern.log.TernLog
 import kotlinx.coroutines.Dispatchers
 import kotlinx.coroutines.flow.MutableStateFlow
 import kotlinx.coroutines.flow.StateFlow
 import kotlinx.coroutines.flow.asStateFlow
 import kotlinx.coroutines.launch
 import rikka.shizuku.Shizuku
+import rikka.sui.Sui
 
 /**
  * Which installer an install goes to. The one the person chose, while it can be used; Android's own
@@ -84,12 +86,15 @@ internal class Installers(private val e: RealEngine) {
         e.publish()
     }
 
+    /** The installer the person chose, when the next install goes to Android's in its place. */
+    fun fellBack(): InstallerMode? = fellBackFrom(e.settings.value.installer, readinessNow())
+
     /** The installer the next install goes to. Never blocks: root counts as granted only once su said so. */
     fun effective(): InstallerMode = effectiveInstaller(e.settings.value.installer, readinessNow())
 
     private fun readinessNow(): InstallerReadiness = when (e.settings.value.installer) {
         InstallerMode.SYSTEM -> InstallerReadiness.READY
-        InstallerMode.SHIZUKU -> when (ShizukuShell.state()) {
+        InstallerMode.SHIZUKU -> when (suiThenShizuku()) {
             ShizukuState.READY -> InstallerReadiness.READY
             ShizukuState.NOT_RUNNING -> InstallerReadiness.SHIZUKU_NOT_RUNNING
             ShizukuState.TOO_OLD -> InstallerReadiness.SHIZUKU_TOO_OLD
@@ -100,6 +105,26 @@ internal class Installers(private val e: RealEngine) {
         InstallerMode.OTHER_APP -> if (otherApp() != null) InstallerReadiness.READY else InstallerReadiness.NO_OTHER_APP
     }
 
+    @Volatile
+    private var suiAsked = false
+
+    /**
+     * Shizuku's state, once Sui has been asked for its binder. That asking goes through a hidden
+     * part of Android, so it waits until the person chose Shizuku; ShizukuProvider does not do
+     * it at start (App.attachBaseContext).
+     */
+    private fun suiThenShizuku(): ShizukuState {
+        if (!suiAsked) {
+            suiAsked = true
+            try {
+                Sui.init(e.context.packageName)
+            } catch (ex: RuntimeException) {
+                TernLog.w(TAG, "Sui could not be asked: ${ex.javaClass.simpleName}")
+            }
+        }
+        return ShizukuShell.state()
+    }
+
     fun mayInstall(): Boolean = if (effective() == InstallerMode.SYSTEM) e.device.mayInstall() else true
 
     fun mayInstallUnattended(): Boolean = when (effective()) {
@@ -150,6 +175,7 @@ internal class Installers(private val e: RealEngine) {
     private companion object {
         const val PLAY = "com.android.vending"
         const val SHIZUKU_REQUEST = 7301
+        const val TAG = "TernInstallers"
     }
 }
 
@@ -159,3 +185,7 @@ internal class Installers(private val e: RealEngine) {
  */
 internal fun effectiveInstaller(chosen: InstallerMode, readiness: InstallerReadiness): InstallerMode =
     if (chosen == InstallerMode.SYSTEM || chosen == InstallerMode.DHIZUKU || readiness == InstallerReadiness.READY) chosen else InstallerMode.SYSTEM
+
+/** [chosen] when an install goes to another installer in its place, which the log then says; null when it goes to [chosen]. */
+internal fun fellBackFrom(chosen: InstallerMode, readiness: InstallerReadiness): InstallerMode? =
+    chosen.takeIf { effectiveInstaller(chosen, readiness) != chosen }
diff --git a/app/src/main/kotlin/io/github/munzzyy/tern/engine/real/Installs.kt b/app/src/main/kotlin/io/github/munzzyy/tern/engine/real/Installs.kt
index 6d2ed9f9..1600fed8 100644
--- a/app/src/main/kotlin/io/github/munzzyy/tern/engine/real/Installs.kt
+++ b/app/src/main/kotlin/io/github/munzzyy/tern/engine/real/Installs.kt
@@ -77,7 +77,7 @@ internal class Installs(private val e: RealEngine) {
         val self = e.stored[appId]?.config?.let(e::isSelf) == true
         val job = e.scope.launch {
             if (self) untilOthersDone(appId)
-            run(appId, releaseId, assetUrl)
+            run(appId, releaseId, assetUrl, picked = userStarted && releaseId != null)
         }
         jobs[appId] = job
         job.invokeOnCompletion {
@@ -145,22 +145,25 @@ internal class Installs(private val e: RealEngine) {
         return false
     }
 
-    /** Returns the session handed to the installer, or null when the pipeline stopped before that. */
-    suspend fun run(appId: String, releaseId: String?, assetUrl: String?): Int? = withContext(Dispatchers.IO) {
+    /**
+     * Returns the session handed to the installer, or null when the pipeline stopped before that.
+     * [picked] is a release the person chose by hand, the only install that may go to an older version.
+     */
+    suspend fun run(appId: String, releaseId: String?, assetUrl: String?, picked: Boolean = false): Int? = withContext(Dispatchers.IO) {
         e.ready()
         if (!busy.add(appId)) return@withContext null
         val staging = File(e.staging, e.downloader.folder(appId).name)
         try {
             // A source whose file addresses do not last is asked again first, unless a particular file was picked.
             if (releaseId == null && assetUrl == null && e.stored[appId]?.config?.refreshFirst == true) e.checks.run(listOf(appId), CheckCause.INSTALL)
-            pipeline(appId, releaseId, assetUrl, staging)
+            pipeline(appId, releaseId, assetUrl, staging, picked)
         } finally {
             staging.deleteRecursively()
             busy.remove(appId)
         }
     }
 
-    private suspend fun pipeline(appId: String, releaseId: String?, assetUrl: String?, staging: File): Int? {
+    private suspend fun pipeline(appId: String, releaseId: String?, assetUrl: String?, staging: File, picked: Boolean): Int? {
         val stored = e.stored[appId] ?: return null
         val waiting = stored.state.pending
         if (waiting != null && waiting.sessionId in e.installer.liveSessionIds()) {
@@ -219,7 +222,8 @@ internal class Installs(private val e: RealEngine) {
                 device = e.device.profile,
                 staging = staging,
                 builtInPin = e.builtIn.hold(config),
-                allowDowngrade = e.settings.value.allowDowngrades && e.canDowngrade(),
+                allowDowngrade = allowsDowngrade(picked, e.settings.value.allowDowngrades, e::canDowngrade),
+                claimedVersionCode = chosenRelease.versionCode,
                 installsInside = { name -> AssetPicker.installsInside(config.assets, name) },
                 parts = files.drop(1).zip(downloads.drop(1)) { file, got -> FetchedPart(file.name, got.file) },
                 unpacksObb = e.installer.placesObb,
@@ -227,7 +231,10 @@ internal class Installs(private val e: RealEngine) {
             val pass = runInterruptible { e.gate.check(request) }
             val facts = pass.facts.copy(checksumMatchedFrom = expected?.second, fileSha256 = download.sha256)
             e.inspector.remember(chosenAsset, chosenRelease.id, facts)
-            e.event(appId, EventKind.VERIFIED, e.texts.eventVerified(facts.packageName, facts.versionCode, facts.signers.firstOrNull()?.take(16) ?: "?"))
+            val verified = e.texts.eventVerified(facts.packageName, facts.versionCode, facts.signers.firstOrNull()?.take(16) ?: "?")
+            // Installing through another installer than the one chosen is never silent.
+            val fellBack = e.installers.fellBack()?.let { " " + e.texts.installerFellBack(it) }.orEmpty()
+            e.event(appId, EventKind.VERIFIED, verified + fellBack)
             val update = e.readInstalled(facts.packageName) != null
             updating[appId] = update
             if (!update) handToVerifier(appId, pass.apks.first(), facts.packageName)
@@ -281,7 +288,8 @@ internal class Installs(private val e: RealEngine) {
      */
     private suspend fun handToVerifier(appId: String, apk: File, packageName: String) {
         val send = { pkg: String -> Intent(Intent.ACTION_SEND).setPackage(pkg).setType(APK_MIME) }
-        val verifier = VerifiedApps.first { send(it).resolveActivity(e.context.packageManager) != null }
+        val pm = e.context.packageManager
+        val verifier = VerifiedApps.first({ VerifiedApps.signers(pm, it) }) { send(it).resolveActivity(pm) != null }
         if (!VerifiedApps.handsOver(e.settings.value.shareToVerifier, firstInstall = true, there = appId in e.userTransfers && inForeground(), verifier = verifier)) return
         val copy = runInterruptible {
             val folder = File(e.context.cacheDir, "${OtherAppInstaller.FOLDER}/$VERIFY_FOLDER").apply {
@@ -348,7 +356,7 @@ internal class Installs(private val e: RealEngine) {
     }
 
     private fun expectedChecksum(config: AppConfig, release: Release, asset: Asset): Pair<String, String>? {
-        asset.sha256?.let { sha -> return normalized(sha) to e.evaluator.digestLabel(config.source.type) }
+        asset.sha256?.let { sha -> return normalized(sha) to e.evaluator.digestLabel(config.source) }
         var fetched: Asset? = null
         val sha = try {
             Checksums.expectedFor(release, asset) { sums ->
@@ -573,15 +581,26 @@ internal class Installs(private val e: RealEngine) {
      * Checks [only] or every app the background looks at, and installs what may install by itself.
      * With [installsNow] false such updates wait, and the run says so. [cause] is what the log says started it.
      */
-    suspend fun runScheduled(settings: Settings, installsNow: Boolean = true, only: Set<String>? = null, cause: CheckCause = CheckCause.SCHEDULE): ScheduledRun {
+    /** [check] false installs from what the last check found, as the waiting job does. */
+    suspend fun runScheduled(
+        settings: Settings,
+        installsNow: Boolean = true,
+        only: Set<String>? = null,
+        cause: CheckCause = CheckCause.SCHEDULE,
+        check: Boolean = true,
+    ): ScheduledRun {
         val targets = e.stored.values
             .filter { checkedInTheBackground(it.config) && e.inWholeListCheck(it.config) && (only == null || it.config.id in only) }
             .map { it.config.id }
-        if (settings.notifyChecking && targets.isNotEmpty()) e.notifier.checking(targets.size)
-        val checked = try {
-            e.checks.run(targets, cause)
-        } finally {
-            e.notifier.doneChecking()
+        val checked: List<CheckOutcome> = if (!check) {
+            emptyList()
+        } else {
+            if (settings.notifyChecking && targets.isNotEmpty()) e.notifier.checking(targets.size)
+            try {
+                e.checks.run(targets, cause)
+            } finally {
+                e.notifier.doneChecking()
+            }
         }
         val installed = ArrayList<Installed>()
         val failed = ArrayList<String>()
@@ -633,6 +652,13 @@ internal class Installs(private val e: RealEngine) {
             mayInstall && config.updates == UpdateMode.AUTO && !config.trackOnly && !busy && evaluation != null &&
                 evaluation.status == AppStatus.UPDATE_AVAILABLE && evaluation.certain && evaluation.problem == null
 
+        /**
+         * Whether an install may put an older version over a newer one: only a release the person
+         * [picked] by hand, with the setting on and something there that lets Android do it.
+         * Background installs, Update all and Install latest never go back.
+         */
+        fun allowsDowngrade(picked: Boolean, setting: Boolean, canDowngrade: () -> Boolean): Boolean = picked && setting && canDowngrade()
+
         /** Which apps the background check looks at: all but those the user set to be left alone. */
         fun checkedInTheBackground(config: AppConfig): Boolean = config.updates != UpdateMode.MANUAL
 
diff --git a/app/src/main/kotlin/io/github/munzzyy/tern/engine/real/Interop.kt b/app/src/main/kotlin/io/github/munzzyy/tern/engine/real/Interop.kt
index ef1f20dc..1359a467 100644
--- a/app/src/main/kotlin/io/github/munzzyy/tern/engine/real/Interop.kt
+++ b/app/src/main/kotlin/io/github/munzzyy/tern/engine/real/Interop.kt
@@ -6,6 +6,7 @@ import androidx.core.content.FileProvider
 import io.github.munzzyy.tern.core.interop.ObtainiumExport
 import io.github.munzzyy.tern.core.interop.ObtainiumImport
 import io.github.munzzyy.tern.core.interop.ObtainiumImportException
+import io.github.munzzyy.tern.core.interop.Skipped
 import io.github.munzzyy.tern.core.interop.TernExport
 import io.github.munzzyy.tern.core.interop.TernExportException
 import io.github.munzzyy.tern.core.json.Json
@@ -17,7 +18,9 @@ import io.github.munzzyy.tern.core.model.Release
 import io.github.munzzyy.tern.core.model.UpdateMode
 import io.github.munzzyy.tern.core.net.RemoteSize
 import io.github.munzzyy.tern.core.net.Urls
+import io.github.munzzyy.tern.core.source.Refusal
 import io.github.munzzyy.tern.core.source.SourceException
+import io.github.munzzyy.tern.core.source.SourceTypes
 import io.github.munzzyy.tern.data.AppState
 import io.github.munzzyy.tern.data.SettingsJson
 import io.github.munzzyy.tern.data.StoredApp
@@ -63,6 +66,7 @@ interface ImportTexts {
     fun linkNotAnExport(): String
     fun serverStatus(code: Int): String
     fun checkRateLimited(untilMs: Long?): String
+    fun importRefused(refusal: Refusal): String
 }
 
 internal class Decoded(val apps: List<AppConfig>, val skipped: List<Pair<String, String>>, val settings: JsonObject? = null)
@@ -110,19 +114,21 @@ internal object ImportDecoder {
         val text = String(bytes, Charsets.UTF_8).trimStart { it.code == BYTE_ORDER_MARK }
         return try {
             val file = TernExport.readFile(text)
-            Decoded(file.apps, emptyList(), file.settings)
+            Decoded(file.apps, file.skipped.map { it.name to reason(it, texts) }, file.settings)
         } catch (tern: TernExportException) {
             // Obtainium's reader finds no app in an export of Tern's and would report an import of nothing.
             if (saysItIsTerns(text)) throw ProblemException(Problem(ProblemKind.PARSE, texts.importUnreadableExport(tern.message)))
             try {
                 val result = ObtainiumImport.read(text)
-                Decoded(result.apps, result.skipped.map { it.name to it.reason }, result.settings)
+                Decoded(result.apps, result.skipped.map { it.name to reason(it, texts) }, result.settings)
             } catch (_: ObtainiumImportException) {
                 throw ProblemException(Problem(ProblemKind.PARSE, notAnExport))
             }
         }
     }
 
+    private fun reason(skipped: Skipped, texts: ImportTexts): String = skipped.refusal?.let(texts::importRefused) ?: skipped.reason
+
     private fun saysItIsTerns(text: String): Boolean = try {
         Json.parseObject(text).string("format") == TERN_FORMAT
     } catch (_: JsonException) {
@@ -344,6 +350,7 @@ internal class Interop(private val e: RealEngine) {
         val withPins = ArrayList<String>()
         val withFilters = ArrayList<String>()
         val askedForMore = ArrayList<String>()
+        val fromStores = ArrayList<String>()
         val others = LinkedHashMap<String, AppConfig>()
         for (imported in decoded.apps.take(MAX_APPS)) {
             val existing = e.findBySpec(imported.source)
@@ -353,7 +360,7 @@ internal class Interop(private val e: RealEngine) {
                 continue
             }
             val config = try {
-                e.validated(Arrivals.stored(imported, if (e.stored.containsKey(imported.id)) e.newId() else imported.id, e.builtIn))
+                e.validated(e.keptPins.restore(Arrivals.stored(imported, if (e.stored.containsKey(imported.id)) e.newId() else imported.id, e.builtIn)))
             } catch (ex: IllegalArgumentException) {
                 skipped += imported.name to (ex.message ?: "")
                 continue
@@ -367,6 +374,7 @@ internal class Interop(private val e: RealEngine) {
             if (imported.pinnedSigners.isNotEmpty()) withPins += config.shownName
             if (hasFilters(config)) withFilters += config.shownName
             if (imported.updates == UpdateMode.AUTO) askedForMore += config.shownName
+            if (config.source.type in SourceTypes.THIRD_PARTY_STORES) fromStores += config.shownName
         }
         e.publish()
         if (fresh.isNotEmpty()) e.scope.launch { e.checks.run(fresh, CheckCause.IMPORTED) }
@@ -378,6 +386,7 @@ internal class Interop(private val e: RealEngine) {
             replaceable = others.map { (id, imported) -> shownNameOf(id, imported) },
             settingsOffered = settings != null,
             offer = offer,
+            fromStores = fromStores,
         )
     }
 
diff --git a/app/src/main/kotlin/io/github/munzzyy/tern/engine/real/ProjectPages.kt b/app/src/main/kotlin/io/github/munzzyy/tern/engine/real/ProjectPages.kt
index 3d4892eb..1a60bc30 100644
--- a/app/src/main/kotlin/io/github/munzzyy/tern/engine/real/ProjectPages.kt
+++ b/app/src/main/kotlin/io/github/munzzyy/tern/engine/real/ProjectPages.kt
@@ -58,11 +58,10 @@ internal class ProjectPages(private val http: HttpClient, private val tokens: To
     private fun forgejo(spec: SourceSpec): String? {
         val host = Urls.host(spec.url)
         val (owner, repo) = ownerRepo(spec) ?: return null
-        val token = tokens.tokenFor(host)
-        val headers = token?.let { mapOf("Authorization" to "token $it") }.orEmpty()
+        val token = tokens.tokenFor(host)?.let { "token $it" }
         val base = "https://$host/api/v1/repos/${Urls.encodeSegment(owner)}/${Urls.encodeSegment(repo)}"
         for (name in README_NAMES) {
-            val answer = get("$base/contents/${Urls.encodeSegment(name)}", headers) ?: continue
+            val answer = get("$base/contents/${Urls.encodeSegment(name)}", authorization = token) ?: continue
             val content = parsed { Json.parseObject(answer).string("content") } ?: continue
             return try {
                 String(Base64.getMimeDecoder().decode(content), Charsets.UTF_8)
diff --git a/app/src/main/kotlin/io/github/munzzyy/tern/engine/real/RealEngine.kt b/app/src/main/kotlin/io/github/munzzyy/tern/engine/real/RealEngine.kt
index 45f44374..e3a5c28b 100644
--- a/app/src/main/kotlin/io/github/munzzyy/tern/engine/real/RealEngine.kt
+++ b/app/src/main/kotlin/io/github/munzzyy/tern/engine/real/RealEngine.kt
@@ -29,6 +29,7 @@ import io.github.munzzyy.tern.core.net.InMemoryValidatorStore
 import io.github.munzzyy.tern.core.net.ValidatorStore
 import io.github.munzzyy.tern.core.source.CheckContext
 import io.github.munzzyy.tern.data.FileFacts
+import io.github.munzzyy.tern.data.KeptPins
 import io.github.munzzyy.tern.core.net.HttpClient
 import io.github.munzzyy.tern.core.net.PoliteHttp
 import io.github.munzzyy.tern.core.net.RateLimiter
@@ -130,19 +131,25 @@ class RealEngine(
     internal val context: Context = context.applicationContext
     internal val store = Store(this.context, storeName)
     private val settingsStore = SettingsStore(this.context, prefsPrefix + SettingsStore.DEFAULT_NAME)
+    internal val keptPins = KeptPins(this.context, prefsPrefix + KeptPins.DEFAULT_NAME, nowMs)
     private val vault = TokenVault(this.context, prefsPrefix + TokenVault.DEFAULT_NAME)
     internal val texts = Texts(this.context)
     internal val device = Device(this.context)
     /** No token for GitHub while its requests go through a hubproxy, which must never see one. */
     internal val tokens = TokenProvider { host -> if (_settings.value.githubProxy != null && GitHubProxy.isGitHubHost(host)) null else vault.tokenFor(host) }
     internal val http: HttpClient = PoliteHttp(GitHubProxyHttp(transport) { _settings.value.githubProxy }, RateLimiter(nowMs), "Tern/${BuildConfig.VERSION_NAME}")
-    internal val registry = SourceRegistry.standard(::trackedInRepository)
+    internal val registry = SourceRegistry.standard(::trackedInRepository) { _settings.value.thirdPartyStores }
     internal val inspector = FileInspector(http, store, tokens, device.sdk)
     internal val builtIn = BuiltInPins(catalog)
-    internal val evaluator = Evaluator(texts, device.profile, builtIn, nowMs, { _settings.value.globalFileFilter }) { _settings.value.minAgeDaysByDefault }
+    internal val evaluator = Evaluator(
+        texts, device.profile, builtIn, nowMs,
+        globalFilter = { _settings.value.globalFileFilter },
+        globalMinAgeDays = { _settings.value.minAgeDaysByDefault },
+        githubProxy = { _settings.value.githubProxy },
+    )
     internal val downloader = Downloader(http, downloadsDir ?: File(this.context.filesDir, "downloads"), texts)
     internal val gate: Gate = gate ?: InstallGate(archiveReader ?: PackageManagerArchiveReader(this.context.packageManager), texts)
-    private val installers = Installers(this)
+    internal val installers = Installers(this)
     internal val installer: Installer = installer ?: installers.routing
     internal val notifier = Notifier(this.context, texts) { _settings.value.notifyNames }
     internal val staging = File(this.context.cacheDir, "staging")
@@ -224,7 +231,11 @@ class RealEngine(
     private val packageReceiver = object : BroadcastReceiver() {
         override fun onReceive(context: Context, intent: Intent) {
             val pkg = intent.data?.schemeSpecificPart ?: return
-            val gone = intent.action == Intent.ACTION_PACKAGE_REMOVED && !intent.getBooleanExtra(Intent.EXTRA_REPLACING, false)
+            val gone = removedForGood(
+                intent.action,
+                replacing = intent.getBooleanExtra(Intent.EXTRA_REPLACING, false),
+                archival = intent.getBooleanExtra(EXTRA_ARCHIVAL, false),
+            )
             orbotLink.packageChanged(pkg)
             scope.launch(Dispatchers.IO) {
                 checks.onPackageChanged(pkg)
@@ -403,22 +414,25 @@ class RealEngine(
 
     override fun proposedConfig(found: Detection.Found): AppConfig {
         val s = _settings.value
-        val base = found.carried ?: AppConfig(
+        val given = found.carried ?: AppConfig(
             id = "",
             source = found.spec,
             name = "",
             // No wait of its own: a new app follows the setting for all apps, also when that changes.
-            releases = ReleasePolicy(includePrereleases = s.includePrereleasesByDefault || found.release?.countsAsPrerelease == true),
+            releases = ReleasePolicy(includePrereleases = s.includePrereleasesByDefault || found.prereleases || found.release?.countsAsPrerelease == true),
             updates = s.defaultUpdateMode,
         )
+        // An app Tern dropped when it was uninstalled elsewhere comes back held to what it was held to.
+        val base = keptPins.restore(given.copy(source = found.spec))
+        val packageName = found.packageName ?: found.verification?.packageName ?: base.packageName ?: found.installed?.packageName
         return validated(
             base.copy(
                 id = idFor(found.spec),
-                source = found.spec,
+                source = base.source,
                 name = found.name.take(200).ifBlank { found.spec.url.take(200) },
                 author = found.author?.take(200),
-                packageName = found.packageName ?: found.verification?.packageName ?: base.packageName ?: found.installed?.packageName,
-                pinnedSigners = builtIn.orElse(found.spec.url, base.pinnedSigners.ifEmpty { found.installed?.signers.orEmpty() }),
+                packageName = packageName,
+                pinnedSigners = builtIn.orElse(found.spec, packageName, base.pinnedSigners.ifEmpty { found.installed?.signers.orEmpty() }),
             ),
         )
     }
@@ -495,7 +509,7 @@ class RealEngine(
 
     override suspend fun remove(appId: String) {
         ready()
-        drop(appId, texts.eventRemoved())
+        drop(appId, texts.eventRemoved(), keepPins = false)
     }
 
     /**
@@ -508,13 +522,15 @@ class RealEngine(
             val pkg = packageOf(app.config) ?: continue
             if (packageName != null && pkg != packageName) continue
             if (!app.state.seenInstalled || app.state.pending != null || progress.containsKey(app.config.id)) continue
-            if (readInstalled(pkg) == null) drop(app.config.id, texts.eventRemovedUninstalled())
+            if (readInstalled(pkg) == null && !device.archived(pkg)) drop(app.config.id, texts.eventRemovedUninstalled(), keepPins = true)
         }
     }
 
-    private suspend fun drop(appId: String, why: String) {
+    /** [keepPins] keeps what the app was held to for when its source is added again; otherwise that is forgotten too. */
+    private suspend fun drop(appId: String, why: String, keepPins: Boolean) {
         withContext(Dispatchers.IO) {
             val app = stored[appId] ?: return@withContext
+            if (keepPins) keptPins.keep(app.config) else keptPins.forget(app.config.source)
             installs.cancel(appId)
             event(appId, EventKind.REMOVED, why)
             store.deleteApp(appId)
@@ -621,11 +637,17 @@ class RealEngine(
             val before = _settings.value
             settingsStore.save(settings)
             val loaded = settingsStore.load()
+            val wasPaused = stored.values.filter { registry.paused(it.config.source) }.map { it.config.id }
             _settings.value = loaded
             Scheduler.apply(context, loaded)
             setObtainiumLinks(loaded.openObtainiumLinks)
             if (loaded.proxy == ProxyMode.ORBOT && before.proxy != ProxyMode.ORBOT) orbotLink.ask()
             if (loaded.installer != before.installer || loaded.otherInstaller != before.otherInstaller) installers.recheck()
+            if (loaded.thirdPartyStores != before.thirdPartyStores) {
+                for (id in stored.keys) checks.reevaluate(id, network = false)
+                publish()
+                if (wasPaused.isNotEmpty() && loaded.thirdPartyStores) scope.launch { checks.run(wasPaused, CheckCause.CHANGED) }
+            }
             if (loaded.globalFileFilter != before.globalFileFilter || loaded.minAgeDaysByDefault != before.minAgeDaysByDefault) {
                 for (id in stored.keys) checks.reevaluate(id, network = false)
                 publish()
@@ -675,7 +697,14 @@ class RealEngine(
         return interop.finish(offer, replace, takeSettings)
     }
 
-    override fun suggestions(): List<Suggestion> = Suggestions.list(device.profile.television, catalog, context::getString)
+    override fun suggestions(): List<Suggestion> {
+        val rows = _apps.value
+        return Suggestions.list(device.profile.television, catalog, here = { app ->
+            val followed = rows.any { it.config.source.url.equals(app.url, ignoreCase = true) || it.config.packageName == app.packageName }
+            val installed = if (followed) null else device.read(app.packageName)?.let { it.app.signers + it.lineage }
+            Suggestions.here(app, followed, installed)
+        }, text = context::getString)
+    }
 
     override fun canOpenInstallSettings(): Boolean = device.canOpenInstallSettings()
 
@@ -803,7 +832,7 @@ class RealEngine(
                 }
             }
         }
-        if (pkg == null && kept == null) sourceIcons.forRow(row, size) else drawable?.toBitmap(size, size)
+        if (pkg == null && kept == null) sourceIcons.forRow(row, size).takeUnless { registry.paused(row.config.source) } else drawable?.toBitmap(size, size)
     }
 
     /** The background check: every app not set to manual, then automatic installs where Android allows them. */
@@ -822,14 +851,24 @@ class RealEngine(
         }
         _lastRunProblem.value = null
         val settings = _settings.value
-        val installsNow = settings.autoInstalls &&
-            (!settings.onlyOnUnmetered || device.onUnmeteredNetwork()) &&
-            (!settings.onlyWhileCharging || device.isCharging())
+        val installsNow = Scheduler.installsNow(settings, waitingJob = false, device::onUnmeteredNetwork, device::isCharging)
         val run = installs.runScheduled(settings, installsNow, only, cause)
-        if (run.waited && settings.autoInstalls) Scheduler.waitForInstalls(context, settings)
+        if (Scheduler.armsWaiting(settings, waitingJob = false, waited = run.waited)) Scheduler.waitForInstalls(context, settings)
         retryDelay(run.failed, attempt, nowMs())?.let { (again, delay) -> Scheduler.retry(context, again, attempt + 1, delay) }
     }
 
+    /** The waiting job: installs what the last check held back, without checking the list again or setting itself anew. */
+    suspend fun runWaitingInstalls() {
+        ready()
+        if (!_online.value) {
+            offline(null)
+            return
+        }
+        val settings = _settings.value
+        if (!Scheduler.installsNow(settings, waitingJob = true, device::onUnmeteredNetwork, device::isCharging)) return
+        installs.runScheduled(settings, installsNow = true, check = false)
+    }
+
     /** Which of [failed] to check again and how long to wait first, or null for none. */
     internal fun retryDelay(failed: List<String>, attempt: Int, now: Long): Pair<List<String>, Long>? =
         Retries.plan(failed.mapNotNull { id -> stored[id]?.state?.checkProblem?.let { id to it } }, attempt, now)
@@ -924,6 +963,16 @@ class RealEngine(
         /** The sources whose projects keep a README Tern reads for an app's page. */
         private val PROJECT_PAGE_SOURCES = setOf(SourceTypes.GITHUB, SourceTypes.GITHUB_ACTIONS, SourceTypes.GITLAB, SourceTypes.FORGEJO)
 
+        /** Intent.EXTRA_ARCHIVAL, which Android 15 sets on the removal that archives an app. */
+        private const val EXTRA_ARCHIVAL = "android.intent.extra.ARCHIVAL"
+
+        /**
+         * Whether a package broadcast means the app is gone: removed, and neither being replaced
+         * nor archived. An archived app keeps its data and comes back with one tap.
+         */
+        internal fun removedForGood(action: String?, replacing: Boolean, archival: Boolean): Boolean =
+            action == Intent.ACTION_PACKAGE_REMOVED && !replacing && !archival
+
         /** Whether [a] and [b] are one app's source: one kind at one address, and in a repository of many apps, one package. */
         internal fun sameSource(a: SourceSpec, b: SourceSpec): Boolean =
             a.type == b.type && a.url.equals(b.url, ignoreCase = true) &&
diff --git a/app/src/main/kotlin/io/github/munzzyy/tern/engine/real/Search.kt b/app/src/main/kotlin/io/github/munzzyy/tern/engine/real/Search.kt
index fa3d699e..1af58a84 100644
--- a/app/src/main/kotlin/io/github/munzzyy/tern/engine/real/Search.kt
+++ b/app/src/main/kotlin/io/github/munzzyy/tern/engine/real/Search.kt
@@ -34,12 +34,13 @@ import kotlinx.coroutines.runInterruptible
 class Search(
     private val http: HttpClient,
     private val tokens: TokenProvider,
-    private val stores: List<Searchable> = emptyList(),
+    /** The sources that may be searched now, asked each time: third-party stores come and go with their setting. */
+    private val stores: () -> List<Searchable> = { emptyList() },
     private val context: () -> CheckContext = { CheckContext(http, InMemoryValidatorStore(), tokens) },
     private val log: (String) -> Unit = { TernLog.i(TAG, it) },
 ) {
     /** Every place a search can look, in the order their hits are shown. */
-    val origins: List<String> = FORGES + stores.map { it.origin }
+    val origins: List<String> get() = FORGES + stores().map { it.origin }
 
     /** The Forgejo or Gitea a search looks in, by its host, and the fewest stars a project on GitHub or a Forgejo may have. */
     data class Scope(val forgejo: String = Settings.DEFAULT_FORGEJO, val minStars: Int = 0)
@@ -65,7 +66,7 @@ class Search(
             Triple(CODEBERG_PLACE, forgejoOrigin(forgejo)) { forgejo(query, forgejo, scope.minStars) },
             Triple("GitLab", "GitLab") { gitlab(query) },
         ).filter { it.first in within }.map { (_, origin, block) -> async { safely(origin, block) } }
-        val others = stores.filter { it.origin in within }.map { store ->
+        val others = stores().filter { it.origin in within }.map { store ->
             async { safely(store.origin) { store.search(query.take(MAX_QUERY), context()).take(PER_STORE).mapNotNull { hit(it, store.origin) } } }
         }
         val places = (forges + others).awaitAll()
diff --git a/app/src/main/kotlin/io/github/munzzyy/tern/engine/real/Suggestions.kt b/app/src/main/kotlin/io/github/munzzyy/tern/engine/real/Suggestions.kt
index 31d3a105..88820805 100644
--- a/app/src/main/kotlin/io/github/munzzyy/tern/engine/real/Suggestions.kt
+++ b/app/src/main/kotlin/io/github/munzzyy/tern/engine/real/Suggestions.kt
@@ -4,6 +4,8 @@ import io.github.munzzyy.tern.R
 import io.github.munzzyy.tern.core.suggest.Catalog
 import io.github.munzzyy.tern.core.suggest.SuggestedApp
 import io.github.munzzyy.tern.core.suggest.SuggestedKind
+import io.github.munzzyy.tern.core.verify.Fingerprints
+import io.github.munzzyy.tern.engine.StarterHere
 import io.github.munzzyy.tern.engine.Suggestion
 import io.github.munzzyy.tern.engine.SuggestionKind
 
@@ -51,10 +53,27 @@ internal object Suggestions {
     }
 
     /** [text] turns a string resource into its text. */
-    fun list(television: Boolean, text: (Int) -> String): List<Suggestion> = list(television, Catalog.all, text)
+    fun list(television: Boolean, text: (Int) -> String): List<Suggestion> = list(television, Catalog.all, text = text)
 
-    fun list(television: Boolean, catalog: List<SuggestedApp>, text: (Int) -> String): List<Suggestion> = Catalog.ordered(television, catalog).mapNotNull { app ->
+    fun list(
+        television: Boolean,
+        catalog: List<SuggestedApp>,
+        here: (SuggestedApp) -> StarterHere = { StarterHere.NONE },
+        text: (Int) -> String,
+    ): List<Suggestion> = Catalog.ordered(television, catalog).mapNotNull { app ->
         val summary = summaryOf(app.summaryKey) ?: return@mapNotNull null
-        Suggestion(app.name, text(summary), app.url, kindOf(app.kind), app.television, pinned = app.signers.isNotEmpty())
+        Suggestion(app.name, text(summary), app.url, kindOf(app.kind), app.television, pinned = app.signers.isNotEmpty(), here = here(app))
+    }
+
+    /**
+     * Where [app] already is. An installed copy counts as another signer's only when Tern carries the
+     * developer's certificate and neither the copy's signer nor any it rotated from is one of them.
+     */
+    fun here(app: SuggestedApp, followed: Boolean, installedSigners: List<String>?): StarterHere {
+        if (followed) return StarterHere.IN_LIST
+        val installed = installedSigners ?: return StarterHere.NONE
+        val carried = app.signers.mapNotNull(Fingerprints::normalize).toSet()
+        if (carried.isEmpty()) return StarterHere.ON_PHONE
+        return if (installed.mapNotNull(Fingerprints::normalize).any { it in carried }) StarterHere.ON_PHONE else StarterHere.ON_PHONE_OTHER_SIGNER
     }
 }
diff --git a/app/src/main/kotlin/io/github/munzzyy/tern/engine/real/Texts.kt b/app/src/main/kotlin/io/github/munzzyy/tern/engine/real/Texts.kt
index 97d30036..32d8f7a3 100644
--- a/app/src/main/kotlin/io/github/munzzyy/tern/engine/real/Texts.kt
+++ b/app/src/main/kotlin/io/github/munzzyy/tern/engine/real/Texts.kt
@@ -8,7 +8,9 @@ import android.text.format.DateFormat
 import android.text.format.Formatter
 import io.github.munzzyy.tern.R
 import io.github.munzzyy.tern.core.select.PickReason
+import io.github.munzzyy.tern.core.source.Refusal
 import io.github.munzzyy.tern.engine.CheckCause
+import io.github.munzzyy.tern.engine.InstallerMode
 import io.github.munzzyy.tern.net.isProxySilent
 import java.io.IOException
 import java.util.Date
@@ -60,6 +62,7 @@ class Texts(context: Context) : ImportTexts {
     fun partNotSigned() = s(R.string.engine4_part_not_signed)
     fun otherAppSigner() = s(R.string.install_other_app_signer)
     fun downgrade(installed: String?, offered: String?) = s(R.string.engine_downgrade, installed ?: "?", offered ?: "?")
+    fun downgradeNotAsNamed(file: Long, named: Long) = s(R.string.engine_downgrade_not_as_named, file, named)
     fun testOnly() = s(R.string.engine_test_only)
     fun needsNewerAndroid(minSdk: Int) = s(R.string.engine_needs_newer_android, minSdk)
 
@@ -126,6 +129,10 @@ class Texts(context: Context) : ImportTexts {
     fun warnPrerelease() = s(R.string.engine_warn_prerelease)
     fun warnMoved(url: String) = s(R.string.engine_warn_moved, url)
     fun notASource() = s(R.string.engine_not_a_source)
+    fun storesOffPaused() = s(R.string.stores_paused_reason)
+    fun refused(refusal: Refusal) = s(if (refusal == Refusal.MODIFIED_APPS) R.string.stores_refused_modified else R.string.stores_refused_impersonation)
+    override fun importRefused(refusal: Refusal) = refused(refusal)
+    fun checksumStore(store: String) = s(R.string.stores_checksum_source, ltr(store))
     fun nothingToSearch() = s(R.string.engine_nothing_to_search)
 
     fun eventAdded(from: String) = s(R.string.engine_event_added, ltr(from))
@@ -137,7 +144,19 @@ class Texts(context: Context) : ImportTexts {
     fun eventVerified(packageName: String, versionCode: Long, signer: String) = s(R.string.engine_event_verified, ltr(packageName), versionCode, ltr(signer))
     fun eventInstalled(version: String, versionCode: Long) = s(R.string.engine_event_installed, version, versionCode)
 
+    fun installerFellBack(chosen: InstallerMode) = s(
+        R.string.engine_installer_fell_back,
+        s(
+            when (chosen) {
+                InstallerMode.SHIZUKU -> R.string.installer_shizuku
+                InstallerMode.ROOT -> R.string.installer_root
+                else -> R.string.installer_other_app
+            },
+        ),
+    )
+
     fun checksumGitHub() = s(R.string.engine_checksum_github)
+    fun checksumGitHubProxy(host: String) = s(R.string.engine_checksum_github_proxy, ltr(host))
     fun checksumIndex() = s(R.string.engine_checksum_index)
     fun checksumSource() = s(R.string.engine_checksum_source)
     fun checksumFile(name: String) = s(R.string.engine_checksum_file, ltr(name.take(120)))
diff --git a/app/src/main/kotlin/io/github/munzzyy/tern/install/InstallGate.kt b/app/src/main/kotlin/io/github/munzzyy/tern/install/InstallGate.kt
index 48b31df8..afed267f 100644
--- a/app/src/main/kotlin/io/github/munzzyy/tern/install/InstallGate.kt
+++ b/app/src/main/kotlin/io/github/munzzyy/tern/install/InstallGate.kt
@@ -58,8 +58,10 @@ data class GateRequest(
     val staging: File,
     /** True when [pinnedSigners] are certificates Tern itself carries for this app, which changes what a refusal says. */
     val builtInPin: Boolean = false,
-    /** An older version may replace a newer one: the person allowed it, and something lets Android do it. */
+    /** An older version may replace a newer one: the person picked it, allowed it, and something lets Android do it. */
     val allowDowngrade: Boolean = false,
+    /** The versionCode the source named for this file, if it named one. */
+    val claimedVersionCode: Long? = null,
     /** Which files inside an archive or a bundle may be installed, by their names there. */
     val installsInside: (String) -> Boolean = { true },
     /**
@@ -71,6 +73,20 @@ data class GateRequest(
     val unpacksObb: Boolean = false,
 )
 
+internal enum class Downgrade { NONE, ALLOWED, REFUSED, NOT_AS_NAMED }
+
+/**
+ * Whether a file of [file] may go over [installed]. An older one goes only where [allowed], and
+ * never when the source named a higher versionCode than the file has: the source said it was
+ * newer, so going back was not what anyone chose.
+ */
+internal fun downgrade(file: Long, installed: Long?, allowed: Boolean, claimed: Long?): Downgrade = when {
+    installed == null || file >= installed -> Downgrade.NONE
+    claimed != null && file < claimed -> Downgrade.NOT_AS_NAMED
+    allowed -> Downgrade.ALLOWED
+    else -> Downgrade.REFUSED
+}
+
 fun interface Gate {
     fun check(request: GateRequest): GatePass
 }
@@ -265,8 +281,10 @@ class InstallGate(
                 Block.PIN_MISMATCH -> StepFailure(ProblemKind.PIN_MISMATCH, if (request.builtInPin) texts.builtInPinMismatch() else texts.pinMismatch())
             }
         }
-        if (installed != null && android.versionCode < installed.versionCode && !request.allowDowngrade) {
-            throw StepFailure(ProblemKind.DOWNGRADE, texts.downgrade(installed.versionName, android.versionName))
+        when (downgrade(android.versionCode, installed?.versionCode, request.allowDowngrade, request.claimedVersionCode)) {
+            Downgrade.NONE, Downgrade.ALLOWED -> Unit
+            Downgrade.REFUSED -> throw StepFailure(ProblemKind.DOWNGRADE, texts.downgrade(installed?.versionName, android.versionName))
+            Downgrade.NOT_AS_NAMED -> throw StepFailure(ProblemKind.DOWNGRADE, texts.downgradeNotAsNamed(android.versionCode, request.claimedVersionCode ?: 0))
         }
         if (android.testOnly || ours.manifest.testOnly) throw StepFailure(ProblemKind.UNSUPPORTED, texts.testOnly())
         val minSdk = android.minSdk ?: ours.manifest.minSdk
diff --git a/app/src/main/kotlin/io/github/munzzyy/tern/install/Parts.kt b/app/src/main/kotlin/io/github/munzzyy/tern/install/Parts.kt
index da190518..4780342f 100644
--- a/app/src/main/kotlin/io/github/munzzyy/tern/install/Parts.kt
+++ b/app/src/main/kotlin/io/github/munzzyy/tern/install/Parts.kt
@@ -16,7 +16,7 @@ data class FetchedPart(val name: String, val file: File)
 /**
  * Puts a base and its splits, fetched one by one, into one zip, so that they are chosen and checked
  * exactly as the APKs of a bundle are. A part that is an APK goes in under its own name, made to end
- * in .apk. A part that is a zip, as RuStore serves each file, gives the APKs it holds under their
+ * in .apk. A part that is a zip, as some stores serve each file, gives the APKs it holds under their
  * names there. Every name is data and never a path, and a name that comes twice is numbered.
  */
 object PartsZip {
diff --git a/app/src/main/kotlin/io/github/munzzyy/tern/install/VerifiedApps.kt b/app/src/main/kotlin/io/github/munzzyy/tern/install/VerifiedApps.kt
index 55dcf6b4..a848b871 100644
--- a/app/src/main/kotlin/io/github/munzzyy/tern/install/VerifiedApps.kt
+++ b/app/src/main/kotlin/io/github/munzzyy/tern/install/VerifiedApps.kt
@@ -1,5 +1,7 @@
 package io.github.munzzyy.tern.install
 
+import android.content.pm.PackageManager
+
 /**
  * Verified Apps, which was AppVerifier, and the builds of it that Obtainium knows. Each is an app
  * of its own that checks an app's signing certificate against one it is given and against its own
@@ -14,11 +16,37 @@ object VerifiedApps {
         "com.roundsalmon4.appverifier",
     )
 
+    /**
+     * The signing certificate of each, SHA-256 in lowercase hex, as its makers publish it and
+     * Privacy Guides' list of verified apps has it too. An app holding one of these names under
+     * another certificate is not the verifier, and gets nothing.
+     */
+    val CERTIFICATES = mapOf(
+        "org.privacyguides.verifiedapps" to "405c6bd2ca7c3aae8f463c6f8b55bcf0ddac431c5ed8eaff65d106c9817a207f",
+        "org.privacyguides.verifiedapps.play" to "e858375b7c45cfc1d4e4f51b4ad659735b382c824fe2244836a814ad7af30061",
+        "dev.soupslurpr.appverifier" to "3a04a80b2a88334c747485f0b2151640a38bb3d2d73a8eab81df503e0f0202b2",
+        "com.roundsalmon4.appverifier" to "1e76f1a15cbe201f0fe26af27a12d91d0d3481fe7dcc7d89e9d2056930f6d5a9",
+    )
+
     /** The page that says what Verified Apps is, as Obtainium links it. */
     const val ABOUT = "https://github.com/privacyguides/verified-apps-android"
 
-    /** The first of [PACKAGES] that [takes] says will take what is to be sent, or null when none will. */
-    fun first(takes: (String) -> Boolean): String? = PACKAGES.firstOrNull(takes)
+    /**
+     * The first of [PACKAGES] that is signed as [CERTIFICATES] says, by the current signers
+     * [signersOf] reads, and that [takes] says will take what is to be sent; null when none is.
+     */
+    fun first(signersOf: (String) -> Collection<String>?, takes: (String) -> Boolean): String? =
+        PACKAGES.firstOrNull { genuine(it, signersOf(it)) && takes(it) }
+
+    fun genuine(packageName: String, signers: Collection<String>?): Boolean =
+        !signers.isNullOrEmpty() && CERTIFICATES[packageName] in signers
+
+    /** The current signers of [packageName] on this device, or null when it is not installed. */
+    fun signers(pm: PackageManager, packageName: String): List<String>? = try {
+        PackageManagerArchiveReader.certificates(pm.getPackageInfo(packageName, PackageManager.GET_SIGNING_CERTIFICATES).signingInfo).first
+    } catch (_: PackageManager.NameNotFoundException) {
+        null
+    }
 
     /**
      * Whether the checked file of an install goes to [verifier] before the installer: only for a
diff --git a/app/src/main/kotlin/io/github/munzzyy/tern/log/Scrub.kt b/app/src/main/kotlin/io/github/munzzyy/tern/log/Scrub.kt
index 9b02b2b0..92ca12c5 100644
--- a/app/src/main/kotlin/io/github/munzzyy/tern/log/Scrub.kt
+++ b/app/src/main/kotlin/io/github/munzzyy/tern/log/Scrub.kt
@@ -4,9 +4,10 @@ package io.github.munzzyy.tern.log
  * Text made fit to keep in the log, which may be shared: nothing in it may open an account or
  * name a person. Every address loses its query, its fragment and any name and password in front
  * of its host, also an address inside another. What looks like a token becomes [GONE]: GitHub's
- * and GitLab's by their prefix, a JSON web token, what follows Bearer or an Authorization header,
- * and a code after a word such as key, token, secret or password. So do an email address and
- * the device's own address in a connection that failed.
+ * and GitLab's by their prefix, a JSON web token, what follows Bearer or an Authorization or
+ * Cookie header, a code after a word such as key, token, secret or session, and anything set as
+ * a password, however short. So do an email address and the device's own address in a
+ * connection that failed.
  *
  * It leaves out too much rather than too little: a fingerprint after the word key goes too.
  */
@@ -36,11 +37,16 @@ object Scrub {
 
     private val AUTHORIZATION = Regex("""(?i)(authorization["']?\s?[:=]\s?["']?)(?:(bearer|basic|token|digest)(\s++))?[^\s"',;]++""")
 
+    private val COOKIE = Regex("""(?i)((?:set-)?cookie["']?\s?:\s?["']?)[^\r\n"']++""")
+
     private val BEARER = Regex("""(?i)\b(bearer\s++)[A-Za-z0-9._~+/=%\-]++""")
 
     private val BASIC = Regex("""\b(Basic\s++)([A-Za-z0-9+/]++={0,2})""")
 
-    private val NAMED = Regex("""(?i)(token|secret|passw(?:or)?d|pwd|credentials?|key|auth)(\s?["']?\s?[:=]\s?["']?\s?|\s)([A-Za-z0-9._~+/=%\-]++)""")
+    private val NAMED = Regex("""(?i)(token|secret|passw(?:or)?d|pwd|passphrase|credentials?|key|auth|session(?:[_-]?id)?|(?<![a-z])sid|cookie)(\s?["']?\s?[:=]\s?["']?\s?|\s)([A-Za-z0-9._~+/=%\-]++)""")
+
+    /** Words whose value goes at any length once it is set with = or :, since a password or a cookie can be short. */
+    private val ALWAYS_SECRET = Regex("""(?i)passw(?:or)?d|pwd|passphrase|cookie""")
 
     /** The device's own address, as Android names it when a connection fails: "from /192.168.1.23 (port 43210)". */
     private val OWN_ADDRESS = Regex("""(?i)(\bfrom )[\w.\-]*/[0-9a-f:.]++(?:%[\w.\-]++)?(?= \(port \d)""")
@@ -54,6 +60,7 @@ object Scrub {
         s = KNOWN_TOKEN.replace(s, GONE)
         s = JSON_WEB_TOKEN.replace(s, GONE)
         s = AUTHORIZATION.replace(s) { it.groupValues[1] + it.groupValues[2] + it.groupValues[3] + GONE }
+        s = COOKIE.replace(s) { it.groupValues[1] + GONE }
         s = BEARER.replace(s) { it.groupValues[1] + GONE }
         s = BASIC.replace(s) { if (isBase64(it.groupValues[2])) it.groupValues[1] + GONE else it.value }
         s = named(s)
@@ -80,7 +87,8 @@ object Scrub {
         while (true) {
             val found = NAMED.find(text, from) ?: break
             val value = found.groups[3]!!
-            if (looksSecret(value.value)) {
+            val set = found.groupValues[2].any { it == ':' || it == '=' }
+            if (looksSecret(value.value) || set && ALWAYS_SECRET.matches(found.groupValues[1])) {
                 out.append(text, copied, value.range.first).append(GONE)
                 copied = value.range.last + 1
                 from = copied
diff --git a/app/src/main/kotlin/io/github/munzzyy/tern/ui/IncomingLinks.kt b/app/src/main/kotlin/io/github/munzzyy/tern/ui/IncomingLinks.kt
index afb13869..f8c10a5e 100644
--- a/app/src/main/kotlin/io/github/munzzyy/tern/ui/IncomingLinks.kt
+++ b/app/src/main/kotlin/io/github/munzzyy/tern/ui/IncomingLinks.kt
@@ -40,6 +40,44 @@ fun refreshLink(raw: String?): RefreshLink? {
     return if (id.isNullOrBlank()) RefreshLink.All else RefreshLink.One(id.take(255))
 }
 
+/**
+ * What an intent that reached Tern's window asks for that goes beyond showing something. [ours]
+ * is true only for Tern's own launcher shortcuts, which come through a component no other app
+ * can start. Anything else may ask for a check and gets a question first; Update all and Add
+ * from anyone else are not done at all.
+ */
+sealed interface Asked {
+    data object UpdateAll : Asked
+    data object Add : Asked
+
+    /** A check to run at once: Tern's own shortcut asked for it. */
+    data class Check(val link: RefreshLink) : Asked
+
+    /** A check a web page or another app asked for, run only once the person says yes. */
+    data class Confirm(val link: RefreshLink) : Asked
+}
+
+fun asked(action: String?, data: String?, ours: Boolean): Asked? = when (action) {
+    ACTION_UPDATE_ALL -> Asked.UpdateAll.takeIf { ours }
+    ACTION_ADD -> Asked.Add.takeIf { ours }
+    ACTION_CHECK -> Asked.Check(RefreshLink.All).takeIf { ours }
+    ACTION_VIEW -> refreshLink(data)?.let { if (ours) Asked.Check(it) else Asked.Confirm(it) }
+    else -> null
+}
+
+/** A check a link asked for waits this long after the last one, so a page cannot keep Tern checking. */
+const val LINK_CHECK_GAP_MS = 60_000L
+
+fun linkCheckAllowed(lastAtMs: Long?, nowMs: Long): Boolean = lastAtMs == null || nowMs - lastAtMs !in 0 until LINK_CHECK_GAP_MS
+
+/** What Tern's own shortcuts ask for. They reach Tern only through [SHORTCUTS], which no other app can start. */
+const val ACTION_ADD = "io.github.munzzyy.tern.action.ADD"
+const val ACTION_UPDATE_ALL = "io.github.munzzyy.tern.action.UPDATE_ALL"
+const val ACTION_CHECK = "io.github.munzzyy.tern.action.CHECK"
+
+/** The activity alias the shortcuts start, declared not exported in the manifest. */
+const val SHORTCUTS = "io.github.munzzyy.tern.Shortcuts"
+
 const val ACTION_SEND = "android.intent.action.SEND"
 const val ACTION_VIEW = "android.intent.action.VIEW"
 
@@ -93,7 +131,10 @@ private fun unknownLink(raw: String, action: String): String? = raw.takeUnless {
 private val KNOWN_ACTIONS = setOf("add", "app", "apps", "refresh")
 
 private fun ternLink(raw: String, rest: String): String? {
-    if (actionOf(rest) != "add") return unknownLink(raw, actionOf(rest))
+    val action = actionOf(rest)
+    // An app's settings, as Tern's add page hands them on; the Add screen reads them as it reads Obtainium's.
+    if (action == "app" || action == "apps") return raw.takeIf { rest.substringAfter('/', "").isNotEmpty() }
+    if (action != "add") return unknownLink(raw, action)
     val query = rest.substringAfter('?', "").substringBefore('#')
     val encoded = query.split('&').firstOrNull { it.startsWith("url=") }?.removePrefix("url=") ?: return null
     return decode(encoded)?.takeIf(::isHttps)
diff --git a/app/src/main/kotlin/io/github/munzzyy/tern/ui/TernApp.kt b/app/src/main/kotlin/io/github/munzzyy/tern/ui/TernApp.kt
index f1bdbdab..9d68dc13 100644
--- a/app/src/main/kotlin/io/github/munzzyy/tern/ui/TernApp.kt
+++ b/app/src/main/kotlin/io/github/munzzyy/tern/ui/TernApp.kt
@@ -71,6 +71,7 @@ import androidx.compose.ui.res.stringResource
 import androidx.compose.ui.semantics.contentDescription
 import androidx.compose.ui.semantics.semantics
 import androidx.compose.ui.text.style.TextAlign
+import androidx.compose.ui.unit.Dp
 import androidx.compose.ui.unit.LayoutDirection
 import androidx.compose.ui.unit.dp
 import androidx.compose.ui.unit.sp
@@ -106,6 +107,10 @@ private val RAIL_WIDTH = 600.dp
 private val TWO_PANE_WIDTH = 840.dp
 private val LIST_PANE_WIDTH = 400.dp
 private const val LIST_PANE_SHARE = 0.45f
+private const val LARGE_TEXT = 1.5f
+
+/** Whether the list and an app's page fit side by side; with large text each needs more room, so the width asked for grows with the text. */
+fun twoPanesFit(width: Dp, fontScale: Float): Boolean = width >= TWO_PANE_WIDTH * (if (fontScale >= LARGE_TEXT) fontScale else 1f)
 
 @OptIn(ExperimentalFoundationApi::class)
 @Composable
@@ -115,6 +120,7 @@ fun TernApp(
     firstRunDone: Boolean,
     onFirstRunDone: () -> Unit,
     reducedMotion: Boolean,
+    dialogs: @Composable () -> Unit = {},
 ) {
     val snackbar = remember { SnackbarHostState() }
     val scope = rememberCoroutineScope()
@@ -154,6 +160,7 @@ fun TernApp(
                 Shell(stack)
             }
             InstallPermissionDialog(guarded)
+            dialogs()
         }
     }
 }
@@ -203,7 +210,7 @@ private fun Shell(stack: BackStack) {
     CompositionLocalProvider(LocalOnline provides online) {
         BoxWithConstraints(Modifier.fillMaxSize()) {
             val wide = !phoneLayout && maxWidth >= RAIL_WIDTH
-            val twoPane = !phoneLayout && maxWidth >= TWO_PANE_WIDTH
+            val twoPane = !phoneLayout && twoPanesFit(maxWidth, LocalDensity.current.fontScale)
             val current = stack.top
             val select: (Tab) -> Unit = { tab ->
                 stack.routes.forEach { if (it != Route.Apps) holder.removeState(encodeRoute(it)) }
diff --git a/app/src/main/kotlin/io/github/munzzyy/tern/ui/activity/EventDays.kt b/app/src/main/kotlin/io/github/munzzyy/tern/ui/activity/EventDays.kt
index 61385d5d..7b128c3f 100644
--- a/app/src/main/kotlin/io/github/munzzyy/tern/ui/activity/EventDays.kt
+++ b/app/src/main/kotlin/io/github/munzzyy/tern/ui/activity/EventDays.kt
@@ -3,6 +3,7 @@ package io.github.munzzyy.tern.ui.activity
 import io.github.munzzyy.tern.engine.Event
 import io.github.munzzyy.tern.engine.EventKind
 import io.github.munzzyy.tern.engine.isOwn
+import io.github.munzzyy.tern.log.Scrub
 import java.time.Instant
 import java.time.LocalDate
 import java.time.ZoneId
@@ -39,7 +40,7 @@ fun dayName(date: LocalDate, today: LocalDate): DayName = when (date) {
  * "2026-09-30 14:03 · App · what happened". The time is written the same in every language, so
  * that whoever reads it can tell the order. [own] takes in Tern's own messages: each is timed to
  * the second and named by its [marks] where an app's name would be, and the lines of an error
- * follow it, indented.
+ * follow it, indented. Every message goes through [Scrub] on its way out, whatever wrote it.
  */
 fun activityText(events: List<Event>, zone: ZoneId, problemsOnly: Boolean, own: Boolean = true, marks: Map<EventKind, String> = emptyMap()): String {
     val stamp = DateTimeFormatter.ofPattern("yyyy-MM-dd HH:mm", Locale.ROOT)
@@ -51,7 +52,7 @@ fun activityText(events: List<Event>, zone: ZoneId, problemsOnly: Boolean, own:
         .joinToString("\n") { e ->
             val at = (if (e.kind.isOwn) second else stamp).format(Instant.ofEpochMilli(e.atMs).atZone(zone))
             val who = if (e.kind.isOwn) marks[e.kind] else e.appName
-            listOfNotNull(at, who?.takeIf { it.isNotBlank() }, e.message.takeIf { it.isNotBlank() }?.replace("\n", "\n  ") ?: e.kind.name.lowercase(Locale.ROOT))
+            listOfNotNull(at, who?.takeIf { it.isNotBlank() }, e.message.takeIf { it.isNotBlank() }?.let(Scrub::text)?.replace("\n", "\n  ") ?: e.kind.name.lowercase(Locale.ROOT))
                 .joinToString(" \u00b7 ")
         }
 }
diff --git a/app/src/main/kotlin/io/github/munzzyy/tern/ui/add/AddScreen.kt b/app/src/main/kotlin/io/github/munzzyy/tern/ui/add/AddScreen.kt
index 57b422fe..33c407c7 100644
--- a/app/src/main/kotlin/io/github/munzzyy/tern/ui/add/AddScreen.kt
+++ b/app/src/main/kotlin/io/github/munzzyy/tern/ui/add/AddScreen.kt
@@ -250,6 +250,7 @@ fun AddScreen(
                                 onReplace = { vm.replace(d) },
                             )
                             is Detection.Results -> ResultsList(d, onPick = { vm.look(it.url, it.type) }, onSearchRepository = { vm.detect(words = it) })
+                            is Detection.StoresOff -> StoresOffCard(d.type, onTurnOn = vm::turnOnStores)
                             is Detection.Failed -> {
                                 val settable = optionsMayHelp(d)
                                 ProblemBox(
diff --git a/app/src/main/kotlin/io/github/munzzyy/tern/ui/add/AddViewModel.kt b/app/src/main/kotlin/io/github/munzzyy/tern/ui/add/AddViewModel.kt
index 216fcf99..fd7b2149 100644
--- a/app/src/main/kotlin/io/github/munzzyy/tern/ui/add/AddViewModel.kt
+++ b/app/src/main/kotlin/io/github/munzzyy/tern/ui/add/AddViewModel.kt
@@ -107,7 +107,7 @@ class AddViewModel(private val engine: Engine) : ViewModel() {
                 spec = when (detection) {
                     is Detection.Found -> detection.spec
                     is Detection.Failed -> detection.spec
-                    is Detection.Results -> null
+                    is Detection.Results, is Detection.StoresOff -> null
                 }
                 AddState.Answer(detection, again)
             } catch (e: CancellationException) {
@@ -118,6 +118,22 @@ class AddViewModel(private val engine: Engine) : ViewModel() {
         }
     }
 
+    /** Turns third-party stores on because the person asked on the card that explains them, then reads the address again. */
+    fun turnOnStores() {
+        job?.cancel()
+        job = viewModelScope.launch {
+            try {
+                engine.saveSettings(engine.settings.value.copy(thirdPartyStores = true))
+            } catch (e: CancellationException) {
+                throw e
+            } catch (_: Exception) {
+                _state.value = AddState.Broken
+                return@launch
+            }
+            detect()
+        }
+    }
+
     /** Looks an address up that the screen itself offered, as if it had been pasted, read as [type] where the address alone does not say. Nothing is added. */
     fun look(url: String, type: String? = null) {
         edit(url)
diff --git a/app/src/main/kotlin/io/github/munzzyy/tern/ui/add/Origin.kt b/app/src/main/kotlin/io/github/munzzyy/tern/ui/add/Origin.kt
new file mode 100644
index 00000000..eba3a5e2
--- /dev/null
+++ b/app/src/main/kotlin/io/github/munzzyy/tern/ui/add/Origin.kt
@@ -0,0 +1,46 @@
+package io.github.munzzyy.tern.ui.add
+
+import androidx.annotation.StringRes
+import androidx.compose.runtime.Composable
+import androidx.compose.ui.res.stringResource
+import io.github.munzzyy.tern.R
+import io.github.munzzyy.tern.core.model.SourceSpec
+import io.github.munzzyy.tern.core.source.SourceTypes
+import io.github.munzzyy.tern.engine.Detection
+import io.github.munzzyy.tern.ui.common.TrustLine
+import io.github.munzzyy.tern.ui.text.Trust
+import io.github.munzzyy.tern.ui.text.hostOf
+
+/** What Tern says of where an app's files come from, for the stores that are not the developer's own place. */
+enum class OriginNote { REPUBLISHED, STORE }
+
+fun originNote(type: String): OriginNote? = when (type) {
+    in SourceTypes.REPUBLISHING -> OriginNote.REPUBLISHED
+    in SourceTypes.THIRD_PARTY_STORES -> OriginNote.STORE
+    else -> null
+}
+
+/**
+ * [pinned] when the app is held to a certificate before its first install: one Tern carries, one
+ * that came with a link or a file, or the one of the app already on the device. Otherwise the
+ * first file from the store decides it, and the note says so.
+ */
+@StringRes
+fun originText(note: OriginNote, pinned: Boolean): Int = when (note) {
+    OriginNote.REPUBLISHED -> if (pinned) R.string.origin_republished_pinned else R.string.origin_republished_first
+    OriginNote.STORE -> if (pinned) R.string.origin_store_pinned else R.string.origin_store_first
+}
+
+/** What the preview will hold the app to once it is added. */
+fun previewPinned(found: Detection.Found): Boolean =
+    found.builtInPin || found.carried?.pinnedSigners?.isNotEmpty() == true || found.installed != null
+
+/** The store's own name, or its host where it has none. */
+fun sourceName(spec: SourceSpec): String = SourceTypes.displayName(spec.type) ?: hostOf(spec.url)
+
+/** Says where the files of an app from a third-party store come from, and what its first install decides; nothing for any other source. */
+@Composable
+fun OriginLine(spec: SourceSpec, pinned: Boolean) {
+    val note = originNote(spec.type) ?: return
+    TrustLine(Trust.NOTE, stringResource(originText(note, pinned), sourceName(spec)))
+}
diff --git a/app/src/main/kotlin/io/github/munzzyy/tern/ui/add/PreviewCard.kt b/app/src/main/kotlin/io/github/munzzyy/tern/ui/add/PreviewCard.kt
index e6b53f32..75017f24 100644
--- a/app/src/main/kotlin/io/github/munzzyy/tern/ui/add/PreviewCard.kt
+++ b/app/src/main/kotlin/io/github/munzzyy/tern/ui/add/PreviewCard.kt
@@ -117,11 +117,7 @@ fun PreviewCard(found: Detection.Found, carried: List<CarriedSetting>, onAdd: (i
             val origin = originNote(found.spec.type)
             if (found.warnings.isNotEmpty() || origin != null) {
                 Column(verticalArrangement = Arrangement.spacedBy(look.gapSmall)) {
-                    when (origin) {
-                        OriginNote.MODIFIED -> TrustLine(Trust.BAD, stringResource(R.string.preview_modified, sourceName(found.spec)))
-                        OriginNote.REPUBLISHED -> TrustLine(Trust.NOTE, stringResource(R.string.preview_republished, sourceName(found.spec)))
-                        null -> Unit
-                    }
+                    OriginLine(found.spec, pinned = previewPinned(found))
                     for (w in found.warnings.take(MAX_WARNINGS)) TrustLine(Trust.BAD, w)
                 }
             }
@@ -203,14 +199,4 @@ fun FoundIcon(found: Detection.Found, size: Dp, modifier: Modifier = Modifier) {
     }
 }
 
-/** What an app's page says about where a file comes from, when it is not from the developer's own channels. */
-enum class OriginNote { REPUBLISHED, MODIFIED }
-
-fun originNote(type: String): OriginNote? = when (type) {
-    in SourceTypes.MODIFIED -> OriginNote.MODIFIED
-    in SourceTypes.REPUBLISHING -> OriginNote.REPUBLISHED
-    else -> null
-}
 
-/** The store's own name, or its host where it has none. */
-fun sourceName(spec: SourceSpec): String = SourceTypes.displayName(spec.type) ?: hostOf(spec.url)
diff --git a/app/src/main/kotlin/io/github/munzzyy/tern/ui/add/ReadingCard.kt b/app/src/main/kotlin/io/github/munzzyy/tern/ui/add/ReadingCard.kt
index 87d98532..18cf1494 100644
--- a/app/src/main/kotlin/io/github/munzzyy/tern/ui/add/ReadingCard.kt
+++ b/app/src/main/kotlin/io/github/munzzyy/tern/ui/add/ReadingCard.kt
@@ -10,14 +10,17 @@ import androidx.compose.material3.OutlinedTextField
 import androidx.compose.material3.Text
 import androidx.compose.runtime.Composable
 import androidx.compose.runtime.CompositionLocalProvider
+import androidx.compose.runtime.getValue
 import androidx.compose.ui.Alignment
 import androidx.compose.ui.Modifier
 import androidx.compose.ui.platform.testTag
 import androidx.compose.ui.res.stringResource
 import androidx.compose.ui.text.input.KeyboardType
 import androidx.compose.ui.unit.dp
+import androidx.lifecycle.compose.collectAsStateWithLifecycle
 import io.github.munzzyy.tern.R
 import io.github.munzzyy.tern.core.source.SourceTypes
+import io.github.munzzyy.tern.ui.LocalEngine
 import io.github.munzzyy.tern.ui.common.ActionRow
 import io.github.munzzyy.tern.ui.common.ChoiceRow
 import io.github.munzzyy.tern.ui.common.SectionCard
@@ -36,6 +39,9 @@ const val ADD_PACKAGE_TAG = "add_package"
 /** What an address may be read as, Automatic first, as Obtainium's "override source" offers it. */
 val READ_AS_CHOICES: List<String?> = listOf<String?>(null) + SourceTypes.OVERRIDABLE
 
+/** [READ_AS_CHOICES] without the third-party stores while those are off. */
+fun readAsChoices(storesOn: Boolean): List<String?> = if (storesOn) READ_AS_CHOICES else READ_AS_CHOICES.filter { it !in SourceTypes.THIRD_PARTY_STORES }
+
 /** A kind of source as the choice names it. */
 @Composable
 fun readAsLabel(type: String?): String = when (type) {
@@ -63,9 +69,10 @@ fun ReadingCard(vm: AddViewModel, answered: Boolean) {
             modifier = Modifier.testTag(ADD_OPTIONS_TAG),
         )
         if (!vm.optionsOpen) return@SectionCard
+        val settings by LocalEngine.current.settings.collectAsStateWithLifecycle()
         ChoiceRow(
             title = stringResource(R.string.add_read_as),
-            options = READ_AS_CHOICES,
+            options = readAsChoices(settings.thirdPartyStores),
             selected = vm.readAs,
             label = { readAsLabel(it) },
             onSelect = vm::pickReadAs,
diff --git a/app/src/main/kotlin/io/github/munzzyy/tern/ui/add/SearchPlaces.kt b/app/src/main/kotlin/io/github/munzzyy/tern/ui/add/SearchPlaces.kt
index 493bfff2..42f9f7c3 100644
--- a/app/src/main/kotlin/io/github/munzzyy/tern/ui/add/SearchPlaces.kt
+++ b/app/src/main/kotlin/io/github/munzzyy/tern/ui/add/SearchPlaces.kt
@@ -2,14 +2,9 @@ package io.github.munzzyy.tern.ui.add
 
 import androidx.compose.foundation.layout.Arrangement
 import androidx.compose.foundation.layout.Column
-import androidx.compose.foundation.layout.FlowRow
 import androidx.compose.foundation.layout.fillMaxWidth
 import androidx.compose.foundation.layout.padding
-import androidx.compose.foundation.layout.size
 import androidx.compose.foundation.text.KeyboardOptions
-import androidx.compose.material3.FilterChip
-import androidx.compose.material3.FilterChipDefaults
-import androidx.compose.material3.Icon
 import androidx.compose.material3.MaterialTheme
 import androidx.compose.material3.OutlinedTextField
 import androidx.compose.material3.Text
@@ -22,6 +17,7 @@ import androidx.compose.runtime.saveable.rememberSaveable
 import androidx.compose.runtime.setValue
 import androidx.compose.ui.Modifier
 import androidx.compose.ui.res.stringResource
+import androidx.compose.ui.semantics.Role
 import androidx.compose.ui.semantics.heading
 import androidx.compose.ui.semantics.semantics
 import androidx.compose.ui.text.input.KeyboardType
@@ -32,11 +28,12 @@ import io.github.munzzyy.tern.data.SettingsStore
 import io.github.munzzyy.tern.engine.Settings
 import io.github.munzzyy.tern.engine.real.Search
 import io.github.munzzyy.tern.ui.LocalEngine
+import io.github.munzzyy.tern.ui.common.ChipLines
+import io.github.munzzyy.tern.ui.common.ChoiceChip
 import io.github.munzzyy.tern.ui.common.rememberActions
 import io.github.munzzyy.tern.ui.common.textFieldKeys
 import kotlinx.coroutines.CancellationException
 import kotlinx.coroutines.delay
-import io.github.munzzyy.tern.ui.icons.Glyphs
 import io.github.munzzyy.tern.ui.theme.LocalLook
 
 /** The places a search looks in after [picked] was switched: at least one always stays. */
@@ -56,7 +53,7 @@ fun SearchPlaces(modifier: Modifier = Modifier) {
     val look = LocalLook.current
     val actions = rememberActions()
     val settings by engine.settings.collectAsStateWithLifecycle()
-    val places = remember(engine) { engine.searchOrigins }
+    val places = remember(engine, settings.thirdPartyStores) { engine.searchOrigins }
     Column(modifier, verticalArrangement = Arrangement.spacedBy(look.gapSmall / 2)) {
         Text(
             stringResource(R.string.search_in),
@@ -64,27 +61,17 @@ fun SearchPlaces(modifier: Modifier = Modifier) {
             color = MaterialTheme.colorScheme.onSurfaceVariant,
             modifier = Modifier.padding(horizontal = look.focusRoom).semantics { heading() },
         )
-        FlowRow(
-            horizontalArrangement = Arrangement.spacedBy(look.gapSmall),
-            verticalArrangement = Arrangement.spacedBy(look.gapSmall / 2),
-            modifier = Modifier.padding(horizontal = look.focusRoom),
-        ) {
-            for (place in places) {
-                val on = place in settings.searchIn
-                FilterChip(
-                    selected = on,
-                    onClick = {
-                        val next = settings.copy(searchIn = toggledPlaces(settings.searchIn, place))
-                        actions.run { engine.saveSettings(next) }
-                    },
-                    label = { Text(if (place == Search.CODEBERG_PLACE) Search.forgejoOrigin(settings.searchForgejo) else place) },
-                    leadingIcon = if (on) {
-                        { Icon(Glyphs.Check, contentDescription = null, modifier = Modifier.size(FilterChipDefaults.IconSize)) }
-                    } else {
-                        null
-                    },
-                )
-            }
+        ChipLines(places, modifier = Modifier.padding(horizontal = look.focusRoom)) { _, place, stop ->
+            ChoiceChip(
+                if (place == Search.CODEBERG_PLACE) Search.forgejoOrigin(settings.searchForgejo) else place,
+                selected = place in settings.searchIn,
+                onClick = {
+                    val next = settings.copy(searchIn = toggledPlaces(settings.searchIn, place))
+                    actions.run { engine.saveSettings(next) }
+                },
+                modifier = stop,
+                role = Role.Checkbox,
+            )
         }
         val forgejo = Search.CODEBERG_PLACE in settings.searchIn
         if (forgejo || "GitHub" in settings.searchIn) SearchScope(forgejo)
diff --git a/app/src/main/kotlin/io/github/munzzyy/tern/ui/add/StoresOffCard.kt b/app/src/main/kotlin/io/github/munzzyy/tern/ui/add/StoresOffCard.kt
new file mode 100644
index 00000000..e4c565f1
--- /dev/null
+++ b/app/src/main/kotlin/io/github/munzzyy/tern/ui/add/StoresOffCard.kt
@@ -0,0 +1,29 @@
+package io.github.munzzyy.tern.ui.add
+
+import androidx.compose.foundation.layout.Arrangement
+import androidx.compose.foundation.layout.Column
+import androidx.compose.material3.MaterialTheme
+import androidx.compose.material3.Text
+import androidx.compose.runtime.Composable
+import androidx.compose.ui.Modifier
+import androidx.compose.ui.platform.testTag
+import androidx.compose.ui.res.stringResource
+import io.github.munzzyy.tern.R
+import io.github.munzzyy.tern.core.source.SourceTypes
+import io.github.munzzyy.tern.ui.common.SectionCard
+import io.github.munzzyy.tern.ui.common.TonalButton
+import io.github.munzzyy.tern.ui.theme.LocalLook
+
+const val STORES_ON_TAG = "stores_turn_on"
+
+/** Said for an address of a third-party store while those are off: what they are, and the one way to turn them on. Nothing was asked of the store. */
+@Composable
+fun StoresOffCard(type: String, onTurnOn: () -> Unit) {
+    val look = LocalLook.current
+    SectionCard(title = stringResource(R.string.stores_off_title, SourceTypes.displayName(type) ?: type), padded = true) {
+        Column(verticalArrangement = Arrangement.spacedBy(look.gapSmall)) {
+            Text(stringResource(R.string.stores_off_body), style = MaterialTheme.typography.bodyMedium)
+            TonalButton(stringResource(R.string.stores_turn_on), onClick = onTurnOn, modifier = Modifier.testTag(STORES_ON_TAG))
+        }
+    }
+}
diff --git a/app/src/main/kotlin/io/github/munzzyy/tern/ui/add/SupportedSources.kt b/app/src/main/kotlin/io/github/munzzyy/tern/ui/add/SupportedSources.kt
index a902b68d..88aa50bc 100644
--- a/app/src/main/kotlin/io/github/munzzyy/tern/ui/add/SupportedSources.kt
+++ b/app/src/main/kotlin/io/github/munzzyy/tern/ui/add/SupportedSources.kt
@@ -18,6 +18,7 @@ import androidx.compose.ui.Modifier
 import androidx.compose.ui.res.stringResource
 import androidx.compose.ui.semantics.heading
 import androidx.compose.ui.semantics.semantics
+import androidx.lifecycle.compose.collectAsStateWithLifecycle
 import io.github.munzzyy.tern.R
 import io.github.munzzyy.tern.core.source.SourceTypes
 import io.github.munzzyy.tern.ui.LocalEngine
@@ -32,7 +33,7 @@ import io.github.munzzyy.tern.ui.theme.LocalLook
 const val SHARED_CONFIGS_URL = "https://apps.obtainium.imranr.dev/"
 
 /** The kinds of place Tern reads, in the order the list shows them. */
-enum class SourceKind { FORGES, REPOSITORIES, STORES, MIRRORS, MODIFIED, OTHER }
+enum class SourceKind { FORGES, REPOSITORIES, STORES, MIRRORS, OTHER }
 
 /** Every kind with the sources of it, each named as people know it. */
 fun sourcesByKind(): List<Pair<SourceKind, List<String>>> {
@@ -41,11 +42,8 @@ fun sourcesByKind(): List<Pair<SourceKind, List<String>>> {
         val kind = when (type) {
             SourceTypes.GITHUB, SourceTypes.GITHUB_ACTIONS, SourceTypes.GITLAB, SourceTypes.FORGEJO -> SourceKind.FORGES
             SourceTypes.FDROID, SourceTypes.FDROID_REPO -> SourceKind.REPOSITORIES
-            in SourceTypes.MODIFIED -> SourceKind.MODIFIED
             in SourceTypes.REPUBLISHING -> SourceKind.MIRRORS
-            SourceTypes.HUAWEI, SourceTypes.SAMSUNG, SourceTypes.VIVO, SourceTypes.TENCENT, SourceTypes.RUSTORE,
-            SourceTypes.COOLAPK, SourceTypes.ITCHIO,
-            -> SourceKind.STORES
+            in SourceTypes.THIRD_PARTY_STORES -> SourceKind.STORES
             else -> SourceKind.OTHER
         }
         kinds.getOrPut(kind) { mutableListOf() } += type
@@ -78,7 +76,9 @@ fun SourcesCard(modifier: Modifier = Modifier) {
 private fun SourcesDialog(onDismiss: () -> Unit) {
     val look = LocalLook.current
     val engine = LocalEngine.current
-    val searchable = remember(engine) { engine.searchOrigins.toSet() }
+    val settings by engine.settings.collectAsStateWithLifecycle()
+    val searchable = remember(engine, settings.thirdPartyStores) { engine.searchOrigins.toSet() }
+    val offWord = stringResource(R.string.stores_off_tag)
     val searchWord = stringResource(R.string.sources_searchable)
     val trackWord = stringResource(R.string.sources_track_only)
     val general = mapOf(
@@ -99,6 +99,7 @@ private fun SourcesDialog(onDismiss: () -> Unit) {
                             val tags = listOfNotNull(
                                 searchWord.takeIf { name in searchable || (type == SourceTypes.FORGEJO && "Codeberg" in searchable) },
                                 trackWord.takeIf { type in SourceTypes.TRACK_ONLY },
+                                offWord.takeIf { type in SourceTypes.THIRD_PARTY_STORES && !settings.thirdPartyStores },
                             )
                             if (tags.isEmpty()) name else "$name (${tags.joinToString()})"
                         },
@@ -119,7 +120,6 @@ private fun kindName(kind: SourceKind): String = stringResource(
         SourceKind.REPOSITORIES -> R.string.sources_repositories
         SourceKind.STORES -> R.string.sources_stores
         SourceKind.MIRRORS -> R.string.sources_mirrors
-        SourceKind.MODIFIED -> R.string.sources_modified
         SourceKind.OTHER -> R.string.sources_other
     },
 )
diff --git a/app/src/main/kotlin/io/github/munzzyy/tern/ui/apps/AppList.kt b/app/src/main/kotlin/io/github/munzzyy/tern/ui/apps/AppList.kt
index a8ef9753..375442ac 100644
--- a/app/src/main/kotlin/io/github/munzzyy/tern/ui/apps/AppList.kt
+++ b/app/src/main/kotlin/io/github/munzzyy/tern/ui/apps/AppList.kt
@@ -97,6 +97,26 @@ data class AppSections(val updates: List<AppRow>, val others: List<AppRow>, val
     val isEmpty: Boolean get() = updates.isEmpty() && others.isEmpty()
 }
 
+fun headerKey(group: RowGroup): String = "g-${group.key}"
+
+/**
+ * The key of what focus lands on when the list opens under keys: its first app, or the header of
+ * the first group when that group is [folded]. An app in a group is keyed by the group and its id,
+ * so an app filed under two categories has a place of its own in each.
+ */
+fun firstPlace(sections: AppSections, folded: Set<String>): String? {
+    sections.updates.firstOrNull()?.let { return it.id }
+    val group = sections.groups.firstOrNull() ?: return sections.others.firstOrNull()?.id
+    val first = group.rows.firstOrNull()
+    return if (group.key in folded || first == null) headerKey(group) else group.key + first.id
+}
+
+/** The apps the list shows: none of those inside a folded group, and an app shown twice only once. */
+fun shownIds(sections: AppSections, folded: Set<String>): List<String> {
+    val others = if (sections.groups.isEmpty()) sections.others else sections.groups.filter { it.key !in folded }.flatMap { it.rows }
+    return (sections.updates + others).map { it.id }.distinct()
+}
+
 fun categoriesOf(rows: List<AppRow>, locale: Locale = Locale.getDefault()): List<String> {
     val collator = Collator.getInstance(locale)
     return rows.flatMap { it.config.categories }.map { it.trim() }.filter { it.isNotEmpty() }
diff --git a/app/src/main/kotlin/io/github/munzzyy/tern/ui/apps/AppRowItem.kt b/app/src/main/kotlin/io/github/munzzyy/tern/ui/apps/AppRowItem.kt
index 79f130f5..3d0e288b 100644
--- a/app/src/main/kotlin/io/github/munzzyy/tern/ui/apps/AppRowItem.kt
+++ b/app/src/main/kotlin/io/github/munzzyy/tern/ui/apps/AppRowItem.kt
@@ -14,6 +14,7 @@ import androidx.compose.foundation.layout.fillMaxWidth
 import androidx.compose.foundation.layout.heightIn
 import androidx.compose.foundation.layout.padding
 import androidx.compose.foundation.layout.size
+import androidx.compose.foundation.layout.wrapContentSize
 import androidx.compose.material3.Checkbox
 import androidx.compose.material3.Icon
 import androidx.compose.material3.LinearProgressIndicator
@@ -59,6 +60,7 @@ import io.github.munzzyy.tern.ui.common.StatusLine
 import io.github.munzzyy.tern.ui.common.TonalButton
 import io.github.munzzyy.tern.ui.common.confirmInstall
 import io.github.munzzyy.tern.ui.common.focusLook
+import io.github.munzzyy.tern.ui.common.pressRoom
 import io.github.munzzyy.tern.ui.common.rememberHaptics
 import io.github.munzzyy.tern.ui.common.rememberActions
 import io.github.munzzyy.tern.ui.icons.AppIcon
@@ -75,6 +77,7 @@ import io.github.munzzyy.tern.ui.text.isWaitingForUser
 import io.github.munzzyy.tern.ui.text.isolate
 import io.github.munzzyy.tern.ui.text.ltr
 import io.github.munzzyy.tern.ui.text.shortUrl
+import io.github.munzzyy.tern.ui.text.isPaused
 import io.github.munzzyy.tern.ui.text.statusLabel
 import io.github.munzzyy.tern.ui.text.versionChange
 import io.github.munzzyy.tern.ui.theme.LocalLook
@@ -254,6 +257,7 @@ private fun RowText(row: AppRow, highlighted: Boolean, large: Boolean, onChanges
         val moved = row.movedTo
         when {
             row.progress != null -> Unit
+            isPaused(row) -> PausedLine(quiet)
             moved != null -> MovedLine(moved, quiet)
             else -> ReleaseLine(row, quiet, onChanges)
         }
@@ -269,6 +273,16 @@ private fun RowText(row: AppRow, highlighted: Boolean, large: Boolean, onChanges
     }
 }
 
+/** Why an app of a third-party store is neither checked nor installed now. */
+@Composable
+private fun PausedLine(ink: Color) {
+    val look = LocalLook.current
+    Row(verticalAlignment = Alignment.CenterVertically, horizontalArrangement = Arrangement.spacedBy(look.gapSmall / 2)) {
+        Icon(Glyphs.Info, contentDescription = null, tint = MaterialTheme.colorScheme.tertiary, modifier = Modifier.size(look.glyphSmall))
+        Text(stringResource(R.string.stores_row_paused), style = MaterialTheme.typography.bodySmall, color = ink, maxLines = 2, overflow = TextOverflow.Ellipsis)
+    }
+}
+
 /** Where the project says it lives now, as its page says it. */
 @Composable
 private fun MovedLine(movedTo: String, ink: Color) {
@@ -304,9 +318,11 @@ private fun ReleaseLine(row: AppRow, ink: Color, onChanges: (() -> Unit)?) {
                 color = MaterialTheme.colorScheme.primary,
                 textDecoration = TextDecoration.Underline,
                 modifier = Modifier
+                    .pressRoom(look.touchTarget)
                     .focusLook(shape)
                     .clip(shape)
                     .clickable(role = Role.Button, onClick = onChanges)
+                    .wrapContentSize()
                     .padding(horizontal = look.gapSmall / 2, vertical = look.gapSmall / 4),
             )
         }
diff --git a/app/src/main/kotlin/io/github/munzzyy/tern/ui/apps/AppsScreen.kt b/app/src/main/kotlin/io/github/munzzyy/tern/ui/apps/AppsScreen.kt
index e11f3dcd..932aac2d 100644
--- a/app/src/main/kotlin/io/github/munzzyy/tern/ui/apps/AppsScreen.kt
+++ b/app/src/main/kotlin/io/github/munzzyy/tern/ui/apps/AppsScreen.kt
@@ -12,6 +12,7 @@ import androidx.compose.foundation.layout.PaddingValues
 import androidx.compose.foundation.layout.Row
 import androidx.compose.foundation.layout.fillMaxSize
 import androidx.compose.foundation.layout.fillMaxWidth
+import androidx.compose.foundation.layout.heightIn
 import androidx.compose.foundation.layout.padding
 import androidx.compose.foundation.layout.size
 import androidx.compose.foundation.lazy.LazyColumn
@@ -183,7 +184,7 @@ fun AppsScreen(
                 SelectionTopBar(
                     picked = picked,
                     onClose = vm::stopSelecting,
-                    onSelectAll = { vm.selectAll(state.sections.updates.map { it.id } + state.sections.others.map { it.id }) },
+                    onSelectAll = { vm.selectAll(shownIds(state.sections, collapsed)) },
                     onAction = { pending = it },
                 )
                 return@Scaffold
@@ -360,9 +361,9 @@ private fun AppList(
     val look = LocalLook.current
     val sections = state.sections
     val categoryColors = LocalEngine.current.settings.collectAsStateWithLifecycle().value.categoryColors
-    val firstId = (sections.updates.firstOrNull() ?: sections.others.firstOrNull())?.id
-    val rowFocus: (String) -> Modifier = { id ->
-        Modifier.returnFocus(screen, id).then(if (id == firstId) Modifier.firstFocus(screen) else Modifier)
+    val landing = remember(sections, collapsed) { firstPlace(sections, collapsed) }
+    val rowFocus: (String) -> Modifier = { key ->
+        Modifier.returnFocus(screen, key).then(if (key == landing) Modifier.firstFocus(screen) else Modifier)
     }
     BoxWithConstraints(Modifier.fillMaxSize()) {
     val place = actionPlace(maxWidth, look.iconList, LocalDensity.current.fontScale, LocalNoTouch.current)
@@ -399,9 +400,9 @@ private fun AppList(
         if (sections.groups.isNotEmpty()) {
             for (group in sections.groups) {
                 val folded = group.key in collapsed
-                item(key = "g-${group.key}", contentType = "group") {
+                item(key = headerKey(group), contentType = "group") {
                     val dot = group.title?.takeIf { group.key.startsWith(CATEGORY_GROUP) }?.let { categoryColor(it, categoryColors) }
-                    GroupHeader(group.title ?: stringResource(R.string.group_other), group.rows.size, folded, dot) { onToggleGroup(group.key) }
+                    GroupHeader(group.title ?: stringResource(R.string.group_other), group.rows.size, folded, dot, rowFocus(headerKey(group))) { onToggleGroup(group.key) }
                 }
                 if (!folded) rows(group.rows, selectedId, onOpen, onRemove, selection, onSelect, rowFocus, place, swipe, keyPrefix = group.key)
             }
@@ -434,7 +435,7 @@ private fun LazyListScope.rows(
                 row,
                 selected = row.id == selectedId,
                 onOpen = { onOpen(row.id) },
-                modifier = if (keyPrefix.isEmpty()) rowFocus(row.id) else Modifier,
+                modifier = rowFocus(keyPrefix + row.id),
                 selecting = selection != null,
                 checked = selection?.contains(row.id) == true,
                 onSelect = { onSelect(row.id) },
@@ -448,7 +449,7 @@ private fun LazyListScope.rows(
 
 /** The name of a group, how many apps it holds, and a press to fold it away or open it again. */
 @Composable
-private fun GroupHeader(title: String, count: Int, folded: Boolean, dot: Color?, onToggle: () -> Unit) {
+internal fun GroupHeader(title: String, count: Int, folded: Boolean, dot: Color?, focus: Modifier, onToggle: () -> Unit) {
     val look = LocalLook.current
     val spoken = stringResource(if (folded) R.string.group_folded else R.string.group_open)
     Row(
@@ -457,6 +458,7 @@ private fun GroupHeader(title: String, count: Int, folded: Boolean, dot: Color?,
         modifier = Modifier
             .fillMaxWidth()
             .padding(horizontal = look.focusRoom, vertical = look.focusRoom / 2)
+            .then(focus)
             .focusLook(MaterialTheme.shapes.medium)
             .clip(MaterialTheme.shapes.medium)
             .clickable(onClick = onToggle)
@@ -464,6 +466,7 @@ private fun GroupHeader(title: String, count: Int, folded: Boolean, dot: Color?,
                 heading()
                 stateDescription = spoken
             }
+            .heightIn(min = look.touchTarget)
             .padding(horizontal = look.rowPaddingHorizontal - look.focusRoom, vertical = look.gapSmall),
     ) {
         if (dot != null) ColorDot(dot)
diff --git a/app/src/main/kotlin/io/github/munzzyy/tern/ui/apps/Bulk.kt b/app/src/main/kotlin/io/github/munzzyy/tern/ui/apps/Bulk.kt
index 98f18640..a39dfc6e 100644
--- a/app/src/main/kotlin/io/github/munzzyy/tern/ui/apps/Bulk.kt
+++ b/app/src/main/kotlin/io/github/munzzyy/tern/ui/apps/Bulk.kt
@@ -7,7 +7,7 @@ import io.github.munzzyy.tern.ui.detail.toggledCategory
 import io.github.munzzyy.tern.ui.text.canInstallNow
 import io.github.munzzyy.tern.ui.text.canUpdateNow
 
-enum class BulkAction { CATEGORY, CHECK, UPDATE, REMOVE, FAVORITE, MODE, SHARE_ADDRESSES, SHARE_EXPORT, UNINSTALL, MARK_SEEN, SAVE_FILES, INSTALL, SHARE_LINKS }
+enum class BulkAction { CATEGORY, CHECK, UPDATE, REMOVE, FAVORITE, MODE, SHARE_ADDRESSES, SHARE_EXPORT, UNINSTALL, MARK_SEEN, SAVE_FILES, INSTALL, SHARE_LINKS, SHARE_OBTAINIUM_LINKS }
 
 const val MAX_CATEGORY = 40
 
diff --git a/app/src/main/kotlin/io/github/munzzyy/tern/ui/apps/FilterDialog.kt b/app/src/main/kotlin/io/github/munzzyy/tern/ui/apps/FilterDialog.kt
index eece3e24..aeade674 100644
--- a/app/src/main/kotlin/io/github/munzzyy/tern/ui/apps/FilterDialog.kt
+++ b/app/src/main/kotlin/io/github/munzzyy/tern/ui/apps/FilterDialog.kt
@@ -2,12 +2,9 @@ package io.github.munzzyy.tern.ui.apps
 
 import androidx.compose.foundation.layout.Arrangement
 import androidx.compose.foundation.layout.Column
-import androidx.compose.foundation.layout.ExperimentalLayoutApi
-import androidx.compose.foundation.layout.FlowRow
 import androidx.compose.foundation.layout.fillMaxWidth
 import androidx.compose.foundation.layout.padding
 import androidx.compose.foundation.rememberScrollState
-import androidx.compose.foundation.selection.selectableGroup
 import androidx.compose.foundation.text.KeyboardOptions
 import androidx.compose.foundation.verticalScroll
 import androidx.compose.material3.AlertDialog
@@ -25,6 +22,7 @@ import androidx.compose.ui.text.input.ImeAction
 import androidx.lifecycle.compose.collectAsStateWithLifecycle
 import io.github.munzzyy.tern.R
 import io.github.munzzyy.tern.ui.LocalEngine
+import io.github.munzzyy.tern.ui.common.ChipLines
 import io.github.munzzyy.tern.ui.common.ChoiceChip
 import io.github.munzzyy.tern.ui.common.SwitchRow
 import io.github.munzzyy.tern.ui.common.focusHighlight
@@ -100,7 +98,6 @@ private fun Words(label: String, value: String, onValue: (String) -> Unit) {
 }
 
 /** Chips of one kind, any number of them on; the list keeps an app that is under any of them. */
-@OptIn(ExperimentalLayoutApi::class)
 @Composable
 private fun Chips(
     title: String,
@@ -117,20 +114,15 @@ private fun Chips(
             .padding(horizontal = look.rowPaddingHorizontal, vertical = look.rowPaddingVertical),
     ) {
         Text(title, style = MaterialTheme.typography.bodyLarge)
-        FlowRow(
-            horizontalArrangement = Arrangement.spacedBy(look.focusRoom * 2),
-            verticalArrangement = Arrangement.spacedBy(look.focusRoom + (look.touchTarget - look.choiceHeight)),
-            modifier = Modifier.selectableGroup(),
-        ) {
-            for ((label, chip) in chips) {
-                ChoiceChip(
-                    label,
-                    selected = filter.has(chip),
-                    onClick = { onChange(filter.toggled(chip)) },
-                    role = Role.Checkbox,
-                    dot = (chip as? AppFilter.Category)?.let { dot(it.name) },
-                )
-            }
+        ChipLines(chips) { _, (label, chip), stop ->
+            ChoiceChip(
+                label,
+                selected = filter.has(chip),
+                onClick = { onChange(filter.toggled(chip)) },
+                modifier = stop,
+                role = Role.Checkbox,
+                dot = (chip as? AppFilter.Category)?.let { dot(it.name) },
+            )
         }
     }
 }
diff --git a/app/src/main/kotlin/io/github/munzzyy/tern/ui/apps/Selection.kt b/app/src/main/kotlin/io/github/munzzyy/tern/ui/apps/Selection.kt
index e68266c8..8a6f13f6 100644
--- a/app/src/main/kotlin/io/github/munzzyy/tern/ui/apps/Selection.kt
+++ b/app/src/main/kotlin/io/github/munzzyy/tern/ui/apps/Selection.kt
@@ -110,6 +110,7 @@ private fun BulkMenu(picked: List<AppRow>, onAction: (BulkAction) -> Unit) {
                 BulkAction.MODE to R.string.action_set_mode,
                 BulkAction.SHARE_ADDRESSES to R.string.action_share_addresses,
                 BulkAction.SHARE_LINKS to R.string.action_share_config_links,
+                BulkAction.SHARE_OBTAINIUM_LINKS to R.string.share_obtainium_links,
                 BulkAction.SHARE_EXPORT to R.string.action_share_export,
                 BulkAction.MARK_SEEN to R.string.action_mark_seen,
                 BulkAction.SAVE_FILES to R.string.action_save_files,
@@ -296,10 +297,12 @@ fun BulkDialog(action: BulkAction, picked: List<AppRow>, engine: Engine, actions
                 onDismiss = onDismiss,
             )
         }
-        BulkAction.SHARE_LINKS -> {
+        BulkAction.SHARE_LINKS, BulkAction.SHARE_OBTAINIUM_LINKS -> {
             val context = LocalContext.current
-            val title = stringResource(R.string.action_share_config_links)
-            val links = remember(touched) { touched.mapNotNull { ConfigLink.web(it.config) } }
+            val title = stringResource(if (action == BulkAction.SHARE_LINKS) R.string.action_share_config_links else R.string.share_obtainium_links)
+            val links = remember(touched, action) {
+                touched.mapNotNull { if (action == BulkAction.SHARE_LINKS) ConfigLink.tern(it.config) else ConfigLink.web(it.config) }
+            }
             val left = n - links.size
             val leftOut = if (left > 0) pluralStringResource(R.plurals.share_links_left, left, left) else null
             LaunchedEffect(Unit) {
diff --git a/app/src/main/kotlin/io/github/munzzyy/tern/ui/common/Components.kt b/app/src/main/kotlin/io/github/munzzyy/tern/ui/common/Components.kt
index f0314fd4..a5607f69 100644
--- a/app/src/main/kotlin/io/github/munzzyy/tern/ui/common/Components.kt
+++ b/app/src/main/kotlin/io/github/munzzyy/tern/ui/common/Components.kt
@@ -59,6 +59,7 @@ import androidx.compose.ui.input.key.KeyEventType
 import androidx.compose.ui.input.key.key
 import androidx.compose.ui.input.key.onPreviewKeyEvent
 import androidx.compose.ui.input.key.type
+import androidx.compose.ui.layout.layout
 import androidx.compose.ui.platform.LocalFocusManager
 import androidx.compose.ui.graphics.Color
 import androidx.compose.ui.graphics.vector.ImageVector
@@ -70,6 +71,8 @@ import androidx.compose.ui.semantics.heading
 import androidx.compose.ui.semantics.semantics
 import androidx.compose.ui.text.style.TextAlign
 import androidx.compose.ui.text.style.TextOverflow
+import androidx.compose.ui.unit.Constraints
+import androidx.compose.ui.unit.Dp
 import io.github.munzzyy.tern.R
 import io.github.munzzyy.tern.core.model.SourceSpec
 import io.github.munzzyy.tern.ui.icons.Glyphs
@@ -132,6 +135,7 @@ private fun StatusLabel.glyph(): ImageVector = when (this) {
     StatusLabel.ERROR, StatusLabel.INSTALL_FAILED -> Glyphs.Failed
     StatusLabel.RATE_LIMITED, StatusLabel.WAITING -> Glyphs.Waiting
     StatusLabel.OFFLINE -> Glyphs.Offline
+    StatusLabel.PAUSED -> Glyphs.Waiting
     StatusLabel.CHECKING -> Glyphs.Busy
     StatusLabel.QUEUED -> Glyphs.Queued
     StatusLabel.DOWNLOADING -> Glyphs.Download
@@ -706,14 +710,25 @@ fun ScreenTop(
                 .windowInsetsPadding(WindowInsets.systemBars.only(WindowInsetsSides.Top + WindowInsetsSides.Horizontal))
                 .padding(horizontal = look.focusRoom, vertical = look.gapSmall / 2),
         ) {
-            Row(
-                verticalAlignment = Alignment.CenterVertically,
-                horizontalArrangement = Arrangement.spacedBy(look.focusRoom),
-                modifier = Modifier.heightIn(min = look.touchTarget + look.focusRoom),
-            ) {
-                back()
-                if (twoLines) Box(Modifier.weight(1f)) else words(Modifier.weight(1f).padding(horizontal = look.rowPaddingHorizontal - look.focusRoom))
-                actions()
+            if (twoLines) {
+                Row(
+                    verticalAlignment = Alignment.CenterVertically,
+                    horizontalArrangement = Arrangement.spacedBy(look.focusRoom),
+                    modifier = Modifier.heightIn(min = look.touchTarget + look.focusRoom),
+                ) {
+                    back()
+                    Box(Modifier.weight(1f))
+                    actions()
+                }
+            } else {
+                TopLine(
+                    back = back,
+                    title = { words(Modifier.padding(horizontal = look.rowPaddingHorizontal - look.focusRoom)) },
+                    actions = actions,
+                    gap = look.focusRoom,
+                    minHeight = look.touchTarget + look.focusRoom,
+                    below = look.gapSmall,
+                )
             }
             if (twoLines) {
                 words(Modifier.padding(start = look.rowPaddingHorizontal - look.focusRoom, end = look.rowPaddingHorizontal - look.focusRoom, bottom = look.gapSmall))
@@ -751,6 +766,19 @@ fun ChoiceChip(text: String, selected: Boolean, onClick: () -> Unit, modifier: M
     }
 }
 
+/**
+ * Takes presses over at least [min] each way around something smaller, such as a link inside a
+ * row, without taking that room from the layout: the rest reaches over what lies around it. Put
+ * it first, and centre the content after the clickable.
+ */
+fun Modifier.pressRoom(min: Dp): Modifier = layout { measurable, constraints ->
+    val side = min.roundToPx()
+    val width = measurable.maxIntrinsicWidth(constraints.maxHeight).coerceIn(constraints.minWidth, constraints.maxWidth)
+    val height = measurable.minIntrinsicHeight(width).coerceIn(constraints.minHeight, constraints.maxHeight)
+    val pressed = measurable.measure(Constraints.fixed(maxOf(width, side), maxOf(height, side)))
+    layout(width, height) { pressed.placeRelative((width - pressed.width) / 2, (height - pressed.height) / 2) }
+}
+
 /** A small round swatch, such as the colour of a category next to its name. */
 @Composable
 fun ColorDot(color: Color, modifier: Modifier = Modifier) {
@@ -768,7 +796,6 @@ fun ColorDot(color: Color, modifier: Modifier = Modifier) {
  * order, also from the end of one line to the start of the next when large text has wrapped
  * them. Up and down leave them, so a remote never has to walk through every line of one choice.
  */
-@OptIn(ExperimentalLayoutApi::class)
 @Composable
 fun ChoiceChips(
     title: String,
@@ -779,9 +806,6 @@ fun ChoiceChips(
     summary: String? = null,
 ) {
     val look = LocalLook.current
-    val focus = LocalFocusManager.current
-    val stops = remember(options.size) { List(options.size) { FocusRequester() } }
-    var inside by remember { mutableStateOf(false) }
     Column(
         verticalArrangement = Arrangement.spacedBy(look.gapSmall),
         modifier = modifier
@@ -789,41 +813,57 @@ fun ChoiceChips(
             .padding(horizontal = look.rowPaddingHorizontal, vertical = look.rowPaddingVertical),
     ) {
         Text(title, style = MaterialTheme.typography.bodyLarge)
-        FlowRow(
-            horizontalArrangement = Arrangement.spacedBy(look.focusRoom * 2),
-            verticalArrangement = Arrangement.spacedBy(look.focusRoom + (look.touchTarget - look.choiceHeight)),
-            modifier = Modifier
-                .selectableGroup()
-                .onFocusChanged { inside = it.hasFocus }
-                .onPreviewKeyEvent { event ->
-                    val direction = when (event.key) {
-                        Key.DirectionDown -> FocusDirection.Down
-                        Key.DirectionUp -> FocusDirection.Up
-                        else -> return@onPreviewKeyEvent false
-                    }
-                    if (event.type != KeyEventType.KeyDown) return@onPreviewKeyEvent true
-                    repeat(options.size) {
-                        if (!focus.moveFocus(direction) || !inside) return@onPreviewKeyEvent true
-                    }
-                    true
-                },
-        ) {
-            options.forEachIndexed { index, option ->
-                ChoiceChip(
-                    option,
-                    selected = index == selected,
-                    onClick = { onSelect(index) },
-                    modifier = Modifier
-                        .focusRequester(stops[index])
-                        .focusProperties {
-                            if (index > 0) start = stops[index - 1]
-                            if (index < stops.lastIndex) end = stops[index + 1]
-                        },
-                )
-            }
+        ChipLines(options) { index, option, stop ->
+            ChoiceChip(option, selected = index == selected, onClick = { onSelect(index) }, modifier = stop)
         }
         if (summary != null) {
             Text(summary, style = MaterialTheme.typography.bodyMedium, color = MaterialTheme.colorScheme.onSurfaceVariant)
         }
     }
 }
+
+/**
+ * [items] as chips on as many lines as they need. Left and right move between them in their
+ * order, also from the end of one line to the start of the next, and up and down leave them, so a
+ * remote never walks through every line. [chip] draws one and puts the modifier it is handed on it.
+ */
+@OptIn(ExperimentalLayoutApi::class)
+@Composable
+fun <T> ChipLines(items: List<T>, modifier: Modifier = Modifier, chip: @Composable (index: Int, item: T, stop: Modifier) -> Unit) {
+    val look = LocalLook.current
+    val focus = LocalFocusManager.current
+    val stops = remember(items.size) { List(items.size) { FocusRequester() } }
+    var inside by remember { mutableStateOf(false) }
+    FlowRow(
+        horizontalArrangement = Arrangement.spacedBy(look.focusRoom * 2),
+        verticalArrangement = Arrangement.spacedBy(look.focusRoom + (look.touchTarget - look.choiceHeight)),
+        modifier = modifier
+            .selectableGroup()
+            .onFocusChanged { inside = it.hasFocus }
+            .onPreviewKeyEvent { event ->
+                val direction = when (event.key) {
+                    Key.DirectionDown -> FocusDirection.Down
+                    Key.DirectionUp -> FocusDirection.Up
+                    else -> return@onPreviewKeyEvent false
+                }
+                if (event.type != KeyEventType.KeyDown) return@onPreviewKeyEvent true
+                repeat(items.size) {
+                    if (!focus.moveFocus(direction) || !inside) return@onPreviewKeyEvent true
+                }
+                true
+            },
+    ) {
+        items.forEachIndexed { index, item ->
+            chip(
+                index,
+                item,
+                Modifier
+                    .focusRequester(stops[index])
+                    .focusProperties {
+                        if (index > 0) start = stops[index - 1]
+                        if (index < stops.lastIndex) end = stops[index + 1]
+                    },
+            )
+        }
+    }
+}
diff --git a/app/src/main/kotlin/io/github/munzzyy/tern/ui/common/LinkCheckDialog.kt b/app/src/main/kotlin/io/github/munzzyy/tern/ui/common/LinkCheckDialog.kt
new file mode 100644
index 00000000..dd56adac
--- /dev/null
+++ b/app/src/main/kotlin/io/github/munzzyy/tern/ui/common/LinkCheckDialog.kt
@@ -0,0 +1,29 @@
+package io.github.munzzyy.tern.ui.common
+
+import androidx.compose.material3.AlertDialog
+import androidx.compose.material3.Text
+import androidx.compose.material3.TextButton
+import androidx.compose.runtime.Composable
+import androidx.compose.ui.Modifier
+import androidx.compose.ui.res.pluralStringResource
+import androidx.compose.ui.res.stringResource
+import io.github.munzzyy.tern.R
+
+/**
+ * Asked when a web page or another app sends a tern:// or obtainium:// link for a check: Tern
+ * reaches the sources only once the person says so. [appName] is the one app the link names,
+ * null for the whole list of [count] apps.
+ */
+@Composable
+fun LinkCheckDialog(appName: String?, count: Int, onCheck: () -> Unit, onDismiss: () -> Unit) {
+    AlertDialog(
+        modifier = Modifier.focusHighlight(),
+        onDismissRequest = onDismiss,
+        title = { Text(stringResource(R.string.link_check_title)) },
+        text = {
+            Text(if (appName != null) stringResource(R.string.link_check_one, appName) else pluralStringResource(R.plurals.link_check_all, count, count))
+        },
+        confirmButton = { TextButton(onClick = onCheck) { Text(stringResource(R.string.link_check_confirm)) } },
+        dismissButton = { TextButton(onClick = onDismiss, modifier = Modifier.focusWhenShown()) { Text(stringResource(R.string.link_check_not_now)) } },
+    )
+}
diff --git a/app/src/main/kotlin/io/github/munzzyy/tern/ui/common/TopLine.kt b/app/src/main/kotlin/io/github/munzzyy/tern/ui/common/TopLine.kt
new file mode 100644
index 00000000..d0cbeb9b
--- /dev/null
+++ b/app/src/main/kotlin/io/github/munzzyy/tern/ui/common/TopLine.kt
@@ -0,0 +1,65 @@
+package io.github.munzzyy.tern.ui.common
+
+import androidx.compose.foundation.layout.Arrangement
+import androidx.compose.foundation.layout.Row
+import androidx.compose.foundation.layout.RowScope
+import androidx.compose.runtime.Composable
+import androidx.compose.ui.Alignment
+import androidx.compose.ui.Modifier
+import androidx.compose.ui.layout.Layout
+import androidx.compose.ui.unit.Constraints
+import androidx.compose.ui.unit.Dp
+
+/** Back, title and actions on one line while the title's longest word fits there; otherwise the title goes under them, never broken inside a word. */
+@Composable
+internal fun TopLine(
+    back: @Composable () -> Unit,
+    title: @Composable () -> Unit,
+    actions: @Composable RowScope.() -> Unit,
+    gap: Dp,
+    minHeight: Dp,
+    below: Dp,
+    modifier: Modifier = Modifier,
+) {
+    Layout(
+        contents = listOf(back, title, { Row(verticalAlignment = Alignment.CenterVertically, horizontalArrangement = Arrangement.spacedBy(gap), content = actions) }),
+        modifier = modifier,
+    ) { (backs, titles, actionRows), constraints ->
+        val loose = constraints.copy(minWidth = 0, minHeight = 0)
+        val gapPx = gap.roundToPx()
+        val lineHeight = minHeight.roundToPx()
+        val backPlaced = backs.map { it.measure(loose) }
+        val actionsPlaced = actionRows.single().measure(loose)
+        val backWidth = backPlaced.sumOf { it.width + gapPx }
+        val actionsWidth = if (actionsPlaced.width > 0) actionsPlaced.width + gapPx else 0
+        val width = if (constraints.hasBoundedWidth) constraints.maxWidth else backWidth + actionsWidth + titles.sumOf { it.maxIntrinsicWidth(Constraints.Infinity) }
+        val room = (width - backWidth - actionsWidth).coerceAtLeast(0)
+        val words = titles.single()
+        if (words.minIntrinsicWidth(Constraints.Infinity) <= room) {
+            val titlePlaced = words.measure(Constraints(minWidth = room, maxWidth = room))
+            val height = maxOf(lineHeight, titlePlaced.height, actionsPlaced.height, backPlaced.maxOfOrNull { it.height } ?: 0)
+            layout(width, height) {
+                var x = 0
+                for (b in backPlaced) {
+                    b.placeRelative(x, (height - b.height) / 2)
+                    x += b.width + gapPx
+                }
+                titlePlaced.placeRelative(x, (height - titlePlaced.height) / 2)
+                actionsPlaced.placeRelative(width - actionsPlaced.width, (height - actionsPlaced.height) / 2)
+            }
+        } else {
+            val titlePlaced = words.measure(Constraints(maxWidth = width))
+            val top = maxOf(lineHeight, actionsPlaced.height, backPlaced.maxOfOrNull { it.height } ?: 0)
+            val belowPx = below.roundToPx()
+            layout(width, top + titlePlaced.height + belowPx) {
+                var x = 0
+                for (b in backPlaced) {
+                    b.placeRelative(x, (top - b.height) / 2)
+                    x += b.width + gapPx
+                }
+                actionsPlaced.placeRelative(width - actionsPlaced.width, (top - actionsPlaced.height) / 2)
+                titlePlaced.placeRelative(0, top)
+            }
+        }
+    }
+}
diff --git a/app/src/main/kotlin/io/github/munzzyy/tern/ui/detail/AppVerifier.kt b/app/src/main/kotlin/io/github/munzzyy/tern/ui/detail/AppVerifier.kt
index f2744ca5..db2e9bca 100644
--- a/app/src/main/kotlin/io/github/munzzyy/tern/ui/detail/AppVerifier.kt
+++ b/app/src/main/kotlin/io/github/munzzyy/tern/ui/detail/AppVerifier.kt
@@ -31,8 +31,8 @@ object AppVerifier {
 class VerifierSend(val intent: Intent, val name: String)
 
 /**
- * What to send for [row] to the first of [VerifiedApps.PACKAGES] on this device, or null when the
- * app is not installed or none of them is there.
+ * What to send for [row] to the first of [VerifiedApps.PACKAGES] on this device that carries its
+ * own certificate, or null when the app is not installed or no genuine verifier is there.
  */
 @Composable
 fun rememberAppVerifier(row: AppRow): VerifierSend? {
@@ -48,7 +48,7 @@ fun rememberAppVerifier(row: AppRow): VerifierSend? {
                 .setType("text/plain")
                 .putExtra(Intent.EXTRA_TEXT, AppVerifier.text(packageName, signers))
         }
-        val verifier = VerifiedApps.first { send(it).resolveActivity(pm) != null } ?: return@remember null
+        val verifier = VerifiedApps.first({ VerifiedApps.signers(pm, it) }) { send(it).resolveActivity(pm) != null } ?: return@remember null
         val name = try {
             pm.getApplicationLabel(pm.getApplicationInfo(verifier, 0)).toString().take(60)
         } catch (_: PackageManager.NameNotFoundException) {
diff --git a/app/src/main/kotlin/io/github/munzzyy/tern/ui/detail/DetailExtras.kt b/app/src/main/kotlin/io/github/munzzyy/tern/ui/detail/DetailExtras.kt
index d2542d74..038e49f2 100644
--- a/app/src/main/kotlin/io/github/munzzyy/tern/ui/detail/DetailExtras.kt
+++ b/app/src/main/kotlin/io/github/munzzyy/tern/ui/detail/DetailExtras.kt
@@ -2,7 +2,6 @@ package io.github.munzzyy.tern.ui.detail
 
 import androidx.compose.foundation.layout.Arrangement
 import androidx.compose.foundation.layout.Column
-import androidx.compose.foundation.layout.FlowRow
 import androidx.compose.foundation.layout.Row
 import androidx.compose.foundation.layout.fillMaxWidth
 import androidx.compose.foundation.layout.heightIn
@@ -32,6 +31,7 @@ import io.github.munzzyy.tern.ui.LocalEngine
 import io.github.munzzyy.tern.ui.apps.MAX_CATEGORY
 import io.github.munzzyy.tern.ui.apps.cleanCategory
 import io.github.munzzyy.tern.ui.common.ActionRow
+import io.github.munzzyy.tern.ui.common.ChipLines
 import io.github.munzzyy.tern.ui.common.ChoiceChip
 import io.github.munzzyy.tern.ui.common.QuietButton
 import io.github.munzzyy.tern.ui.common.TonalButton
@@ -76,18 +76,19 @@ fun CategoriesCard(row: AppRow) {
         actions.run { engine.configure(row.id) { it.copy(categories = toggledCategory(it.categories, name, on)) } }
     }
     DetailCard(stringResource(R.string.setting_categories)) {
-        FlowRow(
-            horizontalArrangement = Arrangement.spacedBy(look.focusRoom * 2),
-            verticalArrangement = Arrangement.spacedBy(look.focusRoom),
+        // The last chip, null, names a new category.
+        ChipLines(
+            names + listOf<String?>(null),
             modifier = Modifier
                 .fillMaxWidth()
                 .padding(horizontal = look.cardPadding - look.focusRoom, vertical = look.gapSmall / 2),
-        ) {
-            for (name in names) {
+        ) { _, name, stop ->
+            if (name == null) {
+                ChoiceChip(stringResource(R.string.categories_new_short), selected = false, onClick = { naming = true }, modifier = stop, role = Role.Button)
+            } else {
                 val on = row.config.categories.any { it.trim().equals(name, ignoreCase = true) }
-                ChoiceChip(name, selected = on, onClick = { toggle(name, !on) }, role = Role.Checkbox, dot = categoryColor(name, settings.categoryColors))
+                ChoiceChip(name, selected = on, onClick = { toggle(name, !on) }, modifier = stop, role = Role.Checkbox, dot = categoryColor(name, settings.categoryColors))
             }
-            ChoiceChip(stringResource(R.string.categories_new_short), selected = false, onClick = { naming = true }, role = Role.Button)
         }
     }
     if (naming) {
diff --git a/app/src/main/kotlin/io/github/munzzyy/tern/ui/detail/DetailMenu.kt b/app/src/main/kotlin/io/github/munzzyy/tern/ui/detail/DetailMenu.kt
index 19c171c6..4d50e2d8 100644
--- a/app/src/main/kotlin/io/github/munzzyy/tern/ui/detail/DetailMenu.kt
+++ b/app/src/main/kotlin/io/github/munzzyy/tern/ui/detail/DetailMenu.kt
@@ -70,7 +70,8 @@ fun DetailMenu(row: AppRow) {
     val shareTitle = stringResource(R.string.action_share)
     val noScreen = stringResource(R.string.action_failed)
     val page = row.latest?.pageUrl
-    val settingsLink = remember(row.config) { ConfigLink.web(row.config) }
+    val settingsLink = remember(row.config) { ConfigLink.tern(row.config) }
+    val obtainiumLink = remember(row.config) { ConfigLink.web(row.config) }
     val noLink = stringResource(R.string.share_link_none)
     Box {
         GlyphButton(Glyphs.More, stringResource(R.string.action_more), onClick = { open = true }, modifier = Modifier.testTag(DETAIL_MENU_TAG))
@@ -82,8 +83,9 @@ fun DetailMenu(row: AppRow) {
             if (page != null) item(R.string.action_release_page, true) { link = page }
             HorizontalDivider()
             item(R.string.action_share_address, true) { shareText(context, shareTitle, row.config.source.url) }
-            item(R.string.action_share_link, true) { shareText(context, shareTitle, ternLink(row.config.source.url)) }
+            item(R.string.action_share_link, true) { shareText(context, shareTitle, ConfigLink.ternAddress(row.config.source.url)) }
             item(R.string.action_share_config_link, true) { settingsLink?.let { shareText(context, shareTitle, it) } ?: actions.say(noLink) }
+            item(R.string.share_obtainium_link, true) { obtainiumLink?.let { shareText(context, shareTitle, it) } ?: actions.say(noLink) }
             item(R.string.action_share_export, true) { exporting = true }
             if (row.installed != null) {
                 HorizontalDivider()
@@ -107,9 +109,6 @@ fun DetailMenu(row: AppRow) {
     }
 }
 
-/** The page of Tern's site that opens an address in Tern, or offers Tern to whoever does not have it yet. */
-fun ternLink(sourceUrl: String): String = "https://tern.munzzyy.dev/add/?url=" + Uri.encode(sourceUrl)
-
 private fun openAppInfo(context: android.content.Context, packageName: String): Boolean = try {
     context.startActivity(Intent(Settings.ACTION_APPLICATION_DETAILS_SETTINGS, Uri.fromParts("package", packageName, null)).addFlags(Intent.FLAG_ACTIVITY_NEW_TASK))
     true
diff --git a/app/src/main/kotlin/io/github/munzzyy/tern/ui/detail/DetailScreen.kt b/app/src/main/kotlin/io/github/munzzyy/tern/ui/detail/DetailScreen.kt
index d548d74d..04f58ea8 100644
--- a/app/src/main/kotlin/io/github/munzzyy/tern/ui/detail/DetailScreen.kt
+++ b/app/src/main/kotlin/io/github/munzzyy/tern/ui/detail/DetailScreen.kt
@@ -23,6 +23,7 @@ import androidx.compose.runtime.Composable
 import androidx.compose.runtime.LaunchedEffect
 import androidx.compose.runtime.derivedStateOf
 import androidx.compose.runtime.getValue
+import androidx.compose.runtime.mutableIntStateOf
 import androidx.compose.runtime.mutableStateOf
 import androidx.compose.runtime.remember
 import androidx.compose.runtime.saveable.rememberSaveable
@@ -48,10 +49,12 @@ import io.github.munzzyy.tern.engine.Phase
 import io.github.munzzyy.tern.engine.ProblemKind
 import io.github.munzzyy.tern.ui.LocalEngine
 import io.github.munzzyy.tern.ui.LocalOnline
+import io.github.munzzyy.tern.ui.add.OriginLine
 import io.github.munzzyy.tern.ui.apps.TernSnackbarHost
 import io.github.munzzyy.tern.ui.apps.progressText
 import io.github.munzzyy.tern.ui.apps.rememberRemovals
 import io.github.munzzyy.tern.ui.apps.versionText
+import io.github.munzzyy.tern.ui.apps.whenGoneWithFocus
 import io.github.munzzyy.tern.ui.common.Explained
 import io.github.munzzyy.tern.ui.common.LinkDialog
 import io.github.munzzyy.tern.ui.common.LinkText
@@ -113,7 +116,8 @@ fun DetailScreen(appId: String, onBack: (() -> Unit)?, onRemoved: () -> Unit, fo
     val current = row?.takeUnless { it.id in hidden }
     val listState = rememberLazyListState()
     val headerGone by remember { derivedStateOf { listState.firstVisibleItemIndex > 0 } }
-    val screen = rememberScreenFocus(again = focusAgain)
+    var landAgain by remember { mutableIntStateOf(0) }
+    val screen = rememberScreenFocus(again = focusAgain + landAgain)
     val look = LocalLook.current
 
     Scaffold(
@@ -142,7 +146,7 @@ fun DetailScreen(appId: String, onBack: (() -> Unit)?, onRemoved: () -> Unit, fo
                 .testTag(DETAIL_LIST_TAG),
         ) {
             item(key = "header") { Header(current, Modifier.backupFocus(screen), top = if (onBack == null) look.gap else look.gapSmall / 2) }
-            item(key = "action") { ActionArea(current, Modifier.firstFocus(screen)) }
+            item(key = "action") { ActionArea(current, Modifier.firstFocus(screen), onFocusGone = { landAgain++ }) }
             val moveState = move
             if (current.movedTo != null || moveState is MoveState.Refused || moveState == MoveState.Followed) {
                 item(key = "moved") { MovedBox(current.movedTo, moveState, vm) }
@@ -157,7 +161,7 @@ fun DetailScreen(appId: String, onBack: (() -> Unit)?, onRemoved: () -> Unit, fo
             }
             verifier?.let { intent -> item(key = "appverifier") { AppVerifierCard(intent) } }
             item(key = "categories") { CategoriesCard(current) }
-            item(key = "notes") { NotesCard(vm, current) }
+            item(key = "own-notes") { NotesCard(vm, current) }
             if (engine.hasProjectPage(current)) item(key = "project") { ProjectPageCard(current) }
             history(vm, current)
             settings(vm, current, onRemoved)
@@ -262,6 +266,19 @@ private fun Header(row: AppRow, focus: Modifier, top: Dp) {
     link?.let { LinkDialog(it, onDismiss = { link = null }) }
 }
 
+/** An app of a third-party store while those are off, and the switch that turns them on, which checks it again. */
+@Composable
+private fun StoresPaused(message: String) {
+    val engine = LocalEngine.current
+    val actions = rememberActions()
+    ProblemBox(
+        title = message,
+        body = null,
+        action = stringResource(R.string.stores_turn_on),
+        onAction = { actions.run { engine.saveSettings(engine.settings.value.copy(thirdPartyStores = true)) } },
+    )
+}
+
 /** What the source says the app is. Long ones open on a press, so the actions stay near the top. */
 @Composable
 private fun Description(text: String) {
@@ -286,7 +303,7 @@ private fun relativeTime(ms: Long): String =
 
 @OptIn(ExperimentalLayoutApi::class)
 @Composable
-private fun ActionArea(row: AppRow, focus: Modifier) {
+private fun ActionArea(row: AppRow, focus: Modifier, onFocusGone: () -> Unit) {
     val engine = LocalEngine.current
     val actions = rememberActions()
     val look = LocalLook.current
@@ -308,12 +325,17 @@ private fun ActionArea(row: AppRow, focus: Modifier) {
         }
         promptLine(row, Build.VERSION.SDK_INT)?.let { Prompt(it) }
         row.problem?.let { p ->
-            val body = buildString {
-                append(stringResource(problemAdvice(p.kind, installed = row.installed != null)))
-                if (p.kind == ProblemKind.RATE_LIMITED) p.retryAtMs?.let { append(" ").append(retryText(it)) }
+            if (p.kind == ProblemKind.STORES_OFF) {
+                StoresPaused(p.message)
+            } else {
+                val body = buildString {
+                    append(stringResource(problemAdvice(p.kind, installed = row.installed != null)))
+                    if (p.kind == ProblemKind.RATE_LIMITED) p.retryAtMs?.let { append(" ").append(retryText(it)) }
+                }
+                ProblemBox(title = p.message, body = body)
             }
-            ProblemBox(title = p.message, body = body)
         }
+        OriginLine(row.config.source, pinned = row.config.pinnedSigners.isNotEmpty() || row.installed != null)
         row.progress?.let { progress ->
             Column(
                 verticalArrangement = Arrangement.spacedBy(look.gapSmall),
@@ -356,20 +378,22 @@ private fun ActionArea(row: AppRow, focus: Modifier) {
                         RowAction.CHECK -> actions.run { engine.check(row.id) }
                     }
                 }
+                // A button that goes with the focus on it, as Cancel does when an install ends, hands the focus back to this row.
+                val tagged = Modifier.whenGoneWithFocus(onFocusGone).testTag(DETAIL_PRIMARY_TAG)
                 if (action == RowAction.CANCEL) {
-                    TonalButton(stringResource(action.text), press, Modifier.testTag(DETAIL_PRIMARY_TAG))
+                    TonalButton(stringResource(action.text), press, tagged)
                 } else {
-                    PrimaryButton(stringResource(action.text), press, Modifier.testTag(DETAIL_PRIMARY_TAG))
+                    PrimaryButton(stringResource(action.text), press, tagged)
                 }
             }
             if (isWaitingForUser(row)) {
-                TonalButton(stringResource(R.string.action_cancel), onClick = { engine.cancel(row.id) })
+                TonalButton(stringResource(R.string.action_cancel), onClick = { engine.cancel(row.id) }, modifier = Modifier.whenGoneWithFocus(onFocusGone))
             }
             if (row.installed != null && primaryAction(row) != RowAction.OPEN && row.progress == null) {
-                TonalButton(stringResource(R.string.action_open), onClick = { if (!engine.open(row.id)) actions.say(noLauncher) })
+                TonalButton(stringResource(R.string.action_open), onClick = { if (!engine.open(row.id)) actions.say(noLauncher) }, modifier = Modifier.whenGoneWithFocus(onFocusGone))
             }
             if (canSkip(row) && row.progress == null && !row.config.trackOnly) {
-                QuietButton(stringResource(R.string.action_skip_version), onClick = { actions.run { engine.dismissRelease(row.id) } })
+                QuietButton(stringResource(R.string.action_skip_version), onClick = { actions.run { engine.dismissRelease(row.id) } }, modifier = Modifier.whenGoneWithFocus(onFocusGone))
             }
         }
     }
diff --git a/app/src/main/kotlin/io/github/munzzyy/tern/ui/detail/SourceOptionsCard.kt b/app/src/main/kotlin/io/github/munzzyy/tern/ui/detail/SourceOptionsCard.kt
index ce0b28f3..1b8efb80 100644
--- a/app/src/main/kotlin/io/github/munzzyy/tern/ui/detail/SourceOptionsCard.kt
+++ b/app/src/main/kotlin/io/github/munzzyy/tern/ui/detail/SourceOptionsCard.kt
@@ -34,7 +34,7 @@ import io.github.munzzyy.tern.ui.theme.LocalLook
 import io.github.munzzyy.tern.ui.theme.fingerprint
 
 /** The sources that have options a person may set. */
-val SOURCES_WITH_OPTIONS = setOf(SourceTypes.GITHUB, SourceTypes.FORGEJO, SourceTypes.GITHUB_ACTIONS, SourceTypes.HTML, SourceTypes.DIRECT, SourceTypes.SAMSUNG, SourceTypes.FARSROID)
+val SOURCES_WITH_OPTIONS = setOf(SourceTypes.GITHUB, SourceTypes.FORGEJO, SourceTypes.GITHUB_ACTIONS, SourceTypes.HTML, SourceTypes.DIRECT, SourceTypes.SAMSUNG)
 
 private val WORKFLOW_NAME = Regex("^[A-Za-z0-9._-]{1,100}\\.ya?ml$")
 private val BRANCH_NAME = Regex("^[A-Za-z0-9._/-]{1,100}$")
@@ -163,13 +163,13 @@ fun SourceOptionsCard(id: String, spec: SourceSpec, save: ((SourceSpec) -> Sourc
                     onChange = { setFlag(SourceOptions.ASSET_DATE, it) },
                 )
             }
-            SourceTypes.FARSROID -> SwitchRow(
-                title = stringResource(R.string.option_file_version),
-                summary = stringResource(R.string.option_file_version_effect),
-                checked = flag(SourceOptions.FILE_VERSION),
-                onChange = { setFlag(SourceOptions.FILE_VERSION, it) },
-            )
             SourceTypes.HTML -> {
+                SwitchRow(
+                    title = stringResource(R.string.option_highest_version),
+                    summary = stringResource(R.string.option_highest_version_effect),
+                    checked = flag(SourceOptions.HIGHEST_VERSION),
+                    onChange = { setFlag(SourceOptions.HIGHEST_VERSION, it) },
+                )
                 SwitchRow(
                     title = stringResource(R.string.option_link_text),
                     summary = stringResource(R.string.option_link_text_effect),
@@ -262,7 +262,7 @@ private enum class OptionField(val key: String, val label: Int, val help: Int?,
     DEVICE_MODEL("deviceModel", R.string.option_device_model, R.string.option_device_model_help),
     CSC("csc", R.string.option_csc, R.string.option_csc_help),
     LINK_FILTER("linkFilter", R.string.option_link_filter, R.string.option_link_filter_help, code = true),
-    HEADERS("headers", R.string.option_headers, R.string.option_headers_help, lines = true, code = true),
+    HEADERS("headers", R.string.option_headers, R.string.option_headers_help_own_agent, lines = true, code = true),
 }
 
 private fun fieldsFor(type: String): List<OptionField> = when (type) {
diff --git a/app/src/main/kotlin/io/github/munzzyy/tern/ui/importing/CarriedNote.kt b/app/src/main/kotlin/io/github/munzzyy/tern/ui/importing/CarriedNote.kt
index 4a1972f7..95c694f0 100644
--- a/app/src/main/kotlin/io/github/munzzyy/tern/ui/importing/CarriedNote.kt
+++ b/app/src/main/kotlin/io/github/munzzyy/tern/ui/importing/CarriedNote.kt
@@ -16,6 +16,7 @@ import androidx.compose.ui.res.stringResource
 import androidx.lifecycle.compose.collectAsStateWithLifecycle
 import io.github.munzzyy.tern.R
 import io.github.munzzyy.tern.core.model.UpdateMode
+import io.github.munzzyy.tern.core.source.SourceTypes
 import io.github.munzzyy.tern.engine.AppRow
 import io.github.munzzyy.tern.engine.ImportSummary
 import io.github.munzzyy.tern.ui.LocalEngine
@@ -57,8 +58,35 @@ fun CarriedNote(summary: ImportSummary, onOpenApp: (String) -> Unit) {
     if (summary.settingsTaken) TrustLine(Trust.NOTE, stringResource(R.string.import_settings_taken))
     summary.offer?.let { ImportOffer(summary, it, onOpenApp) }
     CarriedGroups(summary, onOpenApp)
+    FromStores(summary.fromStores, onOpenApp)
 }
 
+/**
+ * The imported apps that come from third-party stores, each linked to its page: what their first
+ * install decides, and while those stores are off, that the apps wait, with the switch that turns them on.
+ */
+@Composable
+private fun FromStores(names: List<String>, onOpenApp: (String) -> Unit) {
+    if (names.isEmpty()) return
+    val engine = LocalEngine.current
+    val actions = rememberActions()
+    val rows by engine.apps.collectAsStateWithLifecycle()
+    val settings by engine.settings.collectAsStateWithLifecycle()
+    val linked = remember(names, rows) { linkNames(names, rows) { it.config.source.type in SourceTypes.THIRD_PARTY_STORES } }
+    TrustLine(Trust.NOTE, stringResource(R.string.stores_import_from_stores))
+    if (!settings.thirdPartyStores) {
+        TrustLine(Trust.NOTE, stringResource(R.string.stores_import_paused))
+        TonalButton(
+            stringResource(R.string.stores_turn_on),
+            onClick = { actions.run { engine.saveSettings(engine.settings.value.copy(thirdPartyStores = true)) } },
+            modifier = Modifier.testTag(IMPORT_STORES_ON_TAG),
+        )
+    }
+    Group(stringResource(R.string.stores_import_names), linked, onOpenApp)
+}
+
+const val IMPORT_STORES_ON_TAG = "import_stores_on"
+
 const val REPLACE_TAG = "import_replace"
 const val TAKE_SETTINGS_TAG = "import_take_settings"
 
diff --git a/app/src/main/kotlin/io/github/munzzyy/tern/ui/importing/StarsImport.kt b/app/src/main/kotlin/io/github/munzzyy/tern/ui/importing/StarsImport.kt
index ae116746..816fdb01 100644
--- a/app/src/main/kotlin/io/github/munzzyy/tern/ui/importing/StarsImport.kt
+++ b/app/src/main/kotlin/io/github/munzzyy/tern/ui/importing/StarsImport.kt
@@ -35,7 +35,7 @@ suspend fun addEach(
                     }
                 }
                 is Detection.Failed -> skipped += label to reasonFor(found.problem.kind)
-                is Detection.Results -> skipped += label to SkipReason.OTHER
+                is Detection.Results, is Detection.StoresOff -> skipped += label to SkipReason.OTHER
             }
         } catch (e: CancellationException) {
             throw e
diff --git a/app/src/main/kotlin/io/github/munzzyy/tern/ui/settings/Interval.kt b/app/src/main/kotlin/io/github/munzzyy/tern/ui/settings/Interval.kt
index af97a964..c86b9a76 100644
--- a/app/src/main/kotlin/io/github/munzzyy/tern/ui/settings/Interval.kt
+++ b/app/src/main/kotlin/io/github/munzzyy/tern/ui/settings/Interval.kt
@@ -1,5 +1,6 @@
 package io.github.munzzyy.tern.ui.settings
 
+import androidx.annotation.StringRes
 import androidx.compose.foundation.layout.Arrangement
 import androidx.compose.foundation.layout.Column
 import androidx.compose.foundation.layout.Row
@@ -19,6 +20,7 @@ import androidx.compose.runtime.remember
 import androidx.compose.runtime.setValue
 import androidx.compose.ui.Alignment
 import androidx.compose.ui.Modifier
+import androidx.compose.ui.focus.focusProperties
 import androidx.compose.ui.res.stringResource
 import androidx.compose.ui.semantics.contentDescription
 import androidx.compose.ui.semantics.semantics
@@ -26,6 +28,7 @@ import androidx.compose.ui.semantics.stateDescription
 import io.github.munzzyy.tern.R
 import io.github.munzzyy.tern.ui.common.LocalNoTouch
 import io.github.munzzyy.tern.ui.common.focusLook
+import io.github.munzzyy.tern.ui.common.verticalKeysLeave
 import io.github.munzzyy.tern.ui.icons.Glyphs
 import io.github.munzzyy.tern.ui.icons.Minus
 import io.github.munzzyy.tern.ui.icons.Plus
@@ -61,7 +64,7 @@ fun IntervalRow(minutes: Int, onChange: (Int) -> Unit) {
             val buttons = LocalNoTouch.current
             if (buttons) {
                 IconButton(onClick = { settle(at - 1) }, enabled = at > 0, modifier = Modifier.focusLook(CircleShape)) {
-                    Icon(Glyphs.Minus, contentDescription = stringResource(R.string.interval_more_often), modifier = Modifier.size(look.glyph))
+                    Icon(Glyphs.Minus, contentDescription = stringResource(minusLabel(stops, at)), modifier = Modifier.size(look.glyph))
                 }
             }
             Slider(
@@ -72,6 +75,9 @@ fun IntervalRow(minutes: Int, onChange: (Int) -> Unit) {
                 steps = (stops.size - 2).coerceAtLeast(0),
                 modifier = Modifier
                     .weight(1f)
+                    // The slider takes all four arrows; without touch the buttons step it, and up and down have to leave.
+                    .focusProperties { canFocus = !buttons }
+                    .verticalKeysLeave()
                     .focusLook(CircleShape)
                     .semantics {
                         contentDescription = title
@@ -80,9 +86,17 @@ fun IntervalRow(minutes: Int, onChange: (Int) -> Unit) {
             )
             if (buttons) {
                 IconButton(onClick = { settle(at + 1) }, enabled = at < stops.lastIndex, modifier = Modifier.focusLook(CircleShape)) {
-                    Icon(Glyphs.Plus, contentDescription = stringResource(R.string.interval_less_often), modifier = Modifier.size(look.glyph))
+                    Icon(Glyphs.Plus, contentDescription = stringResource(plusLabel(stops, at)), modifier = Modifier.size(look.glyph))
                 }
             }
         }
     }
 }
+
+/** What the minus button does from stop [at]: it checks more often, or turns the checks off where the stop below is off. */
+@StringRes
+fun minusLabel(stops: List<Int>, at: Int): Int = if (stops.getOrNull(at - 1) == 0) R.string.interval_turn_off else R.string.interval_more_often
+
+/** What the plus button does from stop [at]: it checks less often, or turns the checks on where they are off. */
+@StringRes
+fun plusLabel(stops: List<Int>, at: Int): Int = if (stops.getOrNull(at) == 0) R.string.interval_turn_on else R.string.interval_less_often
diff --git a/app/src/main/kotlin/io/github/munzzyy/tern/ui/settings/SettingsScreen.kt b/app/src/main/kotlin/io/github/munzzyy/tern/ui/settings/SettingsScreen.kt
index 2240400c..c16cb60c 100644
--- a/app/src/main/kotlin/io/github/munzzyy/tern/ui/settings/SettingsScreen.kt
+++ b/app/src/main/kotlin/io/github/munzzyy/tern/ui/settings/SettingsScreen.kt
@@ -2,7 +2,9 @@ package io.github.munzzyy.tern.ui.settings
 
 import android.app.Activity
 import android.content.ActivityNotFoundException
+import android.content.Context
 import android.content.Intent
+import android.content.pm.PackageManager
 import android.net.Uri
 import android.os.Build
 import androidx.activity.compose.rememberLauncherForActivityResult
@@ -156,9 +158,39 @@ fun SettingsScreen(onImport: () -> Unit, onLook: () -> Unit, onAdd: (String) ->
     }
 }
 
+/** Tern's entry in F-Droid, which a copy F-Droid installed follows. */
+const val FDROID_URL = "https://f-droid.org/packages/io.github.munzzyy.tern/"
+
+/** Apps that install from F-Droid's repository: F-Droid itself, its privileged extension, and the clients built on its index. */
+val FDROID_CLIENTS = setOf(
+    "org.fdroid.fdroid", "org.fdroid.basic", "org.fdroid.fdroid.privileged",
+    "com.looker.droidify", "com.machiav3lli.fdroid", "eu.bubu1.fdroidclassic",
+)
+
+/**
+ * Where Tern follows its own updates. A copy an F-Droid client installed follows F-Droid, so its
+ * updates stay builds F-Droid made and checked. Any other copy, or one whose installer is not
+ * known, follows the releases on GitHub.
+ */
+fun selfSource(installer: String?): String = if (installer in FDROID_CLIENTS) FDROID_URL else SOURCE_URL
+
 /** Whether Tern is in its own list already, by its address or by its package. */
 fun tracksItself(apps: List<Pair<String, String?>>, ownPackage: String): Boolean =
-    apps.any { (url, pkg) -> pkg == ownPackage || url.trimEnd('/').equals(SOURCE_URL, ignoreCase = true) }
+    apps.any { (url, pkg) -> pkg == ownPackage || url.trimEnd('/').let { it.equals(SOURCE_URL, ignoreCase = true) || it.equals(FDROID_URL.trimEnd('/'), ignoreCase = true) } }
+
+/** The app that installed Tern, as Android recorded it; null when it cannot say. */
+private fun ownInstaller(context: Context): String? = try {
+    if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.R) {
+        context.packageManager.getInstallSourceInfo(context.packageName).installingPackageName
+    } else {
+        @Suppress("DEPRECATION")
+        context.packageManager.getInstallerPackageName(context.packageName)
+    }
+} catch (_: PackageManager.NameNotFoundException) {
+    null
+} catch (_: IllegalArgumentException) {
+    null
+}
 
 /** A television posts notifications and shows none of them, so the rows about them would do nothing there. */
 fun showsNotifications(television: Boolean): Boolean = !television
@@ -184,16 +216,30 @@ private fun BackgroundSection(s: Settings, vm: SettingsViewModel, update: Update
             enabled = on,
             onChange = { v -> update { it.copy(autoInstalls = v) } },
         )
+        SwitchRow(
+            title = stringResource(R.string.settings_unmetered_checks),
+            summary = stringResource(R.string.settings_unmetered_checks_effect),
+            checked = s.checkOnlyOnUnmetered,
+            enabled = on,
+            onChange = { v -> update { it.copy(checkOnlyOnUnmetered = v) } },
+        )
+        SwitchRow(
+            title = stringResource(R.string.settings_charging_checks),
+            summary = stringResource(R.string.settings_charging_checks_effect),
+            checked = s.checkOnlyWhileCharging,
+            enabled = on,
+            onChange = { v -> update { it.copy(checkOnlyWhileCharging = v) } },
+        )
         SwitchRow(
             title = stringResource(R.string.settings_unmetered_installs),
-            summary = stringResource(R.string.settings_unmetered_installs_effect),
+            summary = stringResource(R.string.settings_unmetered_installs_wait),
             checked = s.onlyOnUnmetered,
             enabled = on && s.autoInstalls,
             onChange = { v -> update { it.copy(onlyOnUnmetered = v) } },
         )
         SwitchRow(
             title = stringResource(R.string.settings_charging_installs),
-            summary = stringResource(R.string.settings_charging_installs_effect),
+            summary = stringResource(R.string.settings_charging_installs_wait),
             checked = s.onlyWhileCharging,
             enabled = on && s.autoInstalls,
             onChange = { v -> update { it.copy(onlyWhileCharging = v) } },
@@ -223,7 +269,7 @@ private fun BackgroundSection(s: Settings, vm: SettingsViewModel, update: Update
         )
         SwitchRow(
             title = stringResource(R.string.settings_remove_uninstalled),
-            summary = stringResource(R.string.settings_remove_uninstalled_effect),
+            summary = stringResource(R.string.settings_remove_uninstalled_keeps_pins),
             checked = s.removeUninstalled,
             onChange = { v -> update { it.copy(removeUninstalled = v) } },
         )
@@ -307,7 +353,7 @@ private fun InstallingSection(s: Settings, vm: SettingsViewModel, update: Update
         if (vm.canDowngrade || s.allowDowngrades) {
             SwitchRow(
                 title = stringResource(R.string.settings_allow_downgrades),
-                summary = stringResource(R.string.settings_allow_downgrades_effect),
+                summary = stringResource(R.string.settings_allow_downgrades_picked),
                 checked = s.allowDowngrades,
                 onChange = { v -> update { it.copy(allowDowngrades = v) } },
             )
@@ -513,7 +559,7 @@ private fun GitHubProxyRow(s: Settings, update: Update) {
             .padding(horizontal = look.cardPadding, vertical = look.gapSmall / 2),
     ) {
         Text(stringResource(R.string.github_proxy_title), style = MaterialTheme.typography.titleSmall)
-        Text(stringResource(R.string.github_proxy_effect), style = MaterialTheme.typography.bodyMedium, color = scheme.onSurfaceVariant)
+        Text(stringResource(R.string.github_proxy_effect_trust), style = MaterialTheme.typography.bodyMedium, color = scheme.onSurfaceVariant)
         s.githubProxy?.let { Text(stringResource(R.string.github_proxy_in_use, ltr(it)), style = MaterialTheme.typography.bodyMedium) }
         OutlinedTextField(
             value = host,
@@ -655,9 +701,18 @@ private fun NetworkSection(s: Settings, update: Update, onGetOrbot: () -> Unit,
             checked = s.pinCertificates,
             onChange = { v -> update { it.copy(pinCertificates = v) } },
         )
+        SwitchRow(
+            title = stringResource(R.string.stores_setting),
+            summary = stringResource(R.string.stores_setting_effect),
+            checked = s.thirdPartyStores,
+            onChange = { v -> update { it.copy(thirdPartyStores = v) } },
+            modifier = Modifier.testTag(STORES_SETTING_TAG),
+        )
     }
 }
 
+const val STORES_SETTING_TAG = "settings_third_party_stores"
+
 /** What there is to say about each state of Orbot: the sentence, and the action when there is one. */
 data class OrbotWords(val sentence: Int, val action: Int?)
 
@@ -868,7 +923,7 @@ private fun DataSection(s: Settings, vm: SettingsViewModel, update: Update, onIm
                     else -> R.string.door_export
                 },
             ),
-            summary = outcome ?: stringResource(R.string.settings_export_effect),
+            summary = outcome ?: stringResource(R.string.settings_export_effect_plain),
             onClick = {
                 when {
                     exporting -> Unit
@@ -991,11 +1046,19 @@ private fun AboutSection(onAdd: (String) -> Unit) {
     SectionCard(title = stringResource(R.string.settings_about)) {
         InfoRow(title = stringResource(R.string.about_version), value = BuildConfig.VERSION_NAME)
         if (!tracked) {
+            val self = remember { selfSource(ownInstaller(context)) }
             ActionRow(
                 title = stringResource(R.string.about_track_tern),
-                summary = stringResource(R.string.about_track_tern_effect),
-                onClick = { onAdd(SOURCE_URL) },
+                summary = stringResource(if (self == FDROID_URL) R.string.about_track_tern_fdroid_effect else R.string.about_track_tern_effect),
+                onClick = { onAdd(self) },
             )
+            if (self == FDROID_URL) {
+                ActionRow(
+                    title = stringResource(R.string.about_track_tern_github),
+                    summary = stringResource(R.string.about_track_tern_github_effect),
+                    onClick = { onAdd(SOURCE_URL) },
+                )
+            }
         }
         ActionRow(
             title = stringResource(R.string.about_help),
diff --git a/app/src/main/kotlin/io/github/munzzyy/tern/ui/suggest/Starters.kt b/app/src/main/kotlin/io/github/munzzyy/tern/ui/suggest/Starters.kt
index c5597480..c4fd4a7d 100644
--- a/app/src/main/kotlin/io/github/munzzyy/tern/ui/suggest/Starters.kt
+++ b/app/src/main/kotlin/io/github/munzzyy/tern/ui/suggest/Starters.kt
@@ -13,6 +13,7 @@ import androidx.compose.ui.res.stringResource
 import androidx.compose.ui.semantics.heading
 import androidx.compose.ui.semantics.semantics
 import io.github.munzzyy.tern.R
+import io.github.munzzyy.tern.engine.StarterHere
 import io.github.munzzyy.tern.engine.Suggestion
 import io.github.munzzyy.tern.ui.common.ChipTone
 import io.github.munzzyy.tern.ui.common.PressRow
@@ -86,5 +87,14 @@ private fun StarterRow(app: Suggestion, onLook: () -> Unit, modifier: Modifier)
         Text(app.name, style = MaterialTheme.typography.titleMedium.heavier())
         Text(app.summary, style = MaterialTheme.typography.bodyMedium, color = MaterialTheme.colorScheme.onSurfaceVariant)
         if (app.pinned) StatusChip(Glyphs.Seal, stringResource(R.string.starter_pinned), tone = ChipTone.VERIFIED)
+        when (app.here) {
+            StarterHere.NONE -> Unit
+            StarterHere.IN_LIST -> StatusChip(Glyphs.Check, stringResource(R.string.starter_in_list))
+            StarterHere.ON_PHONE -> StatusChip(Glyphs.Check, stringResource(R.string.starter_on_phone))
+            StarterHere.ON_PHONE_OTHER_SIGNER -> {
+                StatusChip(Glyphs.Caution, stringResource(R.string.starter_on_phone_other), tone = ChipTone.CAUTION)
+                Text(stringResource(R.string.starter_on_phone_other_explain), style = MaterialTheme.typography.bodyMedium, color = MaterialTheme.colorScheme.onSurfaceVariant)
+            }
+        }
     }
 }
diff --git a/app/src/main/kotlin/io/github/munzzyy/tern/ui/text/Evidence.kt b/app/src/main/kotlin/io/github/munzzyy/tern/ui/text/Evidence.kt
index c0e70234..4c4039b9 100644
--- a/app/src/main/kotlin/io/github/munzzyy/tern/ui/text/Evidence.kt
+++ b/app/src/main/kotlin/io/github/munzzyy/tern/ui/text/Evidence.kt
@@ -31,7 +31,7 @@ fun signerLine(v: Verification): EvidenceLine {
 fun checksumLine(v: Verification): EvidenceLine = when (v.checksum) {
     ChecksumState.NOT_PUBLISHED -> EvidenceLine(R.string.checksum_not_published, Trust.NOTE)
     ChecksumState.PENDING -> EvidenceLine(R.string.checksum_pending, Trust.NOTE)
-    ChecksumState.MATCHED -> EvidenceLine(R.string.checksum_matched, Trust.GOOD)
+    ChecksumState.MATCHED -> EvidenceLine(if (v.checksumFromStore) R.string.stores_checksum_matched else R.string.checksum_matched, Trust.GOOD)
     ChecksumState.MISMATCH -> EvidenceLine(R.string.checksum_mismatch, Trust.BAD)
 }
 
@@ -60,7 +60,7 @@ fun signerExplanation(v: Verification, installed: Boolean): Int = when (v.signer
 fun checksumExplanation(v: Verification): Int = when (v.checksum) {
     ChecksumState.NOT_PUBLISHED -> R.string.explain_checksum_none
     ChecksumState.PENDING -> R.string.explain_checksum_pending
-    ChecksumState.MATCHED -> R.string.explain_checksum_matched
+    ChecksumState.MATCHED -> if (v.checksumFromStore) R.string.stores_explain_checksum_matched else R.string.explain_checksum_matched
     ChecksumState.MISMATCH -> R.string.explain_checksum_mismatch
 }
 
diff --git a/app/src/main/kotlin/io/github/munzzyy/tern/ui/text/Status.kt b/app/src/main/kotlin/io/github/munzzyy/tern/ui/text/Status.kt
index 2578e47d..b3b83fd7 100644
--- a/app/src/main/kotlin/io/github/munzzyy/tern/ui/text/Status.kt
+++ b/app/src/main/kotlin/io/github/munzzyy/tern/ui/text/Status.kt
@@ -21,6 +21,7 @@ enum class StatusLabel(@param:StringRes val text: Int, val tone: Tone) {
     RATE_LIMITED(R.string.status_rate_limited, Tone.PROBLEM),
     INSTALL_FAILED(R.string.status_install_failed, Tone.PROBLEM),
     OFFLINE(R.string.status_offline, Tone.NEUTRAL),
+    PAUSED(R.string.stores_status_paused, Tone.NEUTRAL),
     CHECKING(R.string.status_checking, Tone.BUSY),
     QUEUED(R.string.status_queued, Tone.BUSY),
     DOWNLOADING(R.string.status_downloading, Tone.BUSY),
@@ -53,6 +54,7 @@ fun statusLabel(row: AppRow, online: Boolean = true): StatusLabel {
         AppStatus.BLOCKED -> StatusLabel.BLOCKED
         AppStatus.ERROR -> when (row.problem?.kind) {
             ProblemKind.RATE_LIMITED -> StatusLabel.RATE_LIMITED
+            ProblemKind.STORES_OFF -> StatusLabel.PAUSED
             ProblemKind.INSTALL_FAILED, ProblemKind.STORAGE -> StatusLabel.INSTALL_FAILED
             else -> StatusLabel.ERROR
         }
@@ -71,6 +73,9 @@ enum class RowAction(@param:StringRes val text: Int) {
 
 fun isWaitingForUser(row: AppRow): Boolean = row.progress?.phase == Phase.WAITING_FOR_USER
 
+/** An app of a third-party store while those are off: nothing of it is asked for, so nothing is offered but turning them on. */
+fun isPaused(row: AppRow): Boolean = row.problem?.kind == ProblemKind.STORES_OFF
+
 fun isBusy(row: AppRow): Boolean = row.progress != null
 
 /** What is said about the question Android may ask before an update, and what that means when the user asks. */
@@ -112,7 +117,7 @@ fun inlineAction(row: AppRow): RowAction? = when {
 fun primaryAction(row: AppRow): RowAction? = when {
     isWaitingForUser(row) -> RowAction.CONFIRM
     isBusy(row) -> RowAction.CANCEL
-    row.checking -> null
+    row.checking || isPaused(row) -> null
     row.status == AppStatus.BLOCKED || row.status == AppStatus.ERROR -> RowAction.CHECK
     row.config.trackOnly && row.status == AppStatus.NEW_RELEASE -> RowAction.MARK_SEEN
     row.config.trackOnly -> RowAction.CHECK
@@ -127,7 +132,7 @@ fun canSkip(row: AppRow): Boolean =
     row.latest != null && !isBusy(row) && (row.status == AppStatus.UPDATE_AVAILABLE || row.status == AppStatus.NEW_RELEASE)
 
 /** Installing a chosen version or file is offered only when nothing stops installs for this app. */
-fun canPickInstall(row: AppRow): Boolean = !row.config.trackOnly && !isBusy(row) && row.status != AppStatus.BLOCKED
+fun canPickInstall(row: AppRow): Boolean = !row.config.trackOnly && !isBusy(row) && row.status != AppStatus.BLOCKED && !isPaused(row)
 
 fun isUpdate(row: AppRow): Boolean = row.status == AppStatus.UPDATE_AVAILABLE || row.status == AppStatus.NEW_RELEASE
 
@@ -156,4 +161,5 @@ fun problemAdvice(kind: ProblemKind, installed: Boolean = false): Int = when (ki
     ProblemKind.INSTALL_FAILED -> R.string.advice_install_failed
     ProblemKind.STORAGE -> R.string.advice_storage
     ProblemKind.UNSUPPORTED -> R.string.advice_unsupported
+    ProblemKind.STORES_OFF -> R.string.stores_advice
 }
diff --git a/app/src/main/kotlin/io/github/munzzyy/tern/widget/Surfaces.kt b/app/src/main/kotlin/io/github/munzzyy/tern/widget/Surfaces.kt
index 6f483689..bb01948d 100644
--- a/app/src/main/kotlin/io/github/munzzyy/tern/widget/Surfaces.kt
+++ b/app/src/main/kotlin/io/github/munzzyy/tern/widget/Surfaces.kt
@@ -6,10 +6,12 @@ import android.content.Intent
 import android.content.pm.ShortcutInfo
 import android.content.pm.ShortcutManager
 import android.graphics.drawable.Icon
-import android.net.Uri
-import io.github.munzzyy.tern.MainActivity
 import io.github.munzzyy.tern.R
 import io.github.munzzyy.tern.engine.Engine
+import io.github.munzzyy.tern.ui.ACTION_ADD
+import io.github.munzzyy.tern.ui.ACTION_CHECK
+import io.github.munzzyy.tern.ui.ACTION_UPDATE_ALL
+import io.github.munzzyy.tern.ui.SHORTCUTS
 import io.github.munzzyy.tern.log.TernLog
 import kotlinx.coroutines.CoroutineScope
 import kotlinx.coroutines.Dispatchers
@@ -22,10 +24,6 @@ import kotlinx.coroutines.launch
 
 /** The places outside Tern's own window that show its state: the widget, and the shortcuts of its launcher icon. */
 object Surfaces {
-    /** What a shortcut asks of Tern, besides the tern://refresh link the check uses. */
-    const val ACTION_ADD = "io.github.munzzyy.tern.action.ADD"
-    const val ACTION_UPDATE_ALL = "io.github.munzzyy.tern.action.UPDATE_ALL"
-
     /** Which shortcut an intent came from, so the launcher can learn which ones are used. */
     const val EXTRA_SHORTCUT = "io.github.munzzyy.tern.SHORTCUT"
     private const val TAG = "TernSurfaces"
@@ -55,7 +53,8 @@ object Surfaces {
 
     private fun shortcuts(context: Context) {
         val manager = context.getSystemService(ShortcutManager::class.java) ?: return
-        val main = ComponentName(context, MainActivity::class.java)
+        // Through the alias, which only Tern and the launcher acting for it can start.
+        val main = ComponentName(context, SHORTCUTS)
         fun shortcut(id: String, short: Int, long: Int, icon: Int, intent: Intent) = ShortcutInfo.Builder(context, id)
             .setShortLabel(context.getString(short))
             .setLongLabel(context.getString(long))
@@ -63,12 +62,14 @@ object Surfaces {
             .setIntent(intent.setComponent(main).putExtra(EXTRA_SHORTCUT, id))
             .build()
         val list = listOf(
-            shortcut("check", R.string.shortcut_check_short, R.string.shortcut_check_long, R.drawable.ic_shortcut_check, Intent(Intent.ACTION_VIEW, Uri.parse("tern://refresh"))),
+            shortcut("check", R.string.shortcut_check_short, R.string.shortcut_check_long, R.drawable.ic_shortcut_check, Intent(ACTION_CHECK)),
             shortcut("update_all", R.string.action_update_all, R.string.shortcut_update_all_long, R.drawable.ic_shortcut_update, Intent(ACTION_UPDATE_ALL)),
             shortcut("add", R.string.shortcut_add_short, R.string.shortcut_add_long, R.drawable.ic_shortcut_add, Intent(ACTION_ADD)),
         )
         try {
             manager.dynamicShortcuts = list
+            // A shortcut pinned to the home screen keeps its intent until it is updated.
+            manager.updateShortcuts(list)
         } catch (e: IllegalStateException) {
             TernLog.i(TAG, "The launcher took no shortcuts: ${e.message}")
         } catch (e: IllegalArgumentException) {
diff --git a/app/src/main/kotlin/io/github/munzzyy/tern/work/CheckJobService.kt b/app/src/main/kotlin/io/github/munzzyy/tern/work/CheckJobService.kt
index f8db959e..68181c6c 100644
--- a/app/src/main/kotlin/io/github/munzzyy/tern/work/CheckJobService.kt
+++ b/app/src/main/kotlin/io/github/munzzyy/tern/work/CheckJobService.kt
@@ -17,11 +17,13 @@ class CheckJobService : JobService() {
             val self = coroutineContext[Job]
             var failed = false
             try {
-                if (params.jobId == Scheduler.RETRY_JOB_ID) {
-                    val apps = params.extras.getStringArray(Scheduler.EXTRA_APPS).orEmpty().toSet()
-                    if (apps.isNotEmpty()) engine.runScheduledCheck(params.extras.getInt(Scheduler.EXTRA_ATTEMPT, 1), apps)
-                } else {
-                    engine.runScheduledCheck()
+                when (params.jobId) {
+                    Scheduler.RETRY_JOB_ID -> {
+                        val apps = params.extras.getStringArray(Scheduler.EXTRA_APPS).orEmpty().toSet()
+                        if (apps.isNotEmpty()) engine.runScheduledCheck(params.extras.getInt(Scheduler.EXTRA_ATTEMPT, 1), apps)
+                    }
+                    Scheduler.WAITING_JOB_ID -> engine.runWaitingInstalls()
+                    else -> engine.runScheduledCheck()
                 }
             } catch (e: Exception) {
                 if (e is kotlinx.coroutines.CancellationException) throw e
diff --git a/app/src/main/kotlin/io/github/munzzyy/tern/work/Scheduler.kt b/app/src/main/kotlin/io/github/munzzyy/tern/work/Scheduler.kt
index de245bea..a808478b 100644
--- a/app/src/main/kotlin/io/github/munzzyy/tern/work/Scheduler.kt
+++ b/app/src/main/kotlin/io/github/munzzyy/tern/work/Scheduler.kt
@@ -9,9 +9,10 @@ import io.github.munzzyy.tern.engine.Settings
 import io.github.munzzyy.tern.log.TernLog
 
 /**
- * One persisted periodic job, which checks on any network. Re-applying unchanged settings leaves
- * the job alone so its clock keeps running. Two one-off jobs go with it: one that installs what
- * waited for Wi-Fi or charging once there is, and one that checks again what could not be checked.
+ * One persisted periodic job, which checks on any network unless the settings hold checks back.
+ * Re-applying unchanged settings leaves the job alone so its clock keeps running. Two one-off jobs
+ * go with it: one that installs what waited for Wi-Fi or charging once there is, and one that
+ * checks again what could not be checked.
  */
 object Scheduler {
     const val JOB_ID = 1
@@ -20,6 +21,9 @@ object Scheduler {
     const val EXTRA_ATTEMPT = "attempt"
     const val EXTRA_APPS = "apps"
     private const val MINUTE_MS = 60L * 1000
+
+    /** The waiting job runs no sooner than this after it is set, so it can never go round in a loop. */
+    const val WAITING_LATENCY_MS = 15 * MINUTE_MS
     private const val TAG = "TernScheduler"
 
     fun apply(context: Context, settings: Settings): Boolean {
@@ -31,7 +35,8 @@ object Scheduler {
         val wanted = JobInfo.Builder(JOB_ID, ComponentName(context, CheckJobService::class.java))
             .setPeriodic(settings.checkEveryMinutes * MINUTE_MS)
             .setPersisted(true)
-            .setRequiredNetworkType(JobInfo.NETWORK_TYPE_ANY)
+            .setRequiredNetworkType(checkNetwork(settings))
+            .setRequiresCharging(settings.checkOnlyWhileCharging)
             .setRequiresBatteryNotLow(true)
             .build()
         val current = scheduler.getPendingJob(JOB_ID)
@@ -43,11 +48,15 @@ object Scheduler {
 
     fun isScheduled(context: Context): Boolean = context.getSystemService(JobScheduler::class.java).getPendingJob(JOB_ID) != null
 
-    /** Runs the check again, and installs what waited, as soon as the network and the charger are what the settings ask for. */
+    /**
+     * Installs what waited, from what the last check found, once the network and the charger are
+     * what the settings ask for. It checks nothing again but what an app asks to have checked first.
+     */
     fun waitForInstalls(context: Context, settings: Settings) {
         val job = JobInfo.Builder(WAITING_JOB_ID, ComponentName(context, CheckJobService::class.java))
             .setPersisted(true)
-            .setRequiredNetworkType(if (settings.onlyOnUnmetered) JobInfo.NETWORK_TYPE_UNMETERED else JobInfo.NETWORK_TYPE_ANY)
+            .setMinimumLatency(WAITING_LATENCY_MS)
+            .setRequiredNetworkType(installNetwork(settings))
             .setRequiresCharging(settings.onlyWhileCharging)
             .setRequiresBatteryNotLow(true)
             .build()
@@ -69,6 +78,23 @@ object Scheduler {
         if (context.getSystemService(JobScheduler::class.java).schedule(job) != JobScheduler.RESULT_SUCCESS) TernLog.e(TAG, "JobScheduler refused the retry")
     }
 
+    /** The network the periodic check waits for. */
+    fun checkNetwork(settings: Settings): Int = if (settings.checkOnlyOnUnmetered) JobInfo.NETWORK_TYPE_UNMETERED else JobInfo.NETWORK_TYPE_ANY
+
+    /** The network the waiting job waits for. */
+    fun installNetwork(settings: Settings): Int = if (settings.onlyOnUnmetered) JobInfo.NETWORK_TYPE_UNMETERED else JobInfo.NETWORK_TYPE_ANY
+
+    /**
+     * Whether a run installs now. The waiting job runs only once JobScheduler found the network
+     * and the charger the settings ask for, so it takes that as settled; asking the device again
+     * could get another answer (a charger that paused at 80 %) and hold the installs once more.
+     */
+    fun installsNow(settings: Settings, waitingJob: Boolean, unmetered: () -> Boolean, charging: () -> Boolean): Boolean =
+        settings.autoInstalls && (waitingJob || (!settings.onlyOnUnmetered || unmetered()) && (!settings.onlyWhileCharging || charging()))
+
+    /** Whether a run that held installs back sets the waiting job. The waiting job never sets itself again. */
+    fun armsWaiting(settings: Settings, waitingJob: Boolean, waited: Boolean): Boolean = !waitingJob && waited && settings.autoInstalls
+
     private fun same(a: JobInfo, b: JobInfo): Boolean =
         a.intervalMillis == b.intervalMillis && a.isPersisted == b.isPersisted && a.requiredNetwork == b.requiredNetwork &&
             a.isRequireCharging == b.isRequireCharging && a.isRequireBatteryNotLow == b.isRequireBatteryNotLow &&
diff --git a/app/src/main/res/raw/russian_trusted_root.pem b/app/src/main/res/raw/russian_trusted_root.pem
deleted file mode 100644
index a9b27a78..00000000
--- a/app/src/main/res/raw/russian_trusted_root.pem
+++ /dev/null
@@ -1,33 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIFwjCCA6qgAwIBAgICEAAwDQYJKoZIhvcNAQELBQAwcDELMAkGA1UEBhMCUlUx
-PzA9BgNVBAoMNlRoZSBNaW5pc3RyeSBvZiBEaWdpdGFsIERldmVsb3BtZW50IGFu
-ZCBDb21tdW5pY2F0aW9uczEgMB4GA1UEAwwXUnVzc2lhbiBUcnVzdGVkIFJvb3Qg
-Q0EwHhcNMjIwMzAxMjEwNDE1WhcNMzIwMjI3MjEwNDE1WjBwMQswCQYDVQQGEwJS
-VTE/MD0GA1UECgw2VGhlIE1pbmlzdHJ5IG9mIERpZ2l0YWwgRGV2ZWxvcG1lbnQg
-YW5kIENvbW11bmljYXRpb25zMSAwHgYDVQQDDBdSdXNzaWFuIFRydXN0ZWQgUm9v
-dCBDQTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAMfFOZ8pUAL3+r2n
-qqE0Zp52selXsKGFYoG0GM5bwz1bSFtCt+AZQMhkWQheI3poZAToYJu69pHLKS6Q
-XBiwBC1cvzYmUYKMYZC7jE5YhEU2bSL0mX7NaMxMDmH2/NwuOVRj8OImVa5s1F4U
-zn4Kv3PFlDBjjSjXKVY9kmjUBsXQrIHeaqmUIsPIlNWUnimXS0I0abExqkbdrXbX
-YwCOXhOO2pDUx3ckmJlCMUGacUTnylyQW2VsJIyIGA8V0xzdaeUXg0VZ6ZmNUr5Y
-Ber/EAOLPb8NYpsAhJe2mXjMB/J9HNsoFMBFJ0lLOT/+dQvjbdRZoOT8eqJpWnVD
-U+QL/qEZnz57N88OWM3rabJkRNdU/Z7x5SFIM9FrqtN8xewsiBWBI0K6XFuOBOTD
-4V08o4TzJ8+Ccq5XlCUW2L48pZNCYuBDfBh7FxkB7qDgGDiaftEkZZfApRg2E+M9
-G8wkNKTPLDc4wH0FDTijhgxR3Y4PiS1HL2Zhw7bD3CbslmEGgfnnZojNkJtcLeBH
-BLa52/dSwNU4WWLubaYSiAmA9IUMX1/RpfpxOxd4Ykmhz97oFbUaDJFipIggx5sX
-ePAlkTdWnv+RWBxlJwMQ25oEHmRguNYf4Zr/Rxr9cS93Y+mdXIZaBEE0KS2iLRqa
-OiWBki9IMQU4phqPOBAaG7A+eP8PAgMBAAGjZjBkMB0GA1UdDgQWBBTh0YHlzlpf
-BKrS6badZrHF+qwshzAfBgNVHSMEGDAWgBTh0YHlzlpfBKrS6badZrHF+qwshzAS
-BgNVHRMBAf8ECDAGAQH/AgEEMA4GA1UdDwEB/wQEAwIBhjANBgkqhkiG9w0BAQsF
-AAOCAgEAALIY1wkilt/urfEVM5vKzr6utOeDWCUczmWX/RX4ljpRdgF+5fAIS4vH
-tmXkqpSCOVeWUrJV9QvZn6L227ZwuE15cWi8DCDal3Ue90WgAJJZMfTshN4OI8cq
-W9E4EG9wglbEtMnObHlms8F3CHmrw3k6KmUkWGoa+/ENmcVl68u/cMRl1JbW2bM+
-/3A+SAg2c6iPDlehczKx2oa95QW0SkPPWGuNA/CE8CpyANIhu9XFrj3RQ3EqeRcS
-AQQod1RNuHpfETLU/A2gMmvn/w/sx7TB3W5BPs6rprOA37tutPq9u6FTZOcG1Oqj
-C/B7yTqgI7rbyvox7DEXoX7rIiEqyNNUguTk/u3SZ4VXE2kmxdmSh3TQvybfbnXV
-4JbCZVaqiZraqc7oZMnRoWrXRG3ztbnbes/9qhRGI7PqXqeKJBztxRTEVj8ONs1d
-WN5szTwaPIvhkhO3CO5ErU2rVdUr89wKpNXbBODFKRtgxUT70YpmJ46VVaqdAhOZ
-D9EUUn4YaeLaS8AjSF/h7UkjOibNc4qVDiPP+rkehFWM66PVnP1Msh93tc+taIfC
-EYVMxjh8zNbFuoc7fzvvrFILLe7ifvEIUqSVIC/AzplM/Jxw7buXFeGP1qVCBEHq
-391d/9RAfaZ12zkwFsl+IKwE/OZxW8AHa9i1p4GO0YSNuczzEm4=
------END CERTIFICATE-----
\ No newline at end of file
diff --git a/app/src/main/res/values-ar/strings.xml b/app/src/main/res/values-ar/strings.xml
index 4f420537..5dcea2fa 100644
--- a/app/src/main/res/values-ar/strings.xml
+++ b/app/src/main/res/values-ar/strings.xml
@@ -429,7 +429,6 @@
     <string name="settings_import_effect">من تصدير Tern أو Obtainium</string>
     <string name="settings_export">تصدير التطبيقات</string>
     <string name="settings_exporting">جارٍ التصدير</string>
-    <string name="settings_export_effect">يحفظ قائمتك وإعداداتك في ملف. لا يتم تضمين الرموز أبدًا.</string>
     <plurals name="exported">
         <item quantity="zero">تم تصدير %d تطبيق</item>
         <item quantity="one">تم تصدير تطبيق واحد (%d)</item>
diff --git a/app/src/main/res/values-ar/strings_accept.xml b/app/src/main/res/values-ar/strings_accept.xml
new file mode 100644
index 00000000..2cb0f427
--- /dev/null
+++ b/app/src/main/res/values-ar/strings_accept.xml
@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="stores_paused_reason">المتاجر الخارجية متوقفة، لذا لا يسأل Tern هذا المتجر عن أي شيء. شغّلها في الإعدادات لفحصه مرة أخرى.</string>
+</resources>
diff --git a/app/src/main/res/values-ar/strings_checks.xml b/app/src/main/res/values-ar/strings_checks.xml
index ab319923..6c06cbb8 100644
--- a/app/src/main/res/values-ar/strings_checks.xml
+++ b/app/src/main/res/values-ar/strings_checks.xml
@@ -25,13 +25,11 @@
     <string name="settings_only_installed">فحص التطبيقات المثبتة فقط</string>
     <string name="settings_only_installed_effect">التطبيقات التي تُتابَع فقط تُفحص أيضًا. التطبيق الذي تفتحه يُفحص دائمًا.</string>
     <string name="settings_remove_uninstalled">إزالة التطبيقات التي أُلغي تثبيتها في مكان آخر</string>
-    <string name="settings_remove_uninstalled_effect">التطبيق الذي تلغي تثبيته خارج Tern يخرج من القائمة أيضًا.</string>
     <string name="settings_file_filter">فلتر الملفات</string>
     <string name="settings_file_filter_effect">نمط يختار به كل تطبيق ليس له فلتر خاص به ملفَّه.</string>
     <string name="settings_file_filter_none">لا شيء</string>
     <string name="settings_file_filter_invalid">تتعذر قراءة هذا النمط.</string>
     <string name="settings_allow_downgrades">السماح بالإصدارات الأقدم</string>
-    <string name="settings_allow_downgrades_effect">Let Me Downgrade مثبت، لذا يمكن لـ Android وضع إصدار أقدم فوق إصدار أحدث.</string>
     <string name="settings_collapse_groups">البدء بالمجموعات مطوية</string>
     <string name="settings_haptics">الاستجابة اللمسية</string>
     <string name="settings_haptics_effect">اهتزاز خفيف عندما يؤدي السحب أو الضغط المطوّل إلى إجراء ما.</string>
@@ -46,7 +44,6 @@
     <string name="sources_repositories">المستودعات</string>
     <string name="sources_stores">المتاجر</string>
     <string name="sources_mirrors">متاجر تعيد نشر التطبيقات</string>
-    <string name="sources_modified">مواقع لتطبيقات معدّلة</string>
     <string name="sources_other">أماكن أخرى</string>
     <string name="sources_web_page">صفحة ويب بها روابط إلى ملفات</string>
     <string name="sources_direct">رابط مباشر إلى ملف</string>
@@ -56,8 +53,6 @@
     <string name="shared_configs_title">إعدادات يشاركها مستخدمو Obtainium</string>
     <string name="shared_configs_effect">موقع لإعدادات جاهزة للتطبيقات. تُفتح روابطه في Tern عند تشغيل «فتح روابط Obtainium» في الإعدادات.</string>
     <string name="engine_inner_filter_nothing">فلتر الملفات داخل الأرشيفات لا يطابق أيًا من ملفات APK في هذا الأرشيف.</string>
-    <string name="preview_republished">يعيد %1$s نشر ما ينشره المطورون في أماكن أخرى. تُلزَم ملفاته بشهادة المطور بمجرد أن يعرفها Tern، لذا متى استطعت، ثبّت شهادة أو قم أولًا بتثبيت التطبيق من مطوره.</string>
-    <string name="preview_modified">يقدم %1$s تطبيقات عدّلها شخص غير مطورها. وهي موقّعة ممن عدّلها، ولا يستطيع Tern معرفة ما الذي تم تغييره.</string>
     <string name="about_track_tern">إبقاء Tern نفسه محدثًا</string>
     <string name="about_track_tern_effect">يضيف إصدارات Tern نفسه إلى القائمة، تُفحص ويُتحقق منها مثل أي تطبيق.</string>
     <string name="engine_channel_tracked">إصدارات جديدة للتطبيقات المتابَعة</string>
diff --git a/app/src/main/res/values-ar/strings_options.xml b/app/src/main/res/values-ar/strings_options.xml
index 778764ba..a64c96ed 100644
--- a/app/src/main/res/values-ar/strings_options.xml
+++ b/app/src/main/res/values-ar/strings_options.xml
@@ -70,10 +70,6 @@
     <string name="option_workflow">ملف سير العمل</string>
     <string name="option_workflow_help">مثل build.yml.</string>
     <string name="option_branch">الفرع</string>
-    <string name="option_device_model">طراز الجهاز</string>
-    <string name="option_device_model_help">يقدم Galaxy Store لكل طراز نسخته الخاصة، مثل SM-S948B.</string>
-    <string name="option_csc">رمز المنطقة (CSC)</string>
-    <string name="option_csc_help">ثلاثة أحرف، مثل DBT.</string>
     <string name="option_link_filter">فلتر روابط التنزيل</string>
     <string name="option_link_filter_help">الروابط المطابقة فقط تُحتسب كتنزيلات.</string>
     <string name="option_page_order">الإبقاء على ترتيب الصفحة</string>
@@ -84,11 +80,14 @@
     <string name="version_from_text">نص الرابط</string>
     <string name="version_from_page">الصفحة كاملة</string>
     <string name="option_headers">ترويسات الطلب</string>
-    <string name="option_headers_help">واحدة في كل سطر، بالشكل Name: value. لا تضع أبدًا كلمة مرور أو ملف تعريف ارتباط.</string>
     <string name="option_pseudo">عندما لا يوجد رقم إصدار</string>
     <string name="pseudo_default">تمييز الملفات كما يفعل الخادم</string>
     <string name="pseudo_hash">بتجزئة بداية الملف</string>
     <string name="pseudo_link">بعنوان الملف</string>
     <string name="pseudo_etag">بقيمة ETag من الخادم</string>
     <string name="option_invalid">لا يمكن استخدام هذا كما هو.</string>
+    <string name="option_device_model">طراز الجهاز</string>
+    <string name="option_device_model_help">يقدم Galaxy Store لكل طراز نسخته الخاصة، مثل SM-S948B.</string>
+    <string name="option_csc">رمز المنطقة (CSC)</string>
+    <string name="option_csc_help">ثلاثة أحرف، مثل DBT.</string>
 </resources>
diff --git a/app/src/main/res/values-ar/strings_safety.xml b/app/src/main/res/values-ar/strings_safety.xml
new file mode 100644
index 00000000..c9dff038
--- /dev/null
+++ b/app/src/main/res/values-ar/strings_safety.xml
@@ -0,0 +1,33 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="settings_export_effect_plain">يحفظ قائمتك وإعداداتك في ملف. لا تُدرج الرموز أبدًا، ولا ترويسة الطلب التي قد تحمل مفتاحًا.</string>
+    <string name="engine_checksum_github_proxy">خلاصة إصدار GitHub، كما مررها hubproxy %1$s</string>
+    <string name="github_proxy_effect_trust">يذهب كل طلب إلى GitHub إلى هذا المضيف. إنه يرى كل طلب ويمكنه تغيير ما يعود: الإصدارات وخلاصاتها والملفات. تبقى التطبيقات التي لديك ملزمة بشهادتها، لكن أول تثبيت من خلاله يثق في hubproxy بقدر ما يثق في GitHub، ولا يصله تثبيت الشهادة. لا يُرسل أي رمز عبره، لذلك لا يمكن متابعة المشاريع الخاصة و GitHub Actions بهذه الطريقة.</string>
+    <string name="settings_unmetered_checks">الفحص على Wi-Fi فقط</string>
+    <string name="settings_unmetered_checks_effect">تنتظر الفحوصات في الخلفية اتصال Wi-Fi أو كابلًا، لذلك لا تستخدم أي بيانات جوال.</string>
+    <string name="settings_charging_checks">الفحص أثناء الشحن فقط</string>
+    <string name="settings_charging_checks_effect">تنتظر الفحوصات في الخلفية حتى يتم شحن الجهاز.</string>
+    <string name="settings_unmetered_installs_wait">ينتظر التحديث الذي من شأنه أن يثبّت نفسه اتصال Wi-Fi أو كابلًا، كما هو الحال في Obtainium.</string>
+    <string name="settings_charging_installs_wait">ينتظر التحديث الذي من شأنه أن يثبّت نفسه حتى يتم شحن الجهاز.</string>
+    <string name="engine_downgrade_not_as_named">سمى المصدر رمز الإصدار %2$d، لكن هذا الملف هو %1$d، أقدم من المثبت. لا يُوضع فوق الإصدار الأحدث.</string>
+    <string name="settings_allow_downgrades_picked">تطبيق Let Me Downgrade مثبت، لذلك قد يضع Android إصدارًا أقدم فوق إصدار أحدث. يفعل Tern ذلك فقط لإصدار تختاره من سجل التطبيق، أبدًا ليس في الخلفية أو مع خيار تحديث الكل.</string>
+    <string name="option_highest_version">أخذ أعلى إصدار، كما فعل Tern 0.1.0</string>
+    <string name="option_highest_version_effect">يعرض الرابط الذي يحمل أعلى إصدار في الصفحة، أيًا كان مكانه، ويُجري نمط الإصدار على الإصدار المقروء من كل رابط. عند الإيقاف يقرأ Tern الصفحة كما يفعل Obtainium: الرابط الأخير بالترتيب هو الأحدث.</string>
+    <string name="settings_remove_uninstalled_keeps_pins">التطبيق الذي تلغي تثبيته خارج Tern يغادر القائمة أيضًا. يبقى التطبيق المؤرشف. عند إضافته مرة أخرى من نفس المكان، يُلزم التطبيق بالشهادة التي كانت لديه؛ إزالته في Tern ينسى ذلك.</string>
+    <string name="link_check_title">فحص التحديثات الآن؟</string>
+    <string name="link_check_one">طلب رابط من Tern فحص التحديثات لتطبيق %1$s. يُسأل مصدره، ولا يتم تثبيت أي شيء.</string>
+    <plurals name="link_check_all">
+        <item quantity="zero">طلب رابط من Tern فحص التحديثات لـ %d تطبيق في قائمتك. تُسأل مصادرها، ولا يتم تثبيت أي شيء.</item>
+        <item quantity="one">طلب رابط من Tern فحص التحديثات لـ %d تطبيق في قائمتك. يُسأل مصدره، ولا يتم تثبيت أي شيء.</item>
+        <item quantity="two">طلب رابط من Tern فحص التحديثات لـ %d تطبيق في قائمتك. تُسأل مصادرهما، ولا يتم تثبيت أي شيء.</item>
+        <item quantity="few">طلب رابط من Tern فحص التحديثات لـ %d تطبيقات في قائمتك. تُسأل مصادرها، ولا يتم تثبيت أي شيء.</item>
+        <item quantity="many">طلب رابط من Tern فحص التحديثات لـ %d تطبيقًا في قائمتك. تُسأل مصادرها، ولا يتم تثبيت أي شيء.</item>
+        <item quantity="other">طلب رابط من Tern فحص التحديثات لـ %d تطبيق في قائمتك. تُسأل مصادرها، ولا يتم تثبيت أي شيء.</item>
+    </plurals>
+    <string name="link_check_confirm">فحص</string>
+    <string name="link_check_not_now">ليس الآن</string>
+    <string name="engine_installer_fell_back">لم يكن %1$s جاهزًا، لذلك تم استخدام أداة تثبيت Android لهذا الملف.</string>
+    <string name="about_track_tern_fdroid_effect">قام F-Droid بتثبيت هذه النسخة، لذلك يتابع Tern مدخله هناك: التحديثات هي النسخ التي صنعها وفحصها F-Droid، كما يحصل عليها تطبيق F-Droid.</string>
+    <string name="about_track_tern_github">متابعة إصدارات GitHub بدلاً من ذلك</string>
+    <string name="about_track_tern_github_effect">تأتي التحديثات من GitHub بمجرد نشرها، قبل أن يقوم F-Droid ببنائها وفحصها. يتخطى هذا فحوصات F-Droid. لا يزال Tern يفحص كل ملف ويُلزمه بشهادته الخاصة.</string>
+</resources>
diff --git a/app/src/main/res/values-ar/strings_settings_more.xml b/app/src/main/res/values-ar/strings_settings_more.xml
index 875a705a..1dce6ead 100644
--- a/app/src/main/res/values-ar/strings_settings_more.xml
+++ b/app/src/main/res/values-ar/strings_settings_more.xml
@@ -41,9 +41,7 @@
     <string name="settings_auto_installs">تثبيت التحديثات تلقائيًا</string>
     <string name="settings_auto_installs_effect">التطبيقات المضبوطة على التحديث تلقائيًا تتحدث بعد فحص في الخلفية. عند إيقاف التشغيل، تكتفي بالإشارة إلى وجود تحديث، ويحتفظ كل منها باختياره الخاص لوقت لاحق.</string>
     <string name="settings_unmetered_installs">التثبيت عبر Wi-Fi فقط</string>
-    <string name="settings_unmetered_installs_effect">تعمل الفحوصات على أي شبكة. التحديث الذي كان سيُثبَّت من تلقاء نفسه ينتظر شبكة Wi-Fi أو كابل شبكة، كما في Obtainium.</string>
     <string name="settings_charging_installs">التثبيت أثناء الشحن فقط</string>
-    <string name="settings_charging_installs_effect">تعمل الفحوصات على البطارية أيضًا. التحديث الذي كان سيُثبَّت من تلقاء نفسه ينتظر حتى يبدأ الجهاز بالشحن.</string>
     <string name="engine_unreadable_app">تعذرت قراءة التطبيق المحفوظ %1$s، لذلك تُرك خارج القائمة. لم يُحذف شيء: قد يتمكن إصدار أحدث من Tern من قراءته.</string>
     <string name="settings_pin_certificates">تثبيت شهادات منصات الشيفرة</string>
     <string name="settings_pin_certificates_effect">يجب أن تقدم GitHub وGitLab وCodeberg شهادة من جهة إصدار الشهادات المعروف أن كلًا منها يستخدمها، كما في Obtainium. وتُرفض حينئذٍ شهادة أُجبرت جهة أخرى على إصدارها. إذا غيّرت منصة شيفرة جهتها، فستفشل الفحوصات عليها إلى أن يُوقَف هذا الخيار.</string>
diff --git a/app/src/main/res/values-ar/strings_sources_more.xml b/app/src/main/res/values-ar/strings_sources_more.xml
index 3ee007c6..aca9938c 100644
--- a/app/src/main/res/values-ar/strings_sources_more.xml
+++ b/app/src/main/res/values-ar/strings_sources_more.xml
@@ -18,10 +18,7 @@
     <string name="step_arch">تفضيل معالج هذا الجهاز</string>
     <string name="step_add">إضافة صفحة</string>
     <string name="step_remove">إزالة هذه الصفحة</string>
-    <string name="option_file_version">استخدام اسم الملف كرقم الإصدار</string>
-    <string name="option_file_version_effect">عندها يُحتسب كل ملف إصدارًا مستقلًا.</string>
     <string name="github_proxy_title">GitHub عبر hubproxy</string>
-    <string name="github_proxy_effect">كل طلب إلى GitHub يمر عبر هذا المضيف، الذي يرى كل طلب. لا يُرسَل أي رمز عبره، لذلك لا يمكن متابعة المشاريع الخاصة ولا GitHub Actions بهذه الطريقة.</string>
     <string name="github_proxy_host">مضيف hubproxy</string>
     <string name="github_proxy_help">اسم المضيف وحده، مثل gh-proxy.com. يتصل Tern به عبر HTTPS.</string>
     <string name="github_proxy_invalid">هذا ليس اسم مضيف يمكن لـ Tern استخدامه</string>
diff --git a/app/src/main/res/values-ar/strings_starters.xml b/app/src/main/res/values-ar/strings_starters.xml
new file mode 100644
index 00000000..79a9b4c8
--- /dev/null
+++ b/app/src/main/res/values-ar/strings_starters.xml
@@ -0,0 +1,7 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="starter_in_list">في قائمتك</string>
+    <string name="starter_on_phone">على هذا الهاتف</string>
+    <string name="starter_on_phone_other">على هذا الهاتف من موقّع آخر</string>
+    <string name="starter_on_phone_other_explain">النسخة التي لديك موقعة بمفتاح مختلف، لذلك لا يمكن لـ Tern تحديثها من هذا العنوان.</string>
+</resources>
diff --git a/app/src/main/res/values-ar/strings_stores.xml b/app/src/main/res/values-ar/strings_stores.xml
new file mode 100644
index 00000000..96d39c66
--- /dev/null
+++ b/app/src/main/res/values-ar/strings_stores.xml
@@ -0,0 +1,27 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="option_headers_help_own_agent">كل واحد في سطر، بصيغة الاسم: القيمة. لا تضع أبدًا كلمة مرور أو ملف تعريف ارتباط أو وكيل مستخدم: يخبر Tern كل موقع أنه Tern.</string>
+    <string name="origin_republished_first">يقدم %1$s مرة أخرى ما ينشره المطورون في مكان آخر، وليس هو المطور. حتى يُثبَّت التطبيق على شهادة، يقرر أول ملف يثبته Tern منه أي شهادة يجب أن يحملها كل تحديث لاحق.</string>
+    <string name="origin_republished_pinned">يقدم %1$s مرة أخرى ما ينشره المطورون في مكان آخر، وليس هو المطور. يجب أن تحمل ملفاته الشهادة التي يُلزم بها هذا التطبيق.</string>
+    <string name="origin_store_first">%1$s هو متجر، وليس موقع المطور الخاص. حتى يُثبَّت التطبيق على شهادة، يقرر أول ملف يثبته Tern منه أي شهادة يجب أن يحملها كل تحديث لاحق.</string>
+    <string name="origin_store_pinned">%1$s هو متجر، وليس موقع المطور الخاص. يجب أن تحمل ملفاته الشهادة التي يُلزم بها هذا التطبيق.</string>
+    <string name="stores_refused_modified">لا يقرأ Tern المواقع التي تقدم تطبيقات معدلة. يتم تغيير ملفاتها من قبل شخص آخر غير المطور ويتم توقيعها من قبل من غيّرها.</string>
+    <string name="stores_refused_impersonation">لا يستطيع Tern قراءة هذا المتجر دون التظاهر بأنه تطبيقه، لذلك لا يقرؤه.</string>
+    <string name="stores_checksum_source">%1$s، وهو ليس المطور</string>
+    <string name="stores_off_title">%1$s هو متجر خارجي</string>
+    <string name="stores_off_body">المتاجر الخارجية متوقفة. يقدم المتجر نسخه الخاصة من التطبيقات، وليس الملفات من موقع المطور الخاص، ويقرؤه Tern من خلال الواجهة التي صنعها المتجر لتطبيقه أو موقعه على الويب. عند تشغيلها، يسأل Tern متجرًا فقط عن التطبيقات التي تضيفها منه، وحتى يُثبَّت تطبيق على شهادة، يقرر أول ملف يثبته Tern من متجر أي شهادة يجب أن تحملها تحديثاته.</string>
+    <string name="stores_turn_on">تشغيل المتاجر الخارجية</string>
+    <string name="stores_advice">شغّل المتاجر الخارجية في الإعدادات لفحص هذا التطبيق مرة أخرى.</string>
+    <string name="stores_status_paused">متوقف مؤقتًا</string>
+    <string name="stores_row_paused">المتاجر الخارجية متوقفة</string>
+    <string name="stores_setting">المتاجر الخارجية</string>
+    <string name="stores_setting_effect">APKPure و Aptoide و APKCombo و APKMirror و Tencent و Huawei AppGallery و Galaxy Store و vivo. تقدم هذه المتاجر نسخها الخاصة من التطبيقات، وليس ملفات من موقع المطور الخاص، ويقرؤها Tern عبر الواجهات التي صنعوها لتطبيقاتها ومواقعها على الويب. عند الإيقاف، لا يسأل Tern أيًا منها عن أي شيء، ويستثنيها البحث وتُوقف التطبيقات التي منها مؤقتًا.</string>
+    <string name="stores_off_tag">متوقف في الإعدادات</string>
+    <string name="stores_checksum_matched">يطابق الملف المجموع الاختباري للمتجر</string>
+    <string name="stores_explain_checksum_matched">المجموع الاختباري هو بصمة للملف نفسه. أعطى المتجر واحدًا، والملف الذي نزله Tern لديه المجموع نفسه، لذلك وصل كما هو لدى المتجر. المتجر ليس المطور، لذلك هذا لا يقول شيئًا عمن صنع الملف. الشهادة هي التي تفعل ذلك.</string>
+    <string name="stores_import_from_stores">تأتي هذه من متاجر خارجية، والتي تقدم نسخها الخاصة من التطبيقات. حتى يُثبَّت تطبيق على شهادة، يقرر أول ملف يثبته Tern من متجره أي شهادة يجب أن تحملها تحديثاته.</string>
+    <string name="stores_import_paused">المتاجر الخارجية متوقفة، لذلك هذه التطبيقات متوقفة مؤقتًا. لا يسأل Tern هذه المتاجر عن أي شيء حتى تقوم بتشغيلها.</string>
+    <string name="stores_import_names">من متاجر خارجية</string>
+    <string name="share_obtainium_link">مشاركة كرابط Obtainium</string>
+    <string name="share_obtainium_links">مشاركة كروابط Obtainium</string>
+</resources>
diff --git a/app/src/main/res/values-ar/strings_tv.xml b/app/src/main/res/values-ar/strings_tv.xml
new file mode 100644
index 00000000..e7ff346e
--- /dev/null
+++ b/app/src/main/res/values-ar/strings_tv.xml
@@ -0,0 +1,5 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="interval_turn_off">إيقاف الفحوصات في الخلفية</string>
+    <string name="interval_turn_on">تشغيل الفحوصات في الخلفية</string>
+</resources>
diff --git a/app/src/main/res/values-bs/strings.xml b/app/src/main/res/values-bs/strings.xml
index 7b501642..e99d939e 100644
--- a/app/src/main/res/values-bs/strings.xml
+++ b/app/src/main/res/values-bs/strings.xml
@@ -384,7 +384,6 @@
     <string name="settings_import_effect">Iz Tern ili Obtainium izvoza</string>
     <string name="settings_export">Izvezi aplikacije</string>
     <string name="settings_exporting">Izvozi se</string>
-    <string name="settings_export_effect">Sprema vaš spisak i postavke u datoteku. Tokeni se nikada ne uključuju.</string>
     <plurals name="exported">
         <item quantity="one">Izvezena %d aplikacija</item>
         <item quantity="few">Izvezene %d aplikacije</item>
diff --git a/app/src/main/res/values-bs/strings_accept.xml b/app/src/main/res/values-bs/strings_accept.xml
new file mode 100644
index 00000000..11ae80d1
--- /dev/null
+++ b/app/src/main/res/values-bs/strings_accept.xml
@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="stores_paused_reason">Prodavnice trećih strana su isključene, pa Tern ništa ne pita ovu prodavnicu. Uključite ih u postavkama da biste je ponovo provjerili.</string>
+</resources>
diff --git a/app/src/main/res/values-bs/strings_checks.xml b/app/src/main/res/values-bs/strings_checks.xml
index 377d2490..348dd8ec 100644
--- a/app/src/main/res/values-bs/strings_checks.xml
+++ b/app/src/main/res/values-bs/strings_checks.xml
@@ -19,13 +19,11 @@
     <string name="settings_only_installed">Provjeravaj samo instalirane aplikacije</string>
     <string name="settings_only_installed_effect">Aplikacije koje se samo prate također se provjeravaju. Aplikacija koju otvorite uvijek se provjerava.</string>
     <string name="settings_remove_uninstalled">Ukloni aplikacije deinstalirane negdje drugo</string>
-    <string name="settings_remove_uninstalled_effect">Aplikacija koju deinstalirate izvan Terna također napušta spisak.</string>
     <string name="settings_file_filter">Filter za datoteke</string>
     <string name="settings_file_filter_effect">Obrazac po kojem svaka aplikacija bez vlastitog filtera bira svoju datoteku.</string>
     <string name="settings_file_filter_none">Nijedan</string>
     <string name="settings_file_filter_invalid">Ovaj obrazac se ne može pročitati.</string>
     <string name="settings_allow_downgrades">Dozvoli starije verzije</string>
-    <string name="settings_allow_downgrades_effect">Let Me Downgrade je instaliran, pa Android može staviti stariju verziju preko novije.</string>
     <string name="settings_collapse_groups">Počni sa sklopljenim grupama</string>
     <string name="settings_haptics">Haptički odziv</string>
     <string name="settings_haptics_effect">Lagana vibracija kada prevlačenje ili dugi pritisak nešto uradi.</string>
@@ -40,7 +38,6 @@
     <string name="sources_repositories">Repozitoriji</string>
     <string name="sources_stores">Trgovine</string>
     <string name="sources_mirrors">Trgovine koje ponovo objavljuju aplikacije</string>
-    <string name="sources_modified">Stranice s izmijenjenim aplikacijama</string>
     <string name="sources_other">Druga mjesta</string>
     <string name="sources_web_page">Web stranica s linkovima na datoteke</string>
     <string name="sources_direct">Direktan link na datoteku</string>
@@ -50,8 +47,6 @@
     <string name="shared_configs_title">Konfiguracije koje dijele korisnici Obtainiuma</string>
     <string name="shared_configs_effect">Stranica s gotovim postavkama za aplikacije. Njeni linkovi se otvaraju u Ternu kada je u Postavkama uključeno \"Otvori Obtainium linkove\".</string>
     <string name="engine_inner_filter_nothing">Filter za datoteke unutar arhiva ne odgovara nijednom APK-u u ovoj arhivi.</string>
-    <string name="preview_republished">%1$s ponovo nudi ono što programeri objavljuju negdje drugo. Njegove datoteke se provjeravaju prema certifikatu programera čim ga Tern sazna, zato prikvačite certifikat ili prvo instalirajte od programera kada možete.</string>
-    <string name="preview_modified">%1$s nudi aplikacije koje je izmijenio neko drugi, a ne njihov programer. Potpisao ih je onaj ko ih je izmijenio, i Tern ne može znati šta je izmijenjeno.</string>
     <string name="about_track_tern">Održavaj i sam Tern ažurnim</string>
     <string name="about_track_tern_effect">Dodaje Ternova izdanja na spisak, provjerena i verificirana kao i kod svake aplikacije.</string>
     <string name="engine_channel_tracked">Nova izdanja praćenih aplikacija</string>
diff --git a/app/src/main/res/values-bs/strings_options.xml b/app/src/main/res/values-bs/strings_options.xml
index 48a19d5d..3b5364de 100644
--- a/app/src/main/res/values-bs/strings_options.xml
+++ b/app/src/main/res/values-bs/strings_options.xml
@@ -64,10 +64,6 @@
     <string name="option_workflow">Datoteka radnog toka</string>
     <string name="option_workflow_help">Na primjer build.yml.</string>
     <string name="option_branch">Grana</string>
-    <string name="option_device_model">Model uređaja</string>
-    <string name="option_device_model_help">Galaxy Store daje svakom modelu vlastitu verziju, na primjer SM-S948B.</string>
-    <string name="option_csc">Kod regije (CSC)</string>
-    <string name="option_csc_help">Tri slova, na primjer DBT.</string>
     <string name="option_link_filter">Filter za linkove za preuzimanje</string>
     <string name="option_link_filter_help">Samo linkovi koji se podudaraju računaju se kao preuzimanja.</string>
     <string name="option_page_order">Zadrži redoslijed stranice</string>
@@ -78,11 +74,14 @@
     <string name="version_from_text">Tekst linka</string>
     <string name="version_from_page">Cijela stranica</string>
     <string name="option_headers">Zaglavlja zahtjeva</string>
-    <string name="option_headers_help">Jedno po redu, kao Name: value. Nikada lozinka ili kolačić.</string>
     <string name="option_pseudo">Kada nema verzije</string>
     <string name="pseudo_default">Razlikuj datoteke kao što to radi server</string>
     <string name="pseudo_hash">Po hešu početka datoteke</string>
     <string name="pseudo_link">Po adresi datoteke</string>
     <string name="pseudo_etag">Po ETag-u servera</string>
     <string name="option_invalid">Ovo se ne može koristiti ovakvo kakvo je.</string>
+    <string name="option_device_model">Model uređaja</string>
+    <string name="option_device_model_help">Galaxy Store daje svakom modelu vlastitu verziju, na primjer SM-S948B.</string>
+    <string name="option_csc">Kod regije (CSC)</string>
+    <string name="option_csc_help">Tri slova, na primjer DBT.</string>
 </resources>
diff --git a/app/src/main/res/values-bs/strings_safety.xml b/app/src/main/res/values-bs/strings_safety.xml
new file mode 100644
index 00000000..70d1650e
--- /dev/null
+++ b/app/src/main/res/values-bs/strings_safety.xml
@@ -0,0 +1,30 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="settings_export_effect_plain">Sprema vaš spisak i postavke u datoteku. Tokeni nikada ne ulaze, kao ni zaglavlje zahtjeva koje bi moglo sadržavati ključ.</string>
+    <string name="engine_checksum_github_proxy">GitHub kontrolni zbir izdanja, kako ga je hubproxy %1$s proslijedio</string>
+    <string name="github_proxy_effect_trust">Svaki zahtjev prema GitHubu ide ka ovom domaćinu. On vidi svaki od njih i može promijeniti ono što se vraća: izdanja, njihove kontrolne zbirove i datoteke. Aplikacije koje imate i dalje se drže svog certifikata, ali prva instalacija preko njega vjeruje hubproxyju jednako kao i GitHubu, a prikačivanje certifikata do njega ne dopire. Nijedan token se ne šalje preko njega, tako da se privatni projekti i GitHub Actions na ovaj način ne mogu pratiti.</string>
+    <string name="settings_unmetered_checks">Provjeravaj samo na Wi-Fi</string>
+    <string name="settings_unmetered_checks_effect">Provjere u pozadini čekaju na Wi-Fi ili kabl, tako da ne troše mobilne podatke.</string>
+    <string name="settings_charging_checks">Provjeravaj samo dok se puni</string>
+    <string name="settings_charging_checks_effect">Provjere u pozadini čekaju dok se uređaj ne počne puniti.</string>
+    <string name="settings_unmetered_installs_wait">Ažuriranje koje bi se samo instaliralo čeka na Wi-Fi ili kabl, kao u Obtainiumu.</string>
+    <string name="settings_charging_installs_wait">Ažuriranje koje bi se samo instaliralo čeka dok se uređaj ne počne puniti.</string>
+    <string name="engine_downgrade_not_as_named">Izvor je naveo kod verzije %2$d, ali ova datoteka je %1$d, starija od instalirane. Ne stavlja se preko novije.</string>
+    <string name="settings_allow_downgrades_picked">Let Me Downgrade je instaliran, pa Android može staviti stariju verziju preko novije. Tern to radi samo za izdanje koje odaberete iz historije aplikacije, nikada u pozadini ili s opcijom Ažuriraj sve.</string>
+    <string name="option_highest_version">Uzmi najvišu verziju, kao što je to radio Tern 0.1.0</string>
+    <string name="option_highest_version_effect">Nudi link sa najvišom verzijom na stranici, bez obzira na njegovo mjesto, i pokreće obrazac verzije preko verzije pročitane sa svakog linka. Isključeno čita stranicu onako kako to radi Obtainium: posljednji link po redoslijedu je najnoviji.</string>
+    <string name="settings_remove_uninstalled_keeps_pins">Aplikacija koju deinstalirate van Terna također napušta spisak. Arhivirana aplikacija ostaje. Ponovo dodana sa istog mjesta, aplikacija se drži certifikata koji je imala; njeno uklanjanje u Ternu to zaboravlja.</string>
+    <string name="link_check_title">Provjeriti ažuriranja sada?</string>
+    <string name="link_check_one">Link je zatražio od Terna da provjeri ažuriranja za %1$s. Njegov izvor je upitan, i ništa se ne instalira.</string>
+    <plurals name="link_check_all">
+        <item quantity="one">Link je zatražio od Terna da provjeri ažuriranja za %d aplikaciju na vašem spisku. Njen izvor je upitan, i ništa se ne instalira.</item>
+        <item quantity="few">Link je zatražio od Terna da provjeri ažuriranja za %d aplikacije na vašem spisku. Njihovi izvori su upitani, i ništa se ne instalira.</item>
+        <item quantity="other">Link je zatražio od Terna da provjeri ažuriranja za %d aplikacija na vašem spisku. Njihovi izvori su upitani, i ništa se ne instalira.</item>
+    </plurals>
+    <string name="link_check_confirm">Provjeri</string>
+    <string name="link_check_not_now">Ne sada</string>
+    <string name="engine_installer_fell_back">%1$s nije bio spreman, pa je za ovu iskorišten Androidov instalator.</string>
+    <string name="about_track_tern_fdroid_effect">F-Droid je instalirao ovu kopiju, tako da Tern prati njen unos tamo: ažuriranja su buildovi koje je F-Droid napravio i provjerio, onako kako ih dobija F-Droid aplikacija.</string>
+    <string name="about_track_tern_github">Umjesto toga prati GitHub izdanja</string>
+    <string name="about_track_tern_github_effect">Ažuriranja dolaze sa GitHuba čim se objave, prije nego što ih F-Droid izradi i provjeri. Ovo preskače provjere F-Droida. Tern i dalje provjerava svaku datoteku i drži je za njen vlastiti certifikat.</string>
+</resources>
diff --git a/app/src/main/res/values-bs/strings_settings_more.xml b/app/src/main/res/values-bs/strings_settings_more.xml
index a213f34e..4d7de841 100644
--- a/app/src/main/res/values-bs/strings_settings_more.xml
+++ b/app/src/main/res/values-bs/strings_settings_more.xml
@@ -38,9 +38,7 @@
     <string name="settings_auto_installs">Ažuriranja se instaliraju sama</string>
     <string name="settings_auto_installs_effect">Aplikacije postavljene da se same ažuriraju to rade nakon provjere u pozadini. Isključeno, samo javljaju da ažuriranje postoji, a svaka zadržava svoj izbor za kasnije.</string>
     <string name="settings_unmetered_installs">Instaliraj samo na Wi-Fi mreži</string>
-    <string name="settings_unmetered_installs_effect">Provjere rade na bilo kojoj mreži. Ažuriranje koje bi se instaliralo samo čeka Wi-Fi ili kabl, kao u Obtainiumu.</string>
     <string name="settings_charging_installs">Instaliraj samo dok se puni</string>
-    <string name="settings_charging_installs_effect">Provjere rade i na bateriji. Ažuriranje koje bi se instaliralo samo čeka dok se uređaj ne počne puniti.</string>
     <string name="engine_unreadable_app">Sačuvana aplikacija %1$s nije se mogla pročitati, pa je izostavljena sa spiska. Ništa nije izbrisano: novija verzija Terna može je pročitati.</string>
     <string name="settings_pin_certificates">Prikvači certifikate platformi za kod</string>
     <string name="settings_pin_certificates_effect">Kao u Obtainiumu, GitHub, GitLab i Codeberg moraju pokazati certifikat izdavača za kojeg se zna da ga svaki od njih koristi. Certifikat koji je drugi izdavač bio primoran izdati tada se odbija. Ako platforma za kod promijeni izdavača, provjere tamo ne uspijevaju dok se ovo ne isključi.</string>
diff --git a/app/src/main/res/values-bs/strings_sources_more.xml b/app/src/main/res/values-bs/strings_sources_more.xml
index ac0e22a5..9d4943e9 100644
--- a/app/src/main/res/values-bs/strings_sources_more.xml
+++ b/app/src/main/res/values-bs/strings_sources_more.xml
@@ -18,10 +18,7 @@
     <string name="step_arch">Daj prednost procesoru ovog uređaja</string>
     <string name="step_add">Dodaj stranicu</string>
     <string name="step_remove">Ukloni ovu stranicu</string>
-    <string name="option_file_version">Koristi naziv datoteke kao verziju</string>
-    <string name="option_file_version_effect">Svaka datoteka se tada računa kao zasebno izdanje.</string>
     <string name="github_proxy_title">GitHub preko hubproxy</string>
-    <string name="github_proxy_effect">Svaki zahtjev prema GitHubu ide ovom domaćinu, koji vidi svaki od njih. Preko njega se ne šalje token, pa se privatni projekti i GitHub Actions na ovaj način ne mogu pratiti.</string>
     <string name="github_proxy_host">Hubproxy domaćin</string>
     <string name="github_proxy_help">Samo naziv domaćina, na primjer gh-proxy.com. Tern mu pristupa preko HTTPS-a.</string>
     <string name="github_proxy_invalid">To nije naziv domaćina koji Tern može koristiti</string>
diff --git a/app/src/main/res/values-bs/strings_starters.xml b/app/src/main/res/values-bs/strings_starters.xml
new file mode 100644
index 00000000..60038ff8
--- /dev/null
+++ b/app/src/main/res/values-bs/strings_starters.xml
@@ -0,0 +1,7 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="starter_in_list">Na vašem spisku</string>
+    <string name="starter_on_phone">Na ovom telefonu</string>
+    <string name="starter_on_phone_other">Na ovom telefonu od drugog potpisnika</string>
+    <string name="starter_on_phone_other_explain">Kopija koju imate potpisana je drugim ključem, tako da je Tern ne može ažurirati s ove adrese.</string>
+</resources>
diff --git a/app/src/main/res/values-bs/strings_stores.xml b/app/src/main/res/values-bs/strings_stores.xml
new file mode 100644
index 00000000..b47f161b
--- /dev/null
+++ b/app/src/main/res/values-bs/strings_stores.xml
@@ -0,0 +1,27 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="option_headers_help_own_agent">Po jedan u redu, kao Ime: vrijednost. Nikada lozinka, kolačić ili User-Agent: Tern svakoj web lokaciji govori da je Tern.</string>
+    <string name="origin_republished_first">%1$s ponovo nudi ono što programeri objavljuju negdje drugo, i nije programer. Dok se aplikacija ne prikači za certifikat, prva datoteka koju Tern instalira sa njega odlučuje koji certifikat mora nositi svako kasnije ažuriranje.</string>
+    <string name="origin_republished_pinned">%1$s ponovo nudi ono što programeri objavljuju negdje drugo, i nije programer. Njegove datoteke moraju nositi certifikat za koji je ova aplikacija prikačena.</string>
+    <string name="origin_store_first">%1$s je prodavnica, a ne vlastita web lokacija programera. Dok se aplikacija ne prikači za certifikat, prva datoteka koju Tern instalira iz nje odlučuje koji certifikat mora nositi svako kasnije ažuriranje.</string>
+    <string name="origin_store_pinned">%1$s je prodavnica, a ne vlastita web lokacija programera. Njene datoteke moraju nositi certifikat za koji je ova aplikacija prikačena.</string>
+    <string name="stores_refused_modified">Tern ne čita lokacije koje nude modificirane aplikacije. Njihove datoteke mijenja neko drugi, a ne programer, i potpisane su od strane onoga ko ih je promijenio.</string>
+    <string name="stores_refused_impersonation">Tern ne može čitati ovu prodavnicu bez pretvaranja da je njena aplikacija, pa je ne čita.</string>
+    <string name="stores_checksum_source">%1$s, koji nije programer</string>
+    <string name="stores_off_title">%1$s je prodavnica treće strane</string>
+    <string name="stores_off_body">Prodavnice trećih strana su isključene. Prodavnica poslužuje vlastite kopije aplikacija, a ne datoteke sa vlastite web lokacije programera, a Tern je čita kroz interfejs koji je prodavnica napravila za vlastitu aplikaciju ili web lokaciju. Kada su uključene, Tern pita prodavnicu samo za aplikacije koje dodate iz nje, a dok se aplikacija ne prikači za certifikat, prva datoteka koju Tern instalira iz prodavnice odlučuje koji certifikat moraju nositi njena ažuriranja.</string>
+    <string name="stores_turn_on">Uključi prodavnice trećih strana</string>
+    <string name="stores_advice">Uključite Prodavnice trećih strana u postavkama da biste ponovo provjerili ovu aplikaciju.</string>
+    <string name="stores_status_paused">Pauzirano</string>
+    <string name="stores_row_paused">Prodavnice trećih strana su isključene</string>
+    <string name="stores_setting">Prodavnice trećih strana</string>
+    <string name="stores_setting_effect">APKPure, Aptoide, APKCombo, APKMirror, Tencent, Huawei AppGallery, Galaxy Store i vivo. One poslužuju vlastite kopije aplikacija, a ne datoteke sa vlastite web lokacije programera, i Tern ih čita kroz interfejse koje su napravile za vlastite aplikacije i web lokacije. Isključeno, Tern nijednu od njih ništa ne pita, pretraga ih izostavlja i aplikacije s njih su pauzirane.</string>
+    <string name="stores_off_tag">isključeno u postavkama</string>
+    <string name="stores_checksum_matched">Datoteka se podudara s kontrolnim zbirom prodavnice</string>
+    <string name="stores_explain_checksum_matched">Kontrolni zbir je otisak same datoteke. Prodavnica ga je dala, a datoteka koju je Tern preuzeo ima isti, pa je stigla onakva kakvu je prodavnica ima. Prodavnica nije programer, pa to ne govori ništa o tome ko je napravio datoteku. Certifikat to govori.</string>
+    <string name="stores_import_from_stores">Ove dolaze iz prodavnica trećih strana, koje poslužuju vlastite kopije aplikacija. Dok se aplikacija ne prikači za certifikat, prva datoteka koju Tern instalira iz njene prodavnice odlučuje koji certifikat njena ažuriranja moraju nositi.</string>
+    <string name="stores_import_paused">Prodavnice trećih strana su isključene, tako da su ove aplikacije pauzirane. Tern ne pita te prodavnice ništa dok ih ne uključite.</string>
+    <string name="stores_import_names">Iz prodavnica trećih strana</string>
+    <string name="share_obtainium_link">Podijeli kao Obtainium link</string>
+    <string name="share_obtainium_links">Podijeli kao Obtainium linkove</string>
+</resources>
diff --git a/app/src/main/res/values-bs/strings_tv.xml b/app/src/main/res/values-bs/strings_tv.xml
new file mode 100644
index 00000000..7004d02a
--- /dev/null
+++ b/app/src/main/res/values-bs/strings_tv.xml
@@ -0,0 +1,5 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="interval_turn_off">Isključi provjere u pozadini</string>
+    <string name="interval_turn_on">Uključi provjere u pozadini</string>
+</resources>
diff --git a/app/src/main/res/values-ca/strings.xml b/app/src/main/res/values-ca/strings.xml
index 5734c429..6012b2cc 100644
--- a/app/src/main/res/values-ca/strings.xml
+++ b/app/src/main/res/values-ca/strings.xml
@@ -384,7 +384,6 @@
     <string name="settings_import_effect">D\'una exportació de Tern o Obtainium</string>
     <string name="settings_export">Exporta aplicacions</string>
     <string name="settings_exporting">S\'està exportant</string>
-    <string name="settings_export_effect">Desa la teva llista i la configuració en un fitxer. Mai s\'inclouen els tokens.</string>
     <plurals name="exported">
         <item quantity="one">S\'ha exportat %d aplicació</item>
         <item quantity="many">S\'han exportat %d aplicacions</item>
diff --git a/app/src/main/res/values-ca/strings_accept.xml b/app/src/main/res/values-ca/strings_accept.xml
new file mode 100644
index 00000000..74e4e2d5
--- /dev/null
+++ b/app/src/main/res/values-ca/strings_accept.xml
@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="stores_paused_reason">Les botigues de tercers estan desactivades, així que Tern no demana res a aquesta botiga. Activa-les a Configuració per tornar-ho a comprovar.</string>
+</resources>
diff --git a/app/src/main/res/values-ca/strings_checks.xml b/app/src/main/res/values-ca/strings_checks.xml
index b7fea04a..5daabb46 100644
--- a/app/src/main/res/values-ca/strings_checks.xml
+++ b/app/src/main/res/values-ca/strings_checks.xml
@@ -19,13 +19,11 @@
     <string name="settings_only_installed">Comprova només les aplicacions instal·lades</string>
     <string name="settings_only_installed_effect">Les aplicacions que només se segueixen també es comproven. Una aplicació que obres sempre es comprova.</string>
     <string name="settings_remove_uninstalled">Suprimeix les aplicacions desinstal·lades fora de Tern</string>
-    <string name="settings_remove_uninstalled_effect">Una aplicació que desinstal·les fora de Tern també surt de la llista.</string>
     <string name="settings_file_filter">Filtre de fitxers</string>
     <string name="settings_file_filter_effect">Un patró amb què cada aplicació sense filtre propi tria el seu fitxer.</string>
     <string name="settings_file_filter_none">Cap</string>
     <string name="settings_file_filter_invalid">Aquest patró no es pot llegir.</string>
     <string name="settings_allow_downgrades">Permet versions anteriors</string>
-    <string name="settings_allow_downgrades_effect">Let Me Downgrade està instal·lat, així que Android pot posar una versió més antiga per sobre d\'una de més nova.</string>
     <string name="settings_collapse_groups">Comença amb els grups plegats</string>
     <string name="settings_haptics">Resposta hàptica</string>
     <string name="settings_haptics_effect">Una vibració lleugera quan un lliscament o una pulsació llarga fa alguna cosa.</string>
@@ -40,7 +38,6 @@
     <string name="sources_repositories">Repositoris</string>
     <string name="sources_stores">Botigues</string>
     <string name="sources_mirrors">Botigues que tornen a publicar aplicacions</string>
-    <string name="sources_modified">Llocs amb aplicacions modificades</string>
     <string name="sources_other">Altres llocs</string>
     <string name="sources_web_page">Una pàgina web amb enllaços a fitxers</string>
     <string name="sources_direct">Un enllaç directe a un fitxer</string>
@@ -50,8 +47,6 @@
     <string name="shared_configs_title">Configuracions compartides pels usuaris d\'Obtainium</string>
     <string name="shared_configs_effect">Un lloc de configuracions ja fetes per a aplicacions. Els seus enllaços s\'obren a Tern quan Obre enllaços d\'Obtainium està activat a la Configuració.</string>
     <string name="engine_inner_filter_nothing">El filtre de fitxers dins d\'arxius no coincideix amb cap dels APK d\'aquest.</string>
-    <string name="preview_republished">%1$s torna a oferir el que els desenvolupadors publiquen en altres llocs. Tern exigeix als seus fitxers el certificat del desenvolupador tan bon punt el coneix, així que fixa\'n un o instal·la primer des del desenvolupador quan puguis.</string>
-    <string name="preview_modified">%1$s ofereix aplicacions modificades per algú que no és el seu desenvolupador. Estan signades per qui les ha modificat, i Tern no pot saber què s\'ha canviat.</string>
     <string name="about_track_tern">Mantén actualitzat el mateix Tern</string>
     <string name="about_track_tern_effect">Afegeix els llançaments de Tern a la llista, comprovats i verificats com qualsevol aplicació.</string>
     <string name="engine_channel_tracked">Llançaments nous d\'aplicacions seguides</string>
diff --git a/app/src/main/res/values-ca/strings_options.xml b/app/src/main/res/values-ca/strings_options.xml
index d0103246..c5085810 100644
--- a/app/src/main/res/values-ca/strings_options.xml
+++ b/app/src/main/res/values-ca/strings_options.xml
@@ -64,10 +64,6 @@
     <string name="option_workflow">Fitxer de flux de treball</string>
     <string name="option_workflow_help">Com ara build.yml.</string>
     <string name="option_branch">Branca</string>
-    <string name="option_device_model">Model del dispositiu</string>
-    <string name="option_device_model_help">Galaxy Store dona a cada model la seva pròpia compilació, com ara SM-S948B.</string>
-    <string name="option_csc">Codi de regió (CSC)</string>
-    <string name="option_csc_help">Tres lletres, com ara DBT.</string>
     <string name="option_link_filter">Filtre d\'enllaços de baixada</string>
     <string name="option_link_filter_help">Només els enllaços que coincideixen compten com a baixades.</string>
     <string name="option_page_order">Mantén l\'ordre de la pàgina</string>
@@ -78,11 +74,14 @@
     <string name="version_from_text">El text de l\'enllaç</string>
     <string name="version_from_page">Tota la pàgina</string>
     <string name="option_headers">Capçaleres de la petició</string>
-    <string name="option_headers_help">Una per línia, com a Name: value. Mai una contrasenya ni una galeta.</string>
     <string name="option_pseudo">Quan no hi ha versió</string>
     <string name="pseudo_default">Distingeix els fitxers com ho fa el servidor</string>
     <string name="pseudo_hash">Per un hash de l\'inici del fitxer</string>
     <string name="pseudo_link">Per l\'adreça del fitxer</string>
     <string name="pseudo_etag">Per l\'ETag del servidor</string>
     <string name="option_invalid">Això no es pot usar tal com està.</string>
+    <string name="option_device_model">Model del dispositiu</string>
+    <string name="option_device_model_help">Galaxy Store dona a cada model la seva pròpia compilació, com ara SM-S948B.</string>
+    <string name="option_csc">Codi de regió (CSC)</string>
+    <string name="option_csc_help">Tres lletres, com ara DBT.</string>
 </resources>
diff --git a/app/src/main/res/values-ca/strings_safety.xml b/app/src/main/res/values-ca/strings_safety.xml
new file mode 100644
index 00000000..22a1cfab
--- /dev/null
+++ b/app/src/main/res/values-ca/strings_safety.xml
@@ -0,0 +1,30 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="settings_export_effect_plain">Desa la teva llista i configuració en un fitxer. Els tokens mai s\'hi inclouen, ni tampoc cap capçalera de petició que pugui contenir una clau.</string>
+    <string name="engine_checksum_github_proxy">Resum del llançament de GitHub, tal com l\'ha transmès el hubproxy %1$s</string>
+    <string name="github_proxy_effect_trust">Cada petició a GitHub va a aquest amfitrió. Les veu totes i pot canviar el que torna: els llançaments, els seus resums i els fitxers. Les aplicacions que tens es mantenen fixades al seu certificat, però una primera instal·lació a través seu confia tant en el hubproxy com en GitHub, i la fixació de certificats no hi arriba. No s\'hi envia cap token, de manera que els projectes privats i GitHub Actions no es poden seguir d\'aquesta manera.</string>
+    <string name="settings_unmetered_checks">Comprova només amb Wi-Fi</string>
+    <string name="settings_unmetered_checks_effect">Les comprovacions en segon pla esperen el Wi-Fi o un cable, de manera que no usen dades mòbils.</string>
+    <string name="settings_charging_checks">Comprova només mentre carrega</string>
+    <string name="settings_charging_checks_effect">Les comprovacions en segon pla esperen fins que el dispositiu s\'estigui carregant.</string>
+    <string name="settings_unmetered_installs_wait">Una actualització que s\'instal·laria per si sola espera el Wi-Fi o un cable, com a Obtainium.</string>
+    <string name="settings_charging_installs_wait">Una actualització que s\'instal·laria per si sola espera fins que el dispositiu s\'estigui carregant.</string>
+    <string name="engine_downgrade_not_as_named">L\'origen indicava el codi de versió %2$d, però aquest fitxer és %1$d, més antic que l\'instal·lat. No s\'instal·la per sobre del més nou.</string>
+    <string name="settings_allow_downgrades_picked">Let Me Downgrade està instal·lat, per la qual cosa Android pot instal·lar una versió més antiga sobre una de més nova. Tern només ho fa per a un llançament que triïs de l\'historial d\'una aplicació, mai en segon pla ni amb Actualitza-ho tot.</string>
+    <string name="option_highest_version">Pren la versió més alta, com feia Tern 0.1.0</string>
+    <string name="option_highest_version_effect">Ofereix l\'enllaç amb la versió més alta de la pàgina, sigui quin sigui el seu lloc, i executa el patró de versió sobre la versió llegida de cada enllaç. Desactivat llegeix la pàgina de la manera que ho fa Obtainium: l\'últim enllaç per ordre és el més recent.</string>
+    <string name="settings_remove_uninstalled_keeps_pins">Una aplicació que desinstal·les fora de Tern també surt de la llista. Una aplicació arxivada s\'hi manté. Afegida de nou des del mateix lloc, l\'aplicació es manté fixada al certificat que tenia; suprimir-la a Tern ho oblida.</string>
+    <string name="link_check_title">Comprova les actualitzacions ara?</string>
+    <string name="link_check_one">Un enllaç ha demanat a Tern que comprovi les actualitzacions de %1$s. Es pregunta al seu origen i no s\'instal·la res.</string>
+    <plurals name="link_check_all">
+        <item quantity="one">Un enllaç ha demanat a Tern que comprovi %d aplicació de la teva llista per cercar actualitzacions. Es pregunta al seu origen i no s\'instal·la res.</item>
+        <item quantity="many">Un enllaç ha demanat a Tern que comprovi %d aplicacions de la teva llista per cercar actualitzacions. Es pregunta als seus orígens i no s\'instal·la res.</item>
+        <item quantity="other">Un enllaç ha demanat a Tern que comprovi %d aplicacions de la teva llista per cercar actualitzacions. Es pregunta als seus orígens i no s\'instal·la res.</item>
+    </plurals>
+    <string name="link_check_confirm">Comprova</string>
+    <string name="link_check_not_now">Ara no</string>
+    <string name="engine_installer_fell_back">%1$s no estava a punt, així que s\'ha usat l\'instal·lador d\'Android per a aquesta.</string>
+    <string name="about_track_tern_fdroid_effect">F-Droid ha instal·lat aquesta còpia, de manera que Tern segueix la seva entrada allà: les actualitzacions són les compilacions que F-Droid ha fet i comprovat, tal com les obté l\'aplicació F-Droid.</string>
+    <string name="about_track_tern_github">Segueix els llançaments de GitHub</string>
+    <string name="about_track_tern_github_effect">Les actualitzacions arriben de GitHub tan bon punt es publiquen, abans que F-Droid les hagi compilat i comprovat. Això omet les comprovacions de F-Droid. Tern encara comprova cada fitxer i el manté fixat al seu propi certificat.</string>
+</resources>
diff --git a/app/src/main/res/values-ca/strings_settings_more.xml b/app/src/main/res/values-ca/strings_settings_more.xml
index 8b3b9a37..45221ee8 100644
--- a/app/src/main/res/values-ca/strings_settings_more.xml
+++ b/app/src/main/res/values-ca/strings_settings_more.xml
@@ -38,9 +38,7 @@
     <string name="settings_auto_installs">Les actualitzacions s\'instal·len soles</string>
     <string name="settings_auto_installs_effect">Les aplicacions configurades per actualitzar-se soles ho fan després d\'una comprovació en segon pla. Si es desactiva, només avisen que hi ha una actualització, i cadascuna conserva la seva pròpia elecció per a més endavant.</string>
     <string name="settings_unmetered_installs">Instal·la només amb Wi-Fi</string>
-    <string name="settings_unmetered_installs_effect">Les comprovacions es fan a qualsevol xarxa. Una actualització que s\'instal·laria sola espera el Wi-Fi o un cable, com a Obtainium.</string>
     <string name="settings_charging_installs">Instal·la només mentre es carrega</string>
-    <string name="settings_charging_installs_effect">Les comprovacions es fan també amb bateria. Una actualització que s\'instal·laria sola espera fins que el dispositiu estigui carregant-se.</string>
     <string name="engine_unreadable_app">No s\'ha pogut llegir l\'aplicació desada %1$s, de manera que es deixa fora de la llista. No s\'ha esborrat res: una versió més nova de Tern podria llegir-la.</string>
     <string name="settings_pin_certificates">Fixa els certificats de les forges</string>
     <string name="settings_pin_certificates_effect">GitHub, GitLab i Codeberg han de mostrar un certificat de l\'autoritat que se sap que usa cadascun, com a Obtainium. Un certificat que una altra autoritat hagi estat obligada a emetre es rebutja llavors. Si una forja canvia d\'autoritat, les comprovacions allà fallen fins que això es desactivi.</string>
diff --git a/app/src/main/res/values-ca/strings_sources_more.xml b/app/src/main/res/values-ca/strings_sources_more.xml
index edcc1516..b301c284 100644
--- a/app/src/main/res/values-ca/strings_sources_more.xml
+++ b/app/src/main/res/values-ca/strings_sources_more.xml
@@ -18,10 +18,7 @@
     <string name="step_arch">Prefereix el processador d\'aquest dispositiu</string>
     <string name="step_add">Afegeix una pàgina</string>
     <string name="step_remove">Suprimeix aquesta pàgina</string>
-    <string name="option_file_version">Usa el nom del fitxer com a versió</string>
-    <string name="option_file_version_effect">Aleshores cada fitxer compta com un llançament propi.</string>
     <string name="github_proxy_title">GitHub a través d\'un hubproxy</string>
-    <string name="github_proxy_effect">Cada petició a GitHub va a aquest amfitrió, que les veu totes. No s\'hi envia cap token, així que els projectes privats i GitHub Actions no es poden seguir d\'aquesta manera.</string>
     <string name="github_proxy_host">Amfitrió del hubproxy</string>
     <string name="github_proxy_help">Només un nom d\'amfitrió, com ara gh-proxy.com. Tern s\'hi connecta per HTTPS.</string>
     <string name="github_proxy_invalid">Aquest no és un nom d\'amfitrió que Tern pugui usar</string>
diff --git a/app/src/main/res/values-ca/strings_starters.xml b/app/src/main/res/values-ca/strings_starters.xml
new file mode 100644
index 00000000..b1e7ee32
--- /dev/null
+++ b/app/src/main/res/values-ca/strings_starters.xml
@@ -0,0 +1,7 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="starter_in_list">A la teva llista</string>
+    <string name="starter_on_phone">En aquest telèfon</string>
+    <string name="starter_on_phone_other">En aquest telèfon d\'un altre signant</string>
+    <string name="starter_on_phone_other_explain">La còpia que tens està signada amb una clau diferent, així que Tern no pot actualitzar-la des d\'aquesta adreça.</string>
+</resources>
diff --git a/app/src/main/res/values-ca/strings_stores.xml b/app/src/main/res/values-ca/strings_stores.xml
new file mode 100644
index 00000000..90965e52
--- /dev/null
+++ b/app/src/main/res/values-ca/strings_stores.xml
@@ -0,0 +1,27 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="option_headers_help_own_agent">Un per línia, com a Nom: valor. Mai una contrasenya, una galeta o un User-Agent: Tern diu a cada lloc que és Tern.</string>
+    <string name="origin_republished_first">%1$s torna a oferir el que els desenvolupadors publiquen en un altre lloc, i no és el desenvolupador. Fins que l\'aplicació no es fixi a un certificat, el primer fitxer que Tern hi instal·li decideix quin certificat ha de portar cada actualització posterior.</string>
+    <string name="origin_republished_pinned">%1$s torna a oferir el que els desenvolupadors publiquen en un altre lloc, i no és el desenvolupador. Els seus fitxers han de portar el certificat al qual aquesta aplicació està fixada.</string>
+    <string name="origin_store_first">%1$s és una botiga, no el lloc del desenvolupador. Fins que l\'aplicació no es fixi a un certificat, el primer fitxer que Tern hi instal·li decideix quin certificat ha de portar cada actualització posterior.</string>
+    <string name="origin_store_pinned">%1$s és una botiga, no el lloc del desenvolupador. Els seus fitxers han de portar el certificat al qual aquesta aplicació està fixada.</string>
+    <string name="stores_refused_modified">Tern no llegeix llocs que ofereixen aplicacions modificades. Els seus fitxers han estat canviats per algú que no és el desenvolupador i signats per qui els hagi canviat.</string>
+    <string name="stores_refused_impersonation">Tern no pot llegir aquesta botiga sense fer-se passar per la seva aplicació, de manera que no la llegeix.</string>
+    <string name="stores_checksum_source">%1$s, que no és el desenvolupador</string>
+    <string name="stores_off_title">%1$s és una botiga de tercers</string>
+    <string name="stores_off_body">Les botigues de tercers estan desactivades. Una botiga serveix les seves pròpies còpies de les aplicacions, no fitxers del lloc del desenvolupador, i Tern la llegeix a través de la interfície que la botiga ha creat per a la seva pròpia aplicació o lloc web. Amb elles activades, Tern només demana a una botiga les aplicacions que hi afegeixes, i fins que una aplicació no es fixi a un certificat, el primer fitxer que Tern instal·li des d\'una botiga decideix quin certificat han de portar les seves actualitzacions.</string>
+    <string name="stores_turn_on">Activa les botigues de tercers</string>
+    <string name="stores_advice">Activa les botigues de tercers a la Configuració per tornar a comprovar aquesta aplicació.</string>
+    <string name="stores_status_paused">Pausat</string>
+    <string name="stores_row_paused">Botigues de tercers desactivades</string>
+    <string name="stores_setting">Botigues de tercers</string>
+    <string name="stores_setting_effect">APKPure, Aptoide, APKCombo, APKMirror, Tencent, Huawei AppGallery, Galaxy Store i vivo. Serveixen les seves pròpies còpies de les aplicacions, no fitxers del lloc del desenvolupador, i Tern les llegeix a través de les interfícies que han creat per a les seves pròpies aplicacions i llocs web. Desactivades, Tern no els demana res, una cerca les omet i les aplicacions que en provenen es pausen.</string>
+    <string name="stores_off_tag">desactivat a la Configuració</string>
+    <string name="stores_checksum_matched">El fitxer coincideix amb la suma de verificació de la botiga</string>
+    <string name="stores_explain_checksum_matched">Una suma de verificació és una empremta digital del propi fitxer. La botiga n\'ha donat una, i el fitxer que Tern ha baixat té la mateixa, així que ha arribat tal com la té la botiga. La botiga no és el desenvolupador, així que això no diu res sobre qui ha creat el fitxer. El certificat sí.</string>
+    <string name="stores_import_from_stores">Aquestes provenen de botigues de tercers, que serveixen les seves pròpies còpies de les aplicacions. Fins que una aplicació no es fixi a un certificat, el primer fitxer que Tern instal·li de la seva botiga decideix quin certificat han de portar les seves actualitzacions.</string>
+    <string name="stores_import_paused">Les botigues de tercers estan desactivades, així que aquestes aplicacions estan pausades. Tern no pregunta res a aquestes botigues fins que les activis.</string>
+    <string name="stores_import_names">De botigues de tercers</string>
+    <string name="share_obtainium_link">Comparteix com a enllaç d\'Obtainium</string>
+    <string name="share_obtainium_links">Comparteix com a enllaços d\'Obtainium</string>
+</resources>
diff --git a/app/src/main/res/values-ca/strings_tv.xml b/app/src/main/res/values-ca/strings_tv.xml
new file mode 100644
index 00000000..fa7576fa
--- /dev/null
+++ b/app/src/main/res/values-ca/strings_tv.xml
@@ -0,0 +1,5 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="interval_turn_off">Desactiva les comprovacions en segon pla</string>
+    <string name="interval_turn_on">Activa les comprovacions en segon pla</string>
+</resources>
diff --git a/app/src/main/res/values-cs/strings.xml b/app/src/main/res/values-cs/strings.xml
index 99002f85..76ea1b23 100644
--- a/app/src/main/res/values-cs/strings.xml
+++ b/app/src/main/res/values-cs/strings.xml
@@ -399,7 +399,6 @@
     <string name="settings_import_effect">Z exportu z aplikace Tern nebo Obtainium</string>
     <string name="settings_export">Exportovat aplikace</string>
     <string name="settings_exporting">Exportuje se</string>
-    <string name="settings_export_effect">Uloží váš seznam a nastavení do souboru. Tokeny se nikdy nezahrnují.</string>
     <plurals name="exported">
         <item quantity="one">Exportována %d aplikace</item>
         <item quantity="few">Exportovány %d aplikace</item>
diff --git a/app/src/main/res/values-cs/strings_accept.xml b/app/src/main/res/values-cs/strings_accept.xml
new file mode 100644
index 00000000..c1f2d383
--- /dev/null
+++ b/app/src/main/res/values-cs/strings_accept.xml
@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="stores_paused_reason">Obchody třetích stran jsou vypnuté, takže se Tern tohoto obchodu na nic neptá. Zapněte je v Nastavení a zkontrolujte ho znovu.</string>
+</resources>
diff --git a/app/src/main/res/values-cs/strings_checks.xml b/app/src/main/res/values-cs/strings_checks.xml
index 55d471db..f319f7e7 100644
--- a/app/src/main/res/values-cs/strings_checks.xml
+++ b/app/src/main/res/values-cs/strings_checks.xml
@@ -21,13 +21,11 @@
     <string name="settings_only_installed">Kontrolovat jen nainstalované aplikace</string>
     <string name="settings_only_installed_effect">Aplikace, které se jen sledují, se kontrolují také. Aplikace, kterou otevřete, se kontroluje vždy.</string>
     <string name="settings_remove_uninstalled">Odebírat aplikace odinstalované jinde</string>
-    <string name="settings_remove_uninstalled_effect">Aplikace, kterou odinstalujete mimo Tern, zmizí i ze seznamu.</string>
     <string name="settings_file_filter">Filtr souborů</string>
     <string name="settings_file_filter_effect">Vzor, podle kterého si soubor vybírá každá aplikace bez vlastního filtru.</string>
     <string name="settings_file_filter_none">Žádný</string>
     <string name="settings_file_filter_invalid">Tento vzor nelze přečíst.</string>
     <string name="settings_allow_downgrades">Povolit starší verze</string>
-    <string name="settings_allow_downgrades_effect">Je nainstalován Let Me Downgrade, takže Android může nainstalovat starší verzi přes novější.</string>
     <string name="settings_collapse_groups">Začínat se sbalenými skupinami</string>
     <string name="settings_haptics">Hmatová odezva</string>
     <string name="settings_haptics_effect">Jemné zavibrování, když přejetí nebo dlouhé stisknutí něco provede.</string>
@@ -42,7 +40,6 @@
     <string name="sources_repositories">Repozitáře</string>
     <string name="sources_stores">Obchody</string>
     <string name="sources_mirrors">Obchody, které znovu vydávají aplikace</string>
-    <string name="sources_modified">Weby s upravenými aplikacemi</string>
     <string name="sources_other">Jiná místa</string>
     <string name="sources_web_page">Webová stránka s odkazy na soubory</string>
     <string name="sources_direct">Přímý odkaz na soubor</string>
@@ -52,8 +49,6 @@
     <string name="shared_configs_title">Konfigurace sdílené uživateli Obtainium</string>
     <string name="shared_configs_effect">Web s hotovými nastaveními pro aplikace. Jeho odkazy se otevřou v Tern, když je v Nastavení zapnuto „Otevírat odkazy Obtainium“.</string>
     <string name="engine_inner_filter_nothing">Filtr souborů uvnitř archivů neodpovídá žádnému APK v tomto archivu.</string>
-    <string name="preview_republished">%1$s znovu nabízí to, co vývojáři vydávají jinde. Jeho soubory se porovnávají s certifikátem vývojáře, jakmile ho Tern zná, takže pokud můžete, připněte certifikát nebo nejprve nainstalujte aplikaci od vývojáře.</string>
-    <string name="preview_modified">%1$s nabízí aplikace upravené někým jiným než jejich vývojářem. Jsou podepsané tím, kdo je upravil, a Tern nedokáže zjistit, co bylo změněno.</string>
     <string name="about_track_tern">Udržovat aktuální i samotný Tern</string>
     <string name="about_track_tern_effect">Přidá do seznamu vydání samotného Tern, kontrolovaná a ověřovaná jako u každé aplikace.</string>
     <string name="engine_channel_tracked">Nová vydání sledovaných aplikací</string>
diff --git a/app/src/main/res/values-cs/strings_options.xml b/app/src/main/res/values-cs/strings_options.xml
index 44bc3648..0e10fa51 100644
--- a/app/src/main/res/values-cs/strings_options.xml
+++ b/app/src/main/res/values-cs/strings_options.xml
@@ -66,10 +66,6 @@
     <string name="option_workflow">Soubor pracovního postupu</string>
     <string name="option_workflow_help">Například build.yml.</string>
     <string name="option_branch">Větev</string>
-    <string name="option_device_model">Model zařízení</string>
-    <string name="option_device_model_help">Galaxy Store dává každému modelu vlastní sestavení, například SM-S948B.</string>
-    <string name="option_csc">Kód regionu (CSC)</string>
-    <string name="option_csc_help">Tři písmena, například DBT.</string>
     <string name="option_link_filter">Filtr odkazů ke stažení</string>
     <string name="option_link_filter_help">Jako stažení se počítají jen odpovídající odkazy.</string>
     <string name="option_page_order">Zachovat pořadí stránky</string>
@@ -80,11 +76,14 @@
     <string name="version_from_text">Text odkazu</string>
     <string name="version_from_page">Celá stránka</string>
     <string name="option_headers">Hlavičky požadavku</string>
-    <string name="option_headers_help">Jedna na řádek, ve tvaru Name: value. Nikdy heslo ani cookie.</string>
     <string name="option_pseudo">Když chybí verze</string>
     <string name="pseudo_default">Rozlišovat soubory jako server</string>
     <string name="pseudo_hash">Podle hashe začátku souboru</string>
     <string name="pseudo_link">Podle adresy souboru</string>
     <string name="pseudo_etag">Podle ETag serveru</string>
     <string name="option_invalid">Takto to nelze použít.</string>
+    <string name="option_device_model">Model zařízení</string>
+    <string name="option_device_model_help">Galaxy Store dává každému modelu vlastní sestavení, například SM-S948B.</string>
+    <string name="option_csc">Kód regionu (CSC)</string>
+    <string name="option_csc_help">Tři písmena, například DBT.</string>
 </resources>
diff --git a/app/src/main/res/values-cs/strings_safety.xml b/app/src/main/res/values-cs/strings_safety.xml
new file mode 100644
index 00000000..2911f1b1
--- /dev/null
+++ b/app/src/main/res/values-cs/strings_safety.xml
@@ -0,0 +1,31 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="settings_export_effect_plain">Uloží váš seznam a nastavení do souboru. Tokeny do něj nikdy nejdou, a stejně tak ani hlavička požadavku, která by mohla obsahovat klíč.</string>
+    <string name="engine_checksum_github_proxy">Otisk vydání na GitHub, jak ho předal hubproxy %1$s</string>
+    <string name="github_proxy_effect_trust">Každý požadavek na GitHub jde na tohoto hostitele. Vidí každý z nich a může změnit to, co se vrací: vydání, jejich otisky i soubory. Aplikace, které máte, zůstanou vázány na svůj certifikát, ale první instalace přes něj důvěřuje hubproxy stejně jako GitHub, a připnutí certifikátu na ni nedosáhne. Neposílá se přes něj žádný token, takže soukromé projekty a GitHub Actions nelze tímto způsobem sledovat.</string>
+    <string name="settings_unmetered_checks">Kontrolovat jen na Wi-Fi</string>
+    <string name="settings_unmetered_checks_effect">Kontroly na pozadí čekají na Wi-Fi nebo kabel, takže nepoužívají mobilní data.</string>
+    <string name="settings_charging_checks">Kontrolovat jen při nabíjení</string>
+    <string name="settings_charging_checks_effect">Kontroly na pozadí čekají, dokud se zařízení nenabíjí.</string>
+    <string name="settings_unmetered_installs_wait">Aktualizace, která by se nainstalovala sama, čeká na Wi-Fi nebo kabel, jako v Obtainium.</string>
+    <string name="settings_charging_installs_wait">Aktualizace, která by se nainstalovala sama, čeká, dokud se zařízení nenabíjí.</string>
+    <string name="engine_downgrade_not_as_named">Zdroj uvedl kód verze %2$d, ale tento soubor je %1$d, starší než ten nainstalovaný. Nepřepíše tu novější.</string>
+    <string name="settings_allow_downgrades_picked">Aplikace Let Me Downgrade je nainstalována, takže Android může umístit starší verzi přes novější. Tern to dělá jen pro vydání, které si vyberete z historie aplikace, nikdy na pozadí nebo pomocí Aktualizovat vše.</string>
+    <string name="option_highest_version">Vzít nejvyšší verzi, jako to dělal Tern 0.1.0</string>
+    <string name="option_highest_version_effect">Nabízí odkaz s nejvyšší verzí na stránce, ať je kdekoli, a aplikuje vzor verze na verzi načtenou z každého odkazu. Vypnuto čte stránku tak, jak to dělá Obtainium: poslední odkaz v pořadí je ten nejnovější.</string>
+    <string name="settings_remove_uninstalled_keeps_pins">Aplikace, kterou odinstalujete mimo Tern, také opustí seznam. Archivovaná aplikace zůstane. Pokud se aplikace znovu přidá ze stejného místa, je vázána na certifikát, který měla; její odstranění v Tern to zapomene.</string>
+    <string name="link_check_title">Zkontrolovat aktualizace nyní?</string>
+    <string name="link_check_one">Odkaz požádal Tern, aby zkontroloval aktualizace pro %1$s. Zdroj dostane dotaz a nic se nenainstaluje.</string>
+    <plurals name="link_check_all">
+        <item quantity="one">Odkaz požádal Tern, aby zkontroloval aktualizace pro %d aplikaci ve vašem seznamu. Její zdroj dostane dotaz a nic se nenainstaluje.</item>
+        <item quantity="few">Odkaz požádal Tern, aby zkontroloval aktualizace pro %d aplikace ve vašem seznamu. Jejich zdroje dostanou dotaz a nic se nenainstaluje.</item>
+        <item quantity="many">Odkaz požádal Tern, aby zkontroloval aktualizace pro %d aplikací ve vašem seznamu. Jejich zdroje dostanou dotaz a nic se nenainstaluje.</item>
+        <item quantity="other">Odkaz požádal Tern, aby zkontroloval aktualizace pro %d aplikací ve vašem seznamu. Jejich zdroje dostanou dotaz a nic se nenainstaluje.</item>
+    </plurals>
+    <string name="link_check_confirm">Zkontrolovat</string>
+    <string name="link_check_not_now">Teď ne</string>
+    <string name="engine_installer_fell_back">%1$s nebyl připraven, takže pro tuto instalaci byl použit instalátor Androidu.</string>
+    <string name="about_track_tern_fdroid_effect">Tuto kopii nainstaloval F-Droid, takže Tern sleduje jeho záznam tam: aktualizace jsou sestavení, která F-Droid vytvořil a zkontroloval, tak jak je získává aplikace F-Droid.</string>
+    <string name="about_track_tern_github">Sledovat místo toho vydání na GitHub</string>
+    <string name="about_track_tern_github_effect">Aktualizace pocházejí z GitHub hned po jejich zveřejnění, dříve než je F-Droid sestaví a zkontroluje. Tím se přeskočí kontroly F-Droid. Tern stále kontroluje každý soubor a váže jej na jeho vlastní certifikát.</string>
+</resources>
diff --git a/app/src/main/res/values-cs/strings_settings_more.xml b/app/src/main/res/values-cs/strings_settings_more.xml
index c5ef484e..193a55f1 100644
--- a/app/src/main/res/values-cs/strings_settings_more.xml
+++ b/app/src/main/res/values-cs/strings_settings_more.xml
@@ -39,9 +39,7 @@
     <string name="settings_auto_installs">Aktualizace se instalují samostatně</string>
     <string name="settings_auto_installs_effect">Aplikace nastavené na samostatnou aktualizaci ji provedou po kontrole na pozadí. Pokud je to vypnuto, jen oznámí, že aktualizace je k dispozici, a každá si ponechá vlastní volbu pro později.</string>
     <string name="settings_unmetered_installs">Instalovat jen přes Wi-Fi</string>
-    <string name="settings_unmetered_installs_effect">Kontroly probíhají v jakékoli síti. Aktualizace, která by se nainstalovala sama, počká na Wi-Fi nebo kabel, jako v Obtainium.</string>
     <string name="settings_charging_installs">Instalovat jen při nabíjení</string>
-    <string name="settings_charging_installs_effect">Kontroly probíhají i na baterii. Aktualizace, která by se nainstalovala sama, počká, až se zařízení začne nabíjet.</string>
     <string name="engine_unreadable_app">Uloženou aplikaci %1$s se nepodařilo přečíst, proto je ze seznamu vynechána. Nic nebylo smazáno: novější verze Tern ji může přečíst.</string>
     <string name="settings_pin_certificates">Připínat certifikáty hostingů kódu</string>
     <string name="settings_pin_certificates_effect">Stejně jako v Obtainium musí GitHub, GitLab a Codeberg předložit certifikát od certifikační autority, o které je známo, že ji každý z nich používá. Certifikát vydaný pod nátlakem jinou autoritou se pak odmítne. Pokud hosting kódu změní svou autoritu, kontroly tam selhávají, dokud toto nastavení nevypnete.</string>
diff --git a/app/src/main/res/values-cs/strings_sources_more.xml b/app/src/main/res/values-cs/strings_sources_more.xml
index e12f16d9..9d1221dc 100644
--- a/app/src/main/res/values-cs/strings_sources_more.xml
+++ b/app/src/main/res/values-cs/strings_sources_more.xml
@@ -18,10 +18,7 @@
     <string name="step_arch">Upřednostnit procesor tohoto zařízení</string>
     <string name="step_add">Přidat stránku</string>
     <string name="step_remove">Odebrat tuto stránku</string>
-    <string name="option_file_version">Použít název souboru jako verzi</string>
-    <string name="option_file_version_effect">Každý soubor se pak počítá jako samostatné vydání.</string>
     <string name="github_proxy_title">GitHub přes hubproxy</string>
-    <string name="github_proxy_effect">Každý požadavek na GitHub jde na tohoto hostitele, který vidí všechny požadavky. Přes něj se neposílá žádný token, takže soukromé projekty a GitHub Actions se tak sledovat nedají.</string>
     <string name="github_proxy_host">Hostitel hubproxy</string>
     <string name="github_proxy_help">Jen název hostitele, například gh-proxy.com. Tern se k němu připojuje přes HTTPS.</string>
     <string name="github_proxy_invalid">To není název hostitele, který Tern může použít</string>
diff --git a/app/src/main/res/values-cs/strings_starters.xml b/app/src/main/res/values-cs/strings_starters.xml
new file mode 100644
index 00000000..f4995e2c
--- /dev/null
+++ b/app/src/main/res/values-cs/strings_starters.xml
@@ -0,0 +1,7 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="starter_in_list">Ve vašem seznamu</string>
+    <string name="starter_on_phone">Na tomto telefonu</string>
+    <string name="starter_on_phone_other">Na tomto telefonu od jiného podepisatele</string>
+    <string name="starter_on_phone_other_explain">Kopie, kterou máte, je podepsána jiným klíčem, takže ji Tern nemůže z této adresy aktualizovat.</string>
+</resources>
diff --git a/app/src/main/res/values-cs/strings_stores.xml b/app/src/main/res/values-cs/strings_stores.xml
new file mode 100644
index 00000000..9ed06885
--- /dev/null
+++ b/app/src/main/res/values-cs/strings_stores.xml
@@ -0,0 +1,27 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="option_headers_help_own_agent">Na každý řádek jedno, jako Název: hodnota. Nikdy heslo, soubor cookie nebo User-Agent: Tern každému webu sděluje, že je Tern.</string>
+    <string name="origin_republished_first">%1$s znovu nabízí to, co vývojáři publikují jinde, a není vývojářem. Dokud není aplikace připnuta k certifikátu, první soubor, který z něj Tern nainstaluje, určí, jaký certifikát musí nést každá další aktualizace.</string>
+    <string name="origin_republished_pinned">%1$s znovu nabízí to, co vývojáři publikují jinde, a není vývojářem. Jeho soubory musí nést certifikát, ke kterému je tato aplikace vázána.</string>
+    <string name="origin_store_first">%1$s je obchod, ne vlastní web vývojáře. Dokud není aplikace připnuta k certifikátu, první soubor, který z něj Tern nainstaluje, určí, jaký certifikát musí nést každá další aktualizace.</string>
+    <string name="origin_store_pinned">%1$s je obchod, ne vlastní web vývojáře. Jeho soubory musí nést certifikát, ke kterému je tato aplikace vázána.</string>
+    <string name="stores_refused_modified">Tern nečte weby, které nabízejí upravené aplikace. Jejich soubory jsou změněny někým jiným než vývojářem a podepsány tím, kdo je změnil.</string>
+    <string name="stores_refused_impersonation">Tern nemůže číst tento obchod bez toho, aby předstíral, že je jeho aplikací, takže ho nečte.</string>
+    <string name="stores_checksum_source">%1$s, což není vývojář</string>
+    <string name="stores_off_title">%1$s je obchod třetí strany</string>
+    <string name="stores_off_body">Obchody třetích stran jsou vypnuté. Obchod podává vlastní kopie aplikací, ne soubory z vlastního webu vývojáře, a Tern ho čte přes rozhraní, které obchod vytvořil pro svou vlastní aplikaci nebo web. Pokud jsou zapnuté, Tern se obchodu ptá jen na aplikace, které z něj přidáte, a dokud není aplikace připnuta k certifikátu, první soubor, který Tern z obchodu nainstaluje, určí, jaký certifikát musí nést její aktualizace.</string>
+    <string name="stores_turn_on">Zapnout obchody třetích stran</string>
+    <string name="stores_advice">Zapněte Obchody třetích stran v Nastavení a zkontrolujte tuto aplikaci znovu.</string>
+    <string name="stores_status_paused">Pozastaveno</string>
+    <string name="stores_row_paused">Obchody třetích stran jsou vypnuté</string>
+    <string name="stores_setting">Obchody třetích stran</string>
+    <string name="stores_setting_effect">APKPure, Aptoide, APKCombo, APKMirror, Tencent, Huawei AppGallery, Galaxy Store a vivo. Podávají vlastní kopie aplikací, ne soubory z vlastního webu vývojáře, a Tern je čte přes rozhraní, která vytvořily pro své vlastní aplikace a weby. Pokud jsou vypnuté, Tern se nikoho z nich na nic neptá, vyhledávání je vynechá a aplikace z nich jsou pozastaveny.</string>
+    <string name="stores_off_tag">vypnuto v Nastavení</string>
+    <string name="stores_checksum_matched">Soubor odpovídá kontrolnímu součtu obchodu</string>
+    <string name="stores_explain_checksum_matched">Kontrolní součet je otisk samotného souboru. Obchod jeden poskytl a soubor, který Tern stáhl, má stejný, takže dorazil tak, jak ho má obchod. Obchod není vývojář, takže to neříká nic o tom, kdo soubor vytvořil. To říká certifikát.</string>
+    <string name="stores_import_from_stores">Tyto pocházejí z obchodů třetích stran, které podávají vlastní kopie aplikací. Dokud není aplikace připnuta k certifikátu, první soubor, který Tern nainstaluje z jejího obchodu, určí, jaký certifikát musí nést její aktualizace.</string>
+    <string name="stores_import_paused">Obchody třetích stran jsou vypnuté, takže tyto aplikace jsou pozastaveny. Tern se těchto obchodů na nic neptá, dokud je nezapnete.</string>
+    <string name="stores_import_names">Z obchodů třetích stran</string>
+    <string name="share_obtainium_link">Sdílet jako odkaz Obtainium</string>
+    <string name="share_obtainium_links">Sdílet jako odkazy Obtainium</string>
+</resources>
diff --git a/app/src/main/res/values-cs/strings_tv.xml b/app/src/main/res/values-cs/strings_tv.xml
new file mode 100644
index 00000000..d6a007ef
--- /dev/null
+++ b/app/src/main/res/values-cs/strings_tv.xml
@@ -0,0 +1,5 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="interval_turn_off">Vypnout kontroly na pozadí</string>
+    <string name="interval_turn_on">Zapnout kontroly na pozadí</string>
+</resources>
diff --git a/app/src/main/res/values-da/strings.xml b/app/src/main/res/values-da/strings.xml
index b13df442..18ccc977 100644
--- a/app/src/main/res/values-da/strings.xml
+++ b/app/src/main/res/values-da/strings.xml
@@ -369,7 +369,6 @@
     <string name="settings_import_effect">Fra en eksport fra Tern eller Obtainium</string>
     <string name="settings_export">Eksporter apps</string>
     <string name="settings_exporting">Eksporterer</string>
-    <string name="settings_export_effect">Gemmer din liste og indstillinger i en fil. Tokens inkluderes aldrig.</string>
     <plurals name="exported">
         <item quantity="one">Eksporterede %d app</item>
         <item quantity="other">Eksporterede %d apps</item>
diff --git a/app/src/main/res/values-da/strings_accept.xml b/app/src/main/res/values-da/strings_accept.xml
new file mode 100644
index 00000000..3bb01d65
--- /dev/null
+++ b/app/src/main/res/values-da/strings_accept.xml
@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="stores_paused_reason">Tredjepartsbutikker er slået fra, så Tern spørger ikke denne butik om noget. Slå dem til i Indstillinger for at tjekke den igen.</string>
+</resources>
diff --git a/app/src/main/res/values-da/strings_checks.xml b/app/src/main/res/values-da/strings_checks.xml
index 4689fa20..c8f73e66 100644
--- a/app/src/main/res/values-da/strings_checks.xml
+++ b/app/src/main/res/values-da/strings_checks.xml
@@ -17,13 +17,11 @@
     <string name="settings_only_installed">Tjek kun installerede apps</string>
     <string name="settings_only_installed_effect">Apps, der kun spores, tjekkes også. En app, du åbner, tjekkes altid.</string>
     <string name="settings_remove_uninstalled">Fjern apps, der er afinstalleret andetsteds</string>
-    <string name="settings_remove_uninstalled_effect">En app, du afinstallerer uden for Tern, forsvinder også fra listen.</string>
     <string name="settings_file_filter">Filter for filer</string>
     <string name="settings_file_filter_effect">Et mønster, som enhver app uden sit eget filter vælger sin fil efter.</string>
     <string name="settings_file_filter_none">Intet</string>
     <string name="settings_file_filter_invalid">Dette mønster kan ikke læses.</string>
     <string name="settings_allow_downgrades">Tillad ældre versioner</string>
-    <string name="settings_allow_downgrades_effect">Let Me Downgrade er installeret, så Android må installere en ældre version oven på en nyere.</string>
     <string name="settings_collapse_groups">Start med grupper foldet sammen</string>
     <string name="settings_haptics">Haptisk feedback</string>
     <string name="settings_haptics_effect">En let vibration, når et stryg eller et langt tryk gør noget.</string>
@@ -38,7 +36,6 @@
     <string name="sources_repositories">Arkiver</string>
     <string name="sources_stores">Butikker</string>
     <string name="sources_mirrors">Butikker, der genudgiver apps</string>
-    <string name="sources_modified">Websteder med ændrede apps</string>
     <string name="sources_other">Andre steder</string>
     <string name="sources_web_page">En webside med links til filer</string>
     <string name="sources_direct">Et direkte link til en fil</string>
@@ -48,8 +45,6 @@
     <string name="shared_configs_title">Konfigurationer delt af Obtainiums brugere</string>
     <string name="shared_configs_effect">Et websted med færdige indstillinger til apps. Dets links åbner i Tern, når Åbn Obtainium-links er slået til i Indstillinger.</string>
     <string name="engine_inner_filter_nothing">Filteret for filer i arkiver matcher ingen af APK\'erne i dette arkiv.</string>
-    <string name="preview_republished">%1$s tilbyder igen det, som udviklere udgiver andre steder. Dets filer holdes op imod udviklerens certifikat, når Tern kender det, så fastgør et, eller installer fra udvikleren først, når du kan.</string>
-    <string name="preview_modified">%1$s tilbyder apps, der er ændret af en anden end deres udvikler. De er signeret af den, der ændrede dem, og Tern kan ikke se, hvad der blev ændret.</string>
     <string name="about_track_tern">Hold Tern selv opdateret</string>
     <string name="about_track_tern_effect">Tilføjer Terns egne udgivelser til listen, tjekket og verificeret som enhver app.</string>
     <string name="engine_channel_tracked">Nye udgivelser af sporede apps</string>
diff --git a/app/src/main/res/values-da/strings_options.xml b/app/src/main/res/values-da/strings_options.xml
index 3842a2cd..7ada1ee2 100644
--- a/app/src/main/res/values-da/strings_options.xml
+++ b/app/src/main/res/values-da/strings_options.xml
@@ -62,10 +62,6 @@
     <string name="option_workflow">Workflow-fil</string>
     <string name="option_workflow_help">F.eks. build.yml.</string>
     <string name="option_branch">Gren</string>
-    <string name="option_device_model">Enhedsmodel</string>
-    <string name="option_device_model_help">Galaxy Store giver hver model sin egen version, f.eks. SM-S948B.</string>
-    <string name="option_csc">Regionskode (CSC)</string>
-    <string name="option_csc_help">Tre bogstaver, f.eks. DBT.</string>
     <string name="option_link_filter">Filter for downloadlinks</string>
     <string name="option_link_filter_help">Kun links, der matcher, tæller som downloads.</string>
     <string name="option_page_order">Behold sidens rækkefølge</string>
@@ -76,11 +72,14 @@
     <string name="version_from_text">Linkets tekst</string>
     <string name="version_from_page">Hele siden</string>
     <string name="option_headers">Anmodningsheadere</string>
-    <string name="option_headers_help">Én pr. linje, som Name: value. Aldrig en adgangskode eller en cookie.</string>
     <string name="option_pseudo">Når der ingen version er</string>
     <string name="pseudo_default">Skeln filer ad, som serveren gør</string>
     <string name="pseudo_hash">Efter en hash af filens start</string>
     <string name="pseudo_link">Efter filens adresse</string>
     <string name="pseudo_etag">Efter serverens ETag</string>
     <string name="option_invalid">Dette kan ikke bruges, som det er.</string>
+    <string name="option_device_model">Enhedsmodel</string>
+    <string name="option_device_model_help">Galaxy Store giver hver model sin egen version, f.eks. SM-S948B.</string>
+    <string name="option_csc">Regionskode (CSC)</string>
+    <string name="option_csc_help">Tre bogstaver, f.eks. DBT.</string>
 </resources>
diff --git a/app/src/main/res/values-da/strings_safety.xml b/app/src/main/res/values-da/strings_safety.xml
new file mode 100644
index 00000000..65d436f9
--- /dev/null
+++ b/app/src/main/res/values-da/strings_safety.xml
@@ -0,0 +1,29 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="settings_export_effect_plain">Gemmer din liste og dine indstillinger i en fil. Tokens medtages aldrig, og det gør en anmodningsheader, der kunne indeholde en nøgle, heller ikke.</string>
+    <string name="engine_checksum_github_proxy">GitHub-udgivelses-digest, som hubproxyen %1$s videregav det</string>
+    <string name="github_proxy_effect_trust">Hver anmodning til GitHub går til denne vært. Den ser hver enkelt og kan ændre det, der kommer tilbage: udgivelserne, deres digests og filerne. Apps, du har, forbliver fastgjort til deres certifikat, men en første installation gennem den stoler lige så meget på hubproxyen som på GitHub, og certifikatfastgørelse når den ikke. Der sendes intet token gennem den, så private projekter og GitHub Actions kan ikke følges på denne måde.</string>
+    <string name="settings_unmetered_checks">Tjek kun på Wi-Fi</string>
+    <string name="settings_unmetered_checks_effect">Baggrundstjek venter på Wi-Fi eller et kabel, så de ikke bruger mobildata.</string>
+    <string name="settings_charging_checks">Tjek kun under opladning</string>
+    <string name="settings_charging_checks_effect">Baggrundstjek venter, indtil enheden oplades.</string>
+    <string name="settings_unmetered_installs_wait">En opdatering, der ville installere af sig selv, venter på Wi-Fi eller et kabel, ligesom i Obtainium.</string>
+    <string name="settings_charging_installs_wait">En opdatering, der ville installere af sig selv, venter, indtil enheden oplades.</string>
+    <string name="engine_downgrade_not_as_named">Kilden angav versionskode %2$d, men denne fil er %1$d, som er ældre end den installerede. Den lægges ikke over den nyere.</string>
+    <string name="settings_allow_downgrades_picked">Let Me Downgrade er installeret, så Android kan lægge en ældre version over en nyere. Tern gør det kun for en udgivelse, du vælger fra en apps historik, aldrig i baggrunden eller med Opdater alle.</string>
+    <string name="option_highest_version">Tag den højeste version, som Tern 0.1.0 gjorde</string>
+    <string name="option_highest_version_effect">Tilbyder linket med den højeste version på siden, uanset dets placering, og kører versionsmønsteret over versionen læst fra hvert link. Når indstillingen er slået fra, læses siden på samme måde som i Obtainium: det sidste link i rækkefølgen er det nyeste.</string>
+    <string name="settings_remove_uninstalled_keeps_pins">En app, du afinstallerer uden for Tern, forsvinder også fra listen. En arkiveret app forbliver. Tilføjes den igen fra samme sted, er en app bundet til det certifikat, den havde; fjernes den i Tern, glemmes dette.</string>
+    <string name="link_check_title">Tjek for opdateringer nu?</string>
+    <string name="link_check_one">Et link bad Tern om at tjekke %1$s for opdateringer. Dens kilde bliver spurgt, og intet bliver installeret.</string>
+    <plurals name="link_check_all">
+        <item quantity="one">Et link bad Tern om at tjekke %d app på din liste for opdateringer. Dens kilde bliver spurgt, og intet bliver installeret.</item>
+        <item quantity="other">Et link bad Tern om at tjekke %d apps på din liste for opdateringer. Deres kilder bliver spurgt, og intet bliver installeret.</item>
+    </plurals>
+    <string name="link_check_confirm">Tjek</string>
+    <string name="link_check_not_now">Ikke nu</string>
+    <string name="engine_installer_fell_back">%1$s var ikke klar, så Androids installationsprogram blev brugt til denne.</string>
+    <string name="about_track_tern_fdroid_effect">F-Droid installerede denne kopi, så Tern følger dens indgang der: opdateringer er de builds, F-Droid lavede og tjekkede, som F-Droid-appen får dem.</string>
+    <string name="about_track_tern_github">Følg GitHub-udgivelser i stedet</string>
+    <string name="about_track_tern_github_effect">Opdateringer kommer fra GitHub, så snart de er udgivet, før F-Droid har bygget og tjekket dem. Dette springer F-Droids tjek over. Tern tjekker stadig hver fil og fastholder den til dens eget certifikat.</string>
+</resources>
diff --git a/app/src/main/res/values-da/strings_settings_more.xml b/app/src/main/res/values-da/strings_settings_more.xml
index c782505d..3bb6341e 100644
--- a/app/src/main/res/values-da/strings_settings_more.xml
+++ b/app/src/main/res/values-da/strings_settings_more.xml
@@ -37,9 +37,7 @@
     <string name="settings_auto_installs">Opdateringer installeres af sig selv</string>
     <string name="settings_auto_installs_effect">Apps, der er sat til at opdatere sig selv, gør det efter et baggrundstjek. Når det er slået fra, giver de kun besked om, at der er en opdatering, og hver enkelt beholder sit eget valg til senere.</string>
     <string name="settings_unmetered_installs">Installer kun på Wi-Fi</string>
-    <string name="settings_unmetered_installs_effect">Tjek kører på ethvert netværk. En opdatering, der ellers ville installere sig selv, venter på Wi-Fi eller et netværkskabel, som i Obtainium.</string>
     <string name="settings_charging_installs">Installer kun under opladning</string>
-    <string name="settings_charging_installs_effect">Tjek kører også på batteri. En opdatering, der ellers ville installere sig selv, venter, til enheden lader op.</string>
     <string name="engine_unreadable_app">Den gemte app %1$s kunne ikke læses, så den er udeladt fra listen. Intet blev slettet: en nyere version af Tern kan måske læse den.</string>
     <string name="settings_pin_certificates">Fastgør kodeplatformenes certifikater</string>
     <string name="settings_pin_certificates_effect">GitHub, GitLab og Codeberg skal vise et certifikat fra den certificeringsmyndighed, som hver af dem er kendt for at bruge, som i Obtainium. Et certifikat, som en anden myndighed er blevet bragt til at udstede, afvises så. Hvis en kodeplatform skifter myndighed, mislykkes tjek der, indtil dette er slået fra.</string>
diff --git a/app/src/main/res/values-da/strings_sources_more.xml b/app/src/main/res/values-da/strings_sources_more.xml
index 91f52fe7..c45dd4b6 100644
--- a/app/src/main/res/values-da/strings_sources_more.xml
+++ b/app/src/main/res/values-da/strings_sources_more.xml
@@ -18,10 +18,7 @@
     <string name="step_arch">Foretræk denne enheds processor</string>
     <string name="step_add">Tilføj en side</string>
     <string name="step_remove">Fjern denne side</string>
-    <string name="option_file_version">Brug filnavnet som version</string>
-    <string name="option_file_version_effect">Hver fil tæller så som en udgivelse for sig.</string>
     <string name="github_proxy_title">GitHub gennem en hubproxy</string>
-    <string name="github_proxy_effect">Hver anmodning til GitHub går til denne vært, som ser hver eneste. Intet token sendes gennem den, så private projekter og GitHub Actions kan ikke følges på denne måde.</string>
     <string name="github_proxy_host">Hubproxy-vært</string>
     <string name="github_proxy_help">Kun et værtsnavn, f.eks. gh-proxy.com. Tern når den via HTTPS.</string>
     <string name="github_proxy_invalid">Det er ikke et værtsnavn, Tern kan bruge</string>
diff --git a/app/src/main/res/values-da/strings_starters.xml b/app/src/main/res/values-da/strings_starters.xml
new file mode 100644
index 00000000..1810e180
--- /dev/null
+++ b/app/src/main/res/values-da/strings_starters.xml
@@ -0,0 +1,7 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="starter_in_list">På din liste</string>
+    <string name="starter_on_phone">På denne telefon</string>
+    <string name="starter_on_phone_other">På denne telefon signeret af en anden</string>
+    <string name="starter_on_phone_other_explain">Den kopi, du har, er signeret med en anden nøgle, så Tern kan ikke opdatere den fra denne adresse.</string>
+</resources>
diff --git a/app/src/main/res/values-da/strings_stores.xml b/app/src/main/res/values-da/strings_stores.xml
new file mode 100644
index 00000000..44ba20e9
--- /dev/null
+++ b/app/src/main/res/values-da/strings_stores.xml
@@ -0,0 +1,27 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="option_headers_help_own_agent">Én per linje, som Navn: værdi. Aldrig en adgangskode, en cookie eller en User-Agent: Tern fortæller ethvert websted, at den er Tern.</string>
+    <string name="origin_republished_first">%1$s tilbyder igen, hvad udviklere udgiver andre steder, og er ikke udvikleren. Indtil appen er fastgjort til et certifikat, afgør den første fil, Tern installerer derfra, hvilket certifikat hver senere opdatering skal bære.</string>
+    <string name="origin_republished_pinned">%1$s tilbyder igen, hvad udviklere udgiver andre steder, og er ikke udvikleren. Dens filer skal bære det certifikat, denne app er fastgjort til.</string>
+    <string name="origin_store_first">%1$s er en butik, ikke udviklerens eget websted. Indtil appen er fastgjort til et certifikat, afgør den første fil, Tern installerer derfra, hvilket certifikat hver senere opdatering skal bære.</string>
+    <string name="origin_store_pinned">%1$s er en butik, ikke udviklerens eget websted. Dens filer skal bære det certifikat, denne app er fastgjort til.</string>
+    <string name="stores_refused_modified">Tern læser ikke websteder, der tilbyder ændrede apps. Deres filer er ændret af en anden end udvikleren og signeret af den, der ændrede dem.</string>
+    <string name="stores_refused_impersonation">Tern kan ikke læse denne butik uden at lade som om, den er dens app, så den læser den ikke.</string>
+    <string name="stores_checksum_source">%1$s, som ikke er udvikleren</string>
+    <string name="stores_off_title">%1$s er en tredjepartsbutik</string>
+    <string name="stores_off_body">Tredjepartsbutikker er slået fra. En butik serverer sine egne kopier af apps, ikke filer fra udviklerens eget websted, og Tern læser den gennem den grænseflade, butikken lavede til sin egen app eller sit websted. Med dem slået til, spørger Tern kun en butik om de apps, du tilføjer fra den, og indtil en app er fastgjort til et certifikat, afgør den første fil, Tern installerer fra en butik, hvilket certifikat dens opdateringer skal bære.</string>
+    <string name="stores_turn_on">Slå tredjepartsbutikker til</string>
+    <string name="stores_advice">Slå Tredjepartsbutikker til i Indstillinger for at tjekke denne app igen.</string>
+    <string name="stores_status_paused">På pause</string>
+    <string name="stores_row_paused">Tredjepartsbutikker er slået fra</string>
+    <string name="stores_setting">Tredjepartsbutikker</string>
+    <string name="stores_setting_effect">APKPure, Aptoide, APKCombo, APKMirror, Tencent, Huawei AppGallery, Galaxy Store og vivo. De serverer deres egne kopier af apps, ikke filer fra udviklerens eget websted, og Tern læser dem gennem de grænseflader, de lavede til deres egne apps og websteder. Når de er slået fra, spørger Tern ingen af dem om noget, en søgning udelader dem, og apps fra dem er sat på pause.</string>
+    <string name="stores_off_tag">slået fra i Indstillinger</string>
+    <string name="stores_checksum_matched">Filen matcher butikkens kontrolsum</string>
+    <string name="stores_explain_checksum_matched">En kontrolsum er et fingeraftryk af selve filen. Butikken gav en, og den fil, Tern hentede, har den samme, så den ankom, som butikken har den. Butikken er ikke udvikleren, så dette siger intet om, hvem der lavede filen. Det gør certifikatet.</string>
+    <string name="stores_import_from_stores">Disse kommer fra tredjepartsbutikker, som serverer deres egne kopier af apps. Indtil en app er fastgjort til et certifikat, afgør den første fil, Tern installerer fra dens butik, hvilket certifikat dens opdateringer skal bære.</string>
+    <string name="stores_import_paused">Tredjepartsbutikker er slået fra, så disse apps er sat på pause. Tern spørger ikke disse butikker om noget, før du slår dem til.</string>
+    <string name="stores_import_names">Fra tredjepartsbutikker</string>
+    <string name="share_obtainium_link">Del som et Obtainium-link</string>
+    <string name="share_obtainium_links">Del som Obtainium-links</string>
+</resources>
diff --git a/app/src/main/res/values-da/strings_tv.xml b/app/src/main/res/values-da/strings_tv.xml
new file mode 100644
index 00000000..78e79efe
--- /dev/null
+++ b/app/src/main/res/values-da/strings_tv.xml
@@ -0,0 +1,5 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="interval_turn_off">Slå baggrundstjek fra</string>
+    <string name="interval_turn_on">Slå baggrundstjek til</string>
+</resources>
diff --git a/app/src/main/res/values-de/strings.xml b/app/src/main/res/values-de/strings.xml
index 96c14638..871a5e08 100644
--- a/app/src/main/res/values-de/strings.xml
+++ b/app/src/main/res/values-de/strings.xml
@@ -369,7 +369,6 @@
     <string name="settings_import_effect">Aus einem Tern- oder Obtainium-Export</string>
     <string name="settings_export">Apps exportieren</string>
     <string name="settings_exporting">Wird exportiert</string>
-    <string name="settings_export_effect">Speichert deine Liste und Einstellungen in einer Datei. Token sind nie enthalten.</string>
     <plurals name="exported">
         <item quantity="one">%d App exportiert</item>
         <item quantity="other">%d Apps exportiert</item>
diff --git a/app/src/main/res/values-de/strings_accept.xml b/app/src/main/res/values-de/strings_accept.xml
new file mode 100644
index 00000000..54201fdb
--- /dev/null
+++ b/app/src/main/res/values-de/strings_accept.xml
@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="stores_paused_reason">Drittanbieter-Stores sind ausgeschaltet, daher fragt Tern diesen Store nichts. Schalte sie in den Einstellungen ein, um ihn erneut zu prüfen.</string>
+</resources>
diff --git a/app/src/main/res/values-de/strings_checks.xml b/app/src/main/res/values-de/strings_checks.xml
index 535436c4..836ca3de 100644
--- a/app/src/main/res/values-de/strings_checks.xml
+++ b/app/src/main/res/values-de/strings_checks.xml
@@ -17,13 +17,11 @@
     <string name="settings_only_installed">Nur installierte Apps prüfen</string>
     <string name="settings_only_installed_effect">Apps, die nur verfolgt werden, werden auch geprüft. Eine App, die du öffnest, wird immer geprüft.</string>
     <string name="settings_remove_uninstalled">Anderswo deinstallierte Apps entfernen</string>
-    <string name="settings_remove_uninstalled_effect">Eine App, die du außerhalb von Tern deinstallierst, verschwindet auch aus der Liste.</string>
     <string name="settings_file_filter">Filter für Dateien</string>
     <string name="settings_file_filter_effect">Ein Muster, nach dem jede App ohne eigenen Filter ihre Datei auswählt.</string>
     <string name="settings_file_filter_none">Keiner</string>
     <string name="settings_file_filter_invalid">Dieses Muster kann nicht gelesen werden.</string>
     <string name="settings_allow_downgrades">Ältere Versionen erlauben</string>
-    <string name="settings_allow_downgrades_effect">Let Me Downgrade ist installiert, daher darf Android eine ältere Version über eine neuere installieren.</string>
     <string name="settings_collapse_groups">Mit eingeklappten Gruppen beginnen</string>
     <string name="settings_haptics">Haptisches Feedback</string>
     <string name="settings_haptics_effect">Eine leichte Vibration, wenn Wischen oder langes Drücken etwas auslöst.</string>
@@ -38,7 +36,6 @@
     <string name="sources_repositories">Repositories</string>
     <string name="sources_stores">Stores</string>
     <string name="sources_mirrors">Stores, die Apps erneut veröffentlichen</string>
-    <string name="sources_modified">Seiten mit veränderten Apps</string>
     <string name="sources_other">Andere Orte</string>
     <string name="sources_web_page">Eine Webseite mit Links zu Dateien</string>
     <string name="sources_direct">Ein direkter Link zu einer Datei</string>
@@ -48,8 +45,6 @@
     <string name="shared_configs_title">Von Obtainium-Nutzern geteilte Konfigurationen</string>
     <string name="shared_configs_effect">Eine Seite mit fertigen Einstellungen für Apps. Ihre Links öffnen sich in Tern, wenn Obtainium-Links öffnen in den Einstellungen an ist.</string>
     <string name="engine_inner_filter_nothing">Der Filter für Dateien in Archiven passt auf keine der APKs in diesem Archiv.</string>
-    <string name="preview_republished">%1$s bietet erneut an, was Entwickler anderswo veröffentlichen. Seine Dateien werden an das Zertifikat des Entwicklers gebunden, sobald Tern es kennt, also hefte eines an oder installiere zuerst vom Entwickler, wenn du kannst.</string>
-    <string name="preview_modified">%1$s bietet Apps an, die jemand anderes als ihr Entwickler verändert hat. Sie sind von demjenigen signiert, der sie verändert hat, und Tern kann nicht erkennen, was verändert wurde.</string>
     <string name="about_track_tern">Tern selbst aktuell halten</string>
     <string name="about_track_tern_effect">Fügt die eigenen Releases von Tern der Liste hinzu, geprüft und verifiziert wie jede App.</string>
     <string name="engine_channel_tracked">Neue Releases verfolgter Apps</string>
diff --git a/app/src/main/res/values-de/strings_options.xml b/app/src/main/res/values-de/strings_options.xml
index 35ff7d41..fa6685f4 100644
--- a/app/src/main/res/values-de/strings_options.xml
+++ b/app/src/main/res/values-de/strings_options.xml
@@ -62,10 +62,6 @@
     <string name="option_workflow">Workflow-Datei</string>
     <string name="option_workflow_help">Zum Beispiel build.yml.</string>
     <string name="option_branch">Branch</string>
-    <string name="option_device_model">Gerätemodell</string>
-    <string name="option_device_model_help">Der Galaxy Store liefert jedem Modell einen eigenen Build, zum Beispiel SM-S948B.</string>
-    <string name="option_csc">Regionscode (CSC)</string>
-    <string name="option_csc_help">Drei Buchstaben, zum Beispiel DBT.</string>
     <string name="option_link_filter">Filter für Download-Links</string>
     <string name="option_link_filter_help">Nur passende Links zählen als Downloads.</string>
     <string name="option_page_order">Reihenfolge der Seite beibehalten</string>
@@ -76,11 +72,14 @@
     <string name="version_from_text">Linktext</string>
     <string name="version_from_page">Ganze Seite</string>
     <string name="option_headers">Anfrage-Header</string>
-    <string name="option_headers_help">Einer pro Zeile, als Name: value. Nie ein Passwort oder ein Cookie.</string>
     <string name="option_pseudo">Wenn es keine Version gibt</string>
     <string name="pseudo_default">Dateien unterscheiden wie der Server</string>
     <string name="pseudo_hash">Nach einem Hash des Dateianfangs</string>
     <string name="pseudo_link">Nach der Adresse der Datei</string>
     <string name="pseudo_etag">Nach dem ETag des Servers</string>
     <string name="option_invalid">Das kann so nicht verwendet werden.</string>
+    <string name="option_device_model">Gerätemodell</string>
+    <string name="option_device_model_help">Der Galaxy Store liefert jedem Modell einen eigenen Build, zum Beispiel SM-S948B.</string>
+    <string name="option_csc">Regionscode (CSC)</string>
+    <string name="option_csc_help">Drei Buchstaben, zum Beispiel DBT.</string>
 </resources>
diff --git a/app/src/main/res/values-de/strings_safety.xml b/app/src/main/res/values-de/strings_safety.xml
new file mode 100644
index 00000000..b143f996
--- /dev/null
+++ b/app/src/main/res/values-de/strings_safety.xml
@@ -0,0 +1,29 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="settings_export_effect_plain">Speichert deine Liste und Einstellungen in einer Datei. Tokens kommen nie hinein, und auch kein Anfrage-Header, der einen Schlüssel enthalten könnte.</string>
+    <string name="engine_checksum_github_proxy">GitHub-Release-Digest, wie der Hubproxy %1$s ihn weitergegeben hat</string>
+    <string name="github_proxy_effect_trust">Jede Anfrage an GitHub geht an diesen Host. Er sieht jede und kann ändern, was zurückkommt: die Releases, ihre Digests und die Dateien. Apps, die du hast, bleiben an ihr Zertifikat gebunden, aber eine erste Installation darüber vertraut dem Hubproxy genauso sehr wie GitHub, und das Anheften von Zertifikaten erreicht ihn nicht. Es wird kein Token darüber gesendet, daher können private Projekte und GitHub Actions so nicht verfolgt werden.</string>
+    <string name="settings_unmetered_checks">Nur über WLAN prüfen</string>
+    <string name="settings_unmetered_checks_effect">Hintergrundprüfungen warten auf WLAN oder ein Kabel, sodass sie keine mobilen Daten verbrauchen.</string>
+    <string name="settings_charging_checks">Nur beim Laden prüfen</string>
+    <string name="settings_charging_checks_effect">Hintergrundprüfungen warten, bis das Gerät geladen wird.</string>
+    <string name="settings_unmetered_installs_wait">Ein Update, das sich von selbst installieren würde, wartet auf WLAN oder ein Kabel, wie in Obtainium.</string>
+    <string name="settings_charging_installs_wait">Ein Update, das sich von selbst installieren würde, wartet, bis das Gerät geladen wird.</string>
+    <string name="engine_downgrade_not_as_named">Die Quelle nannte Versionscode %2$d, aber diese Datei ist %1$d, älter als die installierte. Sie wird nicht über die neuere installiert.</string>
+    <string name="settings_allow_downgrades_picked">Let Me Downgrade ist installiert, daher kann Android eine ältere Version über eine neuere installieren. Tern macht das nur für ein Release, das du aus dem Verlauf einer App wählst, nie im Hintergrund oder mit Alle aktualisieren.</string>
+    <string name="option_highest_version">Die höchste Version nehmen, wie Tern 0.1.0 es tat</string>
+    <string name="option_highest_version_effect">Bietet den Link mit der höchsten Version auf der Seite an, unabhängig von seinem Platz, und wendet das Versionsmuster auf die aus jedem Link gelesene Version an. Wenn aus, wird die Seite gelesen, wie Obtainium es tut: der letzte Link in der Reihenfolge ist der neueste.</string>
+    <string name="settings_remove_uninstalled_keeps_pins">Eine App, die du außerhalb von Tern deinstallierst, verlässt auch die Liste. Eine archivierte App bleibt. Wenn sie von derselben Stelle erneut hinzugefügt wird, bleibt eine App an das Zertifikat gebunden, das sie hatte; das Entfernen in Tern vergisst dies.</string>
+    <string name="link_check_title">Jetzt auf Updates prüfen?</string>
+    <string name="link_check_one">Ein Link hat Tern gebeten, %1$s auf Updates zu prüfen. Seine Quelle wird gefragt, und es wird nichts installiert.</string>
+    <plurals name="link_check_all">
+        <item quantity="one">Ein Link hat Tern gebeten, die %d App in deiner Liste auf Updates zu prüfen. Ihre Quelle wird gefragt, und es wird nichts installiert.</item>
+        <item quantity="other">Ein Link hat Tern gebeten, die %d Apps in deiner Liste auf Updates zu prüfen. Ihre Quellen werden gefragt, und es wird nichts installiert.</item>
+    </plurals>
+    <string name="link_check_confirm">Prüfen</string>
+    <string name="link_check_not_now">Nicht jetzt</string>
+    <string name="engine_installer_fell_back">%1$s war nicht bereit, daher wurde für diese der Installer von Android verwendet.</string>
+    <string name="about_track_tern_fdroid_effect">F-Droid hat diese Kopie installiert, daher verfolgt Tern ihren Eintrag dort: Updates sind die Builds, die F-Droid erstellt und geprüft hat, so wie die F-Droid-App sie erhält.</string>
+    <string name="about_track_tern_github">Stattdessen GitHub-Releases verfolgen</string>
+    <string name="about_track_tern_github_effect">Updates kommen von GitHub, sobald sie veröffentlicht werden, bevor F-Droid sie erstellt und geprüft hat. Dies überspringt die Prüfungen von F-Droid. Tern prüft weiterhin jede Datei und bindet sie an ihr eigenes Zertifikat.</string>
+</resources>
diff --git a/app/src/main/res/values-de/strings_settings_more.xml b/app/src/main/res/values-de/strings_settings_more.xml
index 40cf2e66..177366a2 100644
--- a/app/src/main/res/values-de/strings_settings_more.xml
+++ b/app/src/main/res/values-de/strings_settings_more.xml
@@ -37,9 +37,7 @@
     <string name="settings_auto_installs">Updates werden selbstständig installiert</string>
     <string name="settings_auto_installs_effect">Apps, die so eingestellt sind, dass sie sich selbstständig aktualisieren, tun das nach einer Hintergrundprüfung. Wenn aus, melden sie nur, dass ein Update da ist, und jede behält ihre eigene Wahl für später.</string>
     <string name="settings_unmetered_installs">Nur über WLAN installieren</string>
-    <string name="settings_unmetered_installs_effect">Prüfungen laufen in jedem Netzwerk. Ein Update, das sich selbstständig installieren würde, wartet auf WLAN oder ein Netzwerkkabel, wie in Obtainium.</string>
     <string name="settings_charging_installs">Nur beim Aufladen installieren</string>
-    <string name="settings_charging_installs_effect">Prüfungen laufen auch im Akkubetrieb. Ein Update, das sich selbstständig installieren würde, wartet, bis das Gerät aufgeladen wird.</string>
     <string name="engine_unreadable_app">Die gespeicherte App %1$s konnte nicht gelesen werden, daher wird sie in der Liste ausgelassen. Nichts wurde gelöscht: Eine neuere Version von Tern kann sie vielleicht lesen.</string>
     <string name="settings_pin_certificates">Zertifikate der Code-Plattformen anheften</string>
     <string name="settings_pin_certificates_effect">GitHub, GitLab und Codeberg müssen ein Zertifikat der Zertifizierungsstelle vorweisen, die jeder von ihnen bekanntermaßen nutzt, wie in Obtainium. Ein Zertifikat, zu dessen Ausstellung eine andere Zertifizierungsstelle gebracht wurde, wird dann abgelehnt. Wechselt eine Code-Plattform ihre Zertifizierungsstelle, schlagen Prüfungen dort fehl, bis dies ausgeschaltet ist.</string>
diff --git a/app/src/main/res/values-de/strings_sources_more.xml b/app/src/main/res/values-de/strings_sources_more.xml
index dd3efbfd..35c2d04b 100644
--- a/app/src/main/res/values-de/strings_sources_more.xml
+++ b/app/src/main/res/values-de/strings_sources_more.xml
@@ -18,10 +18,7 @@
     <string name="step_arch">Prozessor dieses Geräts bevorzugen</string>
     <string name="step_add">Seite hinzufügen</string>
     <string name="step_remove">Diese Seite entfernen</string>
-    <string name="option_file_version">Dateinamen als Version verwenden</string>
-    <string name="option_file_version_effect">Jede Datei gilt dann als eigenes Release.</string>
     <string name="github_proxy_title">GitHub über einen hubproxy</string>
-    <string name="github_proxy_effect">Jede Anfrage an GitHub geht an diesen Host, der jede einzelne sieht. Über ihn wird kein Token gesendet, daher können private Projekte und GitHub Actions auf diesem Weg nicht verfolgt werden.</string>
     <string name="github_proxy_host">Hubproxy-Host</string>
     <string name="github_proxy_help">Ein Hostname allein, zum Beispiel gh-proxy.com. Tern erreicht ihn über HTTPS.</string>
     <string name="github_proxy_invalid">Das ist kein Hostname, den Tern verwenden kann</string>
diff --git a/app/src/main/res/values-de/strings_starters.xml b/app/src/main/res/values-de/strings_starters.xml
new file mode 100644
index 00000000..1b7a6f66
--- /dev/null
+++ b/app/src/main/res/values-de/strings_starters.xml
@@ -0,0 +1,7 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="starter_in_list">In deiner Liste</string>
+    <string name="starter_on_phone">Auf diesem Telefon</string>
+    <string name="starter_on_phone_other">Auf diesem Telefon, anders signiert</string>
+    <string name="starter_on_phone_other_explain">Die Kopie, die du hast, ist mit einem anderen Schlüssel signiert, daher kann Tern sie von dieser Adresse nicht aktualisieren.</string>
+</resources>
diff --git a/app/src/main/res/values-de/strings_stores.xml b/app/src/main/res/values-de/strings_stores.xml
new file mode 100644
index 00000000..f55e74b4
--- /dev/null
+++ b/app/src/main/res/values-de/strings_stores.xml
@@ -0,0 +1,27 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="option_headers_help_own_agent">Einer pro Zeile, als Name: Wert. Niemals ein Passwort, ein Cookie oder ein User-Agent: Tern sagt jeder Seite, dass es Tern ist.</string>
+    <string name="origin_republished_first">%1$s bietet erneut an, was Entwickler woanders veröffentlichen, und ist nicht der Entwickler. Bis die App an ein Zertifikat angeheftet ist, entscheidet die erste Datei, die Tern daraus installiert, welches Zertifikat jedes spätere Update tragen muss.</string>
+    <string name="origin_republished_pinned">%1$s bietet erneut an, was Entwickler woanders veröffentlichen, und ist nicht der Entwickler. Seine Dateien müssen das Zertifikat tragen, an das diese App gebunden ist.</string>
+    <string name="origin_store_first">%1$s ist ein Store, nicht die eigene Seite des Entwicklers. Bis die App an ein Zertifikat angeheftet ist, entscheidet die erste Datei, die Tern daraus installiert, welches Zertifikat jedes spätere Update tragen muss.</string>
+    <string name="origin_store_pinned">%1$s ist ein Store, nicht die eigene Seite des Entwicklers. Seine Dateien müssen das Zertifikat tragen, an das diese App gebunden ist.</string>
+    <string name="stores_refused_modified">Tern liest keine Seiten, die modifizierte Apps anbieten. Deren Dateien werden von jemand anderem als dem Entwickler geändert und von demjenigen signiert, der sie geändert hat.</string>
+    <string name="stores_refused_impersonation">Tern kann diesen Store nicht lesen, ohne vorzugeben, seine App zu sein, daher liest es ihn nicht.</string>
+    <string name="stores_checksum_source">%1$s, was nicht der Entwickler ist</string>
+    <string name="stores_off_title">%1$s ist ein Drittanbieter-Store</string>
+    <string name="stores_off_body">Drittanbieter-Stores sind aus. Ein Store liefert seine eigenen Kopien von Apps, keine Dateien von der eigenen Seite des Entwicklers, und Tern liest ihn über die Schnittstelle, die der Store für seine eigene App oder Website gemacht hat. Wenn sie an sind, fragt Tern einen Store nur nach den Apps, die du von dort hinzufügst, und bis eine App an ein Zertifikat angeheftet ist, entscheidet die erste Datei, die Tern aus einem Store installiert, welches Zertifikat ihre Updates tragen müssen.</string>
+    <string name="stores_turn_on">Drittanbieter-Stores einschalten</string>
+    <string name="stores_advice">Schalte Drittanbieter-Stores in den Einstellungen ein, um diese App erneut zu prüfen.</string>
+    <string name="stores_status_paused">Pausiert</string>
+    <string name="stores_row_paused">Drittanbieter-Stores sind aus</string>
+    <string name="stores_setting">Drittanbieter-Stores</string>
+    <string name="stores_setting_effect">APKPure, Aptoide, APKCombo, APKMirror, Tencent, Huawei AppGallery, der Galaxy Store und vivo. Sie liefern ihre eigenen Kopien von Apps, keine Dateien von der eigenen Seite des Entwicklers, und Tern liest sie über die Schnittstellen, die sie für ihre eigenen Apps und Websites gemacht haben. Wenn sie aus sind, fragt Tern keinen von ihnen etwas, eine Suche lässt sie aus und Apps von ihnen sind pausiert.</string>
+    <string name="stores_off_tag">aus in den Einstellungen</string>
+    <string name="stores_checksum_matched">Die Datei stimmt mit der Prüfsumme des Stores überein</string>
+    <string name="stores_explain_checksum_matched">Eine Prüfsumme ist ein Fingerabdruck der Datei selbst. Der Store hat eine angegeben, und die von Tern heruntergeladene Datei hat dieselbe, also kam sie so an, wie der Store sie hat. Der Store ist nicht der Entwickler, daher sagt dies nichts darüber aus, wer die Datei gemacht hat. Das Zertifikat tut dies.</string>
+    <string name="stores_import_from_stores">Diese kommen von Drittanbieter-Stores, die ihre eigenen Kopien von Apps liefern. Bis eine App an ein Zertifikat angeheftet ist, entscheidet die erste Datei, die Tern aus ihrem Store installiert, welches Zertifikat ihre Updates tragen müssen.</string>
+    <string name="stores_import_paused">Drittanbieter-Stores sind aus, daher sind diese Apps pausiert. Tern fragt diese Stores nichts, bis du sie einschaltest.</string>
+    <string name="stores_import_names">Von Drittanbieter-Stores</string>
+    <string name="share_obtainium_link">Als Obtainium-Link teilen</string>
+    <string name="share_obtainium_links">Als Obtainium-Links teilen</string>
+</resources>
diff --git a/app/src/main/res/values-de/strings_tv.xml b/app/src/main/res/values-de/strings_tv.xml
new file mode 100644
index 00000000..57f371b7
--- /dev/null
+++ b/app/src/main/res/values-de/strings_tv.xml
@@ -0,0 +1,5 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="interval_turn_off">Hintergrundprüfungen ausschalten</string>
+    <string name="interval_turn_on">Hintergrundprüfungen einschalten</string>
+</resources>
diff --git a/app/src/main/res/values-eo/strings.xml b/app/src/main/res/values-eo/strings.xml
index 0dd86887..40db69d2 100644
--- a/app/src/main/res/values-eo/strings.xml
+++ b/app/src/main/res/values-eo/strings.xml
@@ -369,7 +369,6 @@
     <string name="settings_import_effect">El Tern aŭ Obtainium eksporto</string>
     <string name="settings_export">Eksporti aplikaĵojn</string>
     <string name="settings_exporting">Eksportas</string>
-    <string name="settings_export_effect">Konservas vian liston kaj agordojn en dosieron. Ĵetonoj neniam estas inkluzivitaj.</string>
     <plurals name="exported">
         <item quantity="one">Eksportis %d aplikaĵon</item>
         <item quantity="other">Eksportis %d aplikaĵojn</item>
diff --git a/app/src/main/res/values-eo/strings_accept.xml b/app/src/main/res/values-eo/strings_accept.xml
new file mode 100644
index 00000000..ca70df31
--- /dev/null
+++ b/app/src/main/res/values-eo/strings_accept.xml
@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="stores_paused_reason">Triapartaj vendejoj estas malŝaltitaj, do Tern demandas nenion al ĉi tiu vendejo. Ŝaltu ilin en Agordoj por kontroli ĝin denove.</string>
+</resources>
diff --git a/app/src/main/res/values-eo/strings_checks.xml b/app/src/main/res/values-eo/strings_checks.xml
index bf54a332..b3023a4b 100644
--- a/app/src/main/res/values-eo/strings_checks.xml
+++ b/app/src/main/res/values-eo/strings_checks.xml
@@ -17,13 +17,11 @@
     <string name="settings_only_installed">Kontroli nur instalitajn aplikaĵojn</string>
     <string name="settings_only_installed_effect">Aplikaĵoj kiuj estas nur sekvataj ankaŭ estas kontrolataj. Aplikaĵo kiun vi malfermas ĉiam estas kontrolata.</string>
     <string name="settings_remove_uninstalled">Forigi aplikaĵojn malinstalitajn aliloke</string>
-    <string name="settings_remove_uninstalled_effect">Aplikaĵo kiun vi malinstalas ekster Tern ankaŭ forlasas la liston.</string>
     <string name="settings_file_filter">Filtrilo por dosieroj</string>
     <string name="settings_file_filter_effect">Ŝablono laŭ kiu ĉiu aplikaĵo sen propra filtrilo elektas sian dosieron.</string>
     <string name="settings_file_filter_none">Neniu</string>
     <string name="settings_file_filter_invalid">Ĉi tiu ŝablono ne povas esti legita.</string>
     <string name="settings_allow_downgrades">Permesi pli malnovajn versiojn</string>
-    <string name="settings_allow_downgrades_effect">Let Me Downgrade estas instalita, do Android rajtas meti pli malnovan version super pli nova.</string>
     <string name="settings_collapse_groups">Komenci kun falditaj grupoj</string>
     <string name="settings_haptics">Haptika reago</string>
     <string name="settings_haptics_effect">Malpeza vibro kiam ŝovo aŭ longa premo faras ion.</string>
@@ -38,7 +36,6 @@
     <string name="sources_repositories">Deponejoj</string>
     <string name="sources_stores">Vendejoj</string>
     <string name="sources_mirrors">Vendejoj kiuj reeldonas aplikaĵojn</string>
-    <string name="sources_modified">Retejoj kun ŝanĝitaj aplikaĵoj</string>
     <string name="sources_other">Aliaj lokoj</string>
     <string name="sources_web_page">Retpaĝo kun ligiloj al dosieroj</string>
     <string name="sources_direct">Rekta ligilo al dosiero</string>
@@ -48,8 +45,6 @@
     <string name="shared_configs_title">Agordaroj kunhavigitaj de la uzantoj de Obtainium</string>
     <string name="shared_configs_effect">Retejo kun pretaj agordoj por aplikaĵoj. Ĝiaj ligiloj malfermiĝas en Tern kiam Malfermi Obtainium-ligilojn estas ŝaltita en Agordoj.</string>
     <string name="engine_inner_filter_nothing">La filtrilo por dosieroj en arkivoj kongruas kun neniu el la APK-oj en ĉi tiu arkivo.</string>
-    <string name="preview_republished">%1$s reofertas tion, kion programistoj eldonas aliloke. Ĝiaj dosieroj estas tenataj al la atestilo de la programisto tuj kiam Tern konas ĝin, do alpinglu unu aŭ unue instalu de la programisto kiam vi povas.</string>
-    <string name="preview_modified">%1$s ofertas aplikaĵojn ŝanĝitajn de iu alia ol ilia programisto. Ili estas subskribitaj de tiu, kiu ŝanĝis ilin, kaj Tern ne povas diri, kio estis ŝanĝita.</string>
     <string name="about_track_tern">Teni Tern mem ĝisdata</string>
     <string name="about_track_tern_effect">Aldonas la proprajn eldonojn de Tern al la listo, kontrolitajn kaj konfirmitajn kiel iu ajn aplikaĵo.</string>
     <string name="engine_channel_tracked">Novaj eldonoj de sekvataj aplikaĵoj</string>
diff --git a/app/src/main/res/values-eo/strings_options.xml b/app/src/main/res/values-eo/strings_options.xml
index 9522a668..adc88761 100644
--- a/app/src/main/res/values-eo/strings_options.xml
+++ b/app/src/main/res/values-eo/strings_options.xml
@@ -62,10 +62,6 @@
     <string name="option_workflow">Laborflua dosiero</string>
     <string name="option_workflow_help">Ekzemple build.yml.</string>
     <string name="option_branch">Branĉo</string>
-    <string name="option_device_model">Aparata modelo</string>
-    <string name="option_device_model_help">La Galaxy Store donas al ĉiu modelo sian propran konstruon, ekzemple SM-S948B.</string>
-    <string name="option_csc">Regiona kodo (CSC)</string>
-    <string name="option_csc_help">Tri literoj, ekzemple DBT.</string>
     <string name="option_link_filter">Filtrilo por elŝutaj ligiloj</string>
     <string name="option_link_filter_help">Nur kongruantaj ligiloj validas kiel elŝutoj.</string>
     <string name="option_page_order">Konservi la ordon de la paĝo</string>
@@ -76,11 +72,14 @@
     <string name="version_from_text">La teksto de la ligilo</string>
     <string name="version_from_page">La tuta paĝo</string>
     <string name="option_headers">Petaj kapoj</string>
-    <string name="option_headers_help">Po unu en linio, kiel Name: value. Neniam pasvorto aŭ kuketo.</string>
     <string name="option_pseudo">Kiam ne estas versio</string>
     <string name="pseudo_default">Distingi dosierojn kiel la servilo faras</string>
     <string name="pseudo_hash">Laŭ haketaĵo de la komenco de la dosiero</string>
     <string name="pseudo_link">Laŭ la adreso de la dosiero</string>
     <string name="pseudo_etag">Laŭ la ETag de la servilo</string>
     <string name="option_invalid">Ĉi tio ne povas esti uzata tia, kia ĝi estas.</string>
+    <string name="option_device_model">Aparata modelo</string>
+    <string name="option_device_model_help">La Galaxy Store donas al ĉiu modelo sian propran konstruon, ekzemple SM-S948B.</string>
+    <string name="option_csc">Regiona kodo (CSC)</string>
+    <string name="option_csc_help">Tri literoj, ekzemple DBT.</string>
 </resources>
diff --git a/app/src/main/res/values-eo/strings_safety.xml b/app/src/main/res/values-eo/strings_safety.xml
new file mode 100644
index 00000000..da7f0cea
--- /dev/null
+++ b/app/src/main/res/values-eo/strings_safety.xml
@@ -0,0 +1,29 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="settings_export_effect_plain">Konservas vian liston kaj agordojn en dosiero. Ĵetonoj neniam eniras, kaj same ne peta kaplinio kiu povus enhavi ŝlosilon.</string>
+    <string name="engine_checksum_github_proxy">Haketaĵo de GitHub-eldono, kiel la hubproxy %1$s transdonis ĝin</string>
+    <string name="github_proxy_effect_trust">Ĉiu peto al GitHub iras al ĉi tiu gastiganto. Ĝi vidas ĉiun kaj povas ŝanĝi kio revenas: la eldonojn, iliajn haketaĵojn kaj la dosierojn. Aplikaĵoj kiujn vi havas restas tenataj al sia atestilo, sed unua instalo per ĝi fidas la hubproxy tiom kiom GitHub, kaj alpinglado de atestiloj ne atingas ĝin. Neniu ĵetono estas sendita per ĝi, do privataj projektoj kaj GitHub Actions ne povas esti sekvataj ĉi tiel.</string>
+    <string name="settings_unmetered_checks">Kontroli nur sur Wi-Fi</string>
+    <string name="settings_unmetered_checks_effect">Fonaj kontroloj atendas Wi-Fi aŭ kablon, do ili uzas neniujn poŝtelefonajn datumojn.</string>
+    <string name="settings_charging_checks">Kontroli nur dum ŝargado</string>
+    <string name="settings_charging_checks_effect">Fonaj kontroloj atendas ĝis la aparato ŝargas.</string>
+    <string name="settings_unmetered_installs_wait">Ĝisdatigo kiu instaliĝus mem atendas Wi-Fi aŭ kablon, kiel en Obtainium.</string>
+    <string name="settings_charging_installs_wait">Ĝisdatigo kiu instaliĝus mem atendas ĝis la aparato ŝargas.</string>
+    <string name="engine_downgrade_not_as_named">La fonto nomis versiokodon %2$d, sed ĉi tiu dosiero estas %1$d, pli malnova ol la instalita. Ĝi ne estas metita super la pli novan.</string>
+    <string name="settings_allow_downgrades_picked">Let Me Downgrade estas instalita, do Android eble metos pli malnovan version super pli novan. Tern faras tion nur por eldono kiun vi elektas el la historio de aplikaĵo, neniam en la fono aŭ per Ĝisdatigi ĉion.</string>
+    <string name="option_highest_version">Preni la plej altan version, kiel Tern 0.1.0 faris</string>
+    <string name="option_highest_version_effect">Ofertas la ligilon kun la plej alta versio sur la paĝo, negrave ĝia loko, kaj rulas la versio-ŝablonon sur la versio legita de ĉiu ligilo. Malŝaltite legas la paĝon kiel Obtainium faras: la lasta ligilo en la ordo estas la plej nova.</string>
+    <string name="settings_remove_uninstalled_keeps_pins">Aplikaĵo kiun vi malinstalas ekster Tern forlasas ankaŭ la liston. Arkivita aplikaĵo restas. Aldonita denove de la sama loko, aplikaĵo estas tenata al la atestilo kiun ĝi havis; forigi ĝin en Tern forgesas tion.</string>
+    <string name="link_check_title">Kontroli por ĝisdatigoj nun?</string>
+    <string name="link_check_one">Ligilo petis al Tern kontroli %1$s por ĝisdatigoj. Ĝia fonto estas demandita, kaj nenio estas instalita.</string>
+    <plurals name="link_check_all">
+        <item quantity="one">Ligilo petis al Tern kontroli la %d aplikaĵon en via listo por ĝisdatigoj. Ĝia fonto estas demandita, kaj nenio estas instalita.</item>
+        <item quantity="other">Ligilo petis al Tern kontroli la %d aplikaĵojn en via listo por ĝisdatigoj. Iliaj fontoj estas demanditaj, kaj nenio estas instalita.</item>
+    </plurals>
+    <string name="link_check_confirm">Kontroli</string>
+    <string name="link_check_not_now">Ne nun</string>
+    <string name="engine_installer_fell_back">%1$s ne estis preta, do la instalilo de Android estis uzita por ĉi tiu.</string>
+    <string name="about_track_tern_fdroid_effect">F-Droid instalis ĉi tiun kopion, do Tern sekvas ĝian enskribon tie: ĝisdatigoj estas la kompiloj kiujn F-Droid konstruis kaj kontrolis, kiel la F-Droid-aplikaĵo ricevas ilin.</string>
+    <string name="about_track_tern_github">Sekvi GitHub-eldonojn anstataŭe</string>
+    <string name="about_track_tern_github_effect">Ĝisdatigoj venas de GitHub tuj kiam ili estas publikigitaj, antaŭ ol F-Droid konstruis kaj kontrolis ilin. Ĉi tio pretersaltas la kontrolojn de F-Droid. Tern ankoraŭ kontrolas ĉiun dosieron kaj tenas ĝin al sia propra atestilo.</string>
+</resources>
diff --git a/app/src/main/res/values-eo/strings_settings_more.xml b/app/src/main/res/values-eo/strings_settings_more.xml
index 41632f8a..9fcd25f5 100644
--- a/app/src/main/res/values-eo/strings_settings_more.xml
+++ b/app/src/main/res/values-eo/strings_settings_more.xml
@@ -37,9 +37,7 @@
     <string name="settings_auto_installs">Ĝisdatigoj instaliĝas memstare</string>
     <string name="settings_auto_installs_effect">Aplikaĵoj agorditaj ĝisdatiĝi memstare faras tion post fona kontrolo. Malŝaltite, ili nur diras, ke ĝisdatigo estas disponebla, kaj ĉiu konservas sian propran elekton por poste.</string>
     <string name="settings_unmetered_installs">Instali nur per Wi-Fi</string>
-    <string name="settings_unmetered_installs_effect">Kontroloj funkcias en iu ajn reto. Ĝisdatigo, kiu instaliĝus memstare, atendas Wi-Fi aŭ retkablon, kiel en Obtainium.</string>
     <string name="settings_charging_installs">Instali nur dum ŝargado</string>
-    <string name="settings_charging_installs_effect">Kontroloj funkcias ankaŭ per baterio. Ĝisdatigo, kiu instaliĝus memstare, atendas ĝis la aparato ŝargiĝas.</string>
     <string name="engine_unreadable_app">La konservita aplikaĵo %1$s ne povis esti legita, do ĝi estas preterlasita el la listo. Nenio estis forigita: pli nova versio de Tern eble legos ĝin.</string>
     <string name="settings_pin_certificates">Alpingli la atestilojn de la kodgastigejoj</string>
     <string name="settings_pin_certificates_effect">GitHub, GitLab kaj Codeberg devas montri atestilon de la atestila aŭtoritato, pri kiu oni scias, ke ĉiu el ili uzas ĝin, kiel en Obtainium. Atestilo, kiun alia atestila aŭtoritato estis igita eldoni, estas tiam rifuzita. Se kodgastigejo ŝanĝas sian atestilan aŭtoritaton, kontroloj tie malsukcesas ĝis tio estas malŝaltita.</string>
diff --git a/app/src/main/res/values-eo/strings_sources_more.xml b/app/src/main/res/values-eo/strings_sources_more.xml
index 02ac9c0c..1069b19b 100644
--- a/app/src/main/res/values-eo/strings_sources_more.xml
+++ b/app/src/main/res/values-eo/strings_sources_more.xml
@@ -18,10 +18,7 @@
     <string name="step_arch">Preferi la procesoron de ĉi tiu aparato</string>
     <string name="step_add">Aldoni paĝon</string>
     <string name="step_remove">Forigi ĉi tiun paĝon</string>
-    <string name="option_file_version">Uzi la dosiernomon kiel version</string>
-    <string name="option_file_version_effect">Ĉiu dosiero tiam validas kiel propra eldono.</string>
     <string name="github_proxy_title">GitHub tra hubproxy</string>
-    <string name="github_proxy_effect">Ĉiu peto al GitHub iras al ĉi tiu gastiganto, kiu vidas ĉiun. Neniu ĵetono estas sendata tra ĝi, do privataj projektoj kaj GitHub Actions ne povas esti sekvataj tiel.</string>
     <string name="github_proxy_host">Gastiganto de hubproxy</string>
     <string name="github_proxy_help">Nur gastignomo, ekzemple gh-proxy.com. Tern atingas ĝin per HTTPS.</string>
     <string name="github_proxy_invalid">Tio ne estas gastignomo, kiun Tern povas uzi</string>
diff --git a/app/src/main/res/values-eo/strings_starters.xml b/app/src/main/res/values-eo/strings_starters.xml
new file mode 100644
index 00000000..3046757f
--- /dev/null
+++ b/app/src/main/res/values-eo/strings_starters.xml
@@ -0,0 +1,7 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="starter_in_list">En via listo</string>
+    <string name="starter_on_phone">En ĉi tiu telefono</string>
+    <string name="starter_on_phone_other">En ĉi tiu telefono de alia subskribinto</string>
+    <string name="starter_on_phone_other_explain">La kopio, kiun vi havas, estas subskribita per alia ŝlosilo, do Tern ne povas ĝisdatigi ĝin de ĉi tiu adreso.</string>
+</resources>
diff --git a/app/src/main/res/values-eo/strings_stores.xml b/app/src/main/res/values-eo/strings_stores.xml
new file mode 100644
index 00000000..0eef2e23
--- /dev/null
+++ b/app/src/main/res/values-eo/strings_stores.xml
@@ -0,0 +1,27 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="option_headers_help_own_agent">Unu po linio, kiel Nomo: valoro. Neniam pasvorton, kuketon aŭ User-Agent: Tern diras al ĉiu retejo, ke ĝi estas Tern.</string>
+    <string name="origin_republished_first">%1$s denove ofertas tion kion programistoj publikigas aliloke, kaj ne estas la programisto. Ĝis la aplikaĵo estas alpinglita al atestilo, la unua dosiero kiun Tern instalas de ĝi decidas kiun atestilon ĉiu posta ĝisdatigo devas porti.</string>
+    <string name="origin_republished_pinned">%1$s denove ofertas tion kion programistoj publikigas aliloke, kaj ne estas la programisto. Ĝiaj dosieroj devas porti la atestilon al kiu ĉi tiu aplikaĵo estas tenata.</string>
+    <string name="origin_store_first">%1$s estas vendejo, ne la propra retejo de la programisto. Ĝis la aplikaĵo estas alpinglita al atestilo, la unua dosiero kiun Tern instalas de ĝi decidas kiun atestilon ĉiu posta ĝisdatigo devas porti.</string>
+    <string name="origin_store_pinned">%1$s estas vendejo, ne la propra retejo de la programisto. Ĝiaj dosieroj devas porti la atestilon al kiu ĉi tiu aplikaĵo estas tenata.</string>
+    <string name="stores_refused_modified">Tern ne legas retejojn kiuj ofertas modifitajn aplikaĵojn. Iliaj dosieroj estas ŝanĝitaj de iu alia ol la programisto kaj subskribitaj de tiu, kiu ŝanĝis ilin.</string>
+    <string name="stores_refused_impersonation">Tern ne povas legi ĉi tiun vendejon sen ŝajnigi esti ĝia aplikaĵo, do ĝi ne legas ĝin.</string>
+    <string name="stores_checksum_source">%1$s, kiu ne estas la programisto</string>
+    <string name="stores_off_title">%1$s estas triaparta vendejo</string>
+    <string name="stores_off_body">Triapartaj vendejoj estas malŝaltitaj. Vendejo servas siajn proprajn kopiojn de aplikaĵoj, ne dosierojn de la propra retejo de la programisto, kaj Tern legas ĝin per la interfaco kiun la vendejo faris por sia propra aplikaĵo aŭ retejo. Kun ili ŝaltitaj, Tern demandas vendejon nur pri la aplikaĵoj kiujn vi aldonas de ĝi, kaj ĝis aplikaĵo estas alpinglita al atestilo, la unua dosiero kiun Tern instalas de vendejo decidas kiun atestilon ĝiaj ĝisdatigoj devas porti.</string>
+    <string name="stores_turn_on">Ŝalti triapartajn vendejojn</string>
+    <string name="stores_advice">Ŝaltu Triapartajn vendejojn en Agordoj por kontroli ĉi tiun aplikaĵon denove.</string>
+    <string name="stores_status_paused">Paŭzita</string>
+    <string name="stores_row_paused">Triapartaj vendejoj estas malŝaltitaj</string>
+    <string name="stores_setting">Triapartaj vendejoj</string>
+    <string name="stores_setting_effect">APKPure, Aptoide, APKCombo, APKMirror, Tencent, Huawei AppGallery, la Galaxy Store kaj vivo. Ili servas siajn proprajn kopiojn de aplikaĵoj, ne dosierojn de la propra retejo de la programisto, kaj Tern legas ilin per la interfacoj kiujn ili faris por siaj propraj aplikaĵoj kaj retejoj. Malŝaltite, Tern demandas al neniu el ili ion ajn, serĉo preterlasas ilin kaj aplikaĵoj de ili estas paŭzitaj.</string>
+    <string name="stores_off_tag">malŝaltita en Agordoj</string>
+    <string name="stores_checksum_matched">La dosiero kongruas kun la kontrolsumo de la vendejo</string>
+    <string name="stores_explain_checksum_matched">Kontrolsumo estas fingrospuro de la dosiero mem. La vendejo donis unu, kaj la dosiero kiun Tern elŝutis havas la saman, do ĝi alvenis kiel la vendejo havas ĝin. La vendejo ne estas la programisto, do ĉi tio diras nenion pri kiu faris la dosieron. La atestilo faras tion.</string>
+    <string name="stores_import_from_stores">Ĉi tiuj venas de triapartaj vendejoj, kiuj servas siajn proprajn kopiojn de aplikaĵoj. Ĝis aplikaĵo estas alpinglita al atestilo, la unua dosiero kiun Tern instalas de ĝia vendejo decidas kiun atestilon ĝiaj ĝisdatigoj devas porti.</string>
+    <string name="stores_import_paused">Triapartaj vendejoj estas malŝaltitaj, do ĉi tiuj aplikaĵoj estas paŭzitaj. Tern demandas al tiuj vendejoj nenion ĝis vi ŝaltas ilin.</string>
+    <string name="stores_import_names">De triapartaj vendejoj</string>
+    <string name="share_obtainium_link">Kunhavigi kiel Obtainium-ligilon</string>
+    <string name="share_obtainium_links">Kunhavigi kiel Obtainium-ligilojn</string>
+</resources>
diff --git a/app/src/main/res/values-eo/strings_tv.xml b/app/src/main/res/values-eo/strings_tv.xml
new file mode 100644
index 00000000..84bfef6c
--- /dev/null
+++ b/app/src/main/res/values-eo/strings_tv.xml
@@ -0,0 +1,5 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="interval_turn_off">Malŝalti fonajn kontrolojn</string>
+    <string name="interval_turn_on">Ŝalti fonajn kontrolojn</string>
+</resources>
diff --git a/app/src/main/res/values-es/strings.xml b/app/src/main/res/values-es/strings.xml
index 7d4305c4..03a819ba 100644
--- a/app/src/main/res/values-es/strings.xml
+++ b/app/src/main/res/values-es/strings.xml
@@ -384,7 +384,6 @@
     <string name="settings_import_effect">De una exportación de Tern u Obtainium</string>
     <string name="settings_export">Exportar aplicaciones</string>
     <string name="settings_exporting">Exportando</string>
-    <string name="settings_export_effect">Guarda tu lista y ajustes en un archivo. Los tokens nunca se incluyen.</string>
     <plurals name="exported">
         <item quantity="one">Exportada %d aplicación</item>
         <item quantity="many">Exportadas %d aplicaciones</item>
diff --git a/app/src/main/res/values-es/strings_accept.xml b/app/src/main/res/values-es/strings_accept.xml
new file mode 100644
index 00000000..d2e630e9
--- /dev/null
+++ b/app/src/main/res/values-es/strings_accept.xml
@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="stores_paused_reason">Las tiendas de terceros están desactivadas, así que Tern no le pregunta nada a esta tienda. Actívalas en Ajustes para volver a comprobarla.</string>
+</resources>
diff --git a/app/src/main/res/values-es/strings_checks.xml b/app/src/main/res/values-es/strings_checks.xml
index 4381507e..fa484002 100644
--- a/app/src/main/res/values-es/strings_checks.xml
+++ b/app/src/main/res/values-es/strings_checks.xml
@@ -19,13 +19,11 @@
     <string name="settings_only_installed">Comprobar solo las aplicaciones instaladas</string>
     <string name="settings_only_installed_effect">Las aplicaciones que solo se siguen también se comprueban. Una aplicación que abres siempre se comprueba.</string>
     <string name="settings_remove_uninstalled">Eliminar las aplicaciones desinstaladas fuera de Tern</string>
-    <string name="settings_remove_uninstalled_effect">Una aplicación que desinstalas fuera de Tern también sale de la lista.</string>
     <string name="settings_file_filter">Filtro de archivos</string>
     <string name="settings_file_filter_effect">Un patrón con el que cada aplicación sin filtro propio elige su archivo.</string>
     <string name="settings_file_filter_none">Ninguno</string>
     <string name="settings_file_filter_invalid">Este patrón no se puede leer.</string>
     <string name="settings_allow_downgrades">Permitir versiones anteriores</string>
-    <string name="settings_allow_downgrades_effect">Let Me Downgrade está instalado, así que Android puede poner una versión anterior sobre una más reciente.</string>
     <string name="settings_collapse_groups">Empezar con los grupos plegados</string>
     <string name="settings_haptics">Respuesta háptica</string>
     <string name="settings_haptics_effect">Una vibración ligera cuando un deslizamiento o una pulsación larga hace algo.</string>
@@ -40,7 +38,6 @@
     <string name="sources_repositories">Repositorios</string>
     <string name="sources_stores">Tiendas</string>
     <string name="sources_mirrors">Tiendas que vuelven a publicar aplicaciones</string>
-    <string name="sources_modified">Sitios con aplicaciones modificadas</string>
     <string name="sources_other">Otros lugares</string>
     <string name="sources_web_page">Una página web con enlaces a archivos</string>
     <string name="sources_direct">Un enlace directo a un archivo</string>
@@ -50,8 +47,6 @@
     <string name="shared_configs_title">Configuraciones compartidas por los usuarios de Obtainium</string>
     <string name="shared_configs_effect">Un sitio con ajustes listos para aplicaciones. Sus enlaces se abren en Tern cuando Abrir enlaces de Obtainium está activado en Ajustes.</string>
     <string name="engine_inner_filter_nothing">El filtro de archivos dentro de archivos comprimidos no coincide con ninguno de los APK de este.</string>
-    <string name="preview_republished">%1$s vuelve a ofrecer lo que los desarrolladores publican en otro lugar. Tern exige a sus archivos el certificado del desarrollador en cuanto lo conoce, así que fija uno o instala primero desde el desarrollador cuando puedas.</string>
-    <string name="preview_modified">%1$s ofrece aplicaciones modificadas por alguien distinto a su desarrollador. Están firmadas por quien las modificó, y Tern no puede saber qué se cambió.</string>
     <string name="about_track_tern">Mantener actualizado el propio Tern</string>
     <string name="about_track_tern_effect">Añade los lanzamientos de Tern a la lista, comprobados y verificados como cualquier aplicación.</string>
     <string name="engine_channel_tracked">Nuevos lanzamientos de aplicaciones seguidas</string>
diff --git a/app/src/main/res/values-es/strings_options.xml b/app/src/main/res/values-es/strings_options.xml
index 67fdb53c..0dc8551a 100644
--- a/app/src/main/res/values-es/strings_options.xml
+++ b/app/src/main/res/values-es/strings_options.xml
@@ -64,10 +64,6 @@
     <string name="option_workflow">Archivo de flujo de trabajo</string>
     <string name="option_workflow_help">Como build.yml.</string>
     <string name="option_branch">Rama</string>
-    <string name="option_device_model">Modelo de dispositivo</string>
-    <string name="option_device_model_help">Galaxy Store da a cada modelo su propia compilación, como SM-S948B.</string>
-    <string name="option_csc">Código de región (CSC)</string>
-    <string name="option_csc_help">Tres letras, como DBT.</string>
     <string name="option_link_filter">Filtro de enlaces de descarga</string>
     <string name="option_link_filter_help">Solo los enlaces que coinciden cuentan como descargas.</string>
     <string name="option_page_order">Mantener el orden de la página</string>
@@ -78,11 +74,14 @@
     <string name="version_from_text">El texto del enlace</string>
     <string name="version_from_page">Toda la página</string>
     <string name="option_headers">Cabeceras de la petición</string>
-    <string name="option_headers_help">Una por línea, como Name: value. Nunca una contraseña ni una cookie.</string>
     <string name="option_pseudo">Cuando no hay versión</string>
     <string name="pseudo_default">Distinguir los archivos como lo hace el servidor</string>
     <string name="pseudo_hash">Por un hash del inicio del archivo</string>
     <string name="pseudo_link">Por la dirección del archivo</string>
     <string name="pseudo_etag">Por el ETag del servidor</string>
     <string name="option_invalid">Esto no se puede usar tal como está.</string>
+    <string name="option_device_model">Modelo de dispositivo</string>
+    <string name="option_device_model_help">Galaxy Store da a cada modelo su propia compilación, como SM-S948B.</string>
+    <string name="option_csc">Código de región (CSC)</string>
+    <string name="option_csc_help">Tres letras, como DBT.</string>
 </resources>
diff --git a/app/src/main/res/values-es/strings_safety.xml b/app/src/main/res/values-es/strings_safety.xml
new file mode 100644
index 00000000..9faf5031
--- /dev/null
+++ b/app/src/main/res/values-es/strings_safety.xml
@@ -0,0 +1,30 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="settings_export_effect_plain">Guarda tu lista y ajustes en un archivo. Los tokens nunca se incluyen, y tampoco un encabezado de solicitud que pudiera contener una clave.</string>
+    <string name="engine_checksum_github_proxy">Resumen del lanzamiento de GitHub, tal y como lo pasó el hubproxy %1$s</string>
+    <string name="github_proxy_effect_trust">Cada solicitud a GitHub va a este host. Ve cada una y puede cambiar lo que devuelve: los lanzamientos, sus resúmenes y los archivos. Las aplicaciones que tienes siguen sujetas a su certificado, pero una primera instalación a través de él confía en el hubproxy tanto como en GitHub, y la fijación de certificados no lo alcanza. No se envía ningún token a través de él, así que los proyectos privados y GitHub Actions no se pueden seguir de esta forma.</string>
+    <string name="settings_unmetered_checks">Comprobar solo con wifi</string>
+    <string name="settings_unmetered_checks_effect">Las comprobaciones en segundo plano esperan a wifi o un cable, así que no usan datos móviles.</string>
+    <string name="settings_charging_checks">Comprobar solo al cargar</string>
+    <string name="settings_charging_checks_effect">Las comprobaciones en segundo plano esperan a que el dispositivo esté cargando.</string>
+    <string name="settings_unmetered_installs_wait">Una actualización que se instalaría por sí sola espera a wifi o un cable, como en Obtainium.</string>
+    <string name="settings_charging_installs_wait">Una actualización que se instalaría por sí sola espera a que el dispositivo esté cargando.</string>
+    <string name="engine_downgrade_not_as_named">El origen nombró el código de versión %2$d, pero este archivo es %1$d, más antiguo que el instalado. No se pone sobre el más nuevo.</string>
+    <string name="settings_allow_downgrades_picked">Let Me Downgrade está instalado, así que Android puede poner una versión anterior sobre una más nueva. Tern solo lo hace para un lanzamiento que elijas del historial de una aplicación, nunca en segundo plano o con Actualizar todas.</string>
+    <string name="option_highest_version">Tomar la versión más alta, como hacía Tern 0.1.0</string>
+    <string name="option_highest_version_effect">Ofrece el enlace con la versión más alta de la página, sin importar su lugar, y ejecuta el patrón de versión sobre la versión leída de cada enlace. Desactivado lee la página como lo hace Obtainium: el último enlace en orden es el más reciente.</string>
+    <string name="settings_remove_uninstalled_keeps_pins">Una aplicación que desinstalas fuera de Tern también desaparece de la lista. Una aplicación archivada se mantiene. Al añadirla de nuevo desde el mismo lugar, a la aplicación se le exige el certificado que tenía; eliminarla en Tern olvida eso.</string>
+    <string name="link_check_title">¿Comprobar actualizaciones ahora?</string>
+    <string name="link_check_one">Un enlace pidió a Tern que comprobara las actualizaciones de %1$s. Se le pregunta a su origen y no se instala nada.</string>
+    <plurals name="link_check_all">
+        <item quantity="one">Un enlace pidió a Tern que comprobara las actualizaciones de %d aplicación de tu lista. Se le pregunta a su origen y no se instala nada.</item>
+        <item quantity="many">Un enlace pidió a Tern que comprobara las actualizaciones de las %d aplicaciones de tu lista. Se les pregunta a sus orígenes y no se instala nada.</item>
+        <item quantity="other">Un enlace pidió a Tern que comprobara las actualizaciones de las %d aplicaciones de tu lista. Se les pregunta a sus orígenes y no se instala nada.</item>
+    </plurals>
+    <string name="link_check_confirm">Comprobar</string>
+    <string name="link_check_not_now">Ahora no</string>
+    <string name="engine_installer_fell_back">%1$s no estaba listo, así que se usó el instalador de Android para esta.</string>
+    <string name="about_track_tern_fdroid_effect">F-Droid instaló esta copia, así que Tern sigue su entrada allí: las actualizaciones son las compilaciones que F-Droid hizo y comprobó, tal y como las obtiene la aplicación F-Droid.</string>
+    <string name="about_track_tern_github">Seguir los lanzamientos de GitHub en su lugar</string>
+    <string name="about_track_tern_github_effect">Las actualizaciones llegan de GitHub en cuanto se publican, antes de que F-Droid las haya compilado y comprobado. Esto omite las comprobaciones de F-Droid. Tern sigue comprobando cada archivo y exigiéndole su propio certificado.</string>
+</resources>
diff --git a/app/src/main/res/values-es/strings_settings_more.xml b/app/src/main/res/values-es/strings_settings_more.xml
index b5610de7..61c238ad 100644
--- a/app/src/main/res/values-es/strings_settings_more.xml
+++ b/app/src/main/res/values-es/strings_settings_more.xml
@@ -38,9 +38,7 @@
     <string name="settings_auto_installs">Las actualizaciones se instalan solas</string>
     <string name="settings_auto_installs_effect">Las aplicaciones configuradas para actualizarse solas lo hacen tras una comprobación en segundo plano. Desactivado, solo avisan de que hay una actualización, y cada una conserva su propia elección para más adelante.</string>
     <string name="settings_unmetered_installs">Instalar solo con Wi-Fi</string>
-    <string name="settings_unmetered_installs_effect">Las comprobaciones se hacen en cualquier red. Una actualización que se instalaría sola espera a que haya Wi-Fi o un cable, como en Obtainium.</string>
     <string name="settings_charging_installs">Instalar solo mientras se carga</string>
-    <string name="settings_charging_installs_effect">Las comprobaciones se hacen también con batería. Una actualización que se instalaría sola espera hasta que el dispositivo esté cargando.</string>
     <string name="engine_unreadable_app">No se pudo leer la aplicación guardada %1$s, así que se deja fuera de la lista. No se borró nada: una versión más reciente de Tern podría leerla.</string>
     <string name="settings_pin_certificates">Fijar los certificados de las forjas</string>
     <string name="settings_pin_certificates_effect">GitHub, GitLab y Codeberg deben presentar un certificado de la autoridad que se sabe que usa cada uno, como en Obtainium. Un certificado que otra autoridad haya sido obligada a emitir se rechaza entonces. Si una forja cambia de autoridad, las comprobaciones allí fallan hasta que esto se desactive.</string>
diff --git a/app/src/main/res/values-es/strings_sources_more.xml b/app/src/main/res/values-es/strings_sources_more.xml
index b6242fda..a23a48cb 100644
--- a/app/src/main/res/values-es/strings_sources_more.xml
+++ b/app/src/main/res/values-es/strings_sources_more.xml
@@ -18,10 +18,7 @@
     <string name="step_arch">Preferir el procesador de este dispositivo</string>
     <string name="step_add">Añadir una página</string>
     <string name="step_remove">Eliminar esta página</string>
-    <string name="option_file_version">Usar el nombre del archivo como versión</string>
-    <string name="option_file_version_effect">Cada archivo cuenta entonces como un lanzamiento propio.</string>
     <string name="github_proxy_title">GitHub a través de un hubproxy</string>
-    <string name="github_proxy_effect">Cada petición a GitHub va a este servidor, que ve todas y cada una. No se envía ningún token a través de él, así que los proyectos privados y GitHub Actions no se pueden seguir de esta forma.</string>
     <string name="github_proxy_host">Servidor del hubproxy</string>
     <string name="github_proxy_help">Solo un nombre de servidor, como gh-proxy.com. Tern se conecta a él por HTTPS.</string>
     <string name="github_proxy_invalid">Ese no es un nombre de servidor que Tern pueda usar</string>
diff --git a/app/src/main/res/values-es/strings_starters.xml b/app/src/main/res/values-es/strings_starters.xml
new file mode 100644
index 00000000..b3a35c87
--- /dev/null
+++ b/app/src/main/res/values-es/strings_starters.xml
@@ -0,0 +1,7 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="starter_in_list">En tu lista</string>
+    <string name="starter_on_phone">En este teléfono</string>
+    <string name="starter_on_phone_other">En este teléfono de otro firmante</string>
+    <string name="starter_on_phone_other_explain">La copia que tienes está firmada con una clave diferente, así que Tern no puede actualizarla desde esta dirección.</string>
+</resources>
diff --git a/app/src/main/res/values-es/strings_stores.xml b/app/src/main/res/values-es/strings_stores.xml
new file mode 100644
index 00000000..682e9e9a
--- /dev/null
+++ b/app/src/main/res/values-es/strings_stores.xml
@@ -0,0 +1,27 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="option_headers_help_own_agent">Uno por línea, como Nombre: valor. Nunca una contraseña, una cookie o un User-Agent: Tern le dice a cada sitio que es Tern.</string>
+    <string name="origin_republished_first">%1$s vuelve a ofrecer lo que los desarrolladores publican en otros lugares, y no es el desarrollador. Hasta que la aplicación se fije a un certificado, el primer archivo que Tern instale desde allí decide qué certificado debe llevar cada actualización posterior.</string>
+    <string name="origin_republished_pinned">%1$s vuelve a ofrecer lo que los desarrolladores publican en otros lugares, y no es el desarrollador. Sus archivos deben llevar el certificado que se le exige a esta aplicación.</string>
+    <string name="origin_store_first">%1$s es una tienda, no el propio sitio del desarrollador. Hasta que la aplicación se fije a un certificado, el primer archivo que Tern instale desde allí decide qué certificado debe llevar cada actualización posterior.</string>
+    <string name="origin_store_pinned">%1$s es una tienda, no el propio sitio del desarrollador. Sus archivos deben llevar el certificado que se le exige a esta aplicación.</string>
+    <string name="stores_refused_modified">Tern no lee sitios que ofrecen aplicaciones modificadas. Sus archivos están cambiados por alguien distinto del desarrollador y firmados por quien los cambió.</string>
+    <string name="stores_refused_impersonation">Tern no puede leer esta tienda sin fingir ser su aplicación, así que no la lee.</string>
+    <string name="stores_checksum_source">%1$s, que no es el desarrollador</string>
+    <string name="stores_off_title">%1$s es una tienda de terceros</string>
+    <string name="stores_off_body">Las tiendas de terceros están desactivadas. Una tienda sirve sus propias copias de aplicaciones, no archivos del propio sitio del desarrollador, y Tern la lee a través de la interfaz que la tienda hizo para su propia aplicación o sitio web. Con ellas activadas, Tern solo le pregunta a una tienda por las aplicaciones que añades de ella, y hasta que una aplicación se fije a un certificado, el primer archivo que Tern instale desde una tienda decide qué certificado deben llevar sus actualizaciones.</string>
+    <string name="stores_turn_on">Activar tiendas de terceros</string>
+    <string name="stores_advice">Activa las Tiendas de terceros en Ajustes para volver a comprobar esta aplicación.</string>
+    <string name="stores_status_paused">En pausa</string>
+    <string name="stores_row_paused">Tiendas de terceros desactivadas</string>
+    <string name="stores_setting">Tiendas de terceros</string>
+    <string name="stores_setting_effect">APKPure, Aptoide, APKCombo, APKMirror, Tencent, Huawei AppGallery, el Galaxy Store y vivo. Sirven sus propias copias de aplicaciones, no archivos del propio sitio del desarrollador, y Tern las lee a través de las interfaces que hicieron para sus propias aplicaciones y sitios web. Desactivadas, Tern no le pregunta nada a ninguna, una búsqueda las excluye y las aplicaciones de ellas están en pausa.</string>
+    <string name="stores_off_tag">desactivadas en Ajustes</string>
+    <string name="stores_checksum_matched">El archivo coincide con la suma de comprobación de la tienda</string>
+    <string name="stores_explain_checksum_matched">Una suma de comprobación es una huella digital del propio archivo. La tienda dio una, y el archivo que Tern descargó tiene la misma, así que llegó tal y como lo tiene la tienda. La tienda no es el desarrollador, así que esto no dice nada sobre quién hizo el archivo. El certificado sí.</string>
+    <string name="stores_import_from_stores">Estas vienen de tiendas de terceros, que sirven sus propias copias de aplicaciones. Hasta que una aplicación se fije a un certificado, el primer archivo que Tern instale desde su tienda decide qué certificado deben llevar sus actualizaciones.</string>
+    <string name="stores_import_paused">Las tiendas de terceros están desactivadas, así que estas aplicaciones están en pausa. Tern no le pregunta nada a esas tiendas hasta que las actives.</string>
+    <string name="stores_import_names">De tiendas de terceros</string>
+    <string name="share_obtainium_link">Compartir como enlace de Obtainium</string>
+    <string name="share_obtainium_links">Compartir como enlaces de Obtainium</string>
+</resources>
diff --git a/app/src/main/res/values-es/strings_tv.xml b/app/src/main/res/values-es/strings_tv.xml
new file mode 100644
index 00000000..180f9d9d
--- /dev/null
+++ b/app/src/main/res/values-es/strings_tv.xml
@@ -0,0 +1,5 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="interval_turn_off">Desactivar comprobaciones en segundo plano</string>
+    <string name="interval_turn_on">Activar comprobaciones en segundo plano</string>
+</resources>
diff --git a/app/src/main/res/values-fa/strings.xml b/app/src/main/res/values-fa/strings.xml
index 005b23be..faba3857 100644
--- a/app/src/main/res/values-fa/strings.xml
+++ b/app/src/main/res/values-fa/strings.xml
@@ -369,7 +369,6 @@
     <string name="settings_import_effect">از فایل برون‌ریزی Tern یا Obtainium</string>
     <string name="settings_export">برون‌ریزی برنامه‌ها</string>
     <string name="settings_exporting">در حال برون‌ریزی</string>
-    <string name="settings_export_effect">لیست و تنظیمات شما را در یک فایل ذخیره می‌کند. توکن‌ها هرگز در آن قرار نمی‌گیرند.</string>
     <plurals name="exported">
         <item quantity="one">%d برنامه برون‌ریزی شد</item>
         <item quantity="other">%d برنامه برون‌ریزی شد</item>
diff --git a/app/src/main/res/values-fa/strings_accept.xml b/app/src/main/res/values-fa/strings_accept.xml
new file mode 100644
index 00000000..e1550d35
--- /dev/null
+++ b/app/src/main/res/values-fa/strings_accept.xml
@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="stores_paused_reason">فروشگاه‌های شخص ثالث خاموش هستند، بنابراین Tern چیزی از این فروشگاه نمی‌پرسد. برای بررسی دوباره، آن‌ها را در تنظیمات روشن کنید.</string>
+</resources>
diff --git a/app/src/main/res/values-fa/strings_checks.xml b/app/src/main/res/values-fa/strings_checks.xml
index 335580a9..1f5daf13 100644
--- a/app/src/main/res/values-fa/strings_checks.xml
+++ b/app/src/main/res/values-fa/strings_checks.xml
@@ -17,13 +17,11 @@
     <string name="settings_only_installed">فقط برنامه‌های نصب‌شده بررسی شوند</string>
     <string name="settings_only_installed_effect">برنامه‌هایی که فقط دنبال می‌شوند هم بررسی می‌شوند. برنامه‌ای که باز می‌کنید همیشه بررسی می‌شود.</string>
     <string name="settings_remove_uninstalled">حذف برنامه‌هایی که جای دیگری حذف نصب شده‌اند</string>
-    <string name="settings_remove_uninstalled_effect">برنامه‌ای که بیرون از Tern حذف نصب کنید، از لیست هم خارج می‌شود.</string>
     <string name="settings_file_filter">فیلتر فایل‌ها</string>
     <string name="settings_file_filter_effect">الگویی که هر برنامه بدون فیلتر اختصاصی، فایلش را با آن انتخاب می‌کند.</string>
     <string name="settings_file_filter_none">هیچ</string>
     <string name="settings_file_filter_invalid">این الگو قابل خواندن نیست.</string>
     <string name="settings_allow_downgrades">اجازه نسخه‌های قدیمی‌تر</string>
-    <string name="settings_allow_downgrades_effect">Let Me Downgrade نصب است، بنابراین Android می‌تواند نسخه قدیمی‌تر را روی نسخه جدیدتر نصب کند.</string>
     <string name="settings_collapse_groups">شروع با گروه‌های جمع‌شده</string>
     <string name="settings_haptics">بازخورد لمسی</string>
     <string name="settings_haptics_effect">لرزشی سبک وقتی کشیدن انگشت یا فشار طولانی کاری انجام می‌دهد.</string>
@@ -38,7 +36,6 @@
     <string name="sources_repositories">مخزن‌ها</string>
     <string name="sources_stores">فروشگاه‌ها</string>
     <string name="sources_mirrors">فروشگاه‌هایی که برنامه‌ها را بازنشر می‌کنند</string>
-    <string name="sources_modified">سایت‌های برنامه‌های تغییریافته</string>
     <string name="sources_other">جاهای دیگر</string>
     <string name="sources_web_page">یک صفحه وب با پیوند به فایل‌ها</string>
     <string name="sources_direct">یک پیوند مستقیم به فایل</string>
@@ -48,8 +45,6 @@
     <string name="shared_configs_title">پیکربندی‌های به‌اشتراک‌گذاشته کاربران Obtainium</string>
     <string name="shared_configs_effect">سایتی از تنظیمات آماده برای برنامه‌ها. وقتی «باز کردن پیوندهای Obtainium» در تنظیمات روشن باشد، پیوندهای آن در Tern باز می‌شوند.</string>
     <string name="engine_inner_filter_nothing">فیلتر فایل‌های درون آرشیوها با هیچ‌کدام از APKهای این آرشیو مطابقت ندارد.</string>
-    <string name="preview_republished">%1$s آنچه را توسعه‌دهندگان در جای دیگری منتشر می‌کنند دوباره ارائه می‌دهد. فایل‌های آن به‌محض اینکه Tern گواهی توسعه‌دهنده را بشناسد، ملزم به همان گواهی می‌شوند، پس هر وقت توانستید یک گواهی پین کنید یا ابتدا از خود توسعه‌دهنده نصب کنید.</string>
-    <string name="preview_modified">%1$s برنامه‌هایی را ارائه می‌دهد که شخصی غیر از توسعه‌دهنده‌شان تغییر داده است. این برنامه‌ها توسط کسی که آن‌ها را تغییر داده امضا شده‌اند، و Tern نمی‌تواند بگوید چه چیزی تغییر کرده است.</string>
     <string name="about_track_tern">به‌روز نگه داشتن خود Tern</string>
     <string name="about_track_tern_effect">انتشارهای خود Tern را به لیست اضافه می‌کند، که مانند هر برنامه‌ای بررسی و تأیید می‌شوند.</string>
     <string name="engine_channel_tracked">انتشارهای جدید برنامه‌های دنبال‌شده</string>
diff --git a/app/src/main/res/values-fa/strings_options.xml b/app/src/main/res/values-fa/strings_options.xml
index 635064bc..2cc5ed32 100644
--- a/app/src/main/res/values-fa/strings_options.xml
+++ b/app/src/main/res/values-fa/strings_options.xml
@@ -62,10 +62,6 @@
     <string name="option_workflow">فایل گردش کار</string>
     <string name="option_workflow_help">مانند build.yml.</string>
     <string name="option_branch">شاخه</string>
-    <string name="option_device_model">مدل دستگاه</string>
-    <string name="option_device_model_help">Galaxy Store برای هر مدل نسخه ساخت خودش را دارد، مانند SM-S948B.</string>
-    <string name="option_csc">کد منطقه (CSC)</string>
-    <string name="option_csc_help">سه حرف، مانند DBT.</string>
     <string name="option_link_filter">فیلتر پیوندهای دانلود</string>
     <string name="option_link_filter_help">فقط پیوندهای مطابق به‌عنوان دانلود حساب می‌شوند.</string>
     <string name="option_page_order">حفظ ترتیب صفحه</string>
@@ -76,11 +72,14 @@
     <string name="version_from_text">متن پیوند</string>
     <string name="version_from_page">کل صفحه</string>
     <string name="option_headers">سرآیندهای درخواست</string>
-    <string name="option_headers_help">هر کدام در یک خط، به‌صورت Name: value. هرگز رمز عبور یا کوکی وارد نکنید.</string>
     <string name="option_pseudo">وقتی نسخه‌ای وجود ندارد</string>
     <string name="pseudo_default">تشخیص فایل‌ها از هم به روش سرور</string>
     <string name="pseudo_hash">با هش ابتدای فایل</string>
     <string name="pseudo_link">با آدرس فایل</string>
     <string name="pseudo_etag">با ETag سرور</string>
     <string name="option_invalid">این را نمی‌توان به همین شکل استفاده کرد.</string>
+    <string name="option_device_model">مدل دستگاه</string>
+    <string name="option_device_model_help">Galaxy Store برای هر مدل نسخه ساخت خودش را دارد، مانند SM-S948B.</string>
+    <string name="option_csc">کد منطقه (CSC)</string>
+    <string name="option_csc_help">سه حرف، مانند DBT.</string>
 </resources>
diff --git a/app/src/main/res/values-fa/strings_safety.xml b/app/src/main/res/values-fa/strings_safety.xml
new file mode 100644
index 00000000..f99be524
--- /dev/null
+++ b/app/src/main/res/values-fa/strings_safety.xml
@@ -0,0 +1,29 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="settings_export_effect_plain">لیست و تنظیمات شما را در یک فایل ذخیره میکند. توکنها هرگز وارد نمیشوند، و همینطور سرآیند درخواستی که بتواند کلیدی را در خود نگه دارد.</string>
+    <string name="engine_checksum_github_proxy">دایجست انتشار GitHub، همان‌طور که پروکسی %1$s آن را منتقل کرد</string>
+    <string name="github_proxy_effect_trust">هر درخواست به GitHub به این میزبان می‌رود. میزبان هر کدام را می‌بیند و می‌تواند آنچه را که برمی‌گردد تغییر دهد: انتشارها، دایجست‌های آن‌ها و فایل‌ها. برنامه‌هایی که دارید به گواهی خود مقید می‌مانند، اما اولین نصب از طریق آن به اندازه GitHub به پروکسی اعتماد می‌کند، و پین کردن گواهی به آن نمی‌رسد. هیچ توکنی از طریق آن ارسال نمی‌شود، بنابراین پروژه‌های خصوصی و GitHub Actions را نمی‌توان به این روش دنبال کرد.</string>
+    <string name="settings_unmetered_checks">بررسی فقط با Wi-Fi</string>
+    <string name="settings_unmetered_checks_effect">بررسیهای پسزمینه منتظر Wi-Fi یا کابل میمانند، بنابراین هیچ داده تلفن همراهی استفاده نمیکنند.</string>
+    <string name="settings_charging_checks">بررسی فقط هنگام شارژ</string>
+    <string name="settings_charging_checks_effect">بررسیهای پسزمینه تا زمانی که دستگاه در حال شارژ است منتظر میمانند.</string>
+    <string name="settings_unmetered_installs_wait">بهروزرسانیای که خودش نصب میشود منتظر Wi-Fi یا کابل میماند، مانند Obtainium.</string>
+    <string name="settings_charging_installs_wait">بهروزرسانیای که خودش نصب میشود تا زمانی که دستگاه در حال شارژ است منتظر میماند.</string>
+    <string name="engine_downgrade_not_as_named">منبع، کد نسخه را %2$d نامید، اما این فایل %1$d است، قدیمیتر از نسخه نصبشده. این فایل روی نسخه جدیدتر نصب نمیشود.</string>
+    <string name="settings_allow_downgrades_picked">برنامه Let Me Downgrade نصب است، بنابراین Android ممکن است یک نسخه قدیمیتر را روی نسخه جدیدتر قرار دهد. Tern این کار را فقط برای انتشاری انجام میدهد که شما از تاریخچه یک برنامه انتخاب میکنید، هرگز در پسزمینه یا با «بهروزرسانی همه» انجام نمیدهد.</string>
+    <string name="option_highest_version">دریافت بالاترین نسخه، همانطور که Tern 0.1.0 انجام میداد</string>
+    <string name="option_highest_version_effect">پیوند دارای بالاترین نسخه در صفحه را ارائه میدهد، در هر کجای صفحه که باشد، و الگوی نسخه را روی نسخه خواندهشده از هر پیوند اجرا میکند. حالت خاموش، صفحه را همانطور که Obtainium میخواند، بررسی میکند: آخرین پیوند به ترتیب، جدیدترین است.</string>
+    <string name="settings_remove_uninstalled_keeps_pins">برنامهای که بیرون از Tern حذف میکنید، از لیست هم خارج میشود. برنامه بایگانیشده باقی میماند. اگر برنامه دوباره از همان مکان اضافه شود، به گواهیای که داشته مقید میماند؛ حذف آن در Tern باعث فراموشی این موضوع میشود.</string>
+    <string name="link_check_title">اکنون بهروزرسانی‌ها بررسی شوند؟</string>
+    <string name="link_check_one">پیوندی از Tern خواست تا بهروزرسانیهای %1$s را بررسی کند. از منبع آن پرسیده میشود، و هیچ چیزی نصب نمیشود.</string>
+    <plurals name="link_check_all">
+        <item quantity="one">پیوندی از Tern خواست تا بهروزرسانیهای %d برنامه در لیست شما را بررسی کند. از منبع آن پرسیده میشود، و هیچ چیزی نصب نمیشود.</item>
+        <item quantity="other">پیوندی از Tern خواست تا بهروزرسانیهای %d برنامه در لیست شما را بررسی کند. از منابع آنها پرسیده میشود، و هیچ چیزی نصب نمیشود.</item>
+    </plurals>
+    <string name="link_check_confirm">بررسی</string>
+    <string name="link_check_not_now">فعلاً نه</string>
+    <string name="engine_installer_fell_back">%1$s آماده نبود، بنابراین از نصبکننده Android برای این مورد استفاده شد.</string>
+    <string name="about_track_tern_fdroid_effect">این نسخه را F-Droid نصب کرده است، بنابراین Tern مدخل آن را در آنجا دنبال میکند: بهروزرسانیها همان نسخههایی هستند که F-Droid ساخته و بررسی کرده است، همانطور که برنامه F-Droid آنها را دریافت میکند.</string>
+    <string name="about_track_tern_github">در عوض، انتشارهای GitHub را دنبال کن</string>
+    <string name="about_track_tern_github_effect">بهروزرسانیها به محض انتشار از GitHub میآیند، پیش از آنکه F-Droid آنها را بسازد و بررسی کند. این کار بررسیهای F-Droid را نادیده میگیرد. Tern همچنان هر فایل را بررسی کرده و آن را به گواهی خودش مقید نگه میدارد.</string>
+</resources>
diff --git a/app/src/main/res/values-fa/strings_settings_more.xml b/app/src/main/res/values-fa/strings_settings_more.xml
index 5b373b99..1dd1e0e1 100644
--- a/app/src/main/res/values-fa/strings_settings_more.xml
+++ b/app/src/main/res/values-fa/strings_settings_more.xml
@@ -37,9 +37,7 @@
     <string name="settings_auto_installs">نصب خودکار به‌روزرسانی‌ها</string>
     <string name="settings_auto_installs_effect">برنامه‌هایی که برای به‌روزرسانی خودکار تنظیم شده‌اند، این کار را پس از یک بررسی در پس‌زمینه انجام می‌دهند. در حالت خاموش، فقط اعلام می‌کنند که به‌روزرسانی هست و هر کدام انتخاب خودش را برای بعد نگه می‌دارد.</string>
     <string name="settings_unmetered_installs">نصب فقط با Wi-Fi</string>
-    <string name="settings_unmetered_installs_effect">بررسی‌ها روی هر شبکه‌ای انجام می‌شوند. به‌روزرسانی‌ای که قرار بود خودکار نصب شود، منتظر Wi-Fi یا کابل شبکه می‌ماند، مانند Obtainium.</string>
     <string name="settings_charging_installs">نصب فقط هنگام شارژ</string>
-    <string name="settings_charging_installs_effect">بررسی‌ها روی باتری هم انجام می‌شوند. به‌روزرسانی‌ای که قرار بود خودکار نصب شود، منتظر می‌ماند تا دستگاه در حال شارژ باشد.</string>
     <string name="engine_unreadable_app">برنامه ذخیره‌شده %1$s خوانده نشد، بنابراین از لیست کنار گذاشته شد. چیزی حذف نشده است: ممکن است نسخه جدیدتر Tern بتواند آن را بخواند.</string>
     <string name="settings_pin_certificates">پین کردن گواهی‌های میزبان‌های کد</string>
     <string name="settings_pin_certificates_effect">GitHub، GitLab و Codeberg باید گواهی‌ای از مرجع صدور گواهی شناخته‌شده خود ارائه دهند، مانند Obtainium. گواهی‌ای که مرجعی دیگر مجبور به صدور آن شده باشد، در این حالت رد می‌شود. اگر یکی از میزبان‌های کد مرجع خود را عوض کند، تا وقتی این گزینه خاموش نشده، بررسی‌ها در آنجا ناموفق می‌شوند.</string>
diff --git a/app/src/main/res/values-fa/strings_sources_more.xml b/app/src/main/res/values-fa/strings_sources_more.xml
index 8221511f..f6c8959c 100644
--- a/app/src/main/res/values-fa/strings_sources_more.xml
+++ b/app/src/main/res/values-fa/strings_sources_more.xml
@@ -18,10 +18,7 @@
     <string name="step_arch">ترجیح پردازنده این دستگاه</string>
     <string name="step_add">افزودن یک صفحه</string>
     <string name="step_remove">حذف این صفحه</string>
-    <string name="option_file_version">استفاده از نام فایل به‌عنوان نسخه</string>
-    <string name="option_file_version_effect">در این صورت هر فایل یک انتشار جداگانه به حساب می‌آید.</string>
     <string name="github_proxy_title">GitHub از طریق hubproxy</string>
-    <string name="github_proxy_effect">هر درخواست به GitHub به این میزبان می‌رود و میزبان همه آن‌ها را می‌بیند. هیچ توکنی از طریق آن ارسال نمی‌شود، بنابراین پروژه‌های خصوصی و GitHub Actions را نمی‌توان از این راه دنبال کرد.</string>
     <string name="github_proxy_host">میزبان hubproxy</string>
     <string name="github_proxy_help">فقط نام میزبان، مانند gh-proxy.com. Tern از طریق HTTPS به آن دسترسی پیدا می‌کند.</string>
     <string name="github_proxy_invalid">این نام میزبانی نیست که Tern بتواند از آن استفاده کند</string>
diff --git a/app/src/main/res/values-fa/strings_starters.xml b/app/src/main/res/values-fa/strings_starters.xml
new file mode 100644
index 00000000..f432b467
--- /dev/null
+++ b/app/src/main/res/values-fa/strings_starters.xml
@@ -0,0 +1,7 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="starter_in_list">در لیست شما</string>
+    <string name="starter_on_phone">روی این گوشی</string>
+    <string name="starter_on_phone_other">روی این گوشی از امضاکننده دیگر</string>
+    <string name="starter_on_phone_other_explain">نسخه‌ای که دارید با کلید متفاوتی امضا شده است، بنابراین Tern نمی‌تواند آن را از این آدرس به‌روزرسانی کند.</string>
+</resources>
diff --git a/app/src/main/res/values-fa/strings_stores.xml b/app/src/main/res/values-fa/strings_stores.xml
new file mode 100644
index 00000000..133bfe8e
--- /dev/null
+++ b/app/src/main/res/values-fa/strings_stores.xml
@@ -0,0 +1,27 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="option_headers_help_own_agent">هر کدام در یک خط، به شکل Name: value. هرگز گذرواژه، کوکی یا User-Agent وارد نکنید: Tern به هر سایتی میگوید که Tern است.</string>
+    <string name="origin_republished_first">%1$s آنچه را که توسعهدهندگان در جای دیگری منتشر میکنند دوباره ارائه میدهد، و خودش توسعهدهنده نیست. تا زمانی که برنامه به یک گواهی پین شود، اولین فایلی که Tern از آن نصب میکند تعیین میکند که هر بهروزرسانی بعدی باید چه گواهیای داشته باشد.</string>
+    <string name="origin_republished_pinned">%1$s آنچه را که توسعهدهندگان در جای دیگری منتشر میکنند دوباره ارائه میدهد، و خودش توسعهدهنده نیست. فایلهای آن باید گواهیای را داشته باشند که این برنامه به آن پین شده است.</string>
+    <string name="origin_store_first">%1$s یک فروشگاه است، نه سایت خود توسعهدهنده. تا زمانی که برنامه به یک گواهی پین شود، اولین فایلی که Tern از آن نصب میکند تعیین میکند که هر بهروزرسانی بعدی باید چه گواهیای داشته باشد.</string>
+    <string name="origin_store_pinned">%1$s یک فروشگاه است، نه سایت خود توسعهدهنده. فایلهای آن باید گواهیای را داشته باشند که این برنامه به آن پین شده است.</string>
+    <string name="stores_refused_modified">Tern سایتهایی را که برنامههای دستکاریشده ارائه میدهند نمیخواند. فایلهای آنها توسط شخص دیگری غیر از توسعهدهنده تغییر کرده و توسط همان شخص تغییردهنده امضا شدهاند.</string>
+    <string name="stores_refused_impersonation">Tern نمیتواند این فروشگاه را بدون اینکه تظاهر کند برنامه آن است بخواند، بنابراین آن را نمیخواند.</string>
+    <string name="stores_checksum_source">%1$s، که توسعهدهنده نیست</string>
+    <string name="stores_off_title">%1$s یک فروشگاه شخص ثالث است</string>
+    <string name="stores_off_body">فروشگاههای شخص ثالث خاموش هستند. یک فروشگاه نسخههای خودش از برنامهها را ارائه میدهد، نه فایلها را از سایت خود توسعهدهنده، و Tern آن را از طریق رابطی که فروشگاه برای برنامه یا وبسایت خودش ساخته است میخواند. با روشن بودن آنها، Tern از یک فروشگاه فقط برنامههایی را میخواهد که شما از آن اضافه میکنید، و تا زمانی که یک برنامه به یک گواهی پین شود، اولین فایلی که Tern از یک فروشگاه نصب میکند تعیین میکند که بهروزرسانیهای آن باید چه گواهیای داشته باشند.</string>
+    <string name="stores_turn_on">فعال‌سازی فروشگاه‌های شخص ثالث</string>
+    <string name="stores_advice">برای بررسی دوباره این برنامه، فروشگاههای شخص ثالث را در تنظیمات روشن کنید.</string>
+    <string name="stores_status_paused">متوقف</string>
+    <string name="stores_row_paused">فروشگاههای شخص ثالث خاموش هستند</string>
+    <string name="stores_setting">فروشگاههای شخص ثالث</string>
+    <string name="stores_setting_effect">APKPure، Aptoide، APKCombo، APKMirror، Tencent، Huawei AppGallery، Galaxy Store و vivo. آنها نسخههای خودشان از برنامهها را ارائه میدهند، نه فایلها را از سایت خود توسعهدهنده، و Tern آنها را از طریق رابطهایی که برای برنامهها و وبسایتهای خود ساختهاند میخواند. در حالت خاموش، Tern هیچ چیزی از آنها نمیپرسد، جستجو آنها را کنار میگذارد و برنامههای آنها متوقف میشوند.</string>
+    <string name="stores_off_tag">خاموش در تنظیمات</string>
+    <string name="stores_checksum_matched">فایل با چکسام فروشگاه مطابقت دارد</string>
+    <string name="stores_explain_checksum_matched">چکسام یک اثر انگشت از خود فایل است. فروشگاه یکی را ارائه داد، و فایلی که Tern دانلود کرد همان را دارد، بنابراین همانطور که فروشگاه آن را دارد رسیده است. فروشگاه توسعهدهنده نیست، بنابراین این مورد هیچ چیزی درباره اینکه چه کسی فایل را ساخته است نمیگوید. گواهی این کار را میکند.</string>
+    <string name="stores_import_from_stores">اینها از فروشگاههای شخص ثالث میآیند، که نسخههای خودشان از برنامهها را ارائه میدهند. تا زمانی که یک برنامه به یک گواهی پین شود، اولین فایلی که Tern از فروشگاه آن نصب میکند تعیین میکند که بهروزرسانیهای آن باید چه گواهیای داشته باشند.</string>
+    <string name="stores_import_paused">فروشگاههای شخص ثالث خاموش هستند، بنابراین این برنامهها متوقف شدهاند. Tern تا زمانی که آنها را روشن نکنید چیزی از آن فروشگاهها نمیپرسد.</string>
+    <string name="stores_import_names">از فروشگاههای شخص ثالث</string>
+    <string name="share_obtainium_link">اشتراکگذاری بهعنوان پیوند Obtainium</string>
+    <string name="share_obtainium_links">اشتراکگذاری بهعنوان پیوندهای Obtainium</string>
+</resources>
diff --git a/app/src/main/res/values-fa/strings_tv.xml b/app/src/main/res/values-fa/strings_tv.xml
new file mode 100644
index 00000000..ed0ff946
--- /dev/null
+++ b/app/src/main/res/values-fa/strings_tv.xml
@@ -0,0 +1,5 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="interval_turn_off">غیرفعال‌سازی بررسی در پس‌زمینه</string>
+    <string name="interval_turn_on">فعال‌سازی بررسی در پس‌زمینه</string>
+</resources>
diff --git a/app/src/main/res/values-fr/strings.xml b/app/src/main/res/values-fr/strings.xml
index 1896e66c..fd2a7fcb 100644
--- a/app/src/main/res/values-fr/strings.xml
+++ b/app/src/main/res/values-fr/strings.xml
@@ -384,7 +384,6 @@
     <string name="settings_import_effect">Depuis une exportation de Tern ou d\'Obtainium</string>
     <string name="settings_export">Exporter des applis</string>
     <string name="settings_exporting">Exportation</string>
-    <string name="settings_export_effect">Enregistre votre liste et vos paramètres dans un fichier. Les jetons ne sont jamais inclus.</string>
     <plurals name="exported">
         <item quantity="one">%d appli exportée</item>
         <item quantity="many">%d applis exportées</item>
diff --git a/app/src/main/res/values-fr/strings_accept.xml b/app/src/main/res/values-fr/strings_accept.xml
new file mode 100644
index 00000000..afe69960
--- /dev/null
+++ b/app/src/main/res/values-fr/strings_accept.xml
@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="stores_paused_reason">Les boutiques tierces sont désactivées, donc Tern ne demande rien à cette boutique. Activez-les dans les paramètres pour la vérifier à nouveau.</string>
+</resources>
diff --git a/app/src/main/res/values-fr/strings_checks.xml b/app/src/main/res/values-fr/strings_checks.xml
index d4589953..bad42c63 100644
--- a/app/src/main/res/values-fr/strings_checks.xml
+++ b/app/src/main/res/values-fr/strings_checks.xml
@@ -19,13 +19,11 @@
     <string name="settings_only_installed">Ne vérifier que les applis installées</string>
     <string name="settings_only_installed_effect">Les applis uniquement suivies sont aussi vérifiées. Une appli que vous ouvrez est toujours vérifiée.</string>
     <string name="settings_remove_uninstalled">Supprimer les applis désinstallées ailleurs</string>
-    <string name="settings_remove_uninstalled_effect">Une appli que vous désinstallez en dehors de Tern quitte aussi la liste.</string>
     <string name="settings_file_filter">Filtre de fichiers</string>
     <string name="settings_file_filter_effect">Un modèle selon lequel chaque appli sans filtre propre choisit son fichier.</string>
     <string name="settings_file_filter_none">Aucun</string>
     <string name="settings_file_filter_invalid">Ce modèle ne peut pas être lu.</string>
     <string name="settings_allow_downgrades">Autoriser les versions plus anciennes</string>
-    <string name="settings_allow_downgrades_effect">Let Me Downgrade est installé, Android peut donc installer une version plus ancienne par-dessus une plus récente.</string>
     <string name="settings_collapse_groups">Commencer avec les groupes repliés</string>
     <string name="settings_haptics">Retour haptique</string>
     <string name="settings_haptics_effect">Une légère vibration quand un balayage ou un appui long déclenche une action.</string>
@@ -40,7 +38,6 @@
     <string name="sources_repositories">Dépôts</string>
     <string name="sources_stores">Boutiques</string>
     <string name="sources_mirrors">Boutiques qui republient des applis</string>
-    <string name="sources_modified">Sites d\'applis modifiées</string>
     <string name="sources_other">Autres endroits</string>
     <string name="sources_web_page">Une page web avec des liens vers des fichiers</string>
     <string name="sources_direct">Un lien direct vers un fichier</string>
@@ -50,8 +47,6 @@
     <string name="shared_configs_title">Configurations partagées par les utilisateurs d\'Obtainium</string>
     <string name="shared_configs_effect">Un site de paramètres prêts à l\'emploi pour les applis. Ses liens s\'ouvrent dans Tern quand Ouvrir les liens Obtainium est activé dans les Paramètres.</string>
     <string name="engine_inner_filter_nothing">Le filtre des fichiers dans les archives ne correspond à aucun des APK de celle-ci.</string>
-    <string name="preview_republished">%1$s propose à nouveau ce que les développeurs publient ailleurs. Tern exige que ses fichiers portent le certificat du développeur dès qu\'il le connaît, donc épinglez-en un ou installez d\'abord depuis le développeur quand vous le pouvez.</string>
-    <string name="preview_modified">%1$s propose des applis modifiées par quelqu\'un d\'autre que leur développeur. Elles sont signées par la personne qui les a modifiées, et Tern ne peut pas savoir ce qui a été modifié.</string>
     <string name="about_track_tern">Garder Tern lui-même à jour</string>
     <string name="about_track_tern_effect">Ajoute les propres versions de Tern à la liste, vérifiées et contrôlées comme n\'importe quelle appli.</string>
     <string name="engine_channel_tracked">Nouvelles versions des applis suivies</string>
diff --git a/app/src/main/res/values-fr/strings_options.xml b/app/src/main/res/values-fr/strings_options.xml
index 028a1079..53efa9e2 100644
--- a/app/src/main/res/values-fr/strings_options.xml
+++ b/app/src/main/res/values-fr/strings_options.xml
@@ -64,10 +64,6 @@
     <string name="option_workflow">Fichier de workflow</string>
     <string name="option_workflow_help">Comme build.yml.</string>
     <string name="option_branch">Branche</string>
-    <string name="option_device_model">Modèle d\'appareil</string>
-    <string name="option_device_model_help">Le Galaxy Store fournit à chaque modèle sa propre version, comme SM-S948B.</string>
-    <string name="option_csc">Code de région (CSC)</string>
-    <string name="option_csc_help">Trois lettres, comme DBT.</string>
     <string name="option_link_filter">Filtre des liens de téléchargement</string>
     <string name="option_link_filter_help">Seuls les liens qui correspondent comptent comme téléchargements.</string>
     <string name="option_page_order">Garder l\'ordre de la page</string>
@@ -78,11 +74,14 @@
     <string name="version_from_text">Le texte du lien</string>
     <string name="version_from_page">Toute la page</string>
     <string name="option_headers">En-têtes de requête</string>
-    <string name="option_headers_help">Un par ligne, sous la forme Name: value. Jamais un mot de passe ou un cookie.</string>
     <string name="option_pseudo">Quand il n\'y a pas de version</string>
     <string name="pseudo_default">Distinguer les fichiers comme le fait le serveur</string>
     <string name="pseudo_hash">Par un hachage du début du fichier</string>
     <string name="pseudo_link">Par l\'adresse du fichier</string>
     <string name="pseudo_etag">Par l\'ETag du serveur</string>
     <string name="option_invalid">Ceci ne peut pas être utilisé tel quel.</string>
+    <string name="option_device_model">Modèle d\'appareil</string>
+    <string name="option_device_model_help">Le Galaxy Store fournit à chaque modèle sa propre version, comme SM-S948B.</string>
+    <string name="option_csc">Code de région (CSC)</string>
+    <string name="option_csc_help">Trois lettres, comme DBT.</string>
 </resources>
diff --git a/app/src/main/res/values-fr/strings_safety.xml b/app/src/main/res/values-fr/strings_safety.xml
new file mode 100644
index 00000000..cdc9e548
--- /dev/null
+++ b/app/src/main/res/values-fr/strings_safety.xml
@@ -0,0 +1,30 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="settings_export_effect_plain">Enregistre votre liste et vos paramètres dans un fichier. Les jetons n\'y vont jamais, pas plus qu\'un en-tête de requête qui pourrait contenir une clé.</string>
+    <string name="engine_checksum_github_proxy">Condensé de la version GitHub, tel que le hubproxy %1$s l\'a transmis</string>
+    <string name="github_proxy_effect_trust">Chaque requête vers GitHub va vers cet hôte. Il voit chacune d\'elles et peut modifier ce qui revient : les versions, leurs condensés et les fichiers. Les applis que vous avez restent tenues à leur certificat, mais une première installation par ce biais fait autant confiance au hubproxy qu\'à GitHub, et l\'épinglage de certificat ne l\'atteint pas. Aucun jeton n\'est envoyé par son intermédiaire, les projets privés et les GitHub Actions ne peuvent donc pas être suivis de cette façon.</string>
+    <string name="settings_unmetered_checks">Vérifier uniquement en Wi-Fi</string>
+    <string name="settings_unmetered_checks_effect">Les vérifications en arrière-plan attendent le Wi-Fi ou un câble, elles n\'utilisent donc pas de données mobiles.</string>
+    <string name="settings_charging_checks">Vérifier uniquement en charge</string>
+    <string name="settings_charging_checks_effect">Les vérifications en arrière-plan attendent que l\'appareil soit en charge.</string>
+    <string name="settings_unmetered_installs_wait">Une mise à jour qui s\'installerait d\'elle-même attend le Wi-Fi ou un câble, comme dans Obtainium.</string>
+    <string name="settings_charging_installs_wait">Une mise à jour qui s\'installerait d\'elle-même attend que l\'appareil soit en charge.</string>
+    <string name="engine_downgrade_not_as_named">La source indiquait le code de version %2$d, mais ce fichier est %1$d, plus ancien que celui installé. Il n\'est pas placé par-dessus le plus récent.</string>
+    <string name="settings_allow_downgrades_picked">Let Me Downgrade est installé, Android peut donc placer une version plus ancienne sur une plus récente. Tern ne le fait que pour une version que vous choisissez dans l\'historique d\'une appli, jamais en arrière-plan ou avec Tout mettre à jour.</string>
+    <string name="option_highest_version">Prendre la version la plus élevée, comme le faisait Tern 0.1.0</string>
+    <string name="option_highest_version_effect">Propose le lien avec la version la plus élevée sur la page, quelle que soit sa place, et applique le modèle de version sur la version lue depuis chaque lien. Désactivé lit la page comme le fait Obtainium : le dernier lien dans l\'ordre est le plus récent.</string>
+    <string name="settings_remove_uninstalled_keeps_pins">Une appli que vous désinstallez en dehors de Tern quitte également la liste. Une appli archivée reste. Ajoutée de nouveau depuis le même endroit, une appli est tenue au certificat qu\'elle avait ; la retirer dans Tern oublie cela.</string>
+    <string name="link_check_title">Vérifier les mises à jour maintenant ?</string>
+    <string name="link_check_one">Un lien a demandé à Tern de vérifier les mises à jour de %1$s. Sa source est interrogée, et rien n\'est installé.</string>
+    <plurals name="link_check_all">
+        <item quantity="one">Un lien a demandé à Tern de vérifier les mises à jour pour %d appli de votre liste. Sa source est interrogée, et rien n\'est installé.</item>
+        <item quantity="many">Un lien a demandé à Tern de vérifier les mises à jour des %d applis de votre liste. Leurs sources sont interrogées, et rien n\'est installé.</item>
+        <item quantity="other">Un lien a demandé à Tern de vérifier les mises à jour des %d applis de votre liste. Leurs sources sont interrogées, et rien n\'est installé.</item>
+    </plurals>
+    <string name="link_check_confirm">Vérifier</string>
+    <string name="link_check_not_now">Pas maintenant</string>
+    <string name="engine_installer_fell_back">%1$s n\'était pas prêt, l\'installateur d\'Android a donc été utilisé pour celui-ci.</string>
+    <string name="about_track_tern_fdroid_effect">F-Droid a installé cette copie, Tern suit donc son entrée là-bas : les mises à jour sont les versions que F-Droid a compilées et vérifiées, telles que l\'appli F-Droid les obtient.</string>
+    <string name="about_track_tern_github">Suivre plutôt les versions de GitHub</string>
+    <string name="about_track_tern_github_effect">Les mises à jour proviennent de GitHub dès qu\'elles sont publiées, avant que F-Droid ne les ait compilées et vérifiées. Cela contourne les vérifications de F-Droid. Tern vérifie toujours chaque fichier et le tient à son propre certificat.</string>
+</resources>
diff --git a/app/src/main/res/values-fr/strings_settings_more.xml b/app/src/main/res/values-fr/strings_settings_more.xml
index 473ed1d9..d5df73f3 100644
--- a/app/src/main/res/values-fr/strings_settings_more.xml
+++ b/app/src/main/res/values-fr/strings_settings_more.xml
@@ -38,9 +38,7 @@
     <string name="settings_auto_installs">Les mises à jour s\'installent automatiquement</string>
     <string name="settings_auto_installs_effect">Les applis réglées pour se mettre à jour automatiquement le font après une vérification en arrière-plan. Désactivé, elles indiquent seulement qu\'une mise à jour est disponible, et chacune garde son propre choix pour plus tard.</string>
     <string name="settings_unmetered_installs">Installer uniquement en Wi-Fi</string>
-    <string name="settings_unmetered_installs_effect">Les vérifications s\'effectuent sur n\'importe quel réseau. Une mise à jour qui s\'installerait automatiquement attend le Wi-Fi ou un câble, comme dans Obtainium.</string>
     <string name="settings_charging_installs">Installer uniquement pendant la charge</string>
-    <string name="settings_charging_installs_effect">Les vérifications s\'effectuent aussi sur batterie. Une mise à jour qui s\'installerait automatiquement attend que l\'appareil soit en charge.</string>
     <string name="engine_unreadable_app">L\'appli enregistrée %1$s n\'a pas pu être lue, elle est donc omise de la liste. Rien n\'a été supprimé : une version plus récente de Tern pourrait la lire.</string>
     <string name="settings_pin_certificates">Épingler les certificats des forges</string>
     <string name="settings_pin_certificates_effect">GitHub, GitLab et Codeberg doivent présenter un certificat de l\'autorité que chacun est connu pour utiliser, comme dans Obtainium. Un certificat qu\'une autre autorité a été amenée à émettre est alors refusé. Si une forge change d\'autorité, les vérifications y échouent tant que ce réglage n\'est pas désactivé.</string>
diff --git a/app/src/main/res/values-fr/strings_sources_more.xml b/app/src/main/res/values-fr/strings_sources_more.xml
index ba8dfe62..e70d61ec 100644
--- a/app/src/main/res/values-fr/strings_sources_more.xml
+++ b/app/src/main/res/values-fr/strings_sources_more.xml
@@ -18,10 +18,7 @@
     <string name="step_arch">Préférer le processeur de cet appareil</string>
     <string name="step_add">Ajouter une page</string>
     <string name="step_remove">Supprimer cette page</string>
-    <string name="option_file_version">Utiliser le nom du fichier comme version</string>
-    <string name="option_file_version_effect">Chaque fichier compte alors comme une version à part.</string>
     <string name="github_proxy_title">GitHub via un hubproxy</string>
-    <string name="github_proxy_effect">Chaque requête vers GitHub est envoyée à cet hôte, qui les voit toutes. Aucun jeton n\'est envoyé par ce biais, donc les projets privés et GitHub Actions ne peuvent pas être suivis ainsi.</string>
     <string name="github_proxy_host">Hôte du hubproxy</string>
     <string name="github_proxy_help">Un nom d\'hôte seul, comme gh-proxy.com. Tern s\'y connecte en HTTPS.</string>
     <string name="github_proxy_invalid">Ce n\'est pas un nom d\'hôte que Tern peut utiliser</string>
diff --git a/app/src/main/res/values-fr/strings_starters.xml b/app/src/main/res/values-fr/strings_starters.xml
new file mode 100644
index 00000000..b1764355
--- /dev/null
+++ b/app/src/main/res/values-fr/strings_starters.xml
@@ -0,0 +1,7 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="starter_in_list">Dans votre liste</string>
+    <string name="starter_on_phone">Sur ce téléphone</string>
+    <string name="starter_on_phone_other">Sur ce téléphone par un autre signataire</string>
+    <string name="starter_on_phone_other_explain">La copie que vous avez est signée avec une clé différente, Tern ne peut donc pas la mettre à jour depuis cette adresse.</string>
+</resources>
diff --git a/app/src/main/res/values-fr/strings_stores.xml b/app/src/main/res/values-fr/strings_stores.xml
new file mode 100644
index 00000000..bd8ffdc7
--- /dev/null
+++ b/app/src/main/res/values-fr/strings_stores.xml
@@ -0,0 +1,27 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="option_headers_help_own_agent">Un par ligne, sous la forme Nom: valeur. Jamais de mot de passe, de cookie ou de User-Agent : Tern indique à chaque site qu\'il est Tern.</string>
+    <string name="origin_republished_first">%1$s propose à nouveau ce que les développeurs publient ailleurs, et n\'est pas le développeur. Tant que l\'appli n\'est pas épinglée à un certificat, le premier fichier que Tern installe à partir d\'elle décide quel certificat chaque mise à jour ultérieure doit porter.</string>
+    <string name="origin_republished_pinned">%1$s propose à nouveau ce que les développeurs publient ailleurs, et n\'est pas le développeur. Ses fichiers doivent porter le certificat auquel cette appli est tenue.</string>
+    <string name="origin_store_first">%1$s est une boutique, pas le propre site du développeur. Tant que l\'appli n\'est pas épinglée à un certificat, le premier fichier que Tern installe à partir d\'elle décide quel certificat chaque mise à jour ultérieure doit porter.</string>
+    <string name="origin_store_pinned">%1$s est une boutique, pas le propre site du développeur. Ses fichiers doivent porter le certificat auquel cette appli est tenue.</string>
+    <string name="stores_refused_modified">Tern ne lit pas les sites qui proposent des applis modifiées. Leurs fichiers sont modifiés par quelqu\'un d\'autre que le développeur et signés par celui qui les a modifiés.</string>
+    <string name="stores_refused_impersonation">Tern ne peut pas lire cette boutique sans se faire passer pour son appli, il ne la lit donc pas.</string>
+    <string name="stores_checksum_source">%1$s, qui n\'est pas le développeur</string>
+    <string name="stores_off_title">%1$s est une boutique tierce</string>
+    <string name="stores_off_body">Les boutiques tierces sont désactivées. Une boutique sert ses propres copies d\'applis, pas les fichiers du propre site du développeur, et Tern la lit via l\'interface que la boutique a créée pour sa propre appli ou son site web. Lorsqu\'elles sont activées, Tern interroge une boutique uniquement pour les applis que vous en ajoutez, et tant qu\'une appli n\'est pas épinglée à un certificat, le premier fichier que Tern installe depuis une boutique décide quel certificat ses mises à jour doivent porter.</string>
+    <string name="stores_turn_on">Activer les boutiques tierces</string>
+    <string name="stores_advice">Activez les boutiques tierces dans les paramètres pour vérifier cette appli à nouveau.</string>
+    <string name="stores_status_paused">En pause</string>
+    <string name="stores_row_paused">Boutiques tierces désactivées</string>
+    <string name="stores_setting">Boutiques tierces</string>
+    <string name="stores_setting_effect">APKPure, Aptoide, APKCombo, APKMirror, Tencent, Huawei AppGallery, le Galaxy Store et vivo. Ils servent leurs propres copies d\'applis, pas les fichiers du propre site du développeur, et Tern les lit via les interfaces qu\'ils ont créées pour leurs propres applis et sites web. Désactivé, Tern ne leur demande rien, une recherche les ignore et les applis qui en proviennent sont en pause.</string>
+    <string name="stores_off_tag">désactivé dans les paramètres</string>
+    <string name="stores_checksum_matched">Le fichier correspond à la somme de contrôle de la boutique</string>
+    <string name="stores_explain_checksum_matched">Une somme de contrôle est une empreinte du fichier lui-même. La boutique en a fourni une, et le fichier que Tern a téléchargé a la même, il est donc arrivé tel que la boutique l\'a. La boutique n\'est pas le développeur, cela ne dit donc rien sur qui a créé le fichier. Le certificat le dit.</string>
+    <string name="stores_import_from_stores">Celles-ci proviennent de boutiques tierces, qui servent leurs propres copies d\'applis. Tant qu\'une appli n\'est pas épinglée à un certificat, le premier fichier que Tern installe depuis sa boutique décide quel certificat ses mises à jour doivent porter.</string>
+    <string name="stores_import_paused">Les boutiques tierces sont désactivées, ces applis sont donc en pause. Tern ne demande rien à ces boutiques jusqu\'à ce que vous les activiez.</string>
+    <string name="stores_import_names">Depuis des boutiques tierces</string>
+    <string name="share_obtainium_link">Partager comme lien Obtainium</string>
+    <string name="share_obtainium_links">Partager comme liens Obtainium</string>
+</resources>
diff --git a/app/src/main/res/values-fr/strings_tv.xml b/app/src/main/res/values-fr/strings_tv.xml
new file mode 100644
index 00000000..710110f2
--- /dev/null
+++ b/app/src/main/res/values-fr/strings_tv.xml
@@ -0,0 +1,5 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="interval_turn_off">Désactiver les vérifications en arrière-plan</string>
+    <string name="interval_turn_on">Activer les vérifications en arrière-plan</string>
+</resources>
diff --git a/app/src/main/res/values-gl/strings.xml b/app/src/main/res/values-gl/strings.xml
index 6c3d35b3..07a2716e 100644
--- a/app/src/main/res/values-gl/strings.xml
+++ b/app/src/main/res/values-gl/strings.xml
@@ -369,7 +369,6 @@
     <string name="settings_import_effect">Dunha exportación de Tern ou Obtainium</string>
     <string name="settings_export">Exportar aplicacións</string>
     <string name="settings_exporting">Exportando</string>
-    <string name="settings_export_effect">Garda a túa lista e axustes nun ficheiro. Os tokens nunca se inclúen.</string>
     <plurals name="exported">
         <item quantity="one">Exportouse %d aplicación</item>
         <item quantity="other">Exportáronse %d aplicacións</item>
diff --git a/app/src/main/res/values-gl/strings_accept.xml b/app/src/main/res/values-gl/strings_accept.xml
new file mode 100644
index 00000000..be018565
--- /dev/null
+++ b/app/src/main/res/values-gl/strings_accept.xml
@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="stores_paused_reason">As tendas de terceiros están desactivadas, polo que Tern non lle pide nada a esta tenda. Actívaas en Axustes para comprobala de novo.</string>
+</resources>
diff --git a/app/src/main/res/values-gl/strings_checks.xml b/app/src/main/res/values-gl/strings_checks.xml
index 531b1b71..1ad1fd94 100644
--- a/app/src/main/res/values-gl/strings_checks.xml
+++ b/app/src/main/res/values-gl/strings_checks.xml
@@ -17,13 +17,11 @@
     <string name="settings_only_installed">Comprobar só as aplicacións instaladas</string>
     <string name="settings_only_installed_effect">As aplicacións que só se seguen tamén se comproban. Unha aplicación que abras compróbase sempre.</string>
     <string name="settings_remove_uninstalled">Eliminar as aplicacións desinstaladas fóra de Tern</string>
-    <string name="settings_remove_uninstalled_effect">Unha aplicación que desinstales fóra de Tern tamén sae da lista.</string>
     <string name="settings_file_filter">Filtro de ficheiros</string>
     <string name="settings_file_filter_effect">Un patrón co que cada aplicación sen filtro propio escolle o seu ficheiro.</string>
     <string name="settings_file_filter_none">Ningún</string>
     <string name="settings_file_filter_invalid">Este patrón non se pode ler.</string>
     <string name="settings_allow_downgrades">Permitir versións máis antigas</string>
-    <string name="settings_allow_downgrades_effect">Let Me Downgrade está instalado, polo que Android pode poñer unha versión máis antiga sobre unha máis nova.</string>
     <string name="settings_collapse_groups">Comezar cos grupos pregados</string>
     <string name="settings_haptics">Resposta háptica</string>
     <string name="settings_haptics_effect">Unha vibración lixeira cando un deslizamento ou unha pulsación longa fai algo.</string>
@@ -38,7 +36,6 @@
     <string name="sources_repositories">Repositorios</string>
     <string name="sources_stores">Tendas</string>
     <string name="sources_mirrors">Tendas que volven publicar aplicacións</string>
-    <string name="sources_modified">Sitios con aplicacións modificadas</string>
     <string name="sources_other">Outros lugares</string>
     <string name="sources_web_page">Unha páxina web con ligazóns a ficheiros</string>
     <string name="sources_direct">Unha ligazón directa a un ficheiro</string>
@@ -48,8 +45,6 @@
     <string name="shared_configs_title">Configuracións compartidas polos usuarios de Obtainium</string>
     <string name="shared_configs_effect">Un sitio con axustes xa preparados para aplicacións. As súas ligazóns ábrense en Tern cando Abrir ligazóns de Obtainium está activado en Axustes.</string>
     <string name="engine_inner_filter_nothing">O filtro de ficheiros dentro de arquivos non coincide con ningún dos APK deste.</string>
-    <string name="preview_republished">%1$s volve ofrecer o que os desenvolvedores publican noutros sitios. Tern esixe aos seus ficheiros o certificado do desenvolvedor en canto o coñece, así que fixa un ou instala primeiro desde o desenvolvedor cando poidas.</string>
-    <string name="preview_modified">%1$s ofrece aplicacións modificadas por alguén distinto do seu desenvolvedor. Están asinadas por quen as modificou, e Tern non pode saber que se cambiou.</string>
     <string name="about_track_tern">Manter o propio Tern ao día</string>
     <string name="about_track_tern_effect">Engade os lanzamentos de Tern á lista, comprobados e verificados coma calquera aplicación.</string>
     <string name="engine_channel_tracked">Novos lanzamentos das aplicacións seguidas</string>
diff --git a/app/src/main/res/values-gl/strings_options.xml b/app/src/main/res/values-gl/strings_options.xml
index dcfe6f35..59c00915 100644
--- a/app/src/main/res/values-gl/strings_options.xml
+++ b/app/src/main/res/values-gl/strings_options.xml
@@ -62,10 +62,6 @@
     <string name="option_workflow">Ficheiro de fluxo de traballo</string>
     <string name="option_workflow_help">Como build.yml.</string>
     <string name="option_branch">Rama</string>
-    <string name="option_device_model">Modelo do dispositivo</string>
-    <string name="option_device_model_help">Galaxy Store dálle a cada modelo a súa propia compilación, como SM-S948B.</string>
-    <string name="option_csc">Código de rexión (CSC)</string>
-    <string name="option_csc_help">Tres letras, como DBT.</string>
     <string name="option_link_filter">Filtro de ligazóns de descarga</string>
     <string name="option_link_filter_help">Só as ligazóns que coinciden contan como descargas.</string>
     <string name="option_page_order">Manter a orde da páxina</string>
@@ -76,11 +72,14 @@
     <string name="version_from_text">O texto da ligazón</string>
     <string name="version_from_page">Toda a páxina</string>
     <string name="option_headers">Cabeceiras da solicitude</string>
-    <string name="option_headers_help">Unha por liña, como Name: value. Nunca un contrasinal nin unha cookie.</string>
     <string name="option_pseudo">Cando non hai versión</string>
     <string name="pseudo_default">Distinguir os ficheiros como o fai o servidor</string>
     <string name="pseudo_hash">Por un hash do inicio do ficheiro</string>
     <string name="pseudo_link">Polo enderezo do ficheiro</string>
     <string name="pseudo_etag">Polo ETag do servidor</string>
     <string name="option_invalid">Isto non se pode usar tal e como está.</string>
+    <string name="option_device_model">Modelo do dispositivo</string>
+    <string name="option_device_model_help">Galaxy Store dálle a cada modelo a súa propia compilación, como SM-S948B.</string>
+    <string name="option_csc">Código de rexión (CSC)</string>
+    <string name="option_csc_help">Tres letras, como DBT.</string>
 </resources>
diff --git a/app/src/main/res/values-gl/strings_safety.xml b/app/src/main/res/values-gl/strings_safety.xml
new file mode 100644
index 00000000..7f70d21e
--- /dev/null
+++ b/app/src/main/res/values-gl/strings_safety.xml
@@ -0,0 +1,29 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="settings_export_effect_plain">Garda a túa lista e axustes nun ficheiro. Os tokens nunca se inclúen, tampouco unha cabeceira de solicitude que poida conter unha chave.</string>
+    <string name="engine_checksum_github_proxy">Resumo criptográfico do lanzamento de GitHub, tal e como o pasou o hubproxy %1$s</string>
+    <string name="github_proxy_effect_trust">Cada solicitude a GitHub vai a este servidor. Ve cada unha e pode cambiar o que devolve: os lanzamentos, as súas sumas de comprobación e os ficheiros. As aplicacións que tes seguen fixadas ao seu certificado, pero unha primeira instalación a través del confía no hubproxy tanto como en GitHub, e a fixación de certificados non o alcanza. Non se envía ningún token a través del, polo que os proxectos privados e GitHub Actions non se poden seguir deste xeito.</string>
+    <string name="settings_unmetered_checks">Comprobar só con Wi-Fi</string>
+    <string name="settings_unmetered_checks_effect">As comprobacións en segundo plano agardan polo Wi-Fi ou un cable, polo que non usan datos móbiles.</string>
+    <string name="settings_charging_checks">Comprobar só mentres se carga</string>
+    <string name="settings_charging_checks_effect">As comprobacións en segundo plano agardan ata que o dispositivo se estea cargando.</string>
+    <string name="settings_unmetered_installs_wait">Unha actualización que se instalaría soa agarda polo Wi-Fi ou un cable, como en Obtainium.</string>
+    <string name="settings_charging_installs_wait">Unha actualización que se instalaría soa agarda ata que o dispositivo se cargue.</string>
+    <string name="engine_downgrade_not_as_named">A orixe nomeou o código de versión %2$d, pero este ficheiro é o %1$d, máis antigo ca o instalado. Non se pon sobre o máis novo.</string>
+    <string name="settings_allow_downgrades_picked">Let Me Downgrade está instalada, polo que Android pode poñer unha versión máis antiga sobre unha máis nova. Tern faio só para un lanzamento que escollas do historial dunha aplicación, nunca en segundo plano nin con Actualizar todo.</string>
+    <string name="option_highest_version">Tomar a versión máis alta, como facía Tern 0.1.0</string>
+    <string name="option_highest_version_effect">Ofrece a ligazón coa versión máis alta da páxina, calquera que sexa o seu lugar, e executa o patrón de versión sobre a versión lida de cada ligazón. Desactivado, le a páxina do xeito que o fai Obtainium: a última ligazón na orde é a máis recente.</string>
+    <string name="settings_remove_uninstalled_keeps_pins">Unha aplicación que desinstalas fóra de Tern tamén sae da lista. Unha aplicación arquivada mantense. Se se engade de novo desde o mesmo lugar, a aplicación mantense fixada ao certificado que tiña; eliminala en Tern esquece iso.</string>
+    <string name="link_check_title">Comprobar actualizacións agora?</string>
+    <string name="link_check_one">Unha ligazón pediulle a Tern que comprobe as actualizacións de %1$s. Pregúntaselle á súa orixe e non se instala nada.</string>
+    <plurals name="link_check_all">
+        <item quantity="one">Unha ligazón pediulle a Tern que comprobe as actualizacións de %d aplicación da túa lista. Pregúntaselle á súa orixe e non se instala nada.</item>
+        <item quantity="other">Unha ligazón pediulle a Tern que comprobe as actualizacións de %d aplicacións da túa lista. Pregúntaselle ás súas orixes e non se instala nada.</item>
+    </plurals>
+    <string name="link_check_confirm">Comprobar</string>
+    <string name="link_check_not_now">Agora non</string>
+    <string name="engine_installer_fell_back">%1$s non estaba listo, polo que se usou o instalador de Android para este.</string>
+    <string name="about_track_tern_fdroid_effect">F-Droid instalou esta copia, polo que Tern segue a súa entrada alí: as actualizacións son as versións que F-Droid fixo e comprobou, tal e como as obtén a aplicación F-Droid.</string>
+    <string name="about_track_tern_github">Seguir os lanzamentos de GitHub no seu lugar</string>
+    <string name="about_track_tern_github_effect">As actualizacións veñen de GitHub tan pronto como se publican, antes de que F-Droid as constrúa e comprobe. Isto omite as comprobacións de F-Droid. Tern segue comprobando cada ficheiro e manteno fixado ao seu propio certificado.</string>
+</resources>
diff --git a/app/src/main/res/values-gl/strings_settings_more.xml b/app/src/main/res/values-gl/strings_settings_more.xml
index 8af5c2f3..814a25d7 100644
--- a/app/src/main/res/values-gl/strings_settings_more.xml
+++ b/app/src/main/res/values-gl/strings_settings_more.xml
@@ -37,9 +37,7 @@
     <string name="settings_auto_installs">As actualizacións instálanse por si soas</string>
     <string name="settings_auto_installs_effect">As aplicacións configuradas para actualizarse por si soas fano despois dunha comprobación en segundo plano. Se está desactivado, só avisan de que hai unha actualización, e cada unha conserva a súa propia escolla para máis adiante.</string>
     <string name="settings_unmetered_installs">Instalar só con wifi</string>
-    <string name="settings_unmetered_installs_effect">As comprobacións execútanse en calquera rede. Unha actualización que se instalaría por si soa agarda pola wifi ou por un cable, como en Obtainium.</string>
     <string name="settings_charging_installs">Instalar só mentres se carga</string>
-    <string name="settings_charging_installs_effect">As comprobacións execútanse tamén coa batería. Unha actualización que se instalaría por si soa agarda ata que o dispositivo estea cargando.</string>
     <string name="engine_unreadable_app">Non se puido ler a aplicación gardada %1$s, así que se deixa fóra da lista. Non se eliminou nada: unha versión máis nova de Tern podería lela.</string>
     <string name="settings_pin_certificates">Fixar os certificados das forxas</string>
     <string name="settings_pin_certificates_effect">GitHub, GitLab e Codeberg deben presentar un certificado da autoridade que se sabe que usa cada un, como en Obtainium. Un certificado que outra autoridade foi obrigada a emitir rexéitase entón. Se unha forxa cambia de autoridade, as comprobacións alí fallan ata que isto se desactive.</string>
diff --git a/app/src/main/res/values-gl/strings_sources_more.xml b/app/src/main/res/values-gl/strings_sources_more.xml
index c3cf25b7..28f0cc52 100644
--- a/app/src/main/res/values-gl/strings_sources_more.xml
+++ b/app/src/main/res/values-gl/strings_sources_more.xml
@@ -18,10 +18,7 @@
     <string name="step_arch">Preferir o procesador deste dispositivo</string>
     <string name="step_add">Engadir unha páxina</string>
     <string name="step_remove">Eliminar esta páxina</string>
-    <string name="option_file_version">Usar o nome do ficheiro como versión</string>
-    <string name="option_file_version_effect">Entón cada ficheiro conta como un lanzamento propio.</string>
     <string name="github_proxy_title">GitHub a través dun hubproxy</string>
-    <string name="github_proxy_effect">Cada solicitude a GitHub vai a este servidor, que as ve todas. Non se envía ningún token a través del, polo que os proxectos privados e GitHub Actions non se poden seguir deste xeito.</string>
     <string name="github_proxy_host">Servidor do hubproxy</string>
     <string name="github_proxy_help">Só un nome de servidor, como gh-proxy.com. Tern conéctase con el por HTTPS.</string>
     <string name="github_proxy_invalid">Ese non é un nome de servidor que Tern poida usar</string>
diff --git a/app/src/main/res/values-gl/strings_starters.xml b/app/src/main/res/values-gl/strings_starters.xml
new file mode 100644
index 00000000..18e2139a
--- /dev/null
+++ b/app/src/main/res/values-gl/strings_starters.xml
@@ -0,0 +1,7 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="starter_in_list">Na túa lista</string>
+    <string name="starter_on_phone">Neste teléfono</string>
+    <string name="starter_on_phone_other">Neste teléfono doutro asinante</string>
+    <string name="starter_on_phone_other_explain">A copia que tes está asinada cunha clave diferente, polo que Tern non pode actualizala desde este enderezo.</string>
+</resources>
diff --git a/app/src/main/res/values-gl/strings_stores.xml b/app/src/main/res/values-gl/strings_stores.xml
new file mode 100644
index 00000000..1bb95c55
--- /dev/null
+++ b/app/src/main/res/values-gl/strings_stores.xml
@@ -0,0 +1,27 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="option_headers_help_own_agent">Unha por liña, como Nome: valor. Nunca un contrasinal, unha cookie ou un User-Agent: Tern dille a cada sitio que é Tern.</string>
+    <string name="origin_republished_first">%1$s volve ofrecer o que os desenvolvedores publican noutros lugares, e non é o desenvolvedor. Ata que a aplicación se fixa a un certificado, o primeiro ficheiro que Tern instala dela decide que certificado debe levar cada actualización posterior.</string>
+    <string name="origin_republished_pinned">%1$s volve ofrecer o que os desenvolvedores publican noutros lugares, e non é o desenvolvedor. Os seus ficheiros deben levar o certificado ao que esta aplicación está fixada.</string>
+    <string name="origin_store_first">%1$s é unha tenda, non o propio sitio do desenvolvedor. Ata que a aplicación se fixa a un certificado, o primeiro ficheiro que Tern instala dela decide que certificado debe levar cada actualización posterior.</string>
+    <string name="origin_store_pinned">%1$s é unha tenda, non o propio sitio do desenvolvedor. Os seus ficheiros deben levar o certificado ao que esta aplicación está fixada.</string>
+    <string name="stores_refused_modified">Tern non le sitios que ofrecen aplicacións modificadas. Os seus ficheiros foron cambiados por alguén distinto ao desenvolvedor e asinados por quen os cambiou.</string>
+    <string name="stores_refused_impersonation">Tern non pode ler esta tenda sen finxir ser a súa aplicación, polo que non a le.</string>
+    <string name="stores_checksum_source">%1$s, que non é o desenvolvedor</string>
+    <string name="stores_off_title">%1$s é unha tenda de terceiros</string>
+    <string name="stores_off_body">As tendas de terceiros están desactivadas. Unha tenda serve as súas propias copias de aplicacións, non ficheiros do propio sitio do desenvolvedor, e Tern a le a través da interface que a tenda fixo para a súa propia aplicación ou sitio web. Con elas activadas, Tern pídelle a unha tenda só as aplicacións que engades dela, e ata que unha aplicación se fixa a un certificado, o primeiro ficheiro que Tern instala dunha tenda decide que certificado deben levar as súas actualizacións.</string>
+    <string name="stores_turn_on">Activar tendas de terceiros</string>
+    <string name="stores_advice">Activa Tendas de terceiros nos Axustes para comprobar esta aplicación de novo.</string>
+    <string name="stores_status_paused">En pausa</string>
+    <string name="stores_row_paused">As tendas de terceiros están desactivadas</string>
+    <string name="stores_setting">Tendas de terceiros</string>
+    <string name="stores_setting_effect">APKPure, Aptoide, APKCombo, APKMirror, Tencent, Huawei AppGallery, Galaxy Store e vivo. Serven as súas propias copias de aplicacións, non ficheiros do propio sitio do desenvolvedor, e Tern as le a través das interfaces que fixeron para as súas propias aplicacións e sitios web. Desactivadas, Tern non lles pregunta nada, unha busca as omite e as aplicacións delas páusanse.</string>
+    <string name="stores_off_tag">desactivadas nos Axustes</string>
+    <string name="stores_checksum_matched">O ficheiro coincide coa suma de comprobación da tenda</string>
+    <string name="stores_explain_checksum_matched">Unha suma de comprobación é unha pegada dixital do propio ficheiro. A tenda deu unha e o ficheiro que Tern descargou ten a mesma, polo que chegou tal e como o ten a tenda. A tenda non é o desenvolvedor, así que isto non di nada sobre quen fixo o ficheiro. O certificado si.</string>
+    <string name="stores_import_from_stores">Estas veñen de tendas de terceiros, que serven as súas propias copias de aplicacións. Ata que unha aplicación se fixa a un certificado, o primeiro ficheiro que Tern instala da súa tenda decide que certificado deben levar as súas actualizacións.</string>
+    <string name="stores_import_paused">As tendas de terceiros están desactivadas, polo que estas aplicacións están en pausa. Tern non lles pregunta nada a esas tendas ata que as actives.</string>
+    <string name="stores_import_names">Desde tendas de terceiros</string>
+    <string name="share_obtainium_link">Compartir como ligazón de Obtainium</string>
+    <string name="share_obtainium_links">Compartir como ligazóns de Obtainium</string>
+</resources>
diff --git a/app/src/main/res/values-gl/strings_tv.xml b/app/src/main/res/values-gl/strings_tv.xml
new file mode 100644
index 00000000..6d2c3755
--- /dev/null
+++ b/app/src/main/res/values-gl/strings_tv.xml
@@ -0,0 +1,5 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="interval_turn_off">Desactivar comprobacións en segundo plano</string>
+    <string name="interval_turn_on">Activar comprobacións en segundo plano</string>
+</resources>
diff --git a/app/src/main/res/values-hu/strings.xml b/app/src/main/res/values-hu/strings.xml
index eb4fe76e..5a07fc34 100644
--- a/app/src/main/res/values-hu/strings.xml
+++ b/app/src/main/res/values-hu/strings.xml
@@ -369,7 +369,6 @@
     <string name="settings_import_effect">Tern vagy Obtainium exportálásból</string>
     <string name="settings_export">Alkalmazások exportálása</string>
     <string name="settings_exporting">Exportálás</string>
-    <string name="settings_export_effect">Fájlba menti a listát és a beállításokat. A tokeneket sosem tartalmazza.</string>
     <plurals name="exported">
         <item quantity="one">%d alkalmazás exportálva</item>
         <item quantity="other">%d alkalmazás exportálva</item>
diff --git a/app/src/main/res/values-hu/strings_accept.xml b/app/src/main/res/values-hu/strings_accept.xml
new file mode 100644
index 00000000..1d2401a5
--- /dev/null
+++ b/app/src/main/res/values-hu/strings_accept.xml
@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="stores_paused_reason">A harmadik féltől származó áruházak ki vannak kapcsolva, így a Tern semmit sem kérdez ettől az áruháztól. Kapcsolja be őket a Beállításokban az ismételt ellenőrzéshez.</string>
+</resources>
diff --git a/app/src/main/res/values-hu/strings_checks.xml b/app/src/main/res/values-hu/strings_checks.xml
index eb496267..81e44b58 100644
--- a/app/src/main/res/values-hu/strings_checks.xml
+++ b/app/src/main/res/values-hu/strings_checks.xml
@@ -17,13 +17,11 @@
     <string name="settings_only_installed">Csak a telepített alkalmazások ellenőrzése</string>
     <string name="settings_only_installed_effect">A csak követett alkalmazások is ellenőrzésre kerülnek. A megnyitott alkalmazás mindig ellenőrzésre kerül.</string>
     <string name="settings_remove_uninstalled">Máshol eltávolított alkalmazások törlése a listáról</string>
-    <string name="settings_remove_uninstalled_effect">Ha a Ternen kívül eltávolít egy alkalmazást, az a listáról is lekerül.</string>
     <string name="settings_file_filter">Fájlszűrő</string>
     <string name="settings_file_filter_effect">Minta, amely alapján minden saját szűrő nélküli alkalmazás kiválasztja a fájlját.</string>
     <string name="settings_file_filter_none">Nincs</string>
     <string name="settings_file_filter_invalid">Ez a minta nem olvasható.</string>
     <string name="settings_allow_downgrades">Régebbi verziók engedélyezése</string>
-    <string name="settings_allow_downgrades_effect">A Let Me Downgrade telepítve van, így az Android egy újabb verzióra régebbit is telepíthet.</string>
     <string name="settings_collapse_groups">Kezdés összecsukott csoportokkal</string>
     <string name="settings_haptics">Haptikus visszajelzés</string>
     <string name="settings_haptics_effect">Enyhe rezgés, amikor egy elhúzás vagy hosszú nyomás hatására történik valami.</string>
@@ -38,7 +36,6 @@
     <string name="sources_repositories">Tárolók</string>
     <string name="sources_stores">Áruházak</string>
     <string name="sources_mirrors">Alkalmazásokat újra közzétevő áruházak</string>
-    <string name="sources_modified">Módosított alkalmazásokat kínáló oldalak</string>
     <string name="sources_other">Egyéb helyek</string>
     <string name="sources_web_page">Fájlokra mutató linkeket tartalmazó weboldal</string>
     <string name="sources_direct">Közvetlen link egy fájlra</string>
@@ -48,8 +45,6 @@
     <string name="shared_configs_title">Az Obtainium felhasználói által megosztott konfigurációk</string>
     <string name="shared_configs_effect">Kész alkalmazásbeállításokat tartalmazó oldal. A linkjei a Ternben nyílnak meg, ha az Obtainium linkek megnyitása be van kapcsolva a Beállításokban.</string>
     <string name="engine_inner_filter_nothing">Az archívumokon belüli fájlok szűrője ebben az archívumban egyik APK-ra sem illik.</string>
-    <string name="preview_republished">A(z) %1$s újra kínálja azt, amit a fejlesztők máshol tesznek közzé. A fájljait a Tern a fejlesztő tanúsítványához köti, amint ismeri azt, ezért ha teheti, rögzítsen egyet, vagy először a fejlesztőtől telepítsen.</string>
-    <string name="preview_modified">A(z) %1$s olyan alkalmazásokat kínál, amelyeket a fejlesztőjükön kívül valaki más módosított. Az írja alá őket, aki módosította őket, és a Tern nem tudja megállapítani, mi lett módosítva.</string>
     <string name="about_track_tern">Maga a Tern is legyen naprakész</string>
     <string name="about_track_tern_effect">Hozzáadja a Tern saját kiadásait a listához, ugyanúgy ellenőrizve és hitelesítve, mint bármely alkalmazást.</string>
     <string name="engine_channel_tracked">Követett alkalmazások új kiadásai</string>
diff --git a/app/src/main/res/values-hu/strings_options.xml b/app/src/main/res/values-hu/strings_options.xml
index 4f2018a4..9c735148 100644
--- a/app/src/main/res/values-hu/strings_options.xml
+++ b/app/src/main/res/values-hu/strings_options.xml
@@ -62,10 +62,6 @@
     <string name="option_workflow">Munkafolyamat-fájl</string>
     <string name="option_workflow_help">Például build.yml.</string>
     <string name="option_branch">Ág</string>
-    <string name="option_device_model">Eszközmodell</string>
-    <string name="option_device_model_help">A Galaxy Store minden modellnek saját változatot ad, például SM-S948B.</string>
-    <string name="option_csc">Régiókód (CSC)</string>
-    <string name="option_csc_help">Három betű, például DBT.</string>
     <string name="option_link_filter">Szűrő a letöltési linkekre</string>
     <string name="option_link_filter_help">Csak az egyező linkek számítanak letöltésnek.</string>
     <string name="option_page_order">Az oldal sorrendjének megtartása</string>
@@ -76,11 +72,14 @@
     <string name="version_from_text">A link szövege</string>
     <string name="version_from_page">Az egész oldal</string>
     <string name="option_headers">Kérésfejlécek</string>
-    <string name="option_headers_help">Soronként egy, Name: value formában. Soha ne legyen benne jelszó vagy süti.</string>
     <string name="option_pseudo">Ha nincs verzió</string>
     <string name="pseudo_default">Fájlok megkülönböztetése a szerver módján</string>
     <string name="pseudo_hash">A fájl elejének hash-e alapján</string>
     <string name="pseudo_link">A fájl címe alapján</string>
     <string name="pseudo_etag">A szerver ETag-je alapján</string>
     <string name="option_invalid">Ez így nem használható.</string>
+    <string name="option_device_model">Eszközmodell</string>
+    <string name="option_device_model_help">A Galaxy Store minden modellnek saját változatot ad, például SM-S948B.</string>
+    <string name="option_csc">Régiókód (CSC)</string>
+    <string name="option_csc_help">Három betű, például DBT.</string>
 </resources>
diff --git a/app/src/main/res/values-hu/strings_safety.xml b/app/src/main/res/values-hu/strings_safety.xml
new file mode 100644
index 00000000..de406a65
--- /dev/null
+++ b/app/src/main/res/values-hu/strings_safety.xml
@@ -0,0 +1,29 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="settings_export_effect_plain">Elmenti a listáját és a beállításait egy fájlba. Tokenek soha nem kerülnek bele, ahogyan olyan kérésfejléc sem, amely kulcsot tartalmazhat.</string>
+    <string name="engine_checksum_github_proxy">GitHub kiadás kivonat, ahogy a(z) %1$s hubproxy továbbította</string>
+    <string name="github_proxy_effect_trust">Minden GitHubra irányuló kérés ehhez a gazdagéphez megy. Mindegyiket látja, és megváltoztathatja, ami visszajön: a kiadásokat, azok kivonatait és a fájlokat. A meglévő alkalmazásai a tanúsítványukhoz rögzítve maradnak, de az ezen keresztül történő első telepítés ugyanannyira megbízik a hubproxyban, mint a GitHubban, és a tanúsítvány rögzítése nem terjed ki rá. Rajta keresztül nem küldünk tokent, így a privát projekteket és a GitHub Actions-t nem lehet ezen a módon követni.</string>
+    <string name="settings_unmetered_checks">Ellenőrzés csak Wi-Fi-n</string>
+    <string name="settings_unmetered_checks_effect">A háttérbeli ellenőrzések Wi-Fi-re vagy kábelre várnak, így nem használnak mobiladatot.</string>
+    <string name="settings_charging_checks">Ellenőrzés csak töltés közben</string>
+    <string name="settings_charging_checks_effect">A háttérbeli ellenőrzések megvárják, amíg az eszköz töltődik.</string>
+    <string name="settings_unmetered_installs_wait">Egy magától települő frissítés Wi-Fi-re vagy kábelre vár, ahogy az Obtainiumban.</string>
+    <string name="settings_charging_installs_wait">Egy magától települő frissítés megvárja, amíg az eszköz töltődik.</string>
+    <string name="engine_downgrade_not_as_named">A forrás a(z) %2$d verziókódot nevezte meg, de ez a fájl %1$d, régebbi, mint a telepített. Nem kerül az újabb fölé.</string>
+    <string name="settings_allow_downgrades_picked">A Let Me Downgrade telepítve van, így az Android képes egy régebbi verziót egy újabb fölé telepíteni. A Tern ezt csak olyan kiadás esetén teszi meg, amelyet Ön választ ki egy alkalmazás előzményeiből, sosem a háttérben vagy az Összes frissítésével.</string>
+    <string name="option_highest_version">A legmagasabb verzió átvétele, ahogy a Tern 0.1.0 tette</string>
+    <string name="option_highest_version_effect">A legmagasabb verziójú linket kínálja fel az oldalon, bárhol is legyen az, és a verziómintát minden linkből kiolvasott verzión futtatja. Kikapcsolva úgy olvassa az oldalt, ahogy az Obtainium teszi: a sorban az utolsó link a legújabb.</string>
+    <string name="settings_remove_uninstalled_keeps_pins">Egy, a Tern alkalmazáson kívül eltávolított alkalmazás a listáról is lekerül. Az archivált alkalmazás megmarad. Ugyanonnan újra hozzáadva egy alkalmazás ahhoz a tanúsítványhoz lesz rögzítve, amellyel korábban rendelkezett; a Tern alkalmazásból való eltávolítás ezt elfelejti.</string>
+    <string name="link_check_title">Frissítések ellenőrzése most?</string>
+    <string name="link_check_one">Egy link arra kérte a Tern-t, hogy ellenőrizze a(z) %1$s frissítéseit. A forrása lekérdezésre kerül, és semmi nem lesz telepítve.</string>
+    <plurals name="link_check_all">
+        <item quantity="one">Egy link arra kérte a Tern alkalmazást, hogy ellenőrizze a listán szereplő %d alkalmazás frissítéseit. Lekérdezzük a forrását, és semmi nem lesz telepítve.</item>
+        <item quantity="other">Egy link arra kérte a Tern alkalmazást, hogy ellenőrizze a listán szereplő %d alkalmazás frissítéseit. Lekérdezzük a forrásaikat, és semmi nem lesz telepítve.</item>
+    </plurals>
+    <string name="link_check_confirm">Ellenőrzés</string>
+    <string name="link_check_not_now">Most nem</string>
+    <string name="engine_installer_fell_back">A(z) %1$s nem volt kész, ezért ennél az Android telepítőjét használta.</string>
+    <string name="about_track_tern_fdroid_effect">Az F-Droid telepítette ezt a példányt, így a Tern az ottani bejegyzését követi: a frissítések azok a változatok, amelyeket az F-Droid készített és ellenőrzött, ahogy az F-Droid alkalmazás is megkapja őket.</string>
+    <string name="about_track_tern_github">Inkább a GitHub-kiadások követése</string>
+    <string name="about_track_tern_github_effect">A frissítések a GitHubról érkeznek, amint közzéteszik őket, mielőtt az F-Droid elkészítené és ellenőrizné őket. Ez kihagyja az F-Droid ellenőrzéseit. A Tern továbbra is ellenőriz minden fájlt, és a saját tanúsítványukhoz rögzíti őket.</string>
+</resources>
diff --git a/app/src/main/res/values-hu/strings_settings_more.xml b/app/src/main/res/values-hu/strings_settings_more.xml
index 1db0adf5..87010bfe 100644
--- a/app/src/main/res/values-hu/strings_settings_more.xml
+++ b/app/src/main/res/values-hu/strings_settings_more.xml
@@ -37,9 +37,7 @@
     <string name="settings_auto_installs">A frissítések maguktól települnek</string>
     <string name="settings_auto_installs_effect">Az automatikus frissítésre beállított alkalmazások háttérbeli ellenőrzés után frissítik magukat. Kikapcsolva csak jelzik, hogy van frissítés, és mindegyik megtartja a saját választását későbbre.</string>
     <string name="settings_unmetered_installs">Telepítés csak Wi-Fi esetén</string>
-    <string name="settings_unmetered_installs_effect">Az ellenőrzések bármilyen hálózaton futnak. Az a frissítés, amely magától települne, Wi-Fi-re vagy hálózati kábelre vár, ahogy az Obtainiumban.</string>
     <string name="settings_charging_installs">Telepítés csak töltés közben</string>
-    <string name="settings_charging_installs_effect">Az ellenőrzések akkumulátorról is futnak. Az a frissítés, amely magától települne, addig vár, amíg az eszköz töltődik.</string>
     <string name="engine_unreadable_app">A mentett alkalmazást (%1$s) nem sikerült beolvasni, ezért kimarad a listából. Semmi nem lett törölve: a Tern egy újabb verziója talán be tudja olvasni.</string>
     <string name="settings_pin_certificates">A kódtárhelyek tanúsítványainak rögzítése</string>
     <string name="settings_pin_certificates_effect">A GitHubnak, a GitLabnak és a Codebergnek annak a tanúsítványkiadónak a tanúsítványát kell felmutatnia, amelyről ismert, hogy az adott oldal használja, ahogy az Obtainiumban is. Az olyan tanúsítvány, amelynek kiállítására egy másik tanúsítványkiadót vettek rá, ilyenkor elutasításra kerül. Ha egy kódtárhely másik tanúsítványkiadóra vált, az ottani ellenőrzések addig sikertelenek, amíg ez ki nincs kapcsolva.</string>
diff --git a/app/src/main/res/values-hu/strings_sources_more.xml b/app/src/main/res/values-hu/strings_sources_more.xml
index 30effcab..58348808 100644
--- a/app/src/main/res/values-hu/strings_sources_more.xml
+++ b/app/src/main/res/values-hu/strings_sources_more.xml
@@ -18,10 +18,7 @@
     <string name="step_arch">Az eszköz processzorának előnyben részesítése</string>
     <string name="step_add">Oldal hozzáadása</string>
     <string name="step_remove">Oldal eltávolítása</string>
-    <string name="option_file_version">A fájlnév használata verzióként</string>
-    <string name="option_file_version_effect">Ekkor minden fájl külön kiadásnak számít.</string>
     <string name="github_proxy_title">GitHub egy hubproxyn keresztül</string>
-    <string name="github_proxy_effect">A GitHubra irányuló minden kérés ehhez a gazdagéphez megy, amely mindegyiket látja. Rajta keresztül nem megy token, így a privát projektek és a GitHub Actions ilyen módon nem követhetők.</string>
     <string name="github_proxy_host">Hubproxy gazdagép</string>
     <string name="github_proxy_help">Csak egy gazdagépnév, például gh-proxy.com. A Tern HTTPS-en keresztül éri el.</string>
     <string name="github_proxy_invalid">Ez nem olyan gazdagépnév, amelyet a Tern használni tud</string>
diff --git a/app/src/main/res/values-hu/strings_starters.xml b/app/src/main/res/values-hu/strings_starters.xml
new file mode 100644
index 00000000..6f16806e
--- /dev/null
+++ b/app/src/main/res/values-hu/strings_starters.xml
@@ -0,0 +1,7 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="starter_in_list">A listáján</string>
+    <string name="starter_on_phone">Ezen a telefonon</string>
+    <string name="starter_on_phone_other">Ezen a telefonon más aláírótól</string>
+    <string name="starter_on_phone_other_explain">Az Ön példánya más kulccsal van aláírva, így a Tern nem tudja frissíteni erről a címről.</string>
+</resources>
diff --git a/app/src/main/res/values-hu/strings_stores.xml b/app/src/main/res/values-hu/strings_stores.xml
new file mode 100644
index 00000000..1e18369d
--- /dev/null
+++ b/app/src/main/res/values-hu/strings_stores.xml
@@ -0,0 +1,27 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="option_headers_help_own_agent">Soronként egy, Név: érték formátumban. Soha ne legyen jelszó, süti vagy User-Agent: a Tern minden oldalnak jelzi, hogy ő a Tern.</string>
+    <string name="origin_republished_first">%1$s újra kínálja azt, amit a fejlesztők máshol közzétesznek, és nem ő a fejlesztő. Amíg az alkalmazás nincs egy tanúsítványhoz rögzítve, az első fájl, amelyet a Tern telepít belőle, dönti el, hogy minden későbbi frissítésnek melyik tanúsítványt kell hordoznia.</string>
+    <string name="origin_republished_pinned">%1$s újra kínálja azt, amit a fejlesztők máshol közzétesznek, és nem ő a fejlesztő. Fájljainak azt a tanúsítványt kell hordozniuk, amelyhez ez az alkalmazás rögzítve van.</string>
+    <string name="origin_store_first">%1$s egy áruház, nem a fejlesztő saját oldala. Amíg az alkalmazás nincs egy tanúsítványhoz rögzítve, az első fájl, amelyet a Tern telepít belőle, dönti el, hogy minden későbbi frissítésnek melyik tanúsítványt kell hordoznia.</string>
+    <string name="origin_store_pinned">%1$s egy áruház, nem a fejlesztő saját oldala. Fájljainak azt a tanúsítványt kell hordozniuk, amelyhez ez az alkalmazás rögzítve van.</string>
+    <string name="stores_refused_modified">A Tern nem olvassa be azokat az oldalakat, amelyek módosított alkalmazásokat kínálnak. A fájljaikat a fejlesztőn kívül más módosította, és az írta alá, aki megváltoztatta őket.</string>
+    <string name="stores_refused_impersonation">A Tern nem tudja beolvasni ezt az áruházat anélkül, hogy az áruház alkalmazásának adná ki magát, ezért nem olvassa be.</string>
+    <string name="stores_checksum_source">%1$s, amely nem a fejlesztő</string>
+    <string name="stores_off_title">%1$s egy harmadik féltől származó áruház</string>
+    <string name="stores_off_body">A harmadik féltől származó áruházak ki vannak kapcsolva. Egy áruház az alkalmazások saját példányait szolgálja ki, nem a fejlesztő saját oldaláról származó fájlokat, és a Tern azon a felületen keresztül olvassa be, amelyet az áruház a saját alkalmazásához vagy weboldalához készített. Ha be vannak kapcsolva, a Tern csak azokról az alkalmazásokról kérdezi az áruházat, amelyeket Ön hozzáad belőle, és amíg egy alkalmazás nincs egy tanúsítványhoz rögzítve, az első fájl, amelyet a Tern egy áruházból telepít, dönti el, hogy a frissítéseknek melyik tanúsítványt kell hordozniuk.</string>
+    <string name="stores_turn_on">Harmadik féltől származó áruházak bekapcsolása</string>
+    <string name="stores_advice">Kapcsolja be a Harmadik féltől származó áruházakat a Beállításokban az alkalmazás ismételt ellenőrzéséhez.</string>
+    <string name="stores_status_paused">Szüneteltetve</string>
+    <string name="stores_row_paused">A harmadik féltől származó áruházak ki vannak kapcsolva</string>
+    <string name="stores_setting">Harmadik féltől származó áruházak</string>
+    <string name="stores_setting_effect">APKPure, Aptoide, APKCombo, APKMirror, Tencent, Huawei AppGallery, a Galaxy Store és a vivo. Az alkalmazások saját példányait szolgálják ki, nem a fejlesztő saját oldaláról származó fájlokat, és a Tern azon a felületeken keresztül olvassa be őket, amelyeket a saját alkalmazásaikhoz és weboldalaikhoz készítettek. Kikapcsolva a Tern egyiküktől sem kérdez semmit, a keresés kihagyja őket, és a tőlük származó alkalmazások szüneteltetnek.</string>
+    <string name="stores_off_tag">kikapcsolva a Beállításokban</string>
+    <string name="stores_checksum_matched">A fájl megegyezik az áruház ellenőrző összegével</string>
+    <string name="stores_explain_checksum_matched">Az ellenőrző összeg magának a fájlnak az ujjlenyomata. Az áruház megadott egyet, és a Tern által letöltött fájl ugyanazzal rendelkezik, tehát úgy érkezett meg, ahogy az az áruházban szerepel. Az áruház nem a fejlesztő, így ez nem mond semmit arról, hogy ki készítette a fájlt. A tanúsítvány igen.</string>
+    <string name="stores_import_from_stores">Ezek harmadik féltől származó áruházakból érkeznek, amelyek az alkalmazások saját példányait szolgálják ki. Amíg egy alkalmazás nincs egy tanúsítványhoz rögzítve, az első fájl, amelyet a Tern a saját áruházából telepít, dönti el, hogy a frissítéseinek melyik tanúsítványt kell hordozniuk.</string>
+    <string name="stores_import_paused">A harmadik féltől származó áruházak ki vannak kapcsolva, így ezek az alkalmazások szüneteltetve vannak. A Tern semmit sem kérdez ezektől az áruházaktól, amíg be nem kapcsolja őket.</string>
+    <string name="stores_import_names">Harmadik féltől származó áruházakból</string>
+    <string name="share_obtainium_link">Megosztás Obtainium-linkként</string>
+    <string name="share_obtainium_links">Megosztás Obtainium-linkekként</string>
+</resources>
diff --git a/app/src/main/res/values-hu/strings_tv.xml b/app/src/main/res/values-hu/strings_tv.xml
new file mode 100644
index 00000000..8579878a
--- /dev/null
+++ b/app/src/main/res/values-hu/strings_tv.xml
@@ -0,0 +1,5 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="interval_turn_off">Háttérbeli ellenőrzések kikapcsolása</string>
+    <string name="interval_turn_on">Háttérbeli ellenőrzések bekapcsolása</string>
+</resources>
diff --git a/app/src/main/res/values-in/strings.xml b/app/src/main/res/values-in/strings.xml
index 635c021e..6f067bb6 100644
--- a/app/src/main/res/values-in/strings.xml
+++ b/app/src/main/res/values-in/strings.xml
@@ -354,7 +354,6 @@
     <string name="settings_import_effect">Dari ekspor Tern atau Obtainium</string>
     <string name="settings_export">Ekspor aplikasi</string>
     <string name="settings_exporting">Mengekspor</string>
-    <string name="settings_export_effect">Menyimpan daftar dan setelan Anda ke dalam sebuah file. Token tidak pernah disertakan.</string>
     <plurals name="exported">
         <item quantity="other">Mengekspor %d aplikasi</item>
     </plurals>
diff --git a/app/src/main/res/values-in/strings_accept.xml b/app/src/main/res/values-in/strings_accept.xml
new file mode 100644
index 00000000..990f621c
--- /dev/null
+++ b/app/src/main/res/values-in/strings_accept.xml
@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="stores_paused_reason">Toko pihak ketiga dimatikan, jadi Tern tidak menanyakan apa pun pada toko ini. Nyalakan di Setelan untuk memeriksanya lagi.</string>
+</resources>
diff --git a/app/src/main/res/values-in/strings_checks.xml b/app/src/main/res/values-in/strings_checks.xml
index a603db9a..aed9b311 100644
--- a/app/src/main/res/values-in/strings_checks.xml
+++ b/app/src/main/res/values-in/strings_checks.xml
@@ -15,13 +15,11 @@
     <string name="settings_only_installed">Hanya periksa aplikasi yang terinstal</string>
     <string name="settings_only_installed_effect">Aplikasi yang hanya diikuti juga diperiksa. Aplikasi yang Anda buka selalu diperiksa.</string>
     <string name="settings_remove_uninstalled">Hapus aplikasi yang di-uninstal di tempat lain</string>
-    <string name="settings_remove_uninstalled_effect">Aplikasi yang Anda uninstal di luar Tern juga keluar dari daftar.</string>
     <string name="settings_file_filter">Filter untuk file</string>
     <string name="settings_file_filter_effect">Pola yang dipakai setiap aplikasi tanpa filter sendiri untuk memilih filenya.</string>
     <string name="settings_file_filter_none">Tidak ada</string>
     <string name="settings_file_filter_invalid">Pola ini tidak dapat dibaca.</string>
     <string name="settings_allow_downgrades">Izinkan versi lama</string>
-    <string name="settings_allow_downgrades_effect">Let Me Downgrade terinstal, jadi Android dapat memasang versi lama menimpa versi yang lebih baru.</string>
     <string name="settings_collapse_groups">Mulai dengan grup terlipat</string>
     <string name="settings_haptics">Umpan balik haptik</string>
     <string name="settings_haptics_effect">Getaran ringan saat geser atau tekan lama melakukan sesuatu.</string>
@@ -36,7 +34,6 @@
     <string name="sources_repositories">Repositori</string>
     <string name="sources_stores">Toko</string>
     <string name="sources_mirrors">Toko yang menerbitkan ulang aplikasi</string>
-    <string name="sources_modified">Situs dengan aplikasi yang diubah</string>
     <string name="sources_other">Tempat lain</string>
     <string name="sources_web_page">Halaman web dengan tautan ke file</string>
     <string name="sources_direct">Tautan langsung ke file</string>
@@ -46,8 +43,6 @@
     <string name="shared_configs_title">Konfigurasi yang dibagikan pengguna Obtainium</string>
     <string name="shared_configs_effect">Situs berisi setelan siap pakai untuk aplikasi. Tautannya terbuka di Tern saat \"Buka tautan Obtainium\" aktif di Setelan.</string>
     <string name="engine_inner_filter_nothing">Filter untuk file di dalam arsip tidak cocok dengan APK mana pun di arsip ini.</string>
-    <string name="preview_republished">%1$s menawarkan ulang apa yang diterbitkan pengembang di tempat lain. Setelah Tern mengetahui sertifikat pengembang, file dari sini harus cocok dengan sertifikat itu, jadi sematkan sertifikat atau instal dari pengembang terlebih dahulu jika bisa.</string>
-    <string name="preview_modified">%1$s menawarkan aplikasi yang diubah oleh orang selain pengembangnya. Aplikasi itu ditandatangani oleh siapa pun yang mengubahnya, dan Tern tidak dapat mengetahui apa yang diubah.</string>
     <string name="about_track_tern">Selalu perbarui Tern sendiri</string>
     <string name="about_track_tern_effect">Menambahkan rilis Tern sendiri ke daftar, diperiksa dan diverifikasi seperti aplikasi lainnya.</string>
     <string name="engine_channel_tracked">Rilis baru aplikasi yang diikuti</string>
diff --git a/app/src/main/res/values-in/strings_options.xml b/app/src/main/res/values-in/strings_options.xml
index 7d9de829..d54846d2 100644
--- a/app/src/main/res/values-in/strings_options.xml
+++ b/app/src/main/res/values-in/strings_options.xml
@@ -60,10 +60,6 @@
     <string name="option_workflow">File workflow</string>
     <string name="option_workflow_help">Seperti build.yml.</string>
     <string name="option_branch">Cabang</string>
-    <string name="option_device_model">Model perangkat</string>
-    <string name="option_device_model_help">Galaxy Store memberi setiap model build sendiri, seperti SM-S948B.</string>
-    <string name="option_csc">Kode wilayah (CSC)</string>
-    <string name="option_csc_help">Tiga huruf, seperti DBT.</string>
     <string name="option_link_filter">Filter untuk tautan unduhan</string>
     <string name="option_link_filter_help">Hanya tautan yang cocok yang dihitung sebagai unduhan.</string>
     <string name="option_page_order">Pertahankan urutan halaman</string>
@@ -74,11 +70,14 @@
     <string name="version_from_text">Teks tautan</string>
     <string name="version_from_page">Seluruh halaman</string>
     <string name="option_headers">Header permintaan</string>
-    <string name="option_headers_help">Satu per baris, sebagai Name: value. Jangan pernah kata sandi atau cookie.</string>
     <string name="option_pseudo">Bila tidak ada versi</string>
     <string name="pseudo_default">Bedakan file seperti yang dilakukan server</string>
     <string name="pseudo_hash">Dengan hash dari awal file</string>
     <string name="pseudo_link">Dengan alamat file</string>
     <string name="pseudo_etag">Dengan ETag dari server</string>
     <string name="option_invalid">Ini tidak dapat digunakan apa adanya.</string>
+    <string name="option_device_model">Model perangkat</string>
+    <string name="option_device_model_help">Galaxy Store memberi setiap model build sendiri, seperti SM-S948B.</string>
+    <string name="option_csc">Kode wilayah (CSC)</string>
+    <string name="option_csc_help">Tiga huruf, seperti DBT.</string>
 </resources>
diff --git a/app/src/main/res/values-in/strings_safety.xml b/app/src/main/res/values-in/strings_safety.xml
new file mode 100644
index 00000000..682281cf
--- /dev/null
+++ b/app/src/main/res/values-in/strings_safety.xml
@@ -0,0 +1,28 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="settings_export_effect_plain">Menyimpan daftar dan setelan Anda ke file. Token tidak pernah disertakan, begitu pula header permintaan yang dapat memuat kunci.</string>
+    <string name="engine_checksum_github_proxy">Digest rilis GitHub, sebagaimana diteruskan oleh hubproxy %1$s</string>
+    <string name="github_proxy_effect_trust">Setiap permintaan ke GitHub masuk ke host ini. Host melihat masing-masingnya dan dapat mengubah apa yang kembali: rilis, digest, dan filenya. Aplikasi yang Anda miliki tetap terikat pada sertifikatnya, tetapi instalasi pertama melaluinya memercayai hubproxy sama seperti GitHub, dan penyematan sertifikat tidak menjangkaunya. Tidak ada token yang dikirim melaluinya, jadi proyek pribadi dan GitHub Actions tidak dapat diikuti dengan cara ini.</string>
+    <string name="settings_unmetered_checks">Periksa hanya di Wi-Fi</string>
+    <string name="settings_unmetered_checks_effect">Pemeriksaan latar belakang menunggu Wi-Fi atau kabel, jadi tidak menggunakan data seluler.</string>
+    <string name="settings_charging_checks">Periksa hanya saat mengisi daya</string>
+    <string name="settings_charging_checks_effect">Pemeriksaan latar belakang menunggu hingga perangkat sedang mengisi daya.</string>
+    <string name="settings_unmetered_installs_wait">Pembaruan yang akan menginstal dengan sendirinya menunggu Wi-Fi atau kabel, seperti di Obtainium.</string>
+    <string name="settings_charging_installs_wait">Pembaruan yang akan menginstal dengan sendirinya menunggu hingga perangkat sedang mengisi daya.</string>
+    <string name="engine_downgrade_not_as_named">Sumber menyebutkan kode versi %2$d, tetapi file ini %1$d, lebih lama dari yang terinstal. File ini tidak diinstal menimpa yang lebih baru.</string>
+    <string name="settings_allow_downgrades_picked">Let Me Downgrade terinstal, sehingga Android dapat menginstal versi lama menimpa yang baru. Tern melakukannya hanya untuk rilis yang Anda pilih dari riwayat aplikasi, tidak pernah di latar belakang atau dengan Perbarui semua.</string>
+    <string name="option_highest_version">Ambil versi tertinggi, seperti Tern 0.1.0</string>
+    <string name="option_highest_version_effect">Menawarkan tautan dengan versi tertinggi di halaman, di mana pun letaknya, dan menjalankan pola versi pada versi yang dibaca dari setiap tautan. Jika nonaktif akan membaca halaman seperti yang dilakukan Obtainium: tautan terakhir dalam urutan adalah yang terbaru.</string>
+    <string name="settings_remove_uninstalled_keeps_pins">Aplikasi yang Anda uninstal di luar Tern juga akan keluar dari daftar. Aplikasi yang diarsipkan akan tetap ada. Jika ditambahkan lagi dari tempat yang sama, aplikasi akan tetap terikat pada sertifikat yang dimilikinya; menghapusnya di Tern akan melupakan hal itu.</string>
+    <string name="link_check_title">Periksa pembaruan sekarang?</string>
+    <string name="link_check_one">Sebuah tautan meminta Tern memeriksa pembaruan %1$s. Sumbernya ditanya, dan tidak ada yang diinstal.</string>
+    <plurals name="link_check_all">
+        <item quantity="other">Sebuah tautan meminta Tern memeriksa pembaruan untuk %d aplikasi di daftar Anda. Sumber mereka ditanya, dan tidak ada yang diinstal.</item>
+    </plurals>
+    <string name="link_check_confirm">Periksa</string>
+    <string name="link_check_not_now">Jangan sekarang</string>
+    <string name="engine_installer_fell_back">%1$s belum siap, jadi aplikasi penginstal Android digunakan untuk yang ini.</string>
+    <string name="about_track_tern_fdroid_effect">F-Droid menginstal salinan ini, jadi Tern mengikuti entrinya di sana: pembaruan adalah versi yang dibuat dan diperiksa F-Droid, sama seperti yang didapat aplikasi F-Droid.</string>
+    <string name="about_track_tern_github">Ikuti rilis GitHub saja</string>
+    <string name="about_track_tern_github_effect">Pembaruan berasal dari GitHub segera setelah diterbitkan, sebelum F-Droid membuat dan memeriksanya. Ini melewati pemeriksaan F-Droid. Tern tetap memeriksa setiap file dan memastikannya sesuai dengan sertifikatnya sendiri.</string>
+</resources>
diff --git a/app/src/main/res/values-in/strings_settings_more.xml b/app/src/main/res/values-in/strings_settings_more.xml
index 2bfd2a8b..ad1c85e2 100644
--- a/app/src/main/res/values-in/strings_settings_more.xml
+++ b/app/src/main/res/values-in/strings_settings_more.xml
@@ -36,9 +36,7 @@
     <string name="settings_auto_installs">Pembaruan diinstal dengan sendirinya</string>
     <string name="settings_auto_installs_effect">Aplikasi yang diatur untuk diperbarui dengan sendirinya melakukannya setelah pemeriksaan di latar belakang. Jika dimatikan, aplikasi hanya memberi tahu bahwa ada pembaruan, dan masing-masing tetap menyimpan pilihannya untuk nanti.</string>
     <string name="settings_unmetered_installs">Instal hanya di Wi-Fi</string>
-    <string name="settings_unmetered_installs_effect">Pemeriksaan berjalan di jaringan apa pun. Pembaruan yang akan diinstal dengan sendirinya menunggu Wi-Fi atau kabel, seperti di Obtainium.</string>
     <string name="settings_charging_installs">Instal hanya saat mengisi daya</string>
-    <string name="settings_charging_installs_effect">Pemeriksaan juga berjalan saat memakai baterai. Pembaruan yang akan diinstal dengan sendirinya menunggu hingga perangkat sedang mengisi daya.</string>
     <string name="engine_unreadable_app">Aplikasi tersimpan %1$s tidak dapat dibaca, jadi tidak dimasukkan ke daftar. Tidak ada yang dihapus: Tern versi yang lebih baru mungkin dapat membacanya.</string>
     <string name="settings_pin_certificates">Sematkan sertifikat platform kode</string>
     <string name="settings_pin_certificates_effect">GitHub, GitLab, dan Codeberg harus menunjukkan sertifikat dari otoritas sertifikat yang diketahui digunakan masing-masing, seperti di Obtainium. Sertifikat yang diterbitkan otoritas lain karena dipaksa akan ditolak. Jika sebuah platform kode mengganti otoritasnya, pemeriksaan di sana gagal hingga ini dimatikan.</string>
diff --git a/app/src/main/res/values-in/strings_sources_more.xml b/app/src/main/res/values-in/strings_sources_more.xml
index f8ba5c84..4842a338 100644
--- a/app/src/main/res/values-in/strings_sources_more.xml
+++ b/app/src/main/res/values-in/strings_sources_more.xml
@@ -18,10 +18,7 @@
     <string name="step_arch">Utamakan prosesor perangkat ini</string>
     <string name="step_add">Tambah halaman</string>
     <string name="step_remove">Hapus halaman ini</string>
-    <string name="option_file_version">Pakai nama file sebagai versi</string>
-    <string name="option_file_version_effect">Setiap file lalu dihitung sebagai rilis tersendiri.</string>
     <string name="github_proxy_title">GitHub melalui hubproxy</string>
-    <string name="github_proxy_effect">Setiap permintaan ke GitHub dikirim ke host ini, yang melihat semuanya. Tidak ada token yang dikirim melaluinya, sehingga proyek privat dan GitHub Actions tidak dapat diikuti dengan cara ini.</string>
     <string name="github_proxy_host">Host hubproxy</string>
     <string name="github_proxy_help">Nama host saja, misalnya gh-proxy.com. Tern terhubung ke sana melalui HTTPS.</string>
     <string name="github_proxy_invalid">Itu bukan nama host yang dapat digunakan Tern</string>
diff --git a/app/src/main/res/values-in/strings_starters.xml b/app/src/main/res/values-in/strings_starters.xml
new file mode 100644
index 00000000..00014012
--- /dev/null
+++ b/app/src/main/res/values-in/strings_starters.xml
@@ -0,0 +1,7 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="starter_in_list">Di daftar Anda</string>
+    <string name="starter_on_phone">Di ponsel ini</string>
+    <string name="starter_on_phone_other">Di ponsel ini dari penandatangan lain</string>
+    <string name="starter_on_phone_other_explain">Salinan yang Anda miliki ditandatangani dengan kunci yang berbeda, jadi Tern tidak dapat memperbaruinya dari alamat ini.</string>
+</resources>
diff --git a/app/src/main/res/values-in/strings_stores.xml b/app/src/main/res/values-in/strings_stores.xml
new file mode 100644
index 00000000..c88a79d2
--- /dev/null
+++ b/app/src/main/res/values-in/strings_stores.xml
@@ -0,0 +1,27 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="option_headers_help_own_agent">Satu per baris, sebagai Nama: nilai. Jangan pernah sandi, cookie, atau User-Agent: Tern memberi tahu setiap situs bahwa ia adalah Tern.</string>
+    <string name="origin_republished_first">%1$s kembali menawarkan apa yang diterbitkan pengembang di tempat lain, dan bukan pengembangnya. Hingga aplikasi disematkan ke sertifikat, file pertama yang diinstal Tern darinya menentukan sertifikat mana yang harus dibawa oleh setiap pembaruan berikutnya.</string>
+    <string name="origin_republished_pinned">%1$s kembali menawarkan apa yang diterbitkan pengembang di tempat lain, dan bukan pengembangnya. File-filenya harus membawa sertifikat yang telah disematkan pada aplikasi ini.</string>
+    <string name="origin_store_first">%1$s adalah toko, bukan situs milik pengembang. Hingga aplikasi disematkan ke sertifikat, file pertama yang diinstal Tern darinya menentukan sertifikat mana yang harus dibawa oleh setiap pembaruan berikutnya.</string>
+    <string name="origin_store_pinned">%1$s adalah toko, bukan situs milik pengembang. File-filenya harus membawa sertifikat yang telah disematkan pada aplikasi ini.</string>
+    <string name="stores_refused_modified">Tern tidak membaca situs yang menawarkan aplikasi yang dimodifikasi. File mereka diubah oleh pihak selain pengembang dan ditandatangani oleh siapa pun yang mengubahnya.</string>
+    <string name="stores_refused_impersonation">Tern tidak dapat membaca toko ini tanpa berpura-pura menjadi aplikasinya, jadi Tern tidak membacanya.</string>
+    <string name="stores_checksum_source">%1$s, yang bukan pengembangnya</string>
+    <string name="stores_off_title">%1$s adalah toko pihak ketiga</string>
+    <string name="stores_off_body">Toko pihak ketiga nonaktif. Sebuah toko menyajikan salinan aplikasinya sendiri, bukan file dari situs milik pengembang, dan Tern membacanya melalui antarmuka yang dibuat toko tersebut untuk aplikasi atau situs webnya sendiri. Jika diaktifkan, Tern hanya bertanya pada toko untuk aplikasi yang Anda tambahkan dari sana, dan hingga aplikasi disematkan ke sertifikat, file pertama yang diinstal Tern dari suatu toko menentukan sertifikat mana yang harus dibawa pembaruannya.</string>
+    <string name="stores_turn_on">Aktifkan toko pihak ketiga</string>
+    <string name="stores_advice">Aktifkan Toko pihak ketiga di Setelan untuk memeriksa aplikasi ini lagi.</string>
+    <string name="stores_status_paused">Dijeda</string>
+    <string name="stores_row_paused">Toko pihak ketiga nonaktif</string>
+    <string name="stores_setting">Toko pihak ketiga</string>
+    <string name="stores_setting_effect">APKPure, Aptoide, APKCombo, APKMirror, Tencent, Huawei AppGallery, Galaxy Store, dan vivo. Mereka menyajikan salinan aplikasi sendiri, bukan file dari situs milik pengembang, dan Tern membacanya melalui antarmuka yang mereka buat untuk aplikasi dan situs web mereka sendiri. Jika nonaktif, Tern tidak menanyakan apa pun kepada mereka, pencarian akan mengabaikannya, dan aplikasi dari mereka dijeda.</string>
+    <string name="stores_off_tag">nonaktif di Setelan</string>
+    <string name="stores_checksum_matched">File cocok dengan checksum toko</string>
+    <string name="stores_explain_checksum_matched">Checksum adalah sidik jari dari file itu sendiri. Toko memberikan satu, dan file yang diunduh Tern memiliki checksum yang sama, jadi file tiba seperti yang dimiliki toko. Toko bukanlah pengembangnya, jadi ini tidak menyatakan apa pun tentang siapa yang membuat file tersebut. Sertifikatlah yang menyatakannya.</string>
+    <string name="stores_import_from_stores">Aplikasi ini berasal dari toko pihak ketiga, yang menyajikan salinan aplikasinya sendiri. Hingga aplikasi disematkan ke sertifikat, file pertama yang diinstal Tern dari tokonya menentukan sertifikat mana yang harus dibawa pembaruannya.</string>
+    <string name="stores_import_paused">Toko pihak ketiga nonaktif, jadi aplikasi ini dijeda. Tern tidak menanyakan apa pun kepada toko tersebut hingga Anda mengaktifkannya.</string>
+    <string name="stores_import_names">Dari toko pihak ketiga</string>
+    <string name="share_obtainium_link">Bagikan sebagai tautan Obtainium</string>
+    <string name="share_obtainium_links">Bagikan sebagai tautan-tautan Obtainium</string>
+</resources>
diff --git a/app/src/main/res/values-in/strings_tv.xml b/app/src/main/res/values-in/strings_tv.xml
new file mode 100644
index 00000000..00603b64
--- /dev/null
+++ b/app/src/main/res/values-in/strings_tv.xml
@@ -0,0 +1,5 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="interval_turn_off">Nonaktifkan pemeriksaan latar belakang</string>
+    <string name="interval_turn_on">Aktifkan pemeriksaan latar belakang</string>
+</resources>
diff --git a/app/src/main/res/values-it/strings.xml b/app/src/main/res/values-it/strings.xml
index a122cb62..920c737a 100644
--- a/app/src/main/res/values-it/strings.xml
+++ b/app/src/main/res/values-it/strings.xml
@@ -384,7 +384,6 @@
     <string name="settings_import_effect">Da un\'esportazione di Tern o Obtainium</string>
     <string name="settings_export">Esporta app</string>
     <string name="settings_exporting">Esportazione in corso</string>
-    <string name="settings_export_effect">Salva la tua lista e le impostazioni su file. I token non sono mai inclusi.</string>
     <plurals name="exported">
         <item quantity="one">Esportata %d app</item>
         <item quantity="many">Esportate %d app</item>
diff --git a/app/src/main/res/values-it/strings_accept.xml b/app/src/main/res/values-it/strings_accept.xml
new file mode 100644
index 00000000..01ec32d4
--- /dev/null
+++ b/app/src/main/res/values-it/strings_accept.xml
@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="stores_paused_reason">Gli store di terze parti sono disattivati, quindi Tern non chiede nulla a questo store. Attivali in Impostazioni per controllarlo di nuovo.</string>
+</resources>
diff --git a/app/src/main/res/values-it/strings_checks.xml b/app/src/main/res/values-it/strings_checks.xml
index 7076c4ef..156db9e4 100644
--- a/app/src/main/res/values-it/strings_checks.xml
+++ b/app/src/main/res/values-it/strings_checks.xml
@@ -19,13 +19,11 @@
     <string name="settings_only_installed">Controlla solo le app installate</string>
     <string name="settings_only_installed_effect">Anche le app solo tracciate vengono controllate. Un\'app che apri viene sempre controllata.</string>
     <string name="settings_remove_uninstalled">Rimuovi le app disinstallate altrove</string>
-    <string name="settings_remove_uninstalled_effect">Un\'app che disinstalli fuori da Tern esce anche dalla lista.</string>
     <string name="settings_file_filter">Filtro per i file</string>
     <string name="settings_file_filter_effect">Un pattern con cui ogni app senza un proprio filtro sceglie il suo file.</string>
     <string name="settings_file_filter_none">Nessuno</string>
     <string name="settings_file_filter_invalid">Questo pattern non può essere letto.</string>
     <string name="settings_allow_downgrades">Consenti versioni precedenti</string>
-    <string name="settings_allow_downgrades_effect">Let Me Downgrade è installato, quindi Android può mettere una versione più vecchia sopra una più recente.</string>
     <string name="settings_collapse_groups">Inizia con i gruppi chiusi</string>
     <string name="settings_haptics">Feedback aptico</string>
     <string name="settings_haptics_effect">Una leggera vibrazione quando uno scorrimento o una pressione prolungata fa qualcosa.</string>
@@ -40,7 +38,6 @@
     <string name="sources_repositories">Repository</string>
     <string name="sources_stores">Store</string>
     <string name="sources_mirrors">Store che ripubblicano app</string>
-    <string name="sources_modified">Siti con app modificate</string>
     <string name="sources_other">Altri posti</string>
     <string name="sources_web_page">Una pagina web con link a file</string>
     <string name="sources_direct">Un link diretto a un file</string>
@@ -50,8 +47,6 @@
     <string name="shared_configs_title">Configurazioni condivise dagli utenti di Obtainium</string>
     <string name="shared_configs_effect">Un sito di impostazioni già pronte per le app. I suoi link si aprono in Tern quando Apri link di Obtainium è attivo nelle Impostazioni.</string>
     <string name="engine_inner_filter_nothing">Il filtro per i file dentro gli archivi non corrisponde a nessuno degli APK di questo.</string>
-    <string name="preview_republished">%1$s ripropone ciò che gli sviluppatori pubblicano altrove. Tern vincola i suoi file al certificato dello sviluppatore non appena lo conosce, quindi fissane uno o installa prima dallo sviluppatore quando puoi.</string>
-    <string name="preview_modified">%1$s offre app modificate da qualcuno diverso dal loro sviluppatore. Sono firmate da chi le ha modificate, e Tern non può sapere cosa è stato cambiato.</string>
     <string name="about_track_tern">Mantieni aggiornato Tern stesso</string>
     <string name="about_track_tern_effect">Aggiunge le release di Tern alla lista, controllate e verificate come qualsiasi app.</string>
     <string name="engine_channel_tracked">Nuove release delle app tracciate</string>
diff --git a/app/src/main/res/values-it/strings_options.xml b/app/src/main/res/values-it/strings_options.xml
index c082cdfa..f44695ee 100644
--- a/app/src/main/res/values-it/strings_options.xml
+++ b/app/src/main/res/values-it/strings_options.xml
@@ -64,10 +64,6 @@
     <string name="option_workflow">File del workflow</string>
     <string name="option_workflow_help">Come build.yml.</string>
     <string name="option_branch">Branch</string>
-    <string name="option_device_model">Modello del dispositivo</string>
-    <string name="option_device_model_help">Il Galaxy Store dà a ogni modello la sua build, come SM-S948B.</string>
-    <string name="option_csc">Codice regione (CSC)</string>
-    <string name="option_csc_help">Tre lettere, come DBT.</string>
     <string name="option_link_filter">Filtro per i link di download</string>
     <string name="option_link_filter_help">Solo i link corrispondenti contano come download.</string>
     <string name="option_page_order">Mantieni l\'ordine della pagina</string>
@@ -78,11 +74,14 @@
     <string name="version_from_text">Il testo del link</string>
     <string name="version_from_page">L\'intera pagina</string>
     <string name="option_headers">Intestazioni della richiesta</string>
-    <string name="option_headers_help">Una per riga, come Name: value. Mai una password o un cookie.</string>
     <string name="option_pseudo">Quando non c\'è una versione</string>
     <string name="pseudo_default">Distingui i file come fa il server</string>
     <string name="pseudo_hash">Con un hash dell\'inizio del file</string>
     <string name="pseudo_link">Con l\'indirizzo del file</string>
     <string name="pseudo_etag">Con l\'ETag del server</string>
     <string name="option_invalid">Questo non può essere usato così com\'è.</string>
+    <string name="option_device_model">Modello del dispositivo</string>
+    <string name="option_device_model_help">Il Galaxy Store dà a ogni modello la sua build, come SM-S948B.</string>
+    <string name="option_csc">Codice regione (CSC)</string>
+    <string name="option_csc_help">Tre lettere, come DBT.</string>
 </resources>
diff --git a/app/src/main/res/values-it/strings_safety.xml b/app/src/main/res/values-it/strings_safety.xml
new file mode 100644
index 00000000..d87ac90f
--- /dev/null
+++ b/app/src/main/res/values-it/strings_safety.xml
@@ -0,0 +1,30 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="settings_export_effect_plain">Salva la tua lista e le impostazioni in un file. I token non vengono mai inseriti, e nemmeno un\'intestazione di richiesta che potrebbe contenere una chiave.</string>
+    <string name="engine_checksum_github_proxy">Checksum della release di GitHub, come l\'ha passato l\'hubproxy %1$s</string>
+    <string name="github_proxy_effect_trust">Ogni richiesta a GitHub va a questo host. Vede ciascuna di esse e può cambiare ciò che torna indietro: le release, i loro checksum e i file. Le app che hai rimangono fissate al loro certificato, ma una prima installazione tramite esso si fida dell\'hubproxy tanto quanto di GitHub, e il fissaggio del certificato non lo raggiunge. Nessun token viene inviato tramite esso, quindi i progetti privati e GitHub Actions non possono essere seguiti in questo modo.</string>
+    <string name="settings_unmetered_checks">Controlla solo in Wi-Fi</string>
+    <string name="settings_unmetered_checks_effect">I controlli in background aspettano il Wi-Fi o un cavo, così non usano dati mobili.</string>
+    <string name="settings_charging_checks">Controlla solo durante la ricarica</string>
+    <string name="settings_charging_checks_effect">I controlli in background aspettano finché il dispositivo non è in ricarica.</string>
+    <string name="settings_unmetered_installs_wait">Un aggiornamento che si installerebbe da solo aspetta il Wi-Fi o un cavo, come in Obtainium.</string>
+    <string name="settings_charging_installs_wait">Un aggiornamento che si installerebbe da solo aspetta finché il dispositivo non è in ricarica.</string>
+    <string name="engine_downgrade_not_as_named">L\'origine ha nominato il codice versione %2$d, ma questo file è %1$d, più vecchio di quello installato. Non viene installato al posto di quello più recente.</string>
+    <string name="settings_allow_downgrades_picked">Let Me Downgrade è installata, quindi Android potrebbe installare una versione più vecchia al posto di una più recente. Tern lo fa solo per una release che scegli dalla cronologia di un\'app, mai in background o con Aggiorna tutte.</string>
+    <string name="option_highest_version">Prendi la versione più alta, come faceva Tern 0.1.0</string>
+    <string name="option_highest_version_effect">Offre il link con la versione più alta nella pagina, qualunque sia la sua posizione, ed esegue il modello di versione sulla versione letta da ogni link. Se spento, legge la pagina nel modo in cui lo fa Obtainium: l\'ultimo link in ordine è il più recente.</string>
+    <string name="settings_remove_uninstalled_keeps_pins">Un\'app che disinstalli fuori da Tern lascia anche la lista. Un\'app archiviata rimane. Aggiunta di nuovo dallo stesso posto, un\'app è fissata al certificato che aveva; rimuoverla in Tern lo dimentica.</string>
+    <string name="link_check_title">Controllare gli aggiornamenti ora?</string>
+    <string name="link_check_one">Un link ha chiesto a Tern di controllare gli aggiornamenti per %1$s. Viene interrogata la sua origine e non viene installato nulla.</string>
+    <plurals name="link_check_all">
+        <item quantity="one">Un link ha chiesto a Tern di controllare gli aggiornamenti per %d app nella tua lista. Viene interrogata la sua origine e non viene installato nulla.</item>
+        <item quantity="many">Un link ha chiesto a Tern di controllare gli aggiornamenti per %d app nella tua lista. Vengono interrogate le loro origini e non viene installato nulla.</item>
+        <item quantity="other">Un link ha chiesto a Tern di controllare gli aggiornamenti per %d app nella tua lista. Vengono interrogate le loro origini e non viene installato nulla.</item>
+    </plurals>
+    <string name="link_check_confirm">Controlla</string>
+    <string name="link_check_not_now">Non ora</string>
+    <string name="engine_installer_fell_back">%1$s non era pronto, quindi per questa è stato usato il programma di installazione di Android.</string>
+    <string name="about_track_tern_fdroid_effect">F-Droid ha installato questa copia, quindi Tern segue la sua voce lì: gli aggiornamenti sono le build che F-Droid ha creato e controllato, proprio come le ottiene l\'app F-Droid.</string>
+    <string name="about_track_tern_github">Segui invece le release di GitHub</string>
+    <string name="about_track_tern_github_effect">Gli aggiornamenti arrivano da GitHub non appena vengono pubblicati, prima che F-Droid li abbia creati e controllati. Questo salta i controlli di F-Droid. Tern controlla comunque ogni file e lo fissa al suo certificato.</string>
+</resources>
diff --git a/app/src/main/res/values-it/strings_settings_more.xml b/app/src/main/res/values-it/strings_settings_more.xml
index baade2d7..b7ffe9a3 100644
--- a/app/src/main/res/values-it/strings_settings_more.xml
+++ b/app/src/main/res/values-it/strings_settings_more.xml
@@ -38,9 +38,7 @@
     <string name="settings_auto_installs">Gli aggiornamenti si installano da soli</string>
     <string name="settings_auto_installs_effect">Le app impostate per aggiornarsi da sole lo fanno dopo un controllo in background. Se disattivato, segnalano solo che c\'è un aggiornamento, e ciascuna mantiene la propria scelta per dopo.</string>
     <string name="settings_unmetered_installs">Installa solo con il Wi-Fi</string>
-    <string name="settings_unmetered_installs_effect">I controlli vengono eseguiti su qualsiasi rete. Un aggiornamento che si installerebbe da solo attende il Wi-Fi o un cavo, come in Obtainium.</string>
     <string name="settings_charging_installs">Installa solo durante la ricarica</string>
-    <string name="settings_charging_installs_effect">I controlli vengono eseguiti anche a batteria. Un aggiornamento che si installerebbe da solo attende che il dispositivo sia in carica.</string>
     <string name="engine_unreadable_app">Impossibile leggere l\'app salvata %1$s, quindi viene esclusa dalla lista. Non è stato eliminato nulla: una versione più recente di Tern potrebbe leggerla.</string>
     <string name="settings_pin_certificates">Fissa i certificati delle forge</string>
     <string name="settings_pin_certificates_effect">GitHub, GitLab e Codeberg devono presentare un certificato dell\'autorità che ciascuno usa notoriamente, come in Obtainium. Un certificato che un\'altra autorità è stata costretta a emettere viene quindi rifiutato. Se una forge cambia autorità, i controlli lì falliscono finché questa opzione non viene disattivata.</string>
diff --git a/app/src/main/res/values-it/strings_sources_more.xml b/app/src/main/res/values-it/strings_sources_more.xml
index 7d684a59..b1e1165b 100644
--- a/app/src/main/res/values-it/strings_sources_more.xml
+++ b/app/src/main/res/values-it/strings_sources_more.xml
@@ -18,10 +18,7 @@
     <string name="step_arch">Preferisci il processore di questo dispositivo</string>
     <string name="step_add">Aggiungi una pagina</string>
     <string name="step_remove">Rimuovi questa pagina</string>
-    <string name="option_file_version">Usa il nome del file come versione</string>
-    <string name="option_file_version_effect">Ogni file conta allora come una release a sé.</string>
     <string name="github_proxy_title">GitHub tramite un hubproxy</string>
-    <string name="github_proxy_effect">Ogni richiesta a GitHub va a questo host, che le vede tutte. Nessun token viene inviato attraverso di esso, quindi i progetti privati e GitHub Actions non possono essere seguiti in questo modo.</string>
     <string name="github_proxy_host">Host dell\'hubproxy</string>
     <string name="github_proxy_help">Solo un nome host, come gh-proxy.com. Tern lo raggiunge tramite HTTPS.</string>
     <string name="github_proxy_invalid">Questo non è un nome host che Tern può usare</string>
diff --git a/app/src/main/res/values-it/strings_starters.xml b/app/src/main/res/values-it/strings_starters.xml
new file mode 100644
index 00000000..d1536725
--- /dev/null
+++ b/app/src/main/res/values-it/strings_starters.xml
@@ -0,0 +1,7 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="starter_in_list">Nella tua lista</string>
+    <string name="starter_on_phone">Su questo telefono</string>
+    <string name="starter_on_phone_other">Su questo telefono da un altro firmatario</string>
+    <string name="starter_on_phone_other_explain">La copia che hai è firmata con una chiave diversa, quindi Tern non può aggiornarla da questo indirizzo.</string>
+</resources>
diff --git a/app/src/main/res/values-it/strings_stores.xml b/app/src/main/res/values-it/strings_stores.xml
new file mode 100644
index 00000000..16edb8ca
--- /dev/null
+++ b/app/src/main/res/values-it/strings_stores.xml
@@ -0,0 +1,27 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="option_headers_help_own_agent">Uno per riga, come Nome: valore. Mai una password, un cookie o un User-Agent: Tern dice a ogni sito che è Tern.</string>
+    <string name="origin_republished_first">%1$s offre di nuovo ciò che gli sviluppatori pubblicano altrove, e non è lo sviluppatore. Finché l\'app non è fissata a un certificato, il primo file che Tern installa da qui decide quale certificato dovrà avere ogni aggiornamento successivo.</string>
+    <string name="origin_republished_pinned">%1$s offre di nuovo ciò che gli sviluppatori pubblicano altrove, e non è lo sviluppatore. I suoi file devono avere il certificato a cui è fissata questa app.</string>
+    <string name="origin_store_first">%1$s è uno store, non il sito dello sviluppatore. Finché l\'app non è fissata a un certificato, il primo file che Tern installa da qui decide quale certificato dovrà avere ogni aggiornamento successivo.</string>
+    <string name="origin_store_pinned">%1$s è uno store, non il sito dello sviluppatore. I suoi file devono avere il certificato a cui è fissata questa app.</string>
+    <string name="stores_refused_modified">Tern non legge i siti che offrono app modificate. I loro file sono modificati da qualcuno diverso dallo sviluppatore e firmati da chi li ha modificati.</string>
+    <string name="stores_refused_impersonation">Tern non può leggere questo store senza fingere di essere la sua app, quindi non lo legge.</string>
+    <string name="stores_checksum_source">%1$s, che non è lo sviluppatore</string>
+    <string name="stores_off_title">%1$s è uno store di terze parti</string>
+    <string name="stores_off_body">Gli store di terze parti sono spenti. Uno store fornisce le proprie copie delle app, non i file dal sito dello sviluppatore, e Tern lo legge tramite l\'interfaccia che lo store ha creato per la propria app o sito web. Se attivati, Tern chiede a uno store solo le app che aggiungi da lì, e finché un\'app non è fissata a un certificato, il primo file che Tern installa da uno store decide quale certificato dovranno avere i suoi aggiornamenti.</string>
+    <string name="stores_turn_on">Attiva gli store di terze parti</string>
+    <string name="stores_advice">Attiva Store di terze parti in Impostazioni per controllare di nuovo questa app.</string>
+    <string name="stores_status_paused">In pausa</string>
+    <string name="stores_row_paused">Gli store di terze parti sono spenti</string>
+    <string name="stores_setting">Store di terze parti</string>
+    <string name="stores_setting_effect">APKPure, Aptoide, APKCombo, APKMirror, Tencent, Huawei AppGallery, il Galaxy Store e vivo. Forniscono le proprie copie delle app, non i file dal sito dello sviluppatore, e Tern li legge tramite le interfacce che hanno creato per le proprie app e siti web. Da spenti, Tern non chiede nulla a nessuno di loro, una ricerca li esclude e le app provenienti da loro sono in pausa.</string>
+    <string name="stores_off_tag">spenti in Impostazioni</string>
+    <string name="stores_checksum_matched">Il file corrisponde al checksum dello store</string>
+    <string name="stores_explain_checksum_matched">Un checksum è un\'impronta digitale del file stesso. Lo store ne ha fornito uno e il file che Tern ha scaricato ha lo stesso, quindi è arrivato come lo ha lo store. Lo store non è lo sviluppatore, quindi questo non dice nulla su chi ha creato il file. Il certificato sì.</string>
+    <string name="stores_import_from_stores">Queste provengono da store di terze parti, che forniscono le proprie copie delle app. Finché un\'app non è fissata a un certificato, il primo file che Tern installa dal suo store decide quale certificato dovranno avere i suoi aggiornamenti.</string>
+    <string name="stores_import_paused">Gli store di terze parti sono spenti, quindi queste app sono in pausa. Tern non chiede nulla a quegli store finché non li attivi.</string>
+    <string name="stores_import_names">Da store di terze parti</string>
+    <string name="share_obtainium_link">Condividi come link Obtainium</string>
+    <string name="share_obtainium_links">Condividi come link Obtainium</string>
+</resources>
diff --git a/app/src/main/res/values-it/strings_tv.xml b/app/src/main/res/values-it/strings_tv.xml
new file mode 100644
index 00000000..c0de1f7e
--- /dev/null
+++ b/app/src/main/res/values-it/strings_tv.xml
@@ -0,0 +1,5 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="interval_turn_off">Disattiva i controlli in background</string>
+    <string name="interval_turn_on">Attiva i controlli in background</string>
+</resources>
diff --git a/app/src/main/res/values-ja/strings.xml b/app/src/main/res/values-ja/strings.xml
index 2b0c9608..a2047d20 100644
--- a/app/src/main/res/values-ja/strings.xml
+++ b/app/src/main/res/values-ja/strings.xml
@@ -354,7 +354,6 @@
     <string name="settings_import_effect">TernまたはObtainiumのエクスポートから</string>
     <string name="settings_export">アプリをエクスポート</string>
     <string name="settings_exporting">エクスポート中</string>
-    <string name="settings_export_effect">リストと設定をファイルに保存します。トークンは含まれません。</string>
     <plurals name="exported">
         <item quantity="other">%d個のアプリをエクスポートしました</item>
     </plurals>
diff --git a/app/src/main/res/values-ja/strings_accept.xml b/app/src/main/res/values-ja/strings_accept.xml
new file mode 100644
index 00000000..8fe5fdcc
--- /dev/null
+++ b/app/src/main/res/values-ja/strings_accept.xml
@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="stores_paused_reason">サードパーティストアがオフになっているため、Ternはこのストアに何も問い合わせません。再度確認するには、設定でオンにしてください。</string>
+</resources>
diff --git a/app/src/main/res/values-ja/strings_checks.xml b/app/src/main/res/values-ja/strings_checks.xml
index 30676851..9f888981 100644
--- a/app/src/main/res/values-ja/strings_checks.xml
+++ b/app/src/main/res/values-ja/strings_checks.xml
@@ -15,13 +15,11 @@
     <string name="settings_only_installed">インストール済みのアプリのみ確認</string>
     <string name="settings_only_installed_effect">追跡のみのアプリも確認されます。開いたアプリは常に確認されます。</string>
     <string name="settings_remove_uninstalled">他でアンインストールされたアプリを削除</string>
-    <string name="settings_remove_uninstalled_effect">Tern以外でアンインストールしたアプリは、リストからも削除されます。</string>
     <string name="settings_file_filter">ファイルのフィルター</string>
     <string name="settings_file_filter_effect">独自のフィルターがないすべてのアプリが、ファイルを選ぶときに使うパターンです。</string>
     <string name="settings_file_filter_none">なし</string>
     <string name="settings_file_filter_invalid">このパターンは読み取れません。</string>
     <string name="settings_allow_downgrades">古いバージョンを許可</string>
-    <string name="settings_allow_downgrades_effect">Let Me Downgradeがインストールされているため、Androidは新しいバージョンの上に古いバージョンをインストールできます。</string>
     <string name="settings_collapse_groups">グループを折りたたんだ状態で開始</string>
     <string name="settings_haptics">触覚フィードバック</string>
     <string name="settings_haptics_effect">スワイプや長押しで操作が実行されたときに軽く振動します。</string>
@@ -36,7 +34,6 @@
     <string name="sources_repositories">リポジトリ</string>
     <string name="sources_stores">ストア</string>
     <string name="sources_mirrors">アプリを再配布するストア</string>
-    <string name="sources_modified">改変されたアプリのサイト</string>
     <string name="sources_other">その他の場所</string>
     <string name="sources_web_page">ファイルへのリンクがあるウェブページ</string>
     <string name="sources_direct">ファイルへの直接リンク</string>
@@ -46,8 +43,6 @@
     <string name="shared_configs_title">Obtainiumのユーザーが共有する設定</string>
     <string name="shared_configs_effect">アプリ用の既成の設定を集めたサイトです。［設定］で「Obtainiumのリンクを開く」がオンのとき、そのリンクはTernで開きます。</string>
     <string name="engine_inner_filter_nothing">アーカイブ内のファイルのフィルターが、このアーカイブ内のどのAPKにも一致しません。</string>
-    <string name="preview_republished">%1$s は、開発者が別の場所で公開しているものを再配布しています。Ternが開発者の証明書を把握すると、ここのファイルにもその証明書が求められます。可能であれば証明書をピン留めするか、先に開発者からインストールしてください。</string>
-    <string name="preview_modified">%1$s は、開発者以外の人が改変したアプリを提供しています。それらは改変した人によって署名されており、Ternには何が変更されたか判断できません。</string>
     <string name="about_track_tern">Tern自体を最新の状態に保つ</string>
     <string name="about_track_tern_effect">Tern自身のリリースをリストに追加し、他のアプリと同じように確認・検証します。</string>
     <string name="engine_channel_tracked">追跡中のアプリの新しいリリース</string>
diff --git a/app/src/main/res/values-ja/strings_options.xml b/app/src/main/res/values-ja/strings_options.xml
index d28e299d..4560a1bb 100644
--- a/app/src/main/res/values-ja/strings_options.xml
+++ b/app/src/main/res/values-ja/strings_options.xml
@@ -60,10 +60,6 @@
     <string name="option_workflow">ワークフローファイル</string>
     <string name="option_workflow_help">例: build.yml</string>
     <string name="option_branch">ブランチ</string>
-    <string name="option_device_model">端末のモデル</string>
-    <string name="option_device_model_help">Galaxy Storeはモデルごとに別のビルドを提供します（例: SM-S948B）。</string>
-    <string name="option_csc">地域コード (CSC)</string>
-    <string name="option_csc_help">3文字（例: DBT）。</string>
     <string name="option_link_filter">ダウンロードリンクのフィルター</string>
     <string name="option_link_filter_help">一致するリンクのみダウンロードとみなされます。</string>
     <string name="option_page_order">ページ上の順序を保つ</string>
@@ -74,11 +70,14 @@
     <string name="version_from_text">リンクのテキスト</string>
     <string name="version_from_page">ページ全体</string>
     <string name="option_headers">リクエストヘッダー</string>
-    <string name="option_headers_help">1行に1つ、Name: value の形式で。パスワードやCookieは決して入れないでください。</string>
     <string name="option_pseudo">バージョンがない場合</string>
     <string name="pseudo_default">サーバーの方法でファイルを区別</string>
     <string name="pseudo_hash">ファイルの先頭のハッシュで区別</string>
     <string name="pseudo_link">ファイルのアドレスで区別</string>
     <string name="pseudo_etag">サーバーのETagで区別</string>
     <string name="option_invalid">このままでは使用できません。</string>
+    <string name="option_device_model">端末のモデル</string>
+    <string name="option_device_model_help">Galaxy Storeはモデルごとに別のビルドを提供します（例: SM-S948B）。</string>
+    <string name="option_csc">地域コード (CSC)</string>
+    <string name="option_csc_help">3文字（例: DBT）。</string>
 </resources>
diff --git a/app/src/main/res/values-ja/strings_safety.xml b/app/src/main/res/values-ja/strings_safety.xml
new file mode 100644
index 00000000..027a9b88
--- /dev/null
+++ b/app/src/main/res/values-ja/strings_safety.xml
@@ -0,0 +1,28 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="settings_export_effect_plain">リストと設定をファイルに保存します。トークンが含まれることはなく、鍵を保持する可能性のあるリクエストヘッダーも含まれません。</string>
+    <string name="engine_checksum_github_proxy">ハブプロキシ %1$s が渡した、GitHubリリースのダイジェスト</string>
+    <string name="github_proxy_effect_trust">GitHubへのすべてのリクエストはこのホストを経由します。ホストは各リクエストを監視し、リリース、ダイジェスト、ファイルなど、返される内容を変更できます。保持しているアプリはそれぞれの証明書に維持されますが、これを経由した初回インストールではGitHubと同じくらいハブプロキシを信頼することになり、証明書のピン留めもそこには及びません。トークンはここを経由して送信されないため、プライベートプロジェクトやGitHub Actionsをこの方法で追跡することはできません。</string>
+    <string name="settings_unmetered_checks">Wi-Fi時のみ確認</string>
+    <string name="settings_unmetered_checks_effect">バックグラウンドチェックはWi-Fiまたはケーブル接続を待機するため、モバイルデータ通信を消費しません。</string>
+    <string name="settings_charging_checks">充電中のみ確認</string>
+    <string name="settings_charging_checks_effect">バックグラウンドチェックは端末が充電されるまで待機します。</string>
+    <string name="settings_unmetered_installs_wait">自動的にインストールされる更新は、Obtainiumと同様に、Wi-Fiまたはケーブル接続を待機します。</string>
+    <string name="settings_charging_installs_wait">自動的にインストールされる更新は、端末が充電されるまで待機します。</string>
+    <string name="engine_downgrade_not_as_named">提供元はバージョンコードを %2$d としていますが、このファイルは %1$d であり、インストールされているものより古いです。インストール済みの新しいバージョンに上書きインストールされることはありません。</string>
+    <string name="settings_allow_downgrades_picked">Let Me Downgradeがインストールされているため、Androidは新しいバージョンに古いバージョンを上書きすることがあります。Ternはアプリの履歴から選択したリリースに対してのみこれを行い、バックグラウンドや「すべて更新」で実行することはありません。</string>
+    <string name="option_highest_version">Tern 0.1.0 のように、最も高いバージョンを取得する</string>
+    <string name="option_highest_version_effect">ページ内の位置に関係なく、最も高いバージョンのリンクを提供し、各リンクから読み取ったバージョンにバージョンのパターンを適用します。オフにすると、Obtainiumと同じようにページを読み取ります: 順番の最後にあるリンクが最新になります。</string>
+    <string name="settings_remove_uninstalled_keeps_pins">Tern以外でアンインストールしたアプリもリストから削除されます。アーカイブされたアプリは残ります。同じ場所から再度追加された場合、アプリは以前保持していた証明書に維持されますが、Tern内で削除するとその情報は忘れられます。</string>
+    <string name="link_check_title">今すぐ更新を確認しますか？</string>
+    <string name="link_check_one">リンクからTernに %1$s の更新を確認するよう要求がありました。その提供元に問い合わせを行いますが、何もインストールされません。</string>
+    <plurals name="link_check_all">
+        <item quantity="other">リンクからTernにリスト内の %d 個のアプリの更新を確認するよう要求がありました。それぞれの提供元に問い合わせを行いますが、何もインストールされません。</item>
+    </plurals>
+    <string name="link_check_confirm">確認</string>
+    <string name="link_check_not_now">今はしない</string>
+    <string name="engine_installer_fell_back">%1$s は準備ができていなかったため、今回はAndroidのインストーラーが使用されました。</string>
+    <string name="about_track_tern_fdroid_effect">F-Droidがこのコピーをインストールしたため、Ternはそこにあるエントリを追跡します: 更新は、F-Droidアプリが取得するのと同じ、F-Droidがビルドして確認したものです。</string>
+    <string name="about_track_tern_github">代わりにGitHubリリースを追跡</string>
+    <string name="about_track_tern_github_effect">更新は、F-Droidがビルドして確認する前、公開されるとすぐにGitHubから取得されます。これによりF-Droidの確認はスキップされます。Ternは引き続き各ファイルを確認し、独自の証明書に維持します。</string>
+</resources>
diff --git a/app/src/main/res/values-ja/strings_settings_more.xml b/app/src/main/res/values-ja/strings_settings_more.xml
index 7066ad7b..5f5c7d7d 100644
--- a/app/src/main/res/values-ja/strings_settings_more.xml
+++ b/app/src/main/res/values-ja/strings_settings_more.xml
@@ -36,9 +36,7 @@
     <string name="settings_auto_installs">更新を自動的にインストールする</string>
     <string name="settings_auto_installs_effect">自動更新に設定されたアプリは、バックグラウンドでの確認後に更新されます。オフにすると、更新があることを知らせるだけになり、各アプリの設定は後のためにそのまま保持されます。</string>
     <string name="settings_unmetered_installs">Wi-Fiでのみインストール</string>
-    <string name="settings_unmetered_installs_effect">確認はどのネットワークでも実行されます。自動でインストールされる更新は、Obtainiumと同様に、Wi-Fiまたは有線接続になるまで待機します。</string>
     <string name="settings_charging_installs">充電中のみインストール</string>
-    <string name="settings_charging_installs_effect">確認はバッテリー駆動中も実行されます。自動でインストールされる更新は、端末が充電中になるまで待機します。</string>
     <string name="engine_unreadable_app">保存されたアプリ %1$s を読み込めなかったため、リストから除外しています。何も削除されていません。新しいバージョンのTernなら読み込める可能性があります。</string>
     <string name="settings_pin_certificates">コードホスティングの証明書をピン留め</string>
     <string name="settings_pin_certificates_effect">GitHub、GitLab、Codebergは、Obtainiumと同様に、それぞれが使用していることが知られている認証局の証明書を提示する必要があります。別の認証局が発行させられた証明書は拒否されます。コードホスティングが認証局を変更すると、これをオフにするまで、そこでの確認は失敗します。</string>
diff --git a/app/src/main/res/values-ja/strings_sources_more.xml b/app/src/main/res/values-ja/strings_sources_more.xml
index 7125b886..8224a78a 100644
--- a/app/src/main/res/values-ja/strings_sources_more.xml
+++ b/app/src/main/res/values-ja/strings_sources_more.xml
@@ -18,10 +18,7 @@
     <string name="step_arch">この端末のプロセッサを優先</string>
     <string name="step_add">ページを追加</string>
     <string name="step_remove">このページを削除</string>
-    <string name="option_file_version">ファイル名をバージョンとして使用</string>
-    <string name="option_file_version_effect">この場合、各ファイルが独立したリリースとして扱われます。</string>
     <string name="github_proxy_title">hubproxy経由のGitHub</string>
-    <string name="github_proxy_effect">GitHubへのすべてのリクエストがこのホストに送られ、ホストはそのすべてを見ることができます。トークンはこのホストを通して送信されないため、この方法では非公開プロジェクトやGitHub Actionsを追跡できません。</string>
     <string name="github_proxy_host">hubproxyのホスト</string>
     <string name="github_proxy_help">ホスト名のみ（例: gh-proxy.com）。TernはHTTPSで接続します。</string>
     <string name="github_proxy_invalid">これはTernが使用できるホスト名ではありません</string>
diff --git a/app/src/main/res/values-ja/strings_starters.xml b/app/src/main/res/values-ja/strings_starters.xml
new file mode 100644
index 00000000..2934adc1
--- /dev/null
+++ b/app/src/main/res/values-ja/strings_starters.xml
@@ -0,0 +1,7 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="starter_in_list">リストにあります</string>
+    <string name="starter_on_phone">この端末にあります</string>
+    <string name="starter_on_phone_other">別の署名者のものがこの端末にあります</string>
+    <string name="starter_on_phone_other_explain">お持ちのアプリは別の鍵で署名されているため、Ternはこのアドレスから更新できません。</string>
+</resources>
diff --git a/app/src/main/res/values-ja/strings_stores.xml b/app/src/main/res/values-ja/strings_stores.xml
new file mode 100644
index 00000000..fc69de28
--- /dev/null
+++ b/app/src/main/res/values-ja/strings_stores.xml
@@ -0,0 +1,27 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="option_headers_help_own_agent">Name: value のように1行に1つずつ指定します。パスワード、Cookie、または User-Agent は絶対に含めないでください: TernはすべてのサイトにTernであることを伝えます。</string>
+    <string name="origin_republished_first">%1$s は開発者が別の場所で公開したものを再提供しているだけで、開発者ではありません。アプリが証明書にピン留めされるまで、Ternがそこからインストールする最初のファイルによって、以降のすべての更新で必要となる証明書が決定されます。</string>
+    <string name="origin_republished_pinned">%1$s は開発者が別の場所で公開したものを再提供しているだけで、開発者ではありません。そのファイルは、このアプリが保持している証明書を持っていなければなりません。</string>
+    <string name="origin_store_first">%1$s はストアであり、開発者自身のサイトではありません。アプリが証明書にピン留めされるまで、Ternがそこからインストールする最初のファイルによって、以降のすべての更新で必要となる証明書が決定されます。</string>
+    <string name="origin_store_pinned">%1$s はストアであり、開発者自身のサイトではありません。そのファイルは、このアプリが保持している証明書を持っていなければなりません。</string>
+    <string name="stores_refused_modified">Ternは変更されたアプリを提供するサイトを読み取りません。それらのファイルは開発者以外によって変更され、変更した者によって署名されています。</string>
+    <string name="stores_refused_impersonation">Ternはそのストアのアプリを偽装しないと読み取れないため、読み取りを行いません。</string>
+    <string name="stores_checksum_source">%1$s（開発者ではありません）</string>
+    <string name="stores_off_title">%1$s はサードパーティストアです</string>
+    <string name="stores_off_body">サードパーティストアはオフになっています。ストアは開発者自身のサイトから取得したファイルではなく、ストア独自のアプリのコピーを提供し、Ternはストアが自身のアプリやウェブサイト用に作成したインターフェースを通じてそれを読み取ります。オンにすると、Ternはそこから追加したアプリについてのみストアに問い合わせを行います。また、アプリが証明書にピン留めされるまで、Ternがストアからインストールする最初のファイルによって、以降の更新で必要となる証明書が決定されます。</string>
+    <string name="stores_turn_on">サードパーティストアをオンにする</string>
+    <string name="stores_advice">このアプリをもう一度確認するには、設定でサードパーティストアをオンにしてください。</string>
+    <string name="stores_status_paused">一時停止中</string>
+    <string name="stores_row_paused">サードパーティストアはオフです</string>
+    <string name="stores_setting">サードパーティストア</string>
+    <string name="stores_setting_effect">APKPure、Aptoide、APKCombo、APKMirror、Tencent、Huawei AppGallery、Galaxy Store、vivoが該当します。これらは開発者自身のサイトからのファイルではなく、独自のアプリのコピーを提供しており、Ternはこれらが自身のアプリやウェブサイト用に作成したインターフェースを通じて読み取ります。オフにすると、Ternはこれらに何も問い合わせず、検索から除外され、これらからのアプリは一時停止されます。</string>
+    <string name="stores_off_tag">設定でオフ</string>
+    <string name="stores_checksum_matched">ファイルはストアのチェックサムと一致します</string>
+    <string name="stores_explain_checksum_matched">チェックサムはファイル自体のフィンガープリントです。ストアが提供したものとTernがダウンロードしたファイルが同じであるため、ストアにある状態のまま届いています。ストアは開発者ではないため、誰がファイルを作成したかについては何もわかりません。証明書によって確認できます。</string>
+    <string name="stores_import_from_stores">これらは、独自のアプリのコピーを提供するサードパーティストアからのものです。アプリが証明書にピン留めされるまで、Ternがストアからインストールする最初のファイルによって、以降の更新で必要となる証明書が決定されます。</string>
+    <string name="stores_import_paused">サードパーティストアがオフになっているため、これらのアプリは一時停止されています。オンにするまで、Ternはそれらのストアには何も問い合わせません。</string>
+    <string name="stores_import_names">サードパーティストアから</string>
+    <string name="share_obtainium_link">Obtainiumリンクとして共有</string>
+    <string name="share_obtainium_links">Obtainiumリンクとして共有</string>
+</resources>
diff --git a/app/src/main/res/values-ja/strings_tv.xml b/app/src/main/res/values-ja/strings_tv.xml
new file mode 100644
index 00000000..136d28ff
--- /dev/null
+++ b/app/src/main/res/values-ja/strings_tv.xml
@@ -0,0 +1,5 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="interval_turn_off">バックグラウンドチェックをオフにする</string>
+    <string name="interval_turn_on">バックグラウンドチェックをオンにする</string>
+</resources>
diff --git a/app/src/main/res/values-ko/strings.xml b/app/src/main/res/values-ko/strings.xml
index 4ac9f083..b607330b 100644
--- a/app/src/main/res/values-ko/strings.xml
+++ b/app/src/main/res/values-ko/strings.xml
@@ -354,7 +354,6 @@
     <string name="settings_import_effect">Tern 또는 Obtainium의 내보내기 파일에서 가져옵니다.</string>
     <string name="settings_export">앱 내보내기</string>
     <string name="settings_exporting">내보내는 중</string>
-    <string name="settings_export_effect">목록과 설정을 파일로 저장합니다. 토큰은 포함되지 않습니다.</string>
     <plurals name="exported">
         <item quantity="other">앱 %d개 내보냄</item>
     </plurals>
diff --git a/app/src/main/res/values-ko/strings_accept.xml b/app/src/main/res/values-ko/strings_accept.xml
new file mode 100644
index 00000000..d01873d4
--- /dev/null
+++ b/app/src/main/res/values-ko/strings_accept.xml
@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="stores_paused_reason">타사 스토어가 꺼져 있어 Tern은 이 스토어에 아무것도 요청하지 않습니다. 다시 확인하려면 설정에서 켜세요.</string>
+</resources>
diff --git a/app/src/main/res/values-ko/strings_checks.xml b/app/src/main/res/values-ko/strings_checks.xml
index 6fef05fb..0cb7ffe2 100644
--- a/app/src/main/res/values-ko/strings_checks.xml
+++ b/app/src/main/res/values-ko/strings_checks.xml
@@ -15,13 +15,11 @@
     <string name="settings_only_installed">설치된 앱만 확인</string>
     <string name="settings_only_installed_effect">추적만 하는 앱도 확인합니다. 직접 연 앱은 항상 확인합니다.</string>
     <string name="settings_remove_uninstalled">다른 곳에서 설치 삭제한 앱 제거</string>
-    <string name="settings_remove_uninstalled_effect">Tern 밖에서 설치 삭제한 앱은 목록에서도 제거됩니다.</string>
     <string name="settings_file_filter">파일 필터</string>
     <string name="settings_file_filter_effect">자체 필터가 없는 모든 앱이 파일을 고를 때 사용하는 패턴입니다.</string>
     <string name="settings_file_filter_none">없음</string>
     <string name="settings_file_filter_invalid">이 패턴을 읽을 수 없습니다.</string>
     <string name="settings_allow_downgrades">이전 버전 허용</string>
-    <string name="settings_allow_downgrades_effect">Let Me Downgrade가 설치되어 있으므로 Android가 최신 버전 위에 이전 버전을 설치할 수 있습니다.</string>
     <string name="settings_collapse_groups">그룹을 접은 상태로 시작</string>
     <string name="settings_haptics">햅틱 피드백</string>
     <string name="settings_haptics_effect">스와이프나 길게 누르기로 동작이 실행될 때 가볍게 진동합니다.</string>
@@ -36,7 +34,6 @@
     <string name="sources_repositories">저장소</string>
     <string name="sources_stores">스토어</string>
     <string name="sources_mirrors">앱을 재배포하는 스토어</string>
-    <string name="sources_modified">변경된 앱을 제공하는 사이트</string>
     <string name="sources_other">기타 위치</string>
     <string name="sources_web_page">파일 링크가 있는 웹 페이지</string>
     <string name="sources_direct">파일 직접 링크</string>
@@ -46,8 +43,6 @@
     <string name="shared_configs_title">Obtainium 사용자들이 공유한 구성</string>
     <string name="shared_configs_effect">앱용으로 미리 만들어진 설정을 모은 사이트입니다. 설정에서 \"Obtainium 링크 열기\"가 켜져 있으면 이 사이트의 링크가 Tern에서 열립니다.</string>
     <string name="engine_inner_filter_nothing">아카이브 내 파일 필터가 이 아카이브의 어떤 APK와도 일치하지 않습니다.</string>
-    <string name="preview_republished">%1$s은(는) 개발자가 다른 곳에 게시한 것을 다시 제공합니다. Tern이 개발자의 인증서를 알게 되면 이곳의 파일은 그 인증서와 일치해야 하므로, 가능하면 인증서를 고정하거나 먼저 개발자에게서 설치하세요.</string>
-    <string name="preview_modified">%1$s은(는) 개발자가 아닌 다른 사람이 변경한 앱을 제공합니다. 이 앱들은 변경한 사람이 서명했으며, Tern은 무엇이 변경되었는지 알 수 없습니다.</string>
     <string name="about_track_tern">Tern 자체를 최신 상태로 유지</string>
     <string name="about_track_tern_effect">Tern의 자체 릴리스를 목록에 추가하며, 다른 앱처럼 확인하고 검증합니다.</string>
     <string name="engine_channel_tracked">추적 중인 앱의 새 릴리스</string>
diff --git a/app/src/main/res/values-ko/strings_options.xml b/app/src/main/res/values-ko/strings_options.xml
index ad4d684b..b72eeadb 100644
--- a/app/src/main/res/values-ko/strings_options.xml
+++ b/app/src/main/res/values-ko/strings_options.xml
@@ -60,10 +60,6 @@
     <string name="option_workflow">워크플로 파일</string>
     <string name="option_workflow_help">예: build.yml</string>
     <string name="option_branch">브랜치</string>
-    <string name="option_device_model">기기 모델</string>
-    <string name="option_device_model_help">Galaxy Store는 모델마다 별도의 빌드를 제공합니다(예: SM-S948B).</string>
-    <string name="option_csc">지역 코드(CSC)</string>
-    <string name="option_csc_help">세 글자입니다(예: DBT).</string>
     <string name="option_link_filter">다운로드 링크 필터</string>
     <string name="option_link_filter_help">일치하는 링크만 다운로드로 간주합니다.</string>
     <string name="option_page_order">페이지의 순서 유지</string>
@@ -74,11 +70,14 @@
     <string name="version_from_text">링크 텍스트</string>
     <string name="version_from_page">전체 페이지</string>
     <string name="option_headers">요청 헤더</string>
-    <string name="option_headers_help">한 줄에 하나씩, Name: value 형식으로 입력합니다. 비밀번호나 쿠키는 절대 넣지 마세요.</string>
     <string name="option_pseudo">버전이 없을 때</string>
     <string name="pseudo_default">서버 방식대로 파일 구분</string>
     <string name="pseudo_hash">파일 앞부분의 해시로 구분</string>
     <string name="pseudo_link">파일 주소로 구분</string>
     <string name="pseudo_etag">서버의 ETag로 구분</string>
     <string name="option_invalid">이대로는 사용할 수 없습니다.</string>
+    <string name="option_device_model">기기 모델</string>
+    <string name="option_device_model_help">Galaxy Store는 모델마다 별도의 빌드를 제공합니다(예: SM-S948B).</string>
+    <string name="option_csc">지역 코드(CSC)</string>
+    <string name="option_csc_help">세 글자입니다(예: DBT).</string>
 </resources>
diff --git a/app/src/main/res/values-ko/strings_safety.xml b/app/src/main/res/values-ko/strings_safety.xml
new file mode 100644
index 00000000..07e9799f
--- /dev/null
+++ b/app/src/main/res/values-ko/strings_safety.xml
@@ -0,0 +1,28 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="settings_export_effect_plain">목록과 설정을 파일로 저장합니다. 토큰은 포함되지 않으며 키가 포함될 수 있는 요청 헤더도 포함되지 않습니다.</string>
+    <string name="engine_checksum_github_proxy">hubproxy %1$s이(가) 전달한 GitHub 릴리스 다이제스트</string>
+    <string name="github_proxy_effect_trust">GitHub에 대한 모든 요청이 이 호스트로 이동합니다. 호스트는 각 요청을 확인하며 반환되는 릴리스, 다이제스트, 파일을 변경할 수 있습니다. 이미 보유한 앱은 인증서에 고정된 상태를 유지하지만 이 호스트를 통한 첫 설치는 GitHub만큼 hubproxy를 신뢰하게 되며 인증서 고정이 적용되지 않습니다. 토큰은 이 호스트를 통해 전송되지 않으므로 이 방법으로 비공개 프로젝트와 GitHub Actions를 추적할 수 없습니다.</string>
+    <string name="settings_unmetered_checks">Wi-Fi에서만 확인</string>
+    <string name="settings_unmetered_checks_effect">백그라운드 확인이 Wi-Fi 또는 유선 연결을 기다리므로 모바일 데이터를 사용하지 않습니다.</string>
+    <string name="settings_charging_checks">충전 중에만 확인</string>
+    <string name="settings_charging_checks_effect">백그라운드 확인이 기기가 충전될 때까지 기다립니다.</string>
+    <string name="settings_unmetered_installs_wait">Obtainium에서와 같이 자동으로 설치될 업데이트가 Wi-Fi 또는 유선 연결을 기다립니다.</string>
+    <string name="settings_charging_installs_wait">자동으로 설치될 업데이트가 기기가 충전될 때까지 기다립니다.</string>
+    <string name="engine_downgrade_not_as_named">소스에서 지정한 버전 코드는 %2$d이지만 이 파일은 %1$d(으)로 설치된 버전보다 오래되었습니다. 최신 버전 위에 설치되지 않습니다.</string>
+    <string name="settings_allow_downgrades_picked">Let Me Downgrade가 설치되어 있어 Android가 최신 버전 위에 이전 버전을 설치할 수 있습니다. Tern은 백그라운드나 모두 업데이트가 아닌 앱 기록에서 사용자가 선택한 릴리스에 대해서만 이 작업을 수행합니다.</string>
+    <string name="option_highest_version">Tern 0.1.0처럼 가장 높은 버전 선택</string>
+    <string name="option_highest_version_effect">위치에 관계없이 페이지에서 가장 높은 버전의 링크를 제공하며 각 링크에서 읽은 버전에 버전 패턴을 실행합니다. 끄면 Obtainium과 같은 방식으로 페이지를 읽습니다: 순서상 마지막 링크가 최신입니다.</string>
+    <string name="settings_remove_uninstalled_keeps_pins">Tern 외부에서 제거한 앱은 목록에서도 사라집니다. 보관된 앱은 유지됩니다. 같은 곳에서 다시 추가하면 앱이 기존에 가졌던 인증서로 유지되지만, Tern에서 제거하면 그 정보를 잊습니다.</string>
+    <string name="link_check_title">지금 업데이트를 확인하시겠습니까?</string>
+    <string name="link_check_one">링크가 Tern에게 %1$s의 업데이트를 확인하도록 요청했습니다. 해당 소스에 요청하며 아무것도 설치되지 않습니다.</string>
+    <plurals name="link_check_all">
+        <item quantity="other">링크가 Tern에게 목록에 있는 %d개 앱의 업데이트를 확인하도록 요청했습니다. 해당 소스들에 요청하며 아무것도 설치되지 않습니다.</item>
+    </plurals>
+    <string name="link_check_confirm">지금 확인</string>
+    <string name="link_check_not_now">지금은 안 함</string>
+    <string name="engine_installer_fell_back">%1$s이(가) 준비되지 않아 이 앱에는 Android의 설치 앱이 사용되었습니다.</string>
+    <string name="about_track_tern_fdroid_effect">F-Droid가 이 사본을 설치했으므로 Tern은 해당 항목을 따릅니다: 업데이트는 F-Droid 앱이 가져오는 대로 F-Droid가 만들고 확인한 빌드입니다.</string>
+    <string name="about_track_tern_github">대신 GitHub 릴리스 추적</string>
+    <string name="about_track_tern_github_effect">업데이트가 F-Droid에서 빌드하고 확인하기 전에 게시되는 즉시 GitHub에서 가져옵니다. 이는 F-Droid의 확인을 건너뜁니다. Tern은 여전히 각 파일을 확인하고 자체 인증서로 유지합니다.</string>
+</resources>
diff --git a/app/src/main/res/values-ko/strings_settings_more.xml b/app/src/main/res/values-ko/strings_settings_more.xml
index d67ae832..4a389f5c 100644
--- a/app/src/main/res/values-ko/strings_settings_more.xml
+++ b/app/src/main/res/values-ko/strings_settings_more.xml
@@ -36,9 +36,7 @@
     <string name="settings_auto_installs">업데이트 자동 설치</string>
     <string name="settings_auto_installs_effect">자동으로 업데이트하도록 설정된 앱은 백그라운드 확인 후 업데이트됩니다. 끄면 업데이트가 있다고 알리기만 하며, 각 앱의 선택은 나중을 위해 그대로 유지됩니다.</string>
     <string name="settings_unmetered_installs">Wi-Fi에서만 설치</string>
-    <string name="settings_unmetered_installs_effect">확인은 모든 네트워크에서 실행됩니다. 자동으로 설치될 업데이트는 Obtainium과 마찬가지로 Wi-Fi나 유선 연결이 될 때까지 기다립니다.</string>
     <string name="settings_charging_installs">충전 중일 때만 설치</string>
-    <string name="settings_charging_installs_effect">확인은 배터리 사용 중에도 실행됩니다. 자동으로 설치될 업데이트는 기기가 충전될 때까지 기다립니다.</string>
     <string name="engine_unreadable_app">저장된 앱 %1$s을(를) 읽을 수 없어 목록에서 제외했습니다. 삭제된 것은 없습니다. 더 최신 버전의 Tern은 읽을 수도 있습니다.</string>
     <string name="settings_pin_certificates">코드 호스팅 인증서 고정</string>
     <string name="settings_pin_certificates_effect">GitHub, GitLab, Codeberg는 Obtainium과 마찬가지로 각각 사용하는 것으로 알려진 인증 기관의 인증서를 제시해야 합니다. 다른 인증 기관이 발급하도록 강제된 인증서는 거부됩니다. 코드 호스팅이 인증 기관을 바꾸면, 이 설정을 끌 때까지 해당 사이트에 대한 확인이 실패합니다.</string>
diff --git a/app/src/main/res/values-ko/strings_sources_more.xml b/app/src/main/res/values-ko/strings_sources_more.xml
index a3a7205a..8674030b 100644
--- a/app/src/main/res/values-ko/strings_sources_more.xml
+++ b/app/src/main/res/values-ko/strings_sources_more.xml
@@ -18,10 +18,7 @@
     <string name="step_arch">이 기기의 프로세서 우선</string>
     <string name="step_add">페이지 추가</string>
     <string name="step_remove">이 페이지 제거</string>
-    <string name="option_file_version">파일 이름을 버전으로 사용</string>
-    <string name="option_file_version_effect">그러면 각 파일이 별개의 릴리스로 취급됩니다.</string>
     <string name="github_proxy_title">hubproxy를 통한 GitHub</string>
-    <string name="github_proxy_effect">GitHub로 가는 모든 요청이 이 호스트로 전달되며, 호스트는 각 요청을 볼 수 있습니다. 토큰은 이 호스트를 통해 전송되지 않으므로 이 방식으로는 비공개 프로젝트와 GitHub Actions를 추적할 수 없습니다.</string>
     <string name="github_proxy_host">hubproxy 호스트</string>
     <string name="github_proxy_help">gh-proxy.com처럼 호스트 이름만 입력하세요. Tern은 HTTPS로 접속합니다.</string>
     <string name="github_proxy_invalid">Tern이 사용할 수 있는 호스트 이름이 아닙니다</string>
diff --git a/app/src/main/res/values-ko/strings_starters.xml b/app/src/main/res/values-ko/strings_starters.xml
new file mode 100644
index 00000000..73fb5c23
--- /dev/null
+++ b/app/src/main/res/values-ko/strings_starters.xml
@@ -0,0 +1,7 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="starter_in_list">목록에 있음</string>
+    <string name="starter_on_phone">이 휴대전화에 있음</string>
+    <string name="starter_on_phone_other">다른 서명자의 앱이 이 휴대전화에 있음</string>
+    <string name="starter_on_phone_other_explain">설치된 앱은 다른 키로 서명되어 있어 Tern이 이 주소에서 업데이트할 수 없습니다.</string>
+</resources>
diff --git a/app/src/main/res/values-ko/strings_stores.xml b/app/src/main/res/values-ko/strings_stores.xml
new file mode 100644
index 00000000..00ff8949
--- /dev/null
+++ b/app/src/main/res/values-ko/strings_stores.xml
@@ -0,0 +1,27 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="option_headers_help_own_agent">한 줄에 하나씩 Name: value 형식으로 입력하세요. 비밀번호, 쿠키, User-Agent는 절대 입력하지 마세요. Tern은 모든 사이트에 자신이 Tern임을 알립니다.</string>
+    <string name="origin_republished_first">%1$s은(는) 개발자가 다른 곳에 게시한 항목을 다시 제공할 뿐, 개발자가 아닙니다. 앱이 인증서에 고정될 때까지 Tern이 이곳에서 설치하는 첫 파일이 이후 모든 업데이트에 포함되어야 할 인증서를 결정합니다.</string>
+    <string name="origin_republished_pinned">%1$s은(는) 개발자가 다른 곳에 게시한 항목을 다시 제공할 뿐, 개발자가 아닙니다. 이 소스의 파일은 이 앱에 고정된 인증서를 포함해야 합니다.</string>
+    <string name="origin_store_first">%1$s은(는) 개발자 자체 사이트가 아닌 스토어입니다. 앱이 인증서에 고정될 때까지 Tern이 이곳에서 설치하는 첫 파일이 이후 모든 업데이트에 포함되어야 할 인증서를 결정합니다.</string>
+    <string name="origin_store_pinned">%1$s은(는) 개발자 자체 사이트가 아닌 스토어입니다. 이 스토어의 파일은 이 앱에 고정된 인증서를 포함해야 합니다.</string>
+    <string name="stores_refused_modified">Tern은 수정된 앱을 제공하는 사이트를 읽지 않습니다. 이러한 파일은 개발자가 아닌 다른 사람이 변경했으며 변경한 사람이 서명했습니다.</string>
+    <string name="stores_refused_impersonation">Tern은 이 스토어의 앱인 척하지 않고는 스토어를 읽을 수 없으므로 읽지 않습니다.</string>
+    <string name="stores_checksum_source">개발자가 아닌 %1$s</string>
+    <string name="stores_off_title">%1$s은(는) 서드파티 스토어입니다</string>
+    <string name="stores_off_body">서드파티 스토어가 꺼져 있습니다. 스토어는 개발자 자체 사이트의 파일이 아닌 앱의 자체 사본을 제공하며, Tern은 스토어가 자체 앱이나 웹사이트를 위해 만든 인터페이스를 통해 이를 읽습니다. 이 설정을 켜면 Tern은 사용자가 해당 스토어에서 추가한 앱에 대해서만 스토어에 요청하며, 앱이 인증서에 고정될 때까지 Tern이 스토어에서 설치하는 첫 파일이 이후 모든 업데이트에 포함되어야 할 인증서를 결정합니다.</string>
+    <string name="stores_turn_on">서드파티 스토어 켜기</string>
+    <string name="stores_advice">이 앱을 다시 확인하려면 설정에서 서드파티 스토어를 켜세요.</string>
+    <string name="stores_status_paused">일시중지됨</string>
+    <string name="stores_row_paused">서드파티 스토어 꺼짐</string>
+    <string name="stores_setting">서드파티 스토어</string>
+    <string name="stores_setting_effect">APKPure, Aptoide, APKCombo, APKMirror, Tencent, Huawei AppGallery, Galaxy Store 및 vivo입니다. 스토어는 개발자 자체 사이트의 파일이 아닌 자체 앱 사본을 제공하며, Tern은 스토어가 자체 앱이나 웹사이트를 위해 만든 인터페이스를 통해 이를 읽습니다. 끄면 Tern은 이들에게 아무것도 요청하지 않으며 검색에서 제외되고 해당 스토어의 앱이 일시중지됩니다.</string>
+    <string name="stores_off_tag">설정에서 꺼짐</string>
+    <string name="stores_checksum_matched">파일이 스토어의 체크섬과 일치합니다</string>
+    <string name="stores_explain_checksum_matched">체크섬은 파일 자체의 지문입니다. 스토어에서 제공한 체크섬과 Tern이 다운로드한 파일이 동일하므로 스토어에 있는 그대로 도착했습니다. 스토어는 개발자가 아니므로 이것만으로는 누가 파일을 만들었는지 알 수 없습니다. 이는 인증서로 알 수 있습니다.</string>
+    <string name="stores_import_from_stores">자체 앱 사본을 제공하는 서드파티 스토어에서 가져왔습니다. 앱이 인증서에 고정될 때까지 Tern이 해당 스토어에서 설치하는 첫 파일이 이후 모든 업데이트에 포함되어야 할 인증서를 결정합니다.</string>
+    <string name="stores_import_paused">서드파티 스토어가 꺼져 있어 이 앱들이 일시중지되었습니다. 설정을 켤 때까지 Tern은 해당 스토어에 아무것도 요청하지 않습니다.</string>
+    <string name="stores_import_names">서드파티 스토어에서 가져옴</string>
+    <string name="share_obtainium_link">Obtainium 링크로 공유</string>
+    <string name="share_obtainium_links">Obtainium 링크로 공유</string>
+</resources>
diff --git a/app/src/main/res/values-ko/strings_tv.xml b/app/src/main/res/values-ko/strings_tv.xml
new file mode 100644
index 00000000..3ab75101
--- /dev/null
+++ b/app/src/main/res/values-ko/strings_tv.xml
@@ -0,0 +1,5 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="interval_turn_off">백그라운드 확인 끄기</string>
+    <string name="interval_turn_on">백그라운드 확인 켜기</string>
+</resources>
diff --git a/app/src/main/res/values-ml/strings.xml b/app/src/main/res/values-ml/strings.xml
index 741b57ea..fbf9bbe1 100644
--- a/app/src/main/res/values-ml/strings.xml
+++ b/app/src/main/res/values-ml/strings.xml
@@ -369,7 +369,6 @@
     <string name="settings_import_effect">ഒരു Tern അല്ലെങ്കിൽ Obtainium എക്സ്പോർട്ടിൽ നിന്ന്</string>
     <string name="settings_export">ആപ്പുകൾ എക്സ്പോർട്ട് ചെയ്യുക</string>
     <string name="settings_exporting">എക്സ്പോർട്ട് ചെയ്യുന്നു</string>
-    <string name="settings_export_effect">നിങ്ങളുടെ ലിസ്റ്റും സെറ്റിംഗ്‌സും ഒരു ഫയലിലേക്ക് സേവ് ചെയ്യുന്നു. ടോക്കണുകൾ ഒരിക്കലും ഉൾപ്പെടുത്തില്ല.</string>
     <plurals name="exported">
         <item quantity="one">%d ആപ്പ് എക്സ്പോർട്ട് ചെയ്തു</item>
         <item quantity="other">%d ആപ്പുകൾ എക്സ്പോർട്ട് ചെയ്തു</item>
diff --git a/app/src/main/res/values-ml/strings_accept.xml b/app/src/main/res/values-ml/strings_accept.xml
new file mode 100644
index 00000000..fbea6b6c
--- /dev/null
+++ b/app/src/main/res/values-ml/strings_accept.xml
@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="stores_paused_reason">തേർഡ് പാർട്ടി സ്റ്റോറുകൾ ഓഫാണ്, അതിനാൽ Tern ഈ സ്റ്റോറിനോട് ഒന്നും ചോദിക്കുന്നില്ല. വീണ്ടും പരിശോധിക്കാൻ സെറ്റിംഗ്സിൽ അവ ഓൺ ചെയ്യുക.</string>
+</resources>
diff --git a/app/src/main/res/values-ml/strings_checks.xml b/app/src/main/res/values-ml/strings_checks.xml
index 30a343be..e80cd7f7 100644
--- a/app/src/main/res/values-ml/strings_checks.xml
+++ b/app/src/main/res/values-ml/strings_checks.xml
@@ -17,13 +17,11 @@
     <string name="settings_only_installed">ഇൻസ്റ്റാൾ ചെയ്ത ആപ്പുകൾ മാത്രം പരിശോധിക്കുക</string>
     <string name="settings_only_installed_effect">പിന്തുടരുക മാത്രം ചെയ്യുന്ന ആപ്പുകളും പരിശോധിക്കും. നിങ്ങൾ തുറക്കുന്ന ആപ്പ് എപ്പോഴും പരിശോധിക്കും.</string>
     <string name="settings_remove_uninstalled">മറ്റിടങ്ങളിൽ അൺഇൻസ്റ്റാൾ ചെയ്ത ആപ്പുകൾ നീക്കംചെയ്യുക</string>
-    <string name="settings_remove_uninstalled_effect">Tern-ന് പുറത്ത് നിങ്ങൾ അൺഇൻസ്റ്റാൾ ചെയ്യുന്ന ആപ്പ് ലിസ്റ്റിൽ നിന്നും പോകും.</string>
     <string name="settings_file_filter">ഫയലുകൾക്കുള്ള ഫിൽട്ടർ</string>
     <string name="settings_file_filter_effect">സ്വന്തമായി ഫിൽട്ടർ ഇല്ലാത്ത ഓരോ ആപ്പും അതിൻ്റെ ഫയൽ തിരഞ്ഞെടുക്കാൻ ഉപയോഗിക്കുന്ന പാറ്റേൺ.</string>
     <string name="settings_file_filter_none">ഒന്നുമില്ല</string>
     <string name="settings_file_filter_invalid">ഈ പാറ്റേൺ വായിക്കാനാകില്ല.</string>
     <string name="settings_allow_downgrades">പഴയ പതിപ്പുകൾ അനുവദിക്കുക</string>
-    <string name="settings_allow_downgrades_effect">Let Me Downgrade ഇൻസ്റ്റാൾ ചെയ്തിട്ടുണ്ട്, അതിനാൽ Android-ന് പുതിയ പതിപ്പിന് മുകളിൽ പഴയ പതിപ്പ് ഇൻസ്റ്റാൾ ചെയ്യാം.</string>
     <string name="settings_collapse_groups">ഗ്രൂപ്പുകൾ മടക്കിയ നിലയിൽ ആരംഭിക്കുക</string>
     <string name="settings_haptics">ഹാപ്റ്റിക് ഫീഡ്ബാക്ക്</string>
     <string name="settings_haptics_effect">ഒരു സ്വൈപ്പോ ദീർഘനേരമുള്ള അമർത്തലോ എന്തെങ്കിലും ചെയ്യുമ്പോൾ ഒരു ചെറിയ വൈബ്രേഷൻ.</string>
@@ -38,7 +36,6 @@
     <string name="sources_repositories">റെപ്പോസിറ്ററികൾ</string>
     <string name="sources_stores">സ്റ്റോറുകൾ</string>
     <string name="sources_mirrors">ആപ്പുകൾ വീണ്ടും പ്രസിദ്ധീകരിക്കുന്ന സ്റ്റോറുകൾ</string>
-    <string name="sources_modified">മാറ്റം വരുത്തിയ ആപ്പുകളുള്ള സൈറ്റുകൾ</string>
     <string name="sources_other">മറ്റ് ഇടങ്ങൾ</string>
     <string name="sources_web_page">ഫയലുകളിലേക്കുള്ള ലിങ്കുകളുള്ള ഒരു വെബ് പേജ്</string>
     <string name="sources_direct">ഒരു ഫയലിലേക്കുള്ള നേരിട്ടുള്ള ലിങ്ക്</string>
@@ -48,8 +45,6 @@
     <string name="shared_configs_title">Obtainium ഉപയോക്താക്കൾ പങ്കിട്ട കോൺഫിഗറേഷനുകൾ</string>
     <string name="shared_configs_effect">ആപ്പുകൾക്കായി തയ്യാറാക്കിയ സെറ്റിംഗ്‌സുള്ള ഒരു സൈറ്റ്. സെറ്റിംഗ്‌സിൽ \"Obtainium ലിങ്കുകൾ തുറക്കുക\" ഓൺ ആയിരിക്കുമ്പോൾ അതിലെ ലിങ്കുകൾ Tern-ൽ തുറക്കും.</string>
     <string name="engine_inner_filter_nothing">ആർക്കൈവുകൾക്കുള്ളിലെ ഫയലുകൾക്കുള്ള ഫിൽട്ടർ ഇതിലെ ഒരു APK-യുമായും പൊരുത്തപ്പെടുന്നില്ല.</string>
-    <string name="preview_republished">ഡെവലപ്പർമാർ മറ്റിടങ്ങളിൽ പ്രസിദ്ധീകരിക്കുന്നവ %1$s വീണ്ടും വാഗ്ദാനം ചെയ്യുന്നു. ഡെവലപ്പറുടെ സർട്ടിഫിക്കറ്റ് Tern-ന് അറിയാമായിക്കഴിഞ്ഞാൽ, ഇതിലെ ഫയലുകൾ ആ സർട്ടിഫിക്കറ്റുമായി പൊരുത്തപ്പെടണം, അതിനാൽ കഴിയുമെങ്കിൽ ഒരു സർട്ടിഫിക്കറ്റ് പിൻ ചെയ്യുക അല്ലെങ്കിൽ ആദ്യം ഡെവലപ്പറിൽ നിന്ന് ഇൻസ്റ്റാൾ ചെയ്യുക.</string>
-    <string name="preview_modified">ഡെവലപ്പർ അല്ലാത്ത മറ്റാരോ മാറ്റം വരുത്തിയ ആപ്പുകളാണ് %1$s വാഗ്ദാനം ചെയ്യുന്നത്. മാറ്റം വരുത്തിയവരാണ് അവ ഒപ്പിട്ടിരിക്കുന്നത്, എന്താണ് മാറ്റിയതെന്ന് Tern-ന് പറയാനാകില്ല.</string>
     <string name="about_track_tern">Tern-നെ തന്നെ ഏറ്റവും പുതിയതായി നിലനിർത്തുക</string>
     <string name="about_track_tern_effect">Tern-ൻ്റെ സ്വന്തം റിലീസുകൾ ലിസ്റ്റിലേക്ക് ചേർക്കുന്നു, മറ്റേതൊരു ആപ്പിനെയും പോലെ പരിശോധിച്ച് സ്ഥിരീകരിക്കുന്നു.</string>
     <string name="engine_channel_tracked">പിന്തുടരുന്ന ആപ്പുകളുടെ പുതിയ റിലീസുകൾ</string>
diff --git a/app/src/main/res/values-ml/strings_options.xml b/app/src/main/res/values-ml/strings_options.xml
index 7df6ff12..be984bc9 100644
--- a/app/src/main/res/values-ml/strings_options.xml
+++ b/app/src/main/res/values-ml/strings_options.xml
@@ -62,10 +62,6 @@
     <string name="option_workflow">വർക്ക്ഫ്ലോ ഫയൽ</string>
     <string name="option_workflow_help">build.yml പോലെ.</string>
     <string name="option_branch">ബ്രാഞ്ച്</string>
-    <string name="option_device_model">ഉപകരണ മോഡൽ</string>
-    <string name="option_device_model_help">Galaxy Store ഓരോ മോഡലിനും അതിൻ്റേതായ ബിൽഡ് നൽകുന്നു, SM-S948B പോലെ.</string>
-    <string name="option_csc">പ്രദേശ കോഡ് (CSC)</string>
-    <string name="option_csc_help">മൂന്ന് അക്ഷരങ്ങൾ, DBT പോലെ.</string>
     <string name="option_link_filter">ഡൗൺലോഡ് ലിങ്കുകൾക്കുള്ള ഫിൽട്ടർ</string>
     <string name="option_link_filter_help">പൊരുത്തപ്പെടുന്ന ലിങ്കുകൾ മാത്രമേ ഡൗൺലോഡുകളായി കണക്കാക്കൂ.</string>
     <string name="option_page_order">പേജിലെ ക്രമം നിലനിർത്തുക</string>
@@ -76,11 +72,14 @@
     <string name="version_from_text">ലിങ്കിൻ്റെ ടെക്സ്റ്റ്</string>
     <string name="version_from_page">മുഴുവൻ പേജ്</string>
     <string name="option_headers">അഭ്യർത്ഥന ഹെഡറുകൾ</string>
-    <string name="option_headers_help">ഓരോ വരിയിലും ഒന്ന്, Name: value എന്ന രീതിയിൽ. ഒരിക്കലും പാസ്‌വേഡോ കുക്കിയോ ചേർക്കരുത്.</string>
     <string name="option_pseudo">പതിപ്പ് ഇല്ലാത്തപ്പോൾ</string>
     <string name="pseudo_default">സെർവർ ചെയ്യുന്നതുപോലെ ഫയലുകൾ വേർതിരിക്കുക</string>
     <string name="pseudo_hash">ഫയലിൻ്റെ തുടക്കത്തിൻ്റെ ഹാഷ് വഴി</string>
     <string name="pseudo_link">ഫയലിൻ്റെ വിലാസം വഴി</string>
     <string name="pseudo_etag">സെർവറിൻ്റെ ETag വഴി</string>
     <string name="option_invalid">ഇത് ഇതേപടി ഉപയോഗിക്കാനാകില്ല.</string>
+    <string name="option_device_model">ഉപകരണ മോഡൽ</string>
+    <string name="option_device_model_help">Galaxy Store ഓരോ മോഡലിനും അതിൻ്റേതായ ബിൽഡ് നൽകുന്നു, SM-S948B പോലെ.</string>
+    <string name="option_csc">പ്രദേശ കോഡ് (CSC)</string>
+    <string name="option_csc_help">മൂന്ന് അക്ഷരങ്ങൾ, DBT പോലെ.</string>
 </resources>
diff --git a/app/src/main/res/values-ml/strings_safety.xml b/app/src/main/res/values-ml/strings_safety.xml
new file mode 100644
index 00000000..4e367782
--- /dev/null
+++ b/app/src/main/res/values-ml/strings_safety.xml
@@ -0,0 +1,29 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="settings_export_effect_plain">നിങ്ങളുടെ ലിസ്റ്റും സെറ്റിംഗ്സും ഒരു ഫയലിലേക്ക് സേവ് ചെയ്യുന്നു. ടോക്കണുകൾ ഒരിക്കലും ഉൾപ്പെടുത്തില്ല, കൂടാതെ ഒരു കീ അടങ്ങിയേക്കാവുന്ന റിക്വസ്റ്റ് ഹെഡറുകളും ഉൾപ്പെടുത്തില്ല.</string>
+    <string name="engine_checksum_github_proxy">ഹബ്പ്രോക്സി %1$s കൈമാറിയതുപോലെയുള്ള, GitHub റിലീസ് ഡൈജസ്റ്റ്</string>
+    <string name="github_proxy_effect_trust">GitHub-ലേക്കുള്ള എല്ലാ റിക്വസ്റ്റും ഈ ഹോസ്റ്റിലേക്കാണ് പോകുന്നത്. ഓരോന്നും കാണുന്ന ഇതിന് തിരികെ വരുന്ന കാര്യങ്ങളിൽ മാറ്റം വരുത്താനാകും: റിലീസുകൾ, അവയുടെ ഡൈജസ്റ്റുകൾ, ഫയലുകൾ എന്നിവയിൽ. നിങ്ങളുടെ പക്കലുള്ള ആപ്പുകൾ അവയുടെ സർട്ടിഫിക്കറ്റിൽ തന്നെ തുടരും, എന്നാൽ ഇതിലൂടെയുള്ള ആദ്യ ഇൻസ്റ്റാൾ GitHub-നെ പോലെ തന്നെ ഹബ്പ്രോക്സിയെയും വിശ്വസിക്കുന്നു, മാത്രമല്ല പിൻ ചെയ്ത സർട്ടിഫിക്കറ്റ് അതിലേക്ക് എത്തില്ല. ഇതിലൂടെ ടോക്കണുകളൊന്നും അയയ്ക്കാത്തതിനാൽ, സ്വകാര്യ പ്രോജക്റ്റുകളും GitHub ആക്ഷൻസും ഈ രീതിയിൽ പിന്തുടരാനാകില്ല.</string>
+    <string name="settings_unmetered_checks">Wi-Fi-യിൽ മാത്രം പരിശോധിക്കുക</string>
+    <string name="settings_unmetered_checks_effect">പശ്ചാത്തല പരിശോധനകൾ Wi-Fi-യ്ക്കോ കേബിളിനോ വേണ്ടി കാത്തിരിക്കും, അതിനാൽ അവ മൊബൈൽ ഡാറ്റ ഉപയോഗിക്കില്ല.</string>
+    <string name="settings_charging_checks">ചാർജ് ചെയ്യുമ്പോൾ മാത്രം പരിശോധിക്കുക</string>
+    <string name="settings_charging_checks_effect">പശ്ചാത്തല പരിശോധനകൾ ഉപകരണം ചാർജ് ചെയ്യുന്നത് വരെ കാത്തിരിക്കും.</string>
+    <string name="settings_unmetered_installs_wait">തനിയെ ഇൻസ്റ്റാൾ ചെയ്യുന്ന ഒരു അപ്ഡേറ്റ് Obtainium-ലെന്നപോലെ Wi-Fi-യ്ക്കോ കേബിളിനോ വേണ്ടി കാത്തിരിക്കും.</string>
+    <string name="settings_charging_installs_wait">തനിയെ ഇൻസ്റ്റാൾ ചെയ്യുന്ന ഒരു അപ്ഡേറ്റ് ഉപകരണം ചാർജ് ചെയ്യുന്നത് വരെ കാത്തിരിക്കും.</string>
+    <string name="engine_downgrade_not_as_named">ഉറവിടം പതിപ്പ് കോഡ് %2$d എന്ന് നൽകിയെങ്കിലും, ഇൻസ്റ്റാൾ ചെയ്തതിനേക്കാൾ പഴയതായ %1$d ആണ് ഈ ഫയൽ. പുതിയതിന് മുകളിൽ ഇത് ഇൻസ്റ്റാൾ ചെയ്യില്ല.</string>
+    <string name="settings_allow_downgrades_picked">Let Me Downgrade ഇൻസ്റ്റാൾ ചെയ്തിരിക്കുന്നതിനാൽ, പുതിയ പതിപ്പിന് മുകളിൽ പഴയത് Android ഇൻസ്റ്റാൾ ചെയ്തേക്കാം. ഒരു ആപ്പിൻ്റെ ഹിസ്റ്ററിയിൽ നിന്നും നിങ്ങൾ തിരഞ്ഞെടുക്കുന്ന ഒരു റിലീസിന് വേണ്ടി മാത്രമേ Tern അങ്ങനെ ചെയ്യൂ, പശ്ചാത്തലത്തിലോ അല്ലെങ്കിൽ എല്ലാം അപ്ഡേറ്റ് ചെയ്യുക എന്നതിലോ ഒരിക്കലും ചെയ്യില്ല.</string>
+    <string name="option_highest_version">Tern 0.1.0 ചെയ്തതുപോലെ ഏറ്റവും ഉയർന്ന പതിപ്പ് എടുക്കുക</string>
+    <string name="option_highest_version_effect">പേജിൽ ഏത് സ്ഥാനത്താണെങ്കിലും ഏറ്റവും ഉയർന്ന പതിപ്പുള്ള ലിങ്ക് വാഗ്ദാനം ചെയ്യുന്നു, കൂടാതെ ഓരോ ലിങ്കിൽ നിന്നും വായിക്കുന്ന പതിപ്പിൽ പതിപ്പ് പാറ്റേൺ പ്രവർത്തിപ്പിക്കുന്നു. ഓഫ് ചെയ്യുന്നത് Obtainium വായിക്കുന്നതുപോലെ പേജ് വായിക്കുന്നു: ക്രമത്തിലെ അവസാന ലിങ്കാണ് ഏറ്റവും പുതിയത്.</string>
+    <string name="settings_remove_uninstalled_keeps_pins">Tern-ന് പുറത്ത് നിങ്ങൾ അൺഇൻസ്റ്റാൾ ചെയ്യുന്ന ഒരു ആപ്പ് ലിസ്റ്റിൽ നിന്നും പോകും. ആർക്കൈവ് ചെയ്ത ആപ്പ് തുടരും. അതേയിടത്ത് നിന്ന് വീണ്ടും ചേർക്കുമ്പോൾ, ആപ്പിന് ഉണ്ടായിരുന്ന സർട്ടിഫിക്കറ്റ് തന്നെ നിലനിർത്തും; Tern-ൽ അത് നീക്കംചെയ്താൽ അത് മറക്കും.</string>
+    <string name="link_check_title">ഇപ്പോൾ അപ്ഡേറ്റുകൾക്കായി പരിശോധിക്കണോ?</string>
+    <string name="link_check_one">%1$s-ൽ അപ്ഡേറ്റുകൾക്കായി പരിശോധിക്കാൻ ഒരു ലിങ്ക് Tern-നോട് ആവശ്യപ്പെട്ടു. ഇതിൻ്റെ ഉറവിടത്തോട് ചോദിക്കുന്നു, കൂടാതെ ഒന്നും ഇൻസ്റ്റാൾ ചെയ്യുകയുമില്ല.</string>
+    <plurals name="link_check_all">
+        <item quantity="one">നിങ്ങളുടെ ലിസ്റ്റിലെ %d ആപ്പിൽ അപ്ഡേറ്റുകൾക്കായി പരിശോധിക്കാൻ ഒരു ലിങ്ക് Tern-നോട് ആവശ്യപ്പെട്ടു. അതിൻ്റെ ഉറവിടത്തോട് ചോദിക്കുന്നു, കൂടാതെ ഒന്നും ഇൻസ്റ്റാൾ ചെയ്യുകയുമില്ല.</item>
+        <item quantity="other">നിങ്ങളുടെ ലിസ്റ്റിലെ %d ആപ്പുകളിൽ അപ്ഡേറ്റുകൾക്കായി പരിശോധിക്കാൻ ഒരു ലിങ്ക് Tern-നോട് ആവശ്യപ്പെട്ടു. അവയുടെ ഉറവിടങ്ങളോട് ചോദിക്കുന്നു, കൂടാതെ ഒന്നും ഇൻസ്റ്റാൾ ചെയ്യുകയുമില്ല.</item>
+    </plurals>
+    <string name="link_check_confirm">പരിശോധിക്കുക</string>
+    <string name="link_check_not_now">ഇപ്പോൾ വേണ്ട</string>
+    <string name="engine_installer_fell_back">%1$s തയ്യാറായില്ല, അതിനാൽ ഇതിനായി Android-ൻ്റെ ഇൻസ്റ്റാളർ ഉപയോഗിച്ചു.</string>
+    <string name="about_track_tern_fdroid_effect">F-Droid ആണ് ഈ പകർപ്പ് ഇൻസ്റ്റാൾ ചെയ്തത്, അതിനാൽ Tern അതിലെ എൻട്രി പിന്തുടരുന്നു: F-Droid ആപ്പിന് ലഭിക്കുന്നതുപോലെ, F-Droid ഉണ്ടാക്കുകയും പരിശോധിക്കുകയും ചെയ്ത ബിൽഡുകളാണ് അപ്ഡേറ്റുകൾ.</string>
+    <string name="about_track_tern_github">പകരം GitHub റിലീസുകൾ പിന്തുടരുക</string>
+    <string name="about_track_tern_github_effect">അവ പ്രസിദ്ധീകരിച്ചയുടനെ GitHub-ൽ നിന്ന് അപ്ഡേറ്റുകൾ വരുന്നു, F-Droid അവ ഉണ്ടാക്കി പരിശോധിക്കുന്നതിന് മുമ്പ് തന്നെ. ഇത് F-Droid-ൻ്റെ പരിശോധനകൾ ഒഴിവാക്കുന്നു. Tern അപ്പോഴും ഓരോ ഫയലും പരിശോധിക്കുകയും അതിൻ്റെ സ്വന്തം സർട്ടിഫിക്കറ്റിൽ നിലനിർത്തുകയും ചെയ്യുന്നു.</string>
+</resources>
diff --git a/app/src/main/res/values-ml/strings_settings_more.xml b/app/src/main/res/values-ml/strings_settings_more.xml
index 37366c08..492823a0 100644
--- a/app/src/main/res/values-ml/strings_settings_more.xml
+++ b/app/src/main/res/values-ml/strings_settings_more.xml
@@ -37,9 +37,7 @@
     <string name="settings_auto_installs">അപ്ഡേറ്റുകൾ സ്വയം ഇൻസ്റ്റാൾ ആകുന്നു</string>
     <string name="settings_auto_installs_effect">സ്വയം അപ്ഡേറ്റ് ചെയ്യാൻ സജ്ജമാക്കിയ ആപ്പുകൾ പശ്ചാത്തല പരിശോധനയ്ക്ക് ശേഷം അങ്ങനെ ചെയ്യും. ഓഫ് ആക്കിയാൽ, അപ്ഡേറ്റ് ഉണ്ടെന്ന് മാത്രം അവ അറിയിക്കും, ഓരോ ആപ്പും അതിൻ്റെ സ്വന്തം തിരഞ്ഞെടുപ്പ് പിന്നീടുള്ള ഉപയോഗത്തിനായി നിലനിർത്തും.</string>
     <string name="settings_unmetered_installs">Wi-Fi-യിൽ മാത്രം ഇൻസ്റ്റാൾ ചെയ്യുക</string>
-    <string name="settings_unmetered_installs_effect">ഏത് നെറ്റ്‌വർക്കിലും പരിശോധനകൾ നടക്കും. സ്വയം ഇൻസ്റ്റാൾ ആകുമായിരുന്ന അപ്ഡേറ്റ്, Obtainium-ലേതു പോലെ, Wi-Fi അല്ലെങ്കിൽ കേബിൾ കണക്ഷൻ ലഭിക്കുന്നത് വരെ കാത്തിരിക്കും.</string>
     <string name="settings_charging_installs">ചാർജ് ചെയ്യുമ്പോൾ മാത്രം ഇൻസ്റ്റാൾ ചെയ്യുക</string>
-    <string name="settings_charging_installs_effect">ബാറ്ററിയിലായിരിക്കുമ്പോഴും പരിശോധനകൾ നടക്കും. സ്വയം ഇൻസ്റ്റാൾ ആകുമായിരുന്ന അപ്ഡേറ്റ് ഉപകരണം ചാർജ് ചെയ്യപ്പെടുന്നത് വരെ കാത്തിരിക്കും.</string>
     <string name="engine_unreadable_app">സേവ് ചെയ്ത ആപ്പ് %1$s വായിക്കാനായില്ല, അതിനാൽ അത് ലിസ്റ്റിൽ നിന്ന് ഒഴിവാക്കി. ഒന്നും ഇല്ലാതാക്കിയിട്ടില്ല: Tern-ൻ്റെ പുതിയ പതിപ്പിന് ഇത് വായിക്കാൻ കഴിഞ്ഞേക്കാം.</string>
     <string name="settings_pin_certificates">കോഡ് ഹോസ്റ്റിംഗ് സൈറ്റുകളുടെ സർട്ടിഫിക്കറ്റുകൾ പിൻ ചെയ്യുക</string>
     <string name="settings_pin_certificates_effect">GitHub, GitLab, Codeberg എന്നിവ Obtainium-ലേതു പോലെ, ഓരോന്നും ഉപയോഗിക്കുന്നതായി അറിയപ്പെടുന്ന സർട്ടിഫിക്കറ്റ് അതോറിറ്റിയുടെ സർട്ടിഫിക്കറ്റ് കാണിക്കണം. മറ്റൊരു സർട്ടിഫിക്കറ്റ് അതോറിറ്റി നിർബന്ധിതമായി നൽകിയ സർട്ടിഫിക്കറ്റ് അപ്പോൾ നിരസിക്കപ്പെടും. ഒരു കോഡ് ഹോസ്റ്റിംഗ് സൈറ്റ് അതിൻ്റെ സർട്ടിഫിക്കറ്റ് അതോറിറ്റി മാറ്റിയാൽ, ഇത് ഓഫ് ആക്കുന്നത് വരെ അവിടത്തെ പരിശോധനകൾ പരാജയപ്പെടും.</string>
diff --git a/app/src/main/res/values-ml/strings_sources_more.xml b/app/src/main/res/values-ml/strings_sources_more.xml
index 1b69bf5e..d61a0f68 100644
--- a/app/src/main/res/values-ml/strings_sources_more.xml
+++ b/app/src/main/res/values-ml/strings_sources_more.xml
@@ -18,10 +18,7 @@
     <string name="step_arch">ഈ ഉപകരണത്തിൻ്റെ പ്രോസസറിന് മുൻഗണന നൽകുക</string>
     <string name="step_add">ഒരു പേജ് ചേർക്കുക</string>
     <string name="step_remove">ഈ പേജ് നീക്കംചെയ്യുക</string>
-    <string name="option_file_version">ഫയലിൻ്റെ പേര് പതിപ്പായി ഉപയോഗിക്കുക</string>
-    <string name="option_file_version_effect">അപ്പോൾ ഓരോ ഫയലും സ്വന്തമായ ഒരു റിലീസായി കണക്കാക്കും.</string>
     <string name="github_proxy_title">hubproxy വഴി GitHub</string>
-    <string name="github_proxy_effect">GitHub-ലേക്കുള്ള ഓരോ അഭ്യർത്ഥനയും ഈ ഹോസ്റ്റിലേക്ക് പോകുന്നു, ഇത് ഓരോന്നും കാണുന്നു. ഇതിലൂടെ ടോക്കൺ അയയ്ക്കില്ല, അതിനാൽ ഈ രീതിയിൽ സ്വകാര്യ പ്രോജക്റ്റുകൾ, GitHub Actions എന്നിവ പിന്തുടരാനാകില്ല.</string>
     <string name="github_proxy_host">hubproxy ഹോസ്റ്റ്</string>
     <string name="github_proxy_help">gh-proxy.com പോലെ ഒരു ഹോസ്റ്റ് നാമം മാത്രം. Tern HTTPS വഴി അതിലേക്ക് എത്തുന്നു.</string>
     <string name="github_proxy_invalid">അത് Tern-ന് ഉപയോഗിക്കാനാകുന്ന ഹോസ്റ്റ് നാമമല്ല</string>
diff --git a/app/src/main/res/values-ml/strings_starters.xml b/app/src/main/res/values-ml/strings_starters.xml
new file mode 100644
index 00000000..f95838f0
--- /dev/null
+++ b/app/src/main/res/values-ml/strings_starters.xml
@@ -0,0 +1,7 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="starter_in_list">നിങ്ങളുടെ ലിസ്റ്റിൽ</string>
+    <string name="starter_on_phone">ഈ ഫോണിൽ</string>
+    <string name="starter_on_phone_other">മറ്റൊരാൾ ഒപ്പിട്ടത് ഈ ഫോണിൽ</string>
+    <string name="starter_on_phone_other_explain">നിങ്ങളുടെ പക്കലുള്ള കോപ്പി മറ്റൊരു കീ ഉപയോഗിച്ചാണ് ഒപ്പിട്ടിരിക്കുന്നത്, അതിനാൽ Tern-ന് ഈ വിലാസത്തിൽ നിന്ന് ഇത് അപ്ഡേറ്റ് ചെയ്യാൻ കഴിയില്ല.</string>
+</resources>
diff --git a/app/src/main/res/values-ml/strings_stores.xml b/app/src/main/res/values-ml/strings_stores.xml
new file mode 100644
index 00000000..d2b5bcb3
--- /dev/null
+++ b/app/src/main/res/values-ml/strings_stores.xml
@@ -0,0 +1,27 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="option_headers_help_own_agent">ഓരോ വരിയിലും, Name: value എന്നതുപോലെ നൽകുക. പാസ്‌വേഡോ കുക്കിയോ User-Agent-ഓ ഒരിക്കലും പാടില്ല: താൻ Tern ആണെന്ന് എല്ലാ സൈറ്റുകളോടും Tern പറയുന്നു.</string>
+    <string name="origin_republished_first">ഡെവലപ്പർമാർ മറ്റിടങ്ങളിൽ പ്രസിദ്ധീകരിക്കുന്നത് %1$s വീണ്ടും നൽകുന്നു, മാത്രമല്ല ഇത് ഡെവലപ്പറുമല്ല. ആപ്പ് ഒരു സർട്ടിഫിക്കറ്റിലേക്ക് പിൻ ചെയ്യുന്നത് വരെ, അതിൽ നിന്ന് Tern ഇൻസ്റ്റാൾ ചെയ്യുന്ന ആദ്യ ഫയൽ തീരുമാനിക്കും പിന്നീടുള്ള ഓരോ അപ്ഡേറ്റിലും ഏത് സർട്ടിഫിക്കറ്റ് ഉണ്ടായിരിക്കണമെന്ന്.</string>
+    <string name="origin_republished_pinned">ഡെവലപ്പർമാർ മറ്റിടങ്ങളിൽ പ്രസിദ്ധീകരിക്കുന്നത് %1$s വീണ്ടും നൽകുന്നു, മാത്രമല്ല ഇത് ഡെവലപ്പറുമല്ല. ഇതിലെ ഫയലുകളിൽ ഈ ആപ്പ് പിൻ ചെയ്തിരിക്കുന്ന സർട്ടിഫിക്കറ്റ് ഉണ്ടായിരിക്കണം.</string>
+    <string name="origin_store_first">%1$s ഒരു സ്റ്റോറാണ്, ഡെവലപ്പറുടെ സ്വന്തം സൈറ്റല്ല. ആപ്പ് ഒരു സർട്ടിഫിക്കറ്റിലേക്ക് പിൻ ചെയ്യുന്നത് വരെ, ഇതിൽ നിന്ന് Tern ഇൻസ്റ്റാൾ ചെയ്യുന്ന ആദ്യ ഫയൽ തീരുമാനിക്കും പിന്നീടുള്ള ഓരോ അപ്ഡേറ്റിലും ഏത് സർട്ടിഫിക്കറ്റ് ഉണ്ടായിരിക്കണമെന്ന്.</string>
+    <string name="origin_store_pinned">%1$s ഒരു സ്റ്റോറാണ്, ഡെവലപ്പറുടെ സ്വന്തം സൈറ്റല്ല. ഇതിലെ ഫയലുകളിൽ ഈ ആപ്പ് പിൻ ചെയ്തിരിക്കുന്ന സർട്ടിഫിക്കറ്റ് ഉണ്ടായിരിക്കണം.</string>
+    <string name="stores_refused_modified">മാറ്റം വരുത്തിയ ആപ്പുകൾ നൽകുന്ന സൈറ്റുകൾ Tern വായിക്കില്ല. അവയിലെ ഫയലുകളിൽ ഡെവലപ്പറല്ലാത്ത മറ്റാരോ മാറ്റം വരുത്തുകയും മാറ്റം വരുത്തിയവർ തന്നെ അവ ഒപ്പിടുകയും ചെയ്യുന്നു.</string>
+    <string name="stores_refused_impersonation">അതിൻ്റെ ആപ്പാണെന്ന് നടിക്കാതെ Tern-ന് ഈ സ്റ്റോർ വായിക്കാനാകില്ല, അതിനാൽ ഇത് വായിക്കുന്നില്ല.</string>
+    <string name="stores_checksum_source">%1$s, ഇത് ഡെവലപ്പറല്ല</string>
+    <string name="stores_off_title">%1$s ഒരു തേർഡ് പാർട്ടി സ്റ്റോറാണ്</string>
+    <string name="stores_off_body">തേർഡ് പാർട്ടി സ്റ്റോറുകൾ ഓഫ് ചെയ്തിരിക്കുന്നു. ഡെവലപ്പറുടെ സ്വന്തം സൈറ്റിൽ നിന്നുള്ള ഫയലുകൾക്ക് പകരം, ഒരു സ്റ്റോർ ആപ്പുകളുടെ സ്വന്തം പകർപ്പുകൾ നൽകുന്നു, കൂടാതെ സ്റ്റോർ അതിൻ്റെ സ്വന്തം ആപ്പിനോ വെബ്സൈറ്റിനോ വേണ്ടി ഉണ്ടാക്കിയ ഇൻ്റർഫേസിലൂടെയാണ് Tern അത് വായിക്കുന്നത്. അവ ഓൺ ചെയ്യുമ്പോൾ, ഒരു സ്റ്റോറിൽ നിന്ന് നിങ്ങൾ ചേർക്കുന്ന ആപ്പുകൾക്ക് വേണ്ടി മാത്രമേ Tern ആ സ്റ്റോറിനോട് ചോദിക്കൂ, കൂടാതെ ഒരു ആപ്പ് സർട്ടിഫിക്കറ്റിലേക്ക് പിൻ ചെയ്യുന്നത് വരെ, ഒരു സ്റ്റോറിൽ നിന്ന് Tern ഇൻസ്റ്റാൾ ചെയ്യുന്ന ആദ്യ ഫയലായിരിക്കും അതിൻ്റെ അപ്ഡേറ്റുകളിൽ ഏത് സർട്ടിഫിക്കറ്റ് ഉണ്ടായിരിക്കണമെന്ന് തീരുമാനിക്കുന്നത്.</string>
+    <string name="stores_turn_on">തേർഡ് പാർട്ടി സ്റ്റോറുകൾ ഓൺ ചെയ്യുക</string>
+    <string name="stores_advice">ഈ ആപ്പ് വീണ്ടും പരിശോധിക്കാൻ സെറ്റിംഗ്സിൽ തേർഡ് പാർട്ടി സ്റ്റോറുകൾ ഓൺ ചെയ്യുക.</string>
+    <string name="stores_status_paused">താൽക്കാലികമായി നിർത്തി</string>
+    <string name="stores_row_paused">തേർഡ് പാർട്ടി സ്റ്റോറുകൾ ഓഫ് ചെയ്തിരിക്കുന്നു</string>
+    <string name="stores_setting">തേർഡ് പാർട്ടി സ്റ്റോറുകൾ</string>
+    <string name="stores_setting_effect">APKPure, Aptoide, APKCombo, APKMirror, Tencent, Huawei AppGallery, Galaxy Store, vivo എന്നിവ. ഡെവലപ്പറുടെ സ്വന്തം സൈറ്റിൽ നിന്നുള്ള ഫയലുകൾക്ക് പകരം, അവ ആപ്പുകളുടെ സ്വന്തം പകർപ്പുകൾ നൽകുന്നു, കൂടാതെ അവയുടെ സ്വന്തം ആപ്പുകൾക്കും വെബ്സൈറ്റുകൾക്കും വേണ്ടി അവ ഉണ്ടാക്കിയ ഇൻ്റർഫേസുകളിലൂടെയാണ് Tern അവ വായിക്കുന്നത്. ഓഫ് ചെയ്യുമ്പോൾ, Tern അവയോടൊന്നും ഒന്നും ചോദിക്കില്ല, തിരയുമ്പോൾ അവയെ ഒഴിവാക്കുകയും അവയിൽ നിന്നുള്ള ആപ്പുകൾ താൽക്കാലികമായി നിർത്തുകയും ചെയ്യുന്നു.</string>
+    <string name="stores_off_tag">സെറ്റിംഗ്സിൽ ഓഫാണ്</string>
+    <string name="stores_checksum_matched">ഫയൽ സ്റ്റോറിൻ്റെ ചെക്ക്സമുമായി പൊരുത്തപ്പെടുന്നു</string>
+    <string name="stores_explain_checksum_matched">ഒരു ചെക്ക്സം എന്നത് ഫയലിൻ്റെ തന്നെ ഒരു ഫിംഗർപ്രിൻ്റാണ്. സ്റ്റോർ ഒരെണ്ണം നൽകി, Tern ഡൗൺലോഡ് ചെയ്ത ഫയലിനും അത് തന്നെയുണ്ട്, അതിനാൽ സ്റ്റോറിലുള്ളതുപോലെ തന്നെയാണ് ഇത് ലഭിച്ചത്. സ്റ്റോർ ഡെവലപ്പർ അല്ലാത്തതിനാൽ, ആരാണ് ഫയൽ ഉണ്ടാക്കിയത് എന്നതിനെക്കുറിച്ച് ഇത് ഒന്നും പറയുന്നില്ല. സർട്ടിഫിക്കറ്റ് അത് പറയുന്നു.</string>
+    <string name="stores_import_from_stores">ഇവ വരുന്നത് ആപ്പുകളുടെ സ്വന്തം പകർപ്പുകൾ നൽകുന്ന തേർഡ് പാർട്ടി സ്റ്റോറുകളിൽ നിന്നാണ്. ഒരു ആപ്പ് സർട്ടിഫിക്കറ്റിലേക്ക് പിൻ ചെയ്യുന്നത് വരെ, അതിൻ്റെ സ്റ്റോറിൽ നിന്ന് Tern ഇൻസ്റ്റാൾ ചെയ്യുന്ന ആദ്യ ഫയലായിരിക്കും അതിൻ്റെ അപ്ഡേറ്റുകളിൽ ഏത് സർട്ടിഫിക്കറ്റ് ഉണ്ടായിരിക്കണമെന്ന് തീരുമാനിക്കുന്നത്.</string>
+    <string name="stores_import_paused">തേർഡ് പാർട്ടി സ്റ്റോറുകൾ ഓഫ് ചെയ്തിരിക്കുന്നു, അതിനാൽ ഈ ആപ്പുകൾ താൽക്കാലികമായി നിർത്തിയിരിക്കുന്നു. നിങ്ങൾ അവ ഓൺ ചെയ്യുന്നത് വരെ Tern ആ സ്റ്റോറുകളോട് ഒന്നും ചോദിക്കില്ല.</string>
+    <string name="stores_import_names">തേർഡ് പാർട്ടി സ്റ്റോറുകളിൽ നിന്ന്</string>
+    <string name="share_obtainium_link">ഒരു Obtainium ലിങ്കായി പങ്കിടുക</string>
+    <string name="share_obtainium_links">Obtainium ലിങ്കുകളായി പങ്കിടുക</string>
+</resources>
diff --git a/app/src/main/res/values-ml/strings_tv.xml b/app/src/main/res/values-ml/strings_tv.xml
new file mode 100644
index 00000000..d58a8486
--- /dev/null
+++ b/app/src/main/res/values-ml/strings_tv.xml
@@ -0,0 +1,5 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="interval_turn_off">പശ്ചാത്തല പരിശോധനകൾ ഓഫ് ചെയ്യുക</string>
+    <string name="interval_turn_on">പശ്ചാത്തല പരിശോധനകൾ ഓൺ ചെയ്യുക</string>
+</resources>
diff --git a/app/src/main/res/values-nl/strings.xml b/app/src/main/res/values-nl/strings.xml
index b889b5df..f1ab88bd 100644
--- a/app/src/main/res/values-nl/strings.xml
+++ b/app/src/main/res/values-nl/strings.xml
@@ -369,7 +369,6 @@
     <string name="settings_import_effect">Van een Tern of Obtainium export</string>
     <string name="settings_export">Apps exporteren</string>
     <string name="settings_exporting">Exporteren</string>
-    <string name="settings_export_effect">Slaat je lijst en instellingen op in een bestand. Tokens worden nooit meegenomen.</string>
     <plurals name="exported">
         <item quantity="one">%d app geëxporteerd</item>
         <item quantity="other">%d apps geëxporteerd</item>
diff --git a/app/src/main/res/values-nl/strings_accept.xml b/app/src/main/res/values-nl/strings_accept.xml
new file mode 100644
index 00000000..1939bb91
--- /dev/null
+++ b/app/src/main/res/values-nl/strings_accept.xml
@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="stores_paused_reason">Winkels van derden staan uit, dus Tern vraagt deze winkel niets. Zet ze aan in Instellingen om deze opnieuw te controleren.</string>
+</resources>
diff --git a/app/src/main/res/values-nl/strings_checks.xml b/app/src/main/res/values-nl/strings_checks.xml
index 431871fe..e6228a94 100644
--- a/app/src/main/res/values-nl/strings_checks.xml
+++ b/app/src/main/res/values-nl/strings_checks.xml
@@ -17,13 +17,11 @@
     <string name="settings_only_installed">Alleen geïnstalleerde apps controleren</string>
     <string name="settings_only_installed_effect">Apps die alleen worden gevolgd, worden ook gecontroleerd. Een app die je opent, wordt altijd gecontroleerd.</string>
     <string name="settings_remove_uninstalled">Elders gede-installeerde apps verwijderen</string>
-    <string name="settings_remove_uninstalled_effect">Een app die je buiten Tern de-installeert, verdwijnt ook uit de lijst.</string>
     <string name="settings_file_filter">Filter voor bestanden</string>
     <string name="settings_file_filter_effect">Een patroon waarmee elke app zonder eigen filter zijn bestand kiest.</string>
     <string name="settings_file_filter_none">Geen</string>
     <string name="settings_file_filter_invalid">Dit patroon kan niet worden gelezen.</string>
     <string name="settings_allow_downgrades">Oudere versies toestaan</string>
-    <string name="settings_allow_downgrades_effect">Let Me Downgrade is geïnstalleerd, dus Android mag een oudere versie over een nieuwere installeren.</string>
     <string name="settings_collapse_groups">Beginnen met ingeklapte groepen</string>
     <string name="settings_haptics">Haptische feedback</string>
     <string name="settings_haptics_effect">Een lichte trilling wanneer vegen of lang indrukken iets doet.</string>
@@ -38,7 +36,6 @@
     <string name="sources_repositories">Repositories</string>
     <string name="sources_stores">Stores</string>
     <string name="sources_mirrors">Stores die apps opnieuw publiceren</string>
-    <string name="sources_modified">Sites met aangepaste apps</string>
     <string name="sources_other">Andere plekken</string>
     <string name="sources_web_page">Een webpagina met links naar bestanden</string>
     <string name="sources_direct">Een directe link naar een bestand</string>
@@ -48,8 +45,6 @@
     <string name="shared_configs_title">Configuraties gedeeld door gebruikers van Obtainium</string>
     <string name="shared_configs_effect">Een site met kant-en-klare instellingen voor apps. De links openen in Tern wanneer Obtainium links openen aan staat in Instellingen.</string>
     <string name="engine_inner_filter_nothing">Het filter voor bestanden in archieven komt met geen enkele APK in dit archief overeen.</string>
-    <string name="preview_republished">%1$s biedt opnieuw aan wat ontwikkelaars elders publiceren. De bestanden worden aan het certificaat van de ontwikkelaar gehouden zodra Tern het kent, dus zet er een vast of installeer eerst van de ontwikkelaar als dat kan.</string>
-    <string name="preview_modified">%1$s biedt apps aan die zijn aangepast door iemand anders dan hun ontwikkelaar. Ze zijn ondertekend door wie ze heeft aangepast, en Tern kan niet zien wat er is veranderd.</string>
     <string name="about_track_tern">Tern zelf up-to-date houden</string>
     <string name="about_track_tern_effect">Voegt de eigen releases van Tern toe aan de lijst, gecontroleerd en geverifieerd zoals elke app.</string>
     <string name="engine_channel_tracked">Nieuwe releases van gevolgde apps</string>
diff --git a/app/src/main/res/values-nl/strings_options.xml b/app/src/main/res/values-nl/strings_options.xml
index 29af0392..1718a969 100644
--- a/app/src/main/res/values-nl/strings_options.xml
+++ b/app/src/main/res/values-nl/strings_options.xml
@@ -62,10 +62,6 @@
     <string name="option_workflow">Workflowbestand</string>
     <string name="option_workflow_help">Zoals build.yml.</string>
     <string name="option_branch">Branch</string>
-    <string name="option_device_model">Apparaatmodel</string>
-    <string name="option_device_model_help">De Galaxy Store geeft elk model een eigen build, zoals SM-S948B.</string>
-    <string name="option_csc">Regiocode (CSC)</string>
-    <string name="option_csc_help">Drie letters, zoals DBT.</string>
     <string name="option_link_filter">Filter voor downloadlinks</string>
     <string name="option_link_filter_help">Alleen links die overeenkomen, tellen als downloads.</string>
     <string name="option_page_order">De volgorde van de pagina behouden</string>
@@ -76,11 +72,14 @@
     <string name="version_from_text">De tekst van de link</string>
     <string name="version_from_page">De hele pagina</string>
     <string name="option_headers">Verzoekheaders</string>
-    <string name="option_headers_help">Eén per regel, als Name: value. Nooit een wachtwoord of een cookie.</string>
     <string name="option_pseudo">Als er geen versie is</string>
     <string name="pseudo_default">Bestanden onderscheiden zoals de server dat doet</string>
     <string name="pseudo_hash">Met een hash van het begin van het bestand</string>
     <string name="pseudo_link">Met het adres van het bestand</string>
     <string name="pseudo_etag">Met de ETag van de server</string>
     <string name="option_invalid">Dit kan zo niet worden gebruikt.</string>
+    <string name="option_device_model">Apparaatmodel</string>
+    <string name="option_device_model_help">De Galaxy Store geeft elk model een eigen build, zoals SM-S948B.</string>
+    <string name="option_csc">Regiocode (CSC)</string>
+    <string name="option_csc_help">Drie letters, zoals DBT.</string>
 </resources>
diff --git a/app/src/main/res/values-nl/strings_safety.xml b/app/src/main/res/values-nl/strings_safety.xml
new file mode 100644
index 00000000..40cd6f59
--- /dev/null
+++ b/app/src/main/res/values-nl/strings_safety.xml
@@ -0,0 +1,29 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="settings_export_effect_plain">Slaat je lijst en instellingen op in een bestand. Tokens gaan er nooit in, en evenmin een request-header die een sleutel zou kunnen bevatten.</string>
+    <string name="engine_checksum_github_proxy">GitHub release-digest, zoals de hubproxy %1$s deze doorgaf</string>
+    <string name="github_proxy_effect_trust">Elk verzoek aan GitHub gaat naar deze host. Deze ziet elk verzoek en kan wijzigen wat er terugkomt: de releases, hun digests en de bestanden. Apps die je hebt blijven gehouden aan hun certificaat, maar een eerste installatie erdoor vertrouwt de hubproxy net zoveel als GitHub, en het vastpinnen van certificaten bereikt deze niet. Er wordt geen token doorheen gestuurd, dus privéprojecten en GitHub Actions kunnen op deze manier niet worden gevolgd.</string>
+    <string name="settings_unmetered_checks">Alleen op wifi controleren</string>
+    <string name="settings_unmetered_checks_effect">Achtergrondcontroles wachten op wifi of een kabel, dus ze gebruiken geen mobiele data.</string>
+    <string name="settings_charging_checks">Alleen controleren tijdens opladen</string>
+    <string name="settings_charging_checks_effect">Achtergrondcontroles wachten totdat het apparaat wordt opgeladen.</string>
+    <string name="settings_unmetered_installs_wait">Een update die vanzelf zou installeren wacht op wifi of een kabel, net als in Obtainium.</string>
+    <string name="settings_charging_installs_wait">Een update die vanzelf zou installeren wacht totdat het apparaat wordt opgeladen.</string>
+    <string name="engine_downgrade_not_as_named">De bron noemde versiecode %2$d, maar dit bestand is %1$d, ouder dan degene die is geïnstalleerd. Het wordt niet over de nieuwere gezet.</string>
+    <string name="settings_allow_downgrades_picked">Let Me Downgrade is geïnstalleerd, dus Android kan een oudere versie over een nieuwere zetten. Tern doet dit alleen voor een release die je kiest uit de geschiedenis van een app, nooit op de achtergrond of met Alles updaten.</string>
+    <string name="option_highest_version">De hoogste versie nemen, zoals Tern 0.1.0 deed</string>
+    <string name="option_highest_version_effect">Biedt de link met de hoogste versie op de pagina aan, ongeacht zijn plaats, en voert het versiepatroon uit over de versie die uit elke link wordt gelezen. Uit leest de pagina op de manier zoals Obtainium dat doet: de laatste link in de volgorde is de nieuwste.</string>
+    <string name="settings_remove_uninstalled_keeps_pins">Een app die je buiten Tern om verwijdert, verdwijnt ook uit de lijst. Een gearchiveerde app blijft staan. Als een app opnieuw vanaf dezelfde plek wordt toegevoegd, wordt deze gehouden aan het certificaat dat hij had; door hem in Tern te verwijderen, wordt dat vergeten.</string>
+    <string name="link_check_title">Nu op updates controleren?</string>
+    <string name="link_check_one">Een link vroeg Tern om %1$s op updates te controleren. De bron ervan wordt gevraagd, en er wordt niets geïnstalleerd.</string>
+    <plurals name="link_check_all">
+        <item quantity="one">Een link vroeg Tern om de %d app in je lijst op updates te controleren. De bron ervan wordt gevraagd, en er wordt niets geïnstalleerd.</item>
+        <item quantity="other">Een link vroeg Tern om de %d apps in je lijst op updates te controleren. De bronnen ervan worden gevraagd, en er wordt niets geïnstalleerd.</item>
+    </plurals>
+    <string name="link_check_confirm">Controleren</string>
+    <string name="link_check_not_now">Nu niet</string>
+    <string name="engine_installer_fell_back">%1$s was niet klaar, dus het installatieprogramma van Android is voor deze gebruikt.</string>
+    <string name="about_track_tern_fdroid_effect">F-Droid heeft deze kopie geïnstalleerd, dus Tern volgt de vermelding daar: updates zijn de builds die F-Droid heeft gemaakt en gecontroleerd, zoals de F-Droid-app ze krijgt.</string>
+    <string name="about_track_tern_github">In plaats daarvan GitHub-releases volgen</string>
+    <string name="about_track_tern_github_effect">Updates komen van GitHub zodra ze zijn gepubliceerd, voordat F-Droid ze heeft gebouwd en gecontroleerd. Dit slaat de controles van F-Droid over. Tern controleert nog steeds elk bestand en houdt het aan zijn eigen certificaat.</string>
+</resources>
diff --git a/app/src/main/res/values-nl/strings_settings_more.xml b/app/src/main/res/values-nl/strings_settings_more.xml
index a8196755..0326a1ba 100644
--- a/app/src/main/res/values-nl/strings_settings_more.xml
+++ b/app/src/main/res/values-nl/strings_settings_more.xml
@@ -37,9 +37,7 @@
     <string name="settings_auto_installs">Updates worden vanzelf geïnstalleerd</string>
     <string name="settings_auto_installs_effect">Apps die zijn ingesteld om zichzelf te updaten, doen dat na een controle op de achtergrond. Staat dit uit, dan melden ze alleen dat er een update is, en elke app houdt zijn eigen keuze voor later.</string>
     <string name="settings_unmetered_installs">Alleen installeren via wifi</string>
-    <string name="settings_unmetered_installs_effect">Controles draaien op elk netwerk. Een update die zichzelf zou installeren, wacht op wifi of een netwerkkabel, zoals in Obtainium.</string>
     <string name="settings_charging_installs">Alleen installeren tijdens het opladen</string>
-    <string name="settings_charging_installs_effect">Controles draaien ook op de batterij. Een update die zichzelf zou installeren, wacht tot het apparaat oplaadt.</string>
     <string name="engine_unreadable_app">De opgeslagen app %1$s kon niet worden gelezen, dus hij is weggelaten uit de lijst. Er is niets verwijderd: een nieuwere versie van Tern kan hem misschien lezen.</string>
     <string name="settings_pin_certificates">De certificaten van de codeplatforms vastzetten</string>
     <string name="settings_pin_certificates_effect">GitHub, GitLab en Codeberg moeten een certificaat tonen van de certificeringsinstantie waarvan bekend is dat elk van hen die gebruikt, zoals in Obtainium. Een certificaat dat een andere instantie ertoe is gebracht uit te geven, wordt dan geweigerd. Als een codeplatform van instantie verandert, mislukken controles daar totdat dit is uitgezet.</string>
diff --git a/app/src/main/res/values-nl/strings_sources_more.xml b/app/src/main/res/values-nl/strings_sources_more.xml
index 8afe2bee..3b16eeb5 100644
--- a/app/src/main/res/values-nl/strings_sources_more.xml
+++ b/app/src/main/res/values-nl/strings_sources_more.xml
@@ -18,10 +18,7 @@
     <string name="step_arch">Voorkeur geven aan de processor van dit apparaat</string>
     <string name="step_add">Een pagina toevoegen</string>
     <string name="step_remove">Deze pagina verwijderen</string>
-    <string name="option_file_version">De bestandsnaam als versie gebruiken</string>
-    <string name="option_file_version_effect">Elk bestand telt dan als een eigen release.</string>
     <string name="github_proxy_title">GitHub via een hubproxy</string>
-    <string name="github_proxy_effect">Elk verzoek aan GitHub gaat naar deze host, die elk verzoek ziet. Er wordt geen token doorheen gestuurd, dus privéprojecten en GitHub Actions kunnen op deze manier niet worden gevolgd.</string>
     <string name="github_proxy_host">Hubproxy-host</string>
     <string name="github_proxy_help">Alleen een hostnaam, zoals gh-proxy.com. Tern bereikt deze via HTTPS.</string>
     <string name="github_proxy_invalid">Dat is geen hostnaam die Tern kan gebruiken</string>
diff --git a/app/src/main/res/values-nl/strings_starters.xml b/app/src/main/res/values-nl/strings_starters.xml
new file mode 100644
index 00000000..40207907
--- /dev/null
+++ b/app/src/main/res/values-nl/strings_starters.xml
@@ -0,0 +1,7 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="starter_in_list">In je lijst</string>
+    <string name="starter_on_phone">Op deze telefoon</string>
+    <string name="starter_on_phone_other">Op deze telefoon van een andere ondertekenaar</string>
+    <string name="starter_on_phone_other_explain">De kopie die je hebt is ondertekend met een andere sleutel, dus Tern kan deze niet updaten vanaf dit adres.</string>
+</resources>
diff --git a/app/src/main/res/values-nl/strings_stores.xml b/app/src/main/res/values-nl/strings_stores.xml
new file mode 100644
index 00000000..0e1f1fca
--- /dev/null
+++ b/app/src/main/res/values-nl/strings_stores.xml
@@ -0,0 +1,27 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="option_headers_help_own_agent">Eén per regel, als Naam: waarde. Nooit een wachtwoord, een cookie of een User-Agent: Tern vertelt elke site dat het Tern is.</string>
+    <string name="origin_republished_first">%1$s biedt opnieuw aan wat ontwikkelaars elders publiceren, en is niet de ontwikkelaar. Totdat de app aan een certificaat is vastgepind, bepaalt het eerste bestand dat Tern ervan installeert welk certificaat elke latere update moet dragen.</string>
+    <string name="origin_republished_pinned">%1$s biedt opnieuw aan wat ontwikkelaars elders publiceren, en is niet de ontwikkelaar. De bestanden ervan moeten het certificaat dragen waaraan deze app is gehouden.</string>
+    <string name="origin_store_first">%1$s is een store, niet de eigen site van de ontwikkelaar. Totdat de app aan een certificaat is vastgepind, bepaalt het eerste bestand dat Tern ervan installeert welk certificaat elke latere update moet dragen.</string>
+    <string name="origin_store_pinned">%1$s is een store, niet de eigen site van de ontwikkelaar. De bestanden ervan moeten het certificaat dragen waaraan deze app is gehouden.</string>
+    <string name="stores_refused_modified">Tern leest geen sites die gemodificeerde apps aanbieden. Hun bestanden zijn gewijzigd door iemand anders dan de ontwikkelaar en ondertekend door degene die ze heeft gewijzigd.</string>
+    <string name="stores_refused_impersonation">Tern kan deze store niet lezen zonder zich voor te doen als de app van de store, dus leest hij deze niet.</string>
+    <string name="stores_checksum_source">%1$s, wat niet de ontwikkelaar is</string>
+    <string name="stores_off_title">%1$s is een store van derden</string>
+    <string name="stores_off_body">Stores van derden staan uit. Een store levert zijn eigen kopieën van apps, geen bestanden van de eigen site van de ontwikkelaar, en Tern leest deze via de interface die de store voor zijn eigen app of website heeft gemaakt. Als ze aan staan, vraagt Tern een store alleen om de apps die je eruit toevoegt, en totdat een app aan een certificaat is vastgepind, bepaalt het eerste bestand dat Tern uit een store installeert welk certificaat de updates ervan moeten dragen.</string>
+    <string name="stores_turn_on">Stores van derden aanzetten</string>
+    <string name="stores_advice">Zet Stores van derden aan in Instellingen om deze app opnieuw te controleren.</string>
+    <string name="stores_status_paused">Gepauzeerd</string>
+    <string name="stores_row_paused">Stores van derden staan uit</string>
+    <string name="stores_setting">Stores van derden</string>
+    <string name="stores_setting_effect">APKPure, Aptoide, APKCombo, APKMirror, Tencent, Huawei AppGallery, the Galaxy Store en vivo. Ze leveren hun eigen kopieën van apps, geen bestanden van de eigen site van de ontwikkelaar, en Tern leest ze via de interfaces die ze voor hun eigen apps en websites hebben gemaakt. Als ze uit staan, vraagt Tern geen van hen iets, laat een zoekopdracht ze weg en worden apps ervan gepauzeerd.</string>
+    <string name="stores_off_tag">uit in Instellingen</string>
+    <string name="stores_checksum_matched">Het bestand komt overeen met de checksum van de store</string>
+    <string name="stores_explain_checksum_matched">Een checksum is een vingerafdruk van het bestand zelf. De store heeft er een gegeven, en het bestand dat Tern heeft gedownload heeft dezelfde, dus het is aangekomen zoals de store het heeft. De store is niet de ontwikkelaar, dus dit zegt niets over wie het bestand heeft gemaakt. Het certificaat wel.</string>
+    <string name="stores_import_from_stores">Deze komen uit stores van derden, die hun eigen kopieën van apps leveren. Totdat een app aan een certificaat is vastgepind, bepaalt het eerste bestand dat Tern uit de bijbehorende store installeert welk certificaat de updates ervan moeten dragen.</string>
+    <string name="stores_import_paused">Stores van derden staan uit, dus deze apps zijn gepauzeerd. Tern vraagt die stores niets totdat je ze aanzet.</string>
+    <string name="stores_import_names">Uit stores van derden</string>
+    <string name="share_obtainium_link">Delen als een Obtainium-link</string>
+    <string name="share_obtainium_links">Delen als Obtainium-links</string>
+</resources>
diff --git a/app/src/main/res/values-nl/strings_tv.xml b/app/src/main/res/values-nl/strings_tv.xml
new file mode 100644
index 00000000..4581a14b
--- /dev/null
+++ b/app/src/main/res/values-nl/strings_tv.xml
@@ -0,0 +1,5 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="interval_turn_off">Achtergrondcontroles uitzetten</string>
+    <string name="interval_turn_on">Achtergrondcontroles aanzetten</string>
+</resources>
diff --git a/app/src/main/res/values-pl/strings.xml b/app/src/main/res/values-pl/strings.xml
index 2a14fd25..a1d22e93 100644
--- a/app/src/main/res/values-pl/strings.xml
+++ b/app/src/main/res/values-pl/strings.xml
@@ -399,7 +399,6 @@
     <string name="settings_import_effect">Z eksportu aplikacji Tern lub Obtainium</string>
     <string name="settings_export">Eksportuj aplikacje</string>
     <string name="settings_exporting">Eksportowanie</string>
-    <string name="settings_export_effect">Zapisuje Twoją listę i ustawienia do pliku. Tokeny dostępu nie są uwzględniane.</string>
     <plurals name="exported">
         <item quantity="one">Wyeksportowano %d aplikację</item>
         <item quantity="few">Wyeksportowano %d aplikacje</item>
diff --git a/app/src/main/res/values-pl/strings_accept.xml b/app/src/main/res/values-pl/strings_accept.xml
new file mode 100644
index 00000000..33c05200
--- /dev/null
+++ b/app/src/main/res/values-pl/strings_accept.xml
@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="stores_paused_reason">Sklepy innych firm są wyłączone, więc Tern o nic nie pyta tego sklepu. Włącz je w Ustawieniach, aby sprawdzić ponownie.</string>
+</resources>
diff --git a/app/src/main/res/values-pl/strings_checks.xml b/app/src/main/res/values-pl/strings_checks.xml
index 6d00840f..d588bf34 100644
--- a/app/src/main/res/values-pl/strings_checks.xml
+++ b/app/src/main/res/values-pl/strings_checks.xml
@@ -21,13 +21,11 @@
     <string name="settings_only_installed">Sprawdzaj tylko zainstalowane aplikacje</string>
     <string name="settings_only_installed_effect">Aplikacje, które są tylko śledzone, też są sprawdzane. Aplikacja, którą otworzysz, jest zawsze sprawdzana.</string>
     <string name="settings_remove_uninstalled">Usuwaj aplikacje odinstalowane gdzie indziej</string>
-    <string name="settings_remove_uninstalled_effect">Aplikacja odinstalowana poza Tern również znika z listy.</string>
     <string name="settings_file_filter">Filtr plików</string>
     <string name="settings_file_filter_effect">Wzorzec, według którego plik wybiera każda aplikacja bez własnego filtra.</string>
     <string name="settings_file_filter_none">Brak</string>
     <string name="settings_file_filter_invalid">Nie można odczytać tego wzorca.</string>
     <string name="settings_allow_downgrades">Zezwalaj na starsze wersje</string>
-    <string name="settings_allow_downgrades_effect">Let Me Downgrade jest zainstalowany, więc Android może zainstalować starszą wersję na nowszą.</string>
     <string name="settings_collapse_groups">Zaczynaj ze zwiniętymi grupami</string>
     <string name="settings_haptics">Reakcja haptyczna</string>
     <string name="settings_haptics_effect">Lekka wibracja, gdy przesunięcie lub długie naciśnięcie coś wykonuje.</string>
@@ -42,7 +40,6 @@
     <string name="sources_repositories">Repozytoria</string>
     <string name="sources_stores">Sklepy</string>
     <string name="sources_mirrors">Sklepy ponownie publikujące aplikacje</string>
-    <string name="sources_modified">Strony ze zmienionymi aplikacjami</string>
     <string name="sources_other">Inne miejsca</string>
     <string name="sources_web_page">Strona internetowa z linkami do plików</string>
     <string name="sources_direct">Bezpośredni link do pliku</string>
@@ -52,8 +49,6 @@
     <string name="shared_configs_title">Konfiguracje udostępnione przez użytkowników Obtainium</string>
     <string name="shared_configs_effect">Strona z gotowymi ustawieniami aplikacji. Jej linki otwierają się w Tern, gdy w Ustawieniach włączona jest opcja Otwieraj linki Obtainium.</string>
     <string name="engine_inner_filter_nothing">Filtr plików wewnątrz archiwów nie pasuje do żadnego pliku APK w tym archiwum.</string>
-    <string name="preview_republished">%1$s ponownie udostępnia to, co twórcy publikują gdzie indziej. Jego pliki muszą zgadzać się z certyfikatem twórcy, gdy tylko Tern go pozna, więc jeśli możesz, przypnij certyfikat lub najpierw zainstaluj aplikację od twórcy.</string>
-    <string name="preview_modified">%1$s oferuje aplikacje zmienione przez kogoś innego niż ich twórca. Są podpisane przez tego, kto je zmienił, a Tern nie może stwierdzić, co zostało zmienione.</string>
     <string name="about_track_tern">Aktualizuj również sam Tern</string>
     <string name="about_track_tern_effect">Dodaje wydania Tern do listy, sprawdzane i weryfikowane jak każda aplikacja.</string>
     <string name="engine_channel_tracked">Nowe wydania śledzonych aplikacji</string>
diff --git a/app/src/main/res/values-pl/strings_options.xml b/app/src/main/res/values-pl/strings_options.xml
index 0315b23c..383fb6f3 100644
--- a/app/src/main/res/values-pl/strings_options.xml
+++ b/app/src/main/res/values-pl/strings_options.xml
@@ -66,10 +66,6 @@
     <string name="option_workflow">Plik przepływu pracy</string>
     <string name="option_workflow_help">Na przykład build.yml.</string>
     <string name="option_branch">Gałąź</string>
-    <string name="option_device_model">Model urządzenia</string>
-    <string name="option_device_model_help">Galaxy Store ma dla każdego modelu osobną wersję, na przykład SM-S948B.</string>
-    <string name="option_csc">Kod regionu (CSC)</string>
-    <string name="option_csc_help">Trzy litery, na przykład DBT.</string>
     <string name="option_link_filter">Filtr linków do pobrania</string>
     <string name="option_link_filter_help">Tylko pasujące linki liczą się jako pliki do pobrania.</string>
     <string name="option_page_order">Zachowaj kolejność ze strony</string>
@@ -80,11 +76,14 @@
     <string name="version_from_text">Tekst linku</string>
     <string name="version_from_page">Cała strona</string>
     <string name="option_headers">Nagłówki żądania</string>
-    <string name="option_headers_help">Po jednym w wierszu, jako Name: value. Nigdy hasło ani plik cookie.</string>
     <string name="option_pseudo">Gdy nie ma wersji</string>
     <string name="pseudo_default">Rozróżniaj pliki tak jak serwer</string>
     <string name="pseudo_hash">Według skrótu początku pliku</string>
     <string name="pseudo_link">Według adresu pliku</string>
     <string name="pseudo_etag">Według ETag serwera</string>
     <string name="option_invalid">Tego nie można użyć w tej postaci.</string>
+    <string name="option_device_model">Model urządzenia</string>
+    <string name="option_device_model_help">Galaxy Store ma dla każdego modelu osobną wersję, na przykład SM-S948B.</string>
+    <string name="option_csc">Kod regionu (CSC)</string>
+    <string name="option_csc_help">Trzy litery, na przykład DBT.</string>
 </resources>
diff --git a/app/src/main/res/values-pl/strings_safety.xml b/app/src/main/res/values-pl/strings_safety.xml
new file mode 100644
index 00000000..a8d8ae34
--- /dev/null
+++ b/app/src/main/res/values-pl/strings_safety.xml
@@ -0,0 +1,31 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="settings_export_effect_plain">Zapisuje Twoją listę i ustawienia do pliku. Tokeny nigdy do niego nie trafiają, podobnie jak nagłówek żądania, który mógłby zawierać klucz.</string>
+    <string name="engine_checksum_github_proxy">Skrót wydania GitHub, tak jak przekazał go hubproxy %1$s</string>
+    <string name="github_proxy_effect_trust">Każde żądanie do GitHub trafia do tego hosta. Widzi on każde z nich i może zmienić to, co wraca: wydania, ich skróty i pliki. Posiadane przez Ciebie aplikacje pozostają przypisane do ich certyfikatu, ale pierwsza instalacja za jego pośrednictwem ufa hubproxy tak samo jak GitHub, a przypięcie certyfikatu tego nie obejmuje. Nie jest przez niego wysyłany żaden token, więc prywatne projekty i GitHub Actions nie mogą być śledzone w ten sposób.</string>
+    <string name="settings_unmetered_checks">Sprawdzaj tylko przez Wi-Fi</string>
+    <string name="settings_unmetered_checks_effect">Sprawdzanie w tle czeka na Wi-Fi lub kabel, więc nie zużywa danych komórkowych.</string>
+    <string name="settings_charging_checks">Sprawdzaj tylko podczas ładowania</string>
+    <string name="settings_charging_checks_effect">Sprawdzanie w tle czeka, aż urządzenie będzie się ładować.</string>
+    <string name="settings_unmetered_installs_wait">Aktualizacja, która zainstalowałaby się samodzielnie, czeka na Wi-Fi lub kabel, tak jak w Obtainium.</string>
+    <string name="settings_charging_installs_wait">Aktualizacja, która zainstalowałaby się samodzielnie, czeka, aż urządzenie będzie się ładować.</string>
+    <string name="engine_downgrade_not_as_named">Źródło podało kod wersji %2$d, ale ten plik to %1$d, jest starszy niż zainstalowany. Nie zostanie nałożony na nowszą wersję.</string>
+    <string name="settings_allow_downgrades_picked">Aplikacja Let Me Downgrade jest zainstalowana, więc Android może nałożyć starszą wersję na nowszą. Tern robi to tylko dla wydania wybranego przez Ciebie z historii aplikacji, nigdy w tle ani opcją Aktualizuj wszystkie.</string>
+    <string name="option_highest_version">Bierz najwyższą wersję, tak jak w Tern 0.1.0</string>
+    <string name="option_highest_version_effect">Oferuje link z najwyższą wersją na stronie, niezależnie od jego miejsca, i dopasowuje wzorzec wersji do wersji odczytanej z każdego linku. Wyłączenie tej opcji odczytuje stronę tak jak Obtainium: ostatni link w kolejności jest tym najnowszym.</string>
+    <string name="settings_remove_uninstalled_keeps_pins">Aplikacja odinstalowana poza Tern również znika z listy. Zarchiwizowana aplikacja zostaje. Dodana ponownie z tego samego miejsca, aplikacja pozostaje przypisana do certyfikatu, który miała; usunięcie jej w Tern powoduje zapomnienie tego.</string>
+    <string name="link_check_title">Sprawdzić teraz aktualizacje?</string>
+    <string name="link_check_one">Link poprosił Tern o sprawdzenie aktualizacji dla %1$s. Tern pyta jego źródło i nic nie instaluje.</string>
+    <plurals name="link_check_all">
+        <item quantity="one">Link poprosił Tern o sprawdzenie aktualizacji dla %d aplikacji z Twojej listy. Wysyłane jest zapytanie do jej źródła i nic nie jest instalowane.</item>
+        <item quantity="few">Link poprosił Tern o sprawdzenie aktualizacji dla %d aplikacji z Twojej listy. Wysyłane są zapytania do ich źródeł i nic nie jest instalowane.</item>
+        <item quantity="many">Link poprosił Tern o sprawdzenie aktualizacji dla %d aplikacji z Twojej listy. Wysyłane są zapytania do ich źródeł i nic nie jest instalowane.</item>
+        <item quantity="other">Link poprosił Tern o sprawdzenie aktualizacji dla %d aplikacji z Twojej listy. Wysyłane są zapytania do ich źródeł i nic nie jest instalowane.</item>
+    </plurals>
+    <string name="link_check_confirm">Sprawdź</string>
+    <string name="link_check_not_now">Nie teraz</string>
+    <string name="engine_installer_fell_back">%1$s nie było gotowe, więc w tym przypadku użyto instalatora Androida.</string>
+    <string name="about_track_tern_fdroid_effect">F-Droid zainstalował tę kopię, więc Tern śledzi jej wpis tam: aktualizacje to wersje zbudowane i sprawdzone przez F-Droid, w takiej postaci, w jakiej otrzymuje je aplikacja F-Droid.</string>
+    <string name="about_track_tern_github">Zamiast tego śledź wydania GitHub</string>
+    <string name="about_track_tern_github_effect">Aktualizacje pochodzą z GitHub, gdy tylko zostaną opublikowane, zanim F-Droid je zbuduje i sprawdzi. To pomija sprawdzanie F-Droid. Tern nadal sprawdza każdy plik i wymaga zgodności z jego własnym certyfikatem.</string>
+</resources>
diff --git a/app/src/main/res/values-pl/strings_settings_more.xml b/app/src/main/res/values-pl/strings_settings_more.xml
index 472eb6a9..6b5121cb 100644
--- a/app/src/main/res/values-pl/strings_settings_more.xml
+++ b/app/src/main/res/values-pl/strings_settings_more.xml
@@ -39,9 +39,7 @@
     <string name="settings_auto_installs">Aktualizacje instalują się samodzielnie</string>
     <string name="settings_auto_installs_effect">Aplikacje ustawione na samodzielną aktualizację robią to po sprawdzeniu w tle. Gdy opcja jest wyłączona, tylko informują, że aktualizacja jest dostępna, a każda zachowuje własny wybór na później.</string>
     <string name="settings_unmetered_installs">Instaluj tylko przez Wi-Fi</string>
-    <string name="settings_unmetered_installs_effect">Sprawdzanie działa w każdej sieci. Aktualizacja, która zainstalowałaby się sama, czeka na Wi-Fi lub kabel, jak w Obtainium.</string>
     <string name="settings_charging_installs">Instaluj tylko podczas ładowania</string>
-    <string name="settings_charging_installs_effect">Sprawdzanie działa także na baterii. Aktualizacja, która zainstalowałaby się sama, czeka, aż urządzenie zacznie się ładować.</string>
     <string name="engine_unreadable_app">Nie udało się odczytać zapisanej aplikacji %1$s, więc została pominięta na liście. Nic nie zostało usunięte: nowsza wersja Tern może ją odczytać.</string>
     <string name="settings_pin_certificates">Przypinaj certyfikaty hostingów kodu</string>
     <string name="settings_pin_certificates_effect">Tak jak w Obtainium, GitHub, GitLab i Codeberg muszą okazać certyfikat urzędu certyfikacji, z którego, jak wiadomo, korzysta każdy z nich. Certyfikat wystawiony pod przymusem przez inny urząd certyfikacji jest wtedy odrzucany. Jeśli hosting kodu zmieni urząd certyfikacji, sprawdzanie tam kończy się niepowodzeniem, dopóki ta opcja nie zostanie wyłączona.</string>
diff --git a/app/src/main/res/values-pl/strings_sources_more.xml b/app/src/main/res/values-pl/strings_sources_more.xml
index 93de9280..4eeefb51 100644
--- a/app/src/main/res/values-pl/strings_sources_more.xml
+++ b/app/src/main/res/values-pl/strings_sources_more.xml
@@ -18,10 +18,7 @@
     <string name="step_arch">Preferuj procesor tego urządzenia</string>
     <string name="step_add">Dodaj stronę</string>
     <string name="step_remove">Usuń tę stronę</string>
-    <string name="option_file_version">Używaj nazwy pliku jako wersji</string>
-    <string name="option_file_version_effect">Każdy plik jest wtedy liczony jako osobne wydanie.</string>
     <string name="github_proxy_title">GitHub przez hubproxy</string>
-    <string name="github_proxy_effect">Każde żądanie do GitHub trafia do tego hosta, który widzi je wszystkie. Nie jest przez niego wysyłany żaden token, więc prywatnych projektów i GitHub Actions nie można w ten sposób śledzić.</string>
     <string name="github_proxy_host">Host hubproxy</string>
     <string name="github_proxy_help">Sama nazwa hosta, na przykład gh-proxy.com. Tern łączy się z nim przez HTTPS.</string>
     <string name="github_proxy_invalid">To nie jest nazwa hosta, której Tern może użyć</string>
diff --git a/app/src/main/res/values-pl/strings_starters.xml b/app/src/main/res/values-pl/strings_starters.xml
new file mode 100644
index 00000000..6aa2c39a
--- /dev/null
+++ b/app/src/main/res/values-pl/strings_starters.xml
@@ -0,0 +1,7 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="starter_in_list">Na Twojej liście</string>
+    <string name="starter_on_phone">Na tym telefonie</string>
+    <string name="starter_on_phone_other">Na tym telefonie, podpisana przez kogoś innego</string>
+    <string name="starter_on_phone_other_explain">Kopia, którą posiadasz, jest podpisana innym kluczem, więc Tern nie może jej zaktualizować z tego adresu.</string>
+</resources>
diff --git a/app/src/main/res/values-pl/strings_stores.xml b/app/src/main/res/values-pl/strings_stores.xml
new file mode 100644
index 00000000..823f71bf
--- /dev/null
+++ b/app/src/main/res/values-pl/strings_stores.xml
@@ -0,0 +1,27 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="option_headers_help_own_agent">Jeden w wierszu, jako Nazwa: wartość. Nigdy hasło, plik cookie ani User-Agent: Tern informuje każdą witrynę, że to Tern.</string>
+    <string name="origin_republished_first">%1$s oferuje ponownie to, co twórcy publikują gdzie indziej, i nie jest twórcą. Dopóki aplikacja nie jest przypięta do certyfikatu, pierwszy plik zainstalowany z niego przez Tern decyduje, jaki certyfikat musi mieć każda późniejsza aktualizacja.</string>
+    <string name="origin_republished_pinned">%1$s oferuje ponownie to, co twórcy publikują gdzie indziej, i nie jest twórcą. Jego pliki muszą mieć certyfikat, do którego przypisana jest ta aplikacja.</string>
+    <string name="origin_store_first">%1$s to sklep, a nie własna strona twórcy. Dopóki aplikacja nie jest przypięta do certyfikatu, pierwszy plik zainstalowany z niego przez Tern decyduje, jaki certyfikat musi mieć każda późniejsza aktualizacja.</string>
+    <string name="origin_store_pinned">%1$s to sklep, a nie własna strona twórcy. Jego pliki muszą mieć certyfikat, do którego przypisana jest ta aplikacja.</string>
+    <string name="stores_refused_modified">Tern nie czyta witryn oferujących zmodyfikowane aplikacje. Ich pliki są zmieniane przez kogoś innego niż twórca i podpisane przez tego, kto je zmienił.</string>
+    <string name="stores_refused_impersonation">Tern nie może odczytać tego sklepu bez podszywania się pod jego aplikację, więc go nie czyta.</string>
+    <string name="stores_checksum_source">%1$s, a nie twórca</string>
+    <string name="stores_off_title">%1$s to sklep innej firmy</string>
+    <string name="stores_off_body">Sklepy innych firm są wyłączone. Sklep udostępnia własne kopie aplikacji, a nie pliki z własnej strony twórcy, a Tern odczytuje go przez interfejs stworzony przez sklep dla jego własnej aplikacji lub strony internetowej. Gdy są włączone, Tern pyta sklep tylko o aplikacje dodane z niego, a dopóki aplikacja nie jest przypięta do certyfikatu, pierwszy plik zainstalowany przez Tern ze sklepu decyduje, jaki certyfikat muszą mieć jej aktualizacje.</string>
+    <string name="stores_turn_on">Włącz sklepy innych firm</string>
+    <string name="stores_advice">Włącz Sklepy innych firm w Ustawieniach, aby ponownie sprawdzić tę aplikację.</string>
+    <string name="stores_status_paused">Wstrzymane</string>
+    <string name="stores_row_paused">Sklepy innych firm są wyłączone</string>
+    <string name="stores_setting">Sklepy innych firm</string>
+    <string name="stores_setting_effect">APKPure, Aptoide, APKCombo, APKMirror, Tencent, Huawei AppGallery, Galaxy Store i vivo. Udostępniają one własne kopie aplikacji, a nie pliki z własnej strony twórcy, a Tern czyta je przez interfejsy stworzone przez nie dla własnych aplikacji i witryn. Gdy opcja jest wyłączona, Tern nie pyta żadnego z nich o nic, wyszukiwanie je pomija, a pochodzące z nich aplikacje są wstrzymane.</string>
+    <string name="stores_off_tag">wyłączone w Ustawieniach</string>
+    <string name="stores_checksum_matched">Plik jest zgodny z sumą kontrolną sklepu</string>
+    <string name="stores_explain_checksum_matched">Suma kontrolna to odcisk palca samego pliku. Sklep podał jedną, a plik pobrany przez Tern ma taką samą, więc dotarł w takiej postaci, w jakiej ma go sklep. Sklep nie jest twórcą, więc to nic nie mówi o tym, kto stworzył plik. Mówi o tym certyfikat.</string>
+    <string name="stores_import_from_stores">Pochodzą one ze sklepów innych firm, które udostępniają własne kopie aplikacji. Dopóki aplikacja nie jest przypięta do certyfikatu, pierwszy plik, który Tern zainstaluje z jej sklepu, decyduje, jaki certyfikat muszą mieć jej aktualizacje.</string>
+    <string name="stores_import_paused">Sklepy innych firm są wyłączone, więc te aplikacje są wstrzymane. Tern o nic nie pyta tych sklepów, dopóki ich nie włączysz.</string>
+    <string name="stores_import_names">Ze sklepów innych firm</string>
+    <string name="share_obtainium_link">Udostępnij jako link Obtainium</string>
+    <string name="share_obtainium_links">Udostępnij jako linki Obtainium</string>
+</resources>
diff --git a/app/src/main/res/values-pl/strings_tv.xml b/app/src/main/res/values-pl/strings_tv.xml
new file mode 100644
index 00000000..6a284ef4
--- /dev/null
+++ b/app/src/main/res/values-pl/strings_tv.xml
@@ -0,0 +1,5 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="interval_turn_off">Wyłącz sprawdzanie w tle</string>
+    <string name="interval_turn_on">Włącz sprawdzanie w tle</string>
+</resources>
diff --git a/app/src/main/res/values-pt-rBR/strings.xml b/app/src/main/res/values-pt-rBR/strings.xml
index c63a0af3..63fa10ba 100644
--- a/app/src/main/res/values-pt-rBR/strings.xml
+++ b/app/src/main/res/values-pt-rBR/strings.xml
@@ -384,7 +384,6 @@
     <string name="settings_import_effect">De uma exportação do Tern ou Obtainium</string>
     <string name="settings_export">Exportar apps</string>
     <string name="settings_exporting">Exportando</string>
-    <string name="settings_export_effect">Salva sua lista e configurações em um arquivo. Os tokens nunca são incluídos.</string>
     <plurals name="exported">
         <item quantity="one">Exportou %d app</item>
         <item quantity="many">Exportou %d apps</item>
diff --git a/app/src/main/res/values-pt-rBR/strings_accept.xml b/app/src/main/res/values-pt-rBR/strings_accept.xml
new file mode 100644
index 00000000..8f669ccc
--- /dev/null
+++ b/app/src/main/res/values-pt-rBR/strings_accept.xml
@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="stores_paused_reason">As lojas de terceiros estão desativadas, então o Tern não pede nada a esta loja. Ative-as nas Configurações para verificar novamente.</string>
+</resources>
diff --git a/app/src/main/res/values-pt-rBR/strings_checks.xml b/app/src/main/res/values-pt-rBR/strings_checks.xml
index a8e70549..df22a50e 100644
--- a/app/src/main/res/values-pt-rBR/strings_checks.xml
+++ b/app/src/main/res/values-pt-rBR/strings_checks.xml
@@ -19,13 +19,11 @@
     <string name="settings_only_installed">Verificar apenas apps instalados</string>
     <string name="settings_only_installed_effect">Apps que são apenas acompanhados também são verificados. Um app que você abre é sempre verificado.</string>
     <string name="settings_remove_uninstalled">Remover apps desinstalados fora do Tern</string>
-    <string name="settings_remove_uninstalled_effect">Um app que você desinstala fora do Tern também sai da lista.</string>
     <string name="settings_file_filter">Filtro de arquivos</string>
     <string name="settings_file_filter_effect">Um padrão pelo qual todo app sem filtro próprio escolhe seu arquivo.</string>
     <string name="settings_file_filter_none">Nenhum</string>
     <string name="settings_file_filter_invalid">Este padrão não pode ser lido.</string>
     <string name="settings_allow_downgrades">Permitir versões mais antigas</string>
-    <string name="settings_allow_downgrades_effect">O Let Me Downgrade está instalado, então o Android pode colocar uma versão mais antiga sobre uma mais nova.</string>
     <string name="settings_collapse_groups">Começar com os grupos recolhidos</string>
     <string name="settings_haptics">Resposta tátil</string>
     <string name="settings_haptics_effect">Uma vibração leve quando um deslize ou um toque longo faz algo.</string>
@@ -40,7 +38,6 @@
     <string name="sources_repositories">Repositórios</string>
     <string name="sources_stores">Lojas</string>
     <string name="sources_mirrors">Lojas que republicam apps</string>
-    <string name="sources_modified">Sites com apps modificados</string>
     <string name="sources_other">Outros lugares</string>
     <string name="sources_web_page">Uma página da web com links para arquivos</string>
     <string name="sources_direct">Um link direto para um arquivo</string>
@@ -50,8 +47,6 @@
     <string name="shared_configs_title">Configurações compartilhadas pelos usuários do Obtainium</string>
     <string name="shared_configs_effect">Um site de configurações prontas para apps. Os links dele abrem no Tern quando Abrir links do Obtainium está ativado nas Configurações.</string>
     <string name="engine_inner_filter_nothing">O filtro de arquivos dentro de arquivos compactados não corresponde a nenhum dos APKs deste.</string>
-    <string name="preview_republished">%1$s oferece de novo o que os desenvolvedores publicam em outro lugar. O Tern exige dos arquivos dele o certificado do desenvolvedor assim que o conhece, então fixe um ou instale primeiro a partir do desenvolvedor quando puder.</string>
-    <string name="preview_modified">%1$s oferece apps alterados por alguém que não é o desenvolvedor deles. Eles são assinados por quem os alterou, e o Tern não tem como saber o que foi alterado.</string>
     <string name="about_track_tern">Manter o próprio Tern atualizado</string>
     <string name="about_track_tern_effect">Adiciona os lançamentos do Tern à lista, verificados e conferidos como qualquer app.</string>
     <string name="engine_channel_tracked">Novos lançamentos de apps acompanhados</string>
diff --git a/app/src/main/res/values-pt-rBR/strings_options.xml b/app/src/main/res/values-pt-rBR/strings_options.xml
index 43a185fa..24e635f0 100644
--- a/app/src/main/res/values-pt-rBR/strings_options.xml
+++ b/app/src/main/res/values-pt-rBR/strings_options.xml
@@ -64,10 +64,6 @@
     <string name="option_workflow">Arquivo de workflow</string>
     <string name="option_workflow_help">Como build.yml.</string>
     <string name="option_branch">Branch</string>
-    <string name="option_device_model">Modelo do dispositivo</string>
-    <string name="option_device_model_help">A Galaxy Store dá a cada modelo a própria compilação, como SM-S948B.</string>
-    <string name="option_csc">Código de região (CSC)</string>
-    <string name="option_csc_help">Três letras, como DBT.</string>
     <string name="option_link_filter">Filtro de links de download</string>
     <string name="option_link_filter_help">Apenas links que correspondem contam como downloads.</string>
     <string name="option_page_order">Manter a ordem da página</string>
@@ -78,11 +74,14 @@
     <string name="version_from_text">O texto do link</string>
     <string name="version_from_page">A página inteira</string>
     <string name="option_headers">Cabeçalhos da solicitação</string>
-    <string name="option_headers_help">Um por linha, como Name: value. Nunca uma senha ou um cookie.</string>
     <string name="option_pseudo">Quando não há versão</string>
     <string name="pseudo_default">Diferenciar os arquivos como o servidor faz</string>
     <string name="pseudo_hash">Por um hash do início do arquivo</string>
     <string name="pseudo_link">Pelo endereço do arquivo</string>
     <string name="pseudo_etag">Pelo ETag do servidor</string>
     <string name="option_invalid">Isso não pode ser usado como está.</string>
+    <string name="option_device_model">Modelo do dispositivo</string>
+    <string name="option_device_model_help">A Galaxy Store dá a cada modelo a própria compilação, como SM-S948B.</string>
+    <string name="option_csc">Código de região (CSC)</string>
+    <string name="option_csc_help">Três letras, como DBT.</string>
 </resources>
diff --git a/app/src/main/res/values-pt-rBR/strings_safety.xml b/app/src/main/res/values-pt-rBR/strings_safety.xml
new file mode 100644
index 00000000..18629184
--- /dev/null
+++ b/app/src/main/res/values-pt-rBR/strings_safety.xml
@@ -0,0 +1,30 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="settings_export_effect_plain">Salva a sua lista e as configurações em um arquivo. Tokens nunca entram, nem um cabeçalho de requisição que possa conter uma chave.</string>
+    <string name="engine_checksum_github_proxy">Digest de lançamento do GitHub, como o hubproxy %1$s o repassou</string>
+    <string name="github_proxy_effect_trust">Toda requisição ao GitHub vai para este host. Ele vê cada uma e pode alterar o que volta: os lançamentos, suas somas de verificação e os arquivos. Apps que você tem continuam fixados aos seus certificados, mas uma primeira instalação por meio dele confia no hubproxy tanto quanto no GitHub, e a fixação de certificado não o alcança. Nenhum token é enviado por ele, então projetos privados e GitHub Actions não podem ser acompanhados dessa forma.</string>
+    <string name="settings_unmetered_checks">Verificar apenas no Wi-Fi</string>
+    <string name="settings_unmetered_checks_effect">Verificações em segundo plano aguardam por Wi-Fi ou um cabo, para não usar dados móveis.</string>
+    <string name="settings_charging_checks">Verificar apenas ao carregar</string>
+    <string name="settings_charging_checks_effect">Verificações em segundo plano aguardam até o dispositivo estar carregando.</string>
+    <string name="settings_unmetered_installs_wait">Uma atualização que se instalaria sozinha aguarda por Wi-Fi ou um cabo, como no Obtainium.</string>
+    <string name="settings_charging_installs_wait">Uma atualização que se instalaria sozinha aguarda até o dispositivo estar carregando.</string>
+    <string name="engine_downgrade_not_as_named">A fonte nomeou o código de versão %2$d, mas este arquivo é %1$d, mais antigo que o instalado. Ele não é colocado sobre o mais recente.</string>
+    <string name="settings_allow_downgrades_picked">O Let Me Downgrade está instalado, então o Android pode colocar uma versão mais antiga sobre uma mais recente. O Tern faz isso apenas para um lançamento que você escolhe do histórico de um app, nunca em segundo plano ou com Atualizar todos.</string>
+    <string name="option_highest_version">Pegar a versão mais alta, como fez o Tern 0.1.0</string>
+    <string name="option_highest_version_effect">Oferece o link com a versão mais alta na página, qualquer que seja o seu lugar, e roda o padrão de versão sobre a versão lida de cada link. Desativado, lê a página como o Obtainium faz: o último link na ordem é o mais recente.</string>
+    <string name="settings_remove_uninstalled_keeps_pins">Um app que você desinstala fora do Tern também sai da lista. Um app arquivado fica. Adicionado de novo do mesmo lugar, um app é mantido no certificado que tinha; removê-lo no Tern faz esquecer isso.</string>
+    <string name="link_check_title">Verificar atualizações agora?</string>
+    <string name="link_check_one">Um link pediu ao Tern para verificar atualizações de %1$s. A fonte dele é consultada, e nada é instalado.</string>
+    <plurals name="link_check_all">
+        <item quantity="one">Um link pediu ao Tern para verificar atualizações de %d app na sua lista. A fonte dele é consultada, e nada é instalado.</item>
+        <item quantity="many">Um link pediu ao Tern para verificar atualizações de %d apps na sua lista. As fontes deles são consultadas, e nada é instalado.</item>
+        <item quantity="other">Um link pediu ao Tern para verificar atualizações de %d apps na sua lista. As fontes deles são consultadas, e nada é instalado.</item>
+    </plurals>
+    <string name="link_check_confirm">Verificar</string>
+    <string name="link_check_not_now">Agora não</string>
+    <string name="engine_installer_fell_back">O %1$s não estava pronto, então o instalador do Android foi usado para este.</string>
+    <string name="about_track_tern_fdroid_effect">O F-Droid instalou esta cópia, então o Tern acompanha a entrada dele lá: as atualizações são as compilações que o F-Droid fez e verificou, como o app F-Droid as recebe.</string>
+    <string name="about_track_tern_github">Acompanhar lançamentos do GitHub</string>
+    <string name="about_track_tern_github_effect">As atualizações vêm do GitHub assim que são publicadas, antes de o F-Droid as ter compilado e verificado. Isso pula as verificações do F-Droid. O Tern ainda verifica cada arquivo e o fixa ao seu próprio certificado.</string>
+</resources>
diff --git a/app/src/main/res/values-pt-rBR/strings_settings_more.xml b/app/src/main/res/values-pt-rBR/strings_settings_more.xml
index ec125f85..4158b3b3 100644
--- a/app/src/main/res/values-pt-rBR/strings_settings_more.xml
+++ b/app/src/main/res/values-pt-rBR/strings_settings_more.xml
@@ -38,9 +38,7 @@
     <string name="settings_auto_installs">As atualizações se instalam sozinhas</string>
     <string name="settings_auto_installs_effect">Apps configurados para se atualizar sozinhos fazem isso depois de uma verificação em segundo plano. Desligado, eles apenas avisam que há uma atualização, e cada um mantém sua própria escolha para depois.</string>
     <string name="settings_unmetered_installs">Instalar apenas no Wi-Fi</string>
-    <string name="settings_unmetered_installs_effect">As verificações rodam em qualquer rede. Uma atualização que se instalaria sozinha espera pelo Wi-Fi ou por um cabo, como no Obtainium.</string>
     <string name="settings_charging_installs">Instalar apenas durante o carregamento</string>
-    <string name="settings_charging_installs_effect">As verificações rodam também com a bateria. Uma atualização que se instalaria sozinha espera até o dispositivo estar carregando.</string>
     <string name="engine_unreadable_app">O app salvo %1$s não pôde ser lido, então fica fora da lista. Nada foi apagado: uma versão mais nova do Tern pode lê-lo.</string>
     <string name="settings_pin_certificates">Fixar os certificados das forjas</string>
     <string name="settings_pin_certificates_effect">O GitHub, o GitLab e o Codeberg precisam apresentar um certificado da autoridade que cada um é conhecido por usar, como no Obtainium. Um certificado que outra autoridade tenha sido obrigada a emitir é então recusado. Se uma forja mudar de autoridade, as verificações nela falham até isto ser desligado.</string>
diff --git a/app/src/main/res/values-pt-rBR/strings_sources_more.xml b/app/src/main/res/values-pt-rBR/strings_sources_more.xml
index c323c2f1..34dd5ef5 100644
--- a/app/src/main/res/values-pt-rBR/strings_sources_more.xml
+++ b/app/src/main/res/values-pt-rBR/strings_sources_more.xml
@@ -18,10 +18,7 @@
     <string name="step_arch">Preferir o processador deste dispositivo</string>
     <string name="step_add">Adicionar uma página</string>
     <string name="step_remove">Remover esta página</string>
-    <string name="option_file_version">Usar o nome do arquivo como versão</string>
-    <string name="option_file_version_effect">Cada arquivo passa então a contar como um lançamento próprio.</string>
     <string name="github_proxy_title">GitHub por meio de um hubproxy</string>
-    <string name="github_proxy_effect">Toda solicitação ao GitHub vai para este host, que vê cada uma delas. Nenhum token é enviado por ele, então projetos privados e o GitHub Actions não podem ser acompanhados assim.</string>
     <string name="github_proxy_host">Host do hubproxy</string>
     <string name="github_proxy_help">Apenas um nome de host, como gh-proxy.com. O Tern se conecta a ele por HTTPS.</string>
     <string name="github_proxy_invalid">Este não é um nome de host que o Tern possa usar</string>
diff --git a/app/src/main/res/values-pt-rBR/strings_starters.xml b/app/src/main/res/values-pt-rBR/strings_starters.xml
new file mode 100644
index 00000000..4b1e022a
--- /dev/null
+++ b/app/src/main/res/values-pt-rBR/strings_starters.xml
@@ -0,0 +1,7 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="starter_in_list">Na sua lista</string>
+    <string name="starter_on_phone">Neste telefone</string>
+    <string name="starter_on_phone_other">Neste telefone com outra assinatura</string>
+    <string name="starter_on_phone_other_explain">A cópia que você tem foi assinada com uma chave diferente, então o Tern não pode atualizá-la deste endereço.</string>
+</resources>
diff --git a/app/src/main/res/values-pt-rBR/strings_stores.xml b/app/src/main/res/values-pt-rBR/strings_stores.xml
new file mode 100644
index 00000000..dc156499
--- /dev/null
+++ b/app/src/main/res/values-pt-rBR/strings_stores.xml
@@ -0,0 +1,27 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="option_headers_help_own_agent">Um por linha, como Nome: valor. Nunca uma senha, um cookie ou um User-Agent: o Tern diz a cada site que é o Tern.</string>
+    <string name="origin_republished_first">%1$s oferece de novo o que desenvolvedores publicam em outro lugar, e não é o desenvolvedor. Até que o app seja fixado a um certificado, o primeiro arquivo que o Tern instala dele decide qual certificado cada atualização posterior precisará ter.</string>
+    <string name="origin_republished_pinned">%1$s oferece de novo o que desenvolvedores publicam em outro lugar, e não é o desenvolvedor. Seus arquivos precisam ter o certificado ao qual este app está fixado.</string>
+    <string name="origin_store_first">%1$s é uma loja, não o site do próprio desenvolvedor. Até que o app seja fixado a um certificado, o primeiro arquivo que o Tern instala dela decide qual certificado cada atualização posterior precisará ter.</string>
+    <string name="origin_store_pinned">%1$s é uma loja, não o site do próprio desenvolvedor. Seus arquivos precisam ter o certificado ao qual este app está fixado.</string>
+    <string name="stores_refused_modified">O Tern não lê sites que oferecem apps modificados. Os arquivos deles são alterados por alguém além do desenvolvedor e assinados por quem os alterou.</string>
+    <string name="stores_refused_impersonation">O Tern não consegue ler esta loja sem fingir ser o app dela, então não a lê.</string>
+    <string name="stores_checksum_source">%1$s, que não é o desenvolvedor</string>
+    <string name="stores_off_title">%1$s é uma loja de terceiros</string>
+    <string name="stores_off_body">As lojas de terceiros estão desativadas. Uma loja serve as próprias cópias de apps, não arquivos do site do próprio desenvolvedor, e o Tern a lê pela interface que a loja fez para o seu próprio app ou site. Com elas ativadas, o Tern pergunta a uma loja apenas sobre os apps que você adiciona dela, e até que um app seja fixado a um certificado, o primeiro arquivo que o Tern instala de uma loja decide qual certificado as suas atualizações precisarão ter.</string>
+    <string name="stores_turn_on">Ativar lojas de terceiros</string>
+    <string name="stores_advice">Ative Lojas de terceiros nas Configurações para verificar este app novamente.</string>
+    <string name="stores_status_paused">Pausado</string>
+    <string name="stores_row_paused">As lojas de terceiros estão desativadas</string>
+    <string name="stores_setting">Lojas de terceiros</string>
+    <string name="stores_setting_effect">APKPure, Aptoide, APKCombo, APKMirror, Tencent, Huawei AppGallery, a Galaxy Store e vivo. Elas servem suas próprias cópias de apps, não arquivos do site do próprio desenvolvedor, e o Tern as lê pelas interfaces que elas fizeram para seus próprios apps e sites. Desativadas, o Tern não pergunta nada a elas, uma pesquisa as deixa de fora e apps vindos delas ficam pausados.</string>
+    <string name="stores_off_tag">desativado nas Configurações</string>
+    <string name="stores_checksum_matched">O arquivo corresponde à soma de verificação da loja</string>
+    <string name="stores_explain_checksum_matched">Uma soma de verificação é uma impressão digital do próprio arquivo. A loja deu uma, e o arquivo que o Tern baixou tem a mesma, então ele chegou como a loja o tem. A loja não é o desenvolvedor, então isso não diz nada sobre quem fez o arquivo. O certificado diz.</string>
+    <string name="stores_import_from_stores">Estes vêm de lojas de terceiros, que servem suas próprias cópias de apps. Até que um app seja fixado a um certificado, o primeiro arquivo que o Tern instala da sua loja decide qual certificado as suas atualizações precisarão ter.</string>
+    <string name="stores_import_paused">As lojas de terceiros estão desativadas, então estes apps estão pausados. O Tern não pergunta nada a essas lojas até você ativá-las.</string>
+    <string name="stores_import_names">De lojas de terceiros</string>
+    <string name="share_obtainium_link">Compartilhar como link do Obtainium</string>
+    <string name="share_obtainium_links">Compartilhar como links do Obtainium</string>
+</resources>
diff --git a/app/src/main/res/values-pt-rBR/strings_tv.xml b/app/src/main/res/values-pt-rBR/strings_tv.xml
new file mode 100644
index 00000000..acfec297
--- /dev/null
+++ b/app/src/main/res/values-pt-rBR/strings_tv.xml
@@ -0,0 +1,5 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="interval_turn_off">Desativar verificações em segundo plano</string>
+    <string name="interval_turn_on">Ativar verificações em segundo plano</string>
+</resources>
diff --git a/app/src/main/res/values-pt/strings.xml b/app/src/main/res/values-pt/strings.xml
index 83e82b2a..cd21184c 100644
--- a/app/src/main/res/values-pt/strings.xml
+++ b/app/src/main/res/values-pt/strings.xml
@@ -384,7 +384,6 @@
     <string name="settings_import_effect">De uma exportação do Tern ou do Obtainium</string>
     <string name="settings_export">Exportar aplicações</string>
     <string name="settings_exporting">A exportar</string>
-    <string name="settings_export_effect">Guarda a sua lista e definições num ficheiro. Tokens de acesso nunca são incluídos.</string>
     <plurals name="exported">
         <item quantity="one">Exportou %d aplicação</item>
         <item quantity="many">Exportou %d aplicações</item>
diff --git a/app/src/main/res/values-pt/strings_accept.xml b/app/src/main/res/values-pt/strings_accept.xml
new file mode 100644
index 00000000..760559da
--- /dev/null
+++ b/app/src/main/res/values-pt/strings_accept.xml
@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="stores_paused_reason">As lojas de terceiros estão desligadas, por isso o Tern não consulta esta loja. Ligue-as nas Definições para a verificar novamente.</string>
+</resources>
diff --git a/app/src/main/res/values-pt/strings_checks.xml b/app/src/main/res/values-pt/strings_checks.xml
index 7bd3b244..b0b5681c 100644
--- a/app/src/main/res/values-pt/strings_checks.xml
+++ b/app/src/main/res/values-pt/strings_checks.xml
@@ -19,13 +19,11 @@
     <string name="settings_only_installed">Verificar apenas aplicações instaladas</string>
     <string name="settings_only_installed_effect">As aplicações que são apenas seguidas também são verificadas. Uma aplicação que abra é sempre verificada.</string>
     <string name="settings_remove_uninstalled">Remover aplicações desinstaladas fora do Tern</string>
-    <string name="settings_remove_uninstalled_effect">Uma aplicação que desinstale fora do Tern também sai da lista.</string>
     <string name="settings_file_filter">Filtro de ficheiros</string>
     <string name="settings_file_filter_effect">Um padrão pelo qual cada aplicação sem filtro próprio escolhe o seu ficheiro.</string>
     <string name="settings_file_filter_none">Nenhum</string>
     <string name="settings_file_filter_invalid">Este padrão não pode ser lido.</string>
     <string name="settings_allow_downgrades">Permitir versões mais antigas</string>
-    <string name="settings_allow_downgrades_effect">O Let Me Downgrade está instalado, por isso o Android pode instalar uma versão mais antiga sobre uma mais recente.</string>
     <string name="settings_collapse_groups">Começar com os grupos fechados</string>
     <string name="settings_haptics">Resposta tátil</string>
     <string name="settings_haptics_effect">Uma vibração leve quando um deslize ou um toque longo faz algo.</string>
@@ -40,7 +38,6 @@
     <string name="sources_repositories">Repositórios</string>
     <string name="sources_stores">Lojas</string>
     <string name="sources_mirrors">Lojas que republicam aplicações</string>
-    <string name="sources_modified">Sites com aplicações modificadas</string>
     <string name="sources_other">Outros locais</string>
     <string name="sources_web_page">Uma página web com ligações para ficheiros</string>
     <string name="sources_direct">Uma ligação direta para um ficheiro</string>
@@ -50,8 +47,6 @@
     <string name="shared_configs_title">Configurações partilhadas pelos utilizadores do Obtainium</string>
     <string name="shared_configs_effect">Um site de definições prontas para aplicações. As suas ligações abrem no Tern quando Abrir ligações do Obtainium está ativado nas Definições.</string>
     <string name="engine_inner_filter_nothing">O filtro de ficheiros dentro de arquivos não corresponde a nenhum dos APK deste.</string>
-    <string name="preview_republished">%1$s volta a oferecer o que os programadores publicam noutros locais. O Tern sujeita os seus ficheiros ao certificado do programador assim que o conhece, por isso fixe um ou instale primeiro a partir do programador quando puder.</string>
-    <string name="preview_modified">%1$s oferece aplicações alteradas por outra pessoa que não o seu programador. São assinadas por quem as alterou, e o Tern não consegue saber o que foi alterado.</string>
     <string name="about_track_tern">Manter o próprio Tern atualizado</string>
     <string name="about_track_tern_effect">Adiciona os lançamentos do Tern à lista, verificados e confirmados como qualquer aplicação.</string>
     <string name="engine_channel_tracked">Novos lançamentos de aplicações seguidas</string>
diff --git a/app/src/main/res/values-pt/strings_options.xml b/app/src/main/res/values-pt/strings_options.xml
index 22a2a674..2ed114b6 100644
--- a/app/src/main/res/values-pt/strings_options.xml
+++ b/app/src/main/res/values-pt/strings_options.xml
@@ -64,10 +64,6 @@
     <string name="option_workflow">Ficheiro de workflow</string>
     <string name="option_workflow_help">Como build.yml.</string>
     <string name="option_branch">Ramo</string>
-    <string name="option_device_model">Modelo do dispositivo</string>
-    <string name="option_device_model_help">A Galaxy Store dá a cada modelo a sua própria compilação, como SM-S948B.</string>
-    <string name="option_csc">Código de região (CSC)</string>
-    <string name="option_csc_help">Três letras, como DBT.</string>
     <string name="option_link_filter">Filtro de ligações de transferência</string>
     <string name="option_link_filter_help">Apenas as ligações correspondentes contam como transferências.</string>
     <string name="option_page_order">Manter a ordem da página</string>
@@ -78,11 +74,14 @@
     <string name="version_from_text">O texto da ligação</string>
     <string name="version_from_page">A página inteira</string>
     <string name="option_headers">Cabeçalhos do pedido</string>
-    <string name="option_headers_help">Um por linha, como Name: value. Nunca uma palavra-passe ou um cookie.</string>
     <string name="option_pseudo">Quando não há versão</string>
     <string name="pseudo_default">Distinguir os ficheiros como o servidor faz</string>
     <string name="pseudo_hash">Por um hash do início do ficheiro</string>
     <string name="pseudo_link">Pelo endereço do ficheiro</string>
     <string name="pseudo_etag">Pelo ETag do servidor</string>
     <string name="option_invalid">Isto não pode ser usado tal como está.</string>
+    <string name="option_device_model">Modelo do dispositivo</string>
+    <string name="option_device_model_help">A Galaxy Store dá a cada modelo a sua própria compilação, como SM-S948B.</string>
+    <string name="option_csc">Código de região (CSC)</string>
+    <string name="option_csc_help">Três letras, como DBT.</string>
 </resources>
diff --git a/app/src/main/res/values-pt/strings_safety.xml b/app/src/main/res/values-pt/strings_safety.xml
new file mode 100644
index 00000000..c449de3b
--- /dev/null
+++ b/app/src/main/res/values-pt/strings_safety.xml
@@ -0,0 +1,30 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="settings_export_effect_plain">Guarda a sua lista e definições num ficheiro. Os tokens nunca entram, nem um cabeçalho de pedido que possa conter uma chave.</string>
+    <string name="engine_checksum_github_proxy">Resumo criptográfico do lançamento do GitHub, tal como o hubproxy %1$s o passou</string>
+    <string name="github_proxy_effect_trust">Todos os pedidos para o GitHub vão para este anfitrião. Ele vê cada um e pode alterar o que volta: os lançamentos, os seus resumos criptográficos e os ficheiros. As aplicações que tem continuam fixadas ao seu certificado, mas uma primeira instalação através dele confia no hubproxy tanto quanto no GitHub, e a fixação de certificados não o alcança. Nenhum token é enviado através dele, por isso projetos privados e GitHub Actions não podem ser seguidos desta forma.</string>
+    <string name="settings_unmetered_checks">Verificar apenas por Wi-Fi</string>
+    <string name="settings_unmetered_checks_effect">As verificações em segundo plano esperam por Wi-Fi ou por um cabo, por isso não usam dados móveis.</string>
+    <string name="settings_charging_checks">Verificar apenas a carregar</string>
+    <string name="settings_charging_checks_effect">As verificações em segundo plano esperam até que o dispositivo esteja a carregar.</string>
+    <string name="settings_unmetered_installs_wait">Uma atualização que se instalaria sozinha espera por Wi-Fi ou por um cabo, como no Obtainium.</string>
+    <string name="settings_charging_installs_wait">Uma atualização que se instalaria sozinha espera até que o dispositivo esteja a carregar.</string>
+    <string name="engine_downgrade_not_as_named">A origem nomeou o código de versão %2$d, mas este ficheiro é %1$d, mais antigo que o instalado. Não é colocado sobre o mais recente.</string>
+    <string name="settings_allow_downgrades_picked">O Let Me Downgrade está instalado, por isso o Android pode colocar uma versão mais antiga sobre uma mais recente. O Tern fá-lo apenas para um lançamento que escolha no histórico de uma aplicação, nunca em segundo plano ou com Atualizar todas.</string>
+    <string name="option_highest_version">Usar a versão mais alta, como o Tern 0.1.0 fazia</string>
+    <string name="option_highest_version_effect">Oferece a ligação com a versão mais alta na página, seja qual for o seu lugar, e aplica o padrão de versão sobre a versão lida de cada ligação. Desligado lê a página da forma que o Obtainium faz: a última ligação por ordem é a mais recente.</string>
+    <string name="settings_remove_uninstalled_keeps_pins">Uma aplicação que desinstale fora do Tern também sai da lista. Uma aplicação arquivada fica. Adicionada novamente do mesmo local, uma aplicação continua fixada ao certificado que tinha; removê-la no Tern esquece isso.</string>
+    <string name="link_check_title">Verificar atualizações agora?</string>
+    <string name="link_check_one">Uma ligação pediu ao Tern para verificar atualizações para %1$s. A sua origem é consultada, e nada é instalado.</string>
+    <plurals name="link_check_all">
+        <item quantity="one">Uma ligação pediu ao Tern para verificar atualizações para a %d aplicação na sua lista. A sua origem é consultada, e nada é instalado.</item>
+        <item quantity="many">Uma ligação pediu ao Tern para verificar atualizações para as %d aplicações na sua lista. As suas origens são consultadas, e nada é instalado.</item>
+        <item quantity="other">Uma ligação pediu ao Tern para verificar atualizações para as %d aplicações na sua lista. As suas origens são consultadas, e nada é instalado.</item>
+    </plurals>
+    <string name="link_check_confirm">Verificar</string>
+    <string name="link_check_not_now">Agora não</string>
+    <string name="engine_installer_fell_back">O %1$s não estava pronto, por isso o instalador do Android foi usado para esta.</string>
+    <string name="about_track_tern_fdroid_effect">O F-Droid instalou esta cópia, por isso o Tern segue a sua entrada lá: as atualizações são as compilações que o F-Droid fez e verificou, tal como a aplicação F-Droid as obtém.</string>
+    <string name="about_track_tern_github">Seguir antes os lançamentos do GitHub</string>
+    <string name="about_track_tern_github_effect">As atualizações vêm do GitHub assim que são publicadas, antes que o F-Droid as tenha compilado e verificado. Isto ignora as verificações do F-Droid. O Tern continua a verificar cada ficheiro e fixa-o ao seu próprio certificado.</string>
+</resources>
diff --git a/app/src/main/res/values-pt/strings_settings_more.xml b/app/src/main/res/values-pt/strings_settings_more.xml
index 63e56c80..af7bc96c 100644
--- a/app/src/main/res/values-pt/strings_settings_more.xml
+++ b/app/src/main/res/values-pt/strings_settings_more.xml
@@ -38,9 +38,7 @@
     <string name="settings_auto_installs">As atualizações instalam-se sozinhas</string>
     <string name="settings_auto_installs_effect">As aplicações definidas para se atualizarem sozinhas fazem-no depois de uma verificação em segundo plano. Desligado, apenas indicam que existe uma atualização, e cada uma mantém a sua própria escolha para mais tarde.</string>
     <string name="settings_unmetered_installs">Instalar apenas com Wi-Fi</string>
-    <string name="settings_unmetered_installs_effect">As verificações são feitas em qualquer rede. Uma atualização que se instalaria sozinha aguarda pelo Wi-Fi ou por um cabo, como no Obtainium.</string>
     <string name="settings_charging_installs">Instalar apenas durante o carregamento</string>
-    <string name="settings_charging_installs_effect">As verificações são feitas também com a bateria. Uma atualização que se instalaria sozinha aguarda até o dispositivo estar a carregar.</string>
     <string name="engine_unreadable_app">A aplicação guardada %1$s não pôde ser lida, por isso fica fora da lista. Nada foi apagado: uma versão mais recente do Tern pode lê-la.</string>
     <string name="settings_pin_certificates">Fixar os certificados das forjas</string>
     <string name="settings_pin_certificates_effect">O GitHub, o GitLab e o Codeberg têm de apresentar um certificado da autoridade que cada um é conhecido por usar, como no Obtainium. Um certificado que outra autoridade tenha sido obrigada a emitir é então recusado. Se uma forja mudar de autoridade, as verificações aí falham até isto ser desligado.</string>
diff --git a/app/src/main/res/values-pt/strings_sources_more.xml b/app/src/main/res/values-pt/strings_sources_more.xml
index 612affe7..460c2e24 100644
--- a/app/src/main/res/values-pt/strings_sources_more.xml
+++ b/app/src/main/res/values-pt/strings_sources_more.xml
@@ -18,10 +18,7 @@
     <string name="step_arch">Preferir o processador deste dispositivo</string>
     <string name="step_add">Adicionar uma página</string>
     <string name="step_remove">Remover esta página</string>
-    <string name="option_file_version">Usar o nome do ficheiro como versão</string>
-    <string name="option_file_version_effect">Cada ficheiro conta então como um lançamento próprio.</string>
     <string name="github_proxy_title">GitHub através de um hubproxy</string>
-    <string name="github_proxy_effect">Cada pedido ao GitHub vai para este anfitrião, que vê cada um deles. Nenhum token é enviado por ele, por isso os projetos privados e o GitHub Actions não podem ser seguidos desta forma.</string>
     <string name="github_proxy_host">Anfitrião do hubproxy</string>
     <string name="github_proxy_help">Apenas um nome de anfitrião, como gh-proxy.com. O Tern liga-se a ele por HTTPS.</string>
     <string name="github_proxy_invalid">Isso não é um nome de anfitrião que o Tern possa usar</string>
diff --git a/app/src/main/res/values-pt/strings_starters.xml b/app/src/main/res/values-pt/strings_starters.xml
new file mode 100644
index 00000000..36964631
--- /dev/null
+++ b/app/src/main/res/values-pt/strings_starters.xml
@@ -0,0 +1,7 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="starter_in_list">Na sua lista</string>
+    <string name="starter_on_phone">Neste telemóvel</string>
+    <string name="starter_on_phone_other">Neste telemóvel de outro assinante</string>
+    <string name="starter_on_phone_other_explain">A cópia que tem está assinada com uma chave diferente, por isso o Tern não a consegue atualizar a partir deste endereço.</string>
+</resources>
diff --git a/app/src/main/res/values-pt/strings_stores.xml b/app/src/main/res/values-pt/strings_stores.xml
new file mode 100644
index 00000000..0fbc6f33
--- /dev/null
+++ b/app/src/main/res/values-pt/strings_stores.xml
@@ -0,0 +1,27 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="option_headers_help_own_agent">Um por linha, como Nome: valor. Nunca uma palavra-passe, um cookie ou um User-Agent: o Tern diz a todos os sites que é o Tern.</string>
+    <string name="origin_republished_first">%1$s volta a oferecer o que os programadores publicam noutros locais, e não é o programador. Até que a aplicação seja fixada a um certificado, o primeiro ficheiro que o Tern instalar a partir dela decide que certificado cada atualização posterior tem de ter.</string>
+    <string name="origin_republished_pinned">%1$s volta a oferecer o que os programadores publicam noutros locais, e não é o programador. Os seus ficheiros têm de ter o certificado a que esta aplicação está fixada.</string>
+    <string name="origin_store_first">%1$s é uma loja, não o site do próprio programador. Até que a aplicação seja fixada a um certificado, o primeiro ficheiro que o Tern instalar a partir dela decide que certificado cada atualização posterior tem de ter.</string>
+    <string name="origin_store_pinned">%1$s é uma loja, não o site do próprio programador. Os seus ficheiros têm de ter o certificado a que esta aplicação está fixada.</string>
+    <string name="stores_refused_modified">O Tern não lê sites que oferecem aplicações modificadas. Os seus ficheiros são alterados por outra pessoa que não o programador e assinados por quem os alterou.</string>
+    <string name="stores_refused_impersonation">O Tern não consegue ler esta loja sem fingir ser a sua aplicação, por isso não a lê.</string>
+    <string name="stores_checksum_source">%1$s, que não é o programador</string>
+    <string name="stores_off_title">%1$s é uma loja de terceiros</string>
+    <string name="stores_off_body">As lojas de terceiros estão desligadas. Uma loja serve as suas próprias cópias de aplicações, não ficheiros do site do próprio programador, e o Tern lê-a através da interface que a loja fez para a sua própria aplicação ou site. Com elas ligadas, o Tern pergunta a uma loja apenas pelas aplicações que adicionar a partir dela, e até que uma aplicação seja fixada a um certificado, o primeiro ficheiro que o Tern instalar de uma loja decide que certificado as suas atualizações têm de ter.</string>
+    <string name="stores_turn_on">Ligar lojas de terceiros</string>
+    <string name="stores_advice">Ligue as Lojas de terceiros nas Definições para verificar esta aplicação novamente.</string>
+    <string name="stores_status_paused">Em pausa</string>
+    <string name="stores_row_paused">Lojas de terceiros desligadas</string>
+    <string name="stores_setting">Lojas de terceiros</string>
+    <string name="stores_setting_effect">APKPure, Aptoide, APKCombo, APKMirror, Tencent, Huawei AppGallery, Galaxy Store e vivo. Servem as suas próprias cópias de aplicações, não ficheiros do site do próprio programador, e o Tern lê-as através das interfaces que fizeram para as suas próprias aplicações e sites. Desligadas, o Tern não pergunta nada a nenhuma delas, uma pesquisa deixa-as de fora e as aplicações delas ficam em pausa.</string>
+    <string name="stores_off_tag">desligadas nas Definições</string>
+    <string name="stores_checksum_matched">O ficheiro corresponde à soma de verificação da loja</string>
+    <string name="stores_explain_checksum_matched">Uma soma de verificação é uma impressão digital do próprio ficheiro. A loja deu uma, e o ficheiro que o Tern transferiu tem a mesma, por isso chegou como a loja o tem. A loja não é o programador, por isso isto não diz nada sobre quem fez o ficheiro. O certificado diz.</string>
+    <string name="stores_import_from_stores">Estas vêm de lojas de terceiros, que servem as suas próprias cópias de aplicações. Até que uma aplicação seja fixada a um certificado, o primeiro ficheiro que o Tern instalar da sua loja decide que certificado as suas atualizações têm de ter.</string>
+    <string name="stores_import_paused">As lojas de terceiros estão desligadas, por isso estas aplicações estão em pausa. O Tern não pergunta nada a essas lojas até que as ligue.</string>
+    <string name="stores_import_names">De lojas de terceiros</string>
+    <string name="share_obtainium_link">Partilhar como ligação do Obtainium</string>
+    <string name="share_obtainium_links">Partilhar como ligações do Obtainium</string>
+</resources>
diff --git a/app/src/main/res/values-pt/strings_tv.xml b/app/src/main/res/values-pt/strings_tv.xml
new file mode 100644
index 00000000..6a355cd9
--- /dev/null
+++ b/app/src/main/res/values-pt/strings_tv.xml
@@ -0,0 +1,5 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="interval_turn_off">Desligar verificações em segundo plano</string>
+    <string name="interval_turn_on">Ligar verificações em segundo plano</string>
+</resources>
diff --git a/app/src/main/res/values-ru/strings.xml b/app/src/main/res/values-ru/strings.xml
index 99cd5827..364f4884 100644
--- a/app/src/main/res/values-ru/strings.xml
+++ b/app/src/main/res/values-ru/strings.xml
@@ -399,7 +399,6 @@
     <string name="settings_import_effect">Из файла экспорта Tern или Obtainium</string>
     <string name="settings_export">Экспорт приложений</string>
     <string name="settings_exporting">Экспорт</string>
-    <string name="settings_export_effect">Сохраняет ваш список и настройки в файл. Токены никогда не включаются.</string>
     <plurals name="exported">
         <item quantity="one">Экспортировано %d приложение</item>
         <item quantity="few">Экспортировано %d приложения</item>
diff --git a/app/src/main/res/values-ru/strings_accept.xml b/app/src/main/res/values-ru/strings_accept.xml
new file mode 100644
index 00000000..76c2326e
--- /dev/null
+++ b/app/src/main/res/values-ru/strings_accept.xml
@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="stores_paused_reason">Сторонние магазины выключены, поэтому Tern ничего не спрашивает у этого магазина. Включите их в Настройках, чтобы проверить его снова.</string>
+</resources>
diff --git a/app/src/main/res/values-ru/strings_checks.xml b/app/src/main/res/values-ru/strings_checks.xml
index 8e0f0e63..e1f43936 100644
--- a/app/src/main/res/values-ru/strings_checks.xml
+++ b/app/src/main/res/values-ru/strings_checks.xml
@@ -21,13 +21,11 @@
     <string name="settings_only_installed">Проверять только установленные приложения</string>
     <string name="settings_only_installed_effect">Приложения, которые только отслеживаются, тоже проверяются. Открытое вами приложение проверяется всегда.</string>
     <string name="settings_remove_uninstalled">Убирать приложения, удаленные в другом месте</string>
-    <string name="settings_remove_uninstalled_effect">Приложение, которое вы удалили не через Tern, тоже исчезает из списка.</string>
     <string name="settings_file_filter">Фильтр файлов</string>
     <string name="settings_file_filter_effect">Шаблон, по которому выбирают файл все приложения без собственного фильтра.</string>
     <string name="settings_file_filter_none">Нет</string>
     <string name="settings_file_filter_invalid">Этот шаблон невозможно прочитать.</string>
     <string name="settings_allow_downgrades">Разрешить старые версии</string>
-    <string name="settings_allow_downgrades_effect">Установлен Let Me Downgrade, поэтому Android может установить старую версию поверх более новой.</string>
     <string name="settings_collapse_groups">Изначально сворачивать группы</string>
     <string name="settings_haptics">Тактильный отклик</string>
     <string name="settings_haptics_effect">Легкая вибрация, когда свайп или долгое нажатие что-то делает.</string>
@@ -42,7 +40,6 @@
     <string name="sources_repositories">Репозитории</string>
     <string name="sources_stores">Магазины</string>
     <string name="sources_mirrors">Магазины, повторно публикующие приложения</string>
-    <string name="sources_modified">Сайты с измененными приложениями</string>
     <string name="sources_other">Другие места</string>
     <string name="sources_web_page">Веб-страница со ссылками на файлы</string>
     <string name="sources_direct">Прямая ссылка на файл</string>
@@ -52,8 +49,6 @@
     <string name="shared_configs_title">Конфигурации от пользователей Obtainium</string>
     <string name="shared_configs_effect">Сайт с готовыми настройками для приложений. Его ссылки открываются в Tern, если в Настройках включено «Открывать ссылки Obtainium».</string>
     <string name="engine_inner_filter_nothing">Фильтр файлов внутри архивов не совпадает ни с одним APK в этом архиве.</string>
-    <string name="preview_republished">%1$s повторно публикует то, что разработчики выпускают в других местах. Его файлы сверяются с сертификатом разработчика, как только Tern его узнает, поэтому по возможности закрепите сертификат или сначала установите приложение от разработчика.</string>
-    <string name="preview_modified">%1$s предлагает приложения, измененные не их разработчиком. Они подписаны тем, кто их изменил, и Tern не может определить, что именно изменено.</string>
     <string name="about_track_tern">Обновлять сам Tern</string>
     <string name="about_track_tern_effect">Добавляет в список релизы самого Tern: они проверяются и сверяются, как у любого приложения.</string>
     <string name="engine_channel_tracked">Новые релизы отслеживаемых приложений</string>
diff --git a/app/src/main/res/values-ru/strings_options.xml b/app/src/main/res/values-ru/strings_options.xml
index af33f63c..9bc337a2 100644
--- a/app/src/main/res/values-ru/strings_options.xml
+++ b/app/src/main/res/values-ru/strings_options.xml
@@ -66,10 +66,6 @@
     <string name="option_workflow">Файл рабочего процесса</string>
     <string name="option_workflow_help">Например, build.yml.</string>
     <string name="option_branch">Ветка</string>
-    <string name="option_device_model">Модель устройства</string>
-    <string name="option_device_model_help">Galaxy Store выпускает для каждой модели свою сборку, например SM-S948B.</string>
-    <string name="option_csc">Код региона (CSC)</string>
-    <string name="option_csc_help">Три буквы, например DBT.</string>
     <string name="option_link_filter">Фильтр ссылок на скачивание</string>
     <string name="option_link_filter_help">Скачиваниями считаются только подходящие ссылки.</string>
     <string name="option_page_order">Сохранять порядок страницы</string>
@@ -80,11 +76,14 @@
     <string name="version_from_text">Текст ссылки</string>
     <string name="version_from_page">Вся страница</string>
     <string name="option_headers">Заголовки запроса</string>
-    <string name="option_headers_help">По одному на строку, в виде Name: value. Никогда не указывайте пароль или cookie.</string>
     <string name="option_pseudo">Когда версии нет</string>
     <string name="pseudo_default">Различать файлы так, как это делает сервер</string>
     <string name="pseudo_hash">По хешу начала файла</string>
     <string name="pseudo_link">По адресу файла</string>
     <string name="pseudo_etag">По ETag сервера</string>
     <string name="option_invalid">Это нельзя использовать в таком виде.</string>
+    <string name="option_device_model">Модель устройства</string>
+    <string name="option_device_model_help">Galaxy Store выпускает для каждой модели свою сборку, например SM-S948B.</string>
+    <string name="option_csc">Код региона (CSC)</string>
+    <string name="option_csc_help">Три буквы, например DBT.</string>
 </resources>
diff --git a/app/src/main/res/values-ru/strings_safety.xml b/app/src/main/res/values-ru/strings_safety.xml
new file mode 100644
index 00000000..da1df24e
--- /dev/null
+++ b/app/src/main/res/values-ru/strings_safety.xml
@@ -0,0 +1,31 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="settings_export_effect_plain">Сохраняет ваш список и настройки в файл. Токены никогда не включаются, как и заголовок запроса, который может содержать ключ.</string>
+    <string name="engine_checksum_github_proxy">Дайджест релиза GitHub, как его передал hubproxy %1$s</string>
+    <string name="github_proxy_effect_trust">Каждый запрос к GitHub идет на этот хост. Он видит каждый из них и может изменить то, что возвращается: релизы, их дайджесты и файлы. Имеющиеся у вас приложения остаются закрепленными за их сертификатом, но первая установка через него доверяет hubproxy так же, как и GitHub, и закрепление сертификата на него не распространяется. Через него не отправляется ни один токен, поэтому приватные проекты и GitHub Actions нельзя отслеживать таким образом.</string>
+    <string name="settings_unmetered_checks">Проверять только по Wi-Fi</string>
+    <string name="settings_unmetered_checks_effect">Фоновые проверки ждут Wi-Fi или кабель, поэтому они не используют мобильные данные.</string>
+    <string name="settings_charging_checks">Проверять только при зарядке</string>
+    <string name="settings_charging_checks_effect">Фоновые проверки ждут, пока устройство заряжается.</string>
+    <string name="settings_unmetered_installs_wait">Обновление, которое установилось бы само, ждет Wi-Fi или кабель, как в Obtainium.</string>
+    <string name="settings_charging_installs_wait">Обновление, которое установилось бы само, ждет зарядки устройства.</string>
+    <string name="engine_downgrade_not_as_named">Источник назвал код версии %2$d, но этот файл имеет код %1$d, более старый, чем установленный. Он не ставится поверх более нового.</string>
+    <string name="settings_allow_downgrades_picked">Let Me Downgrade установлено, поэтому Android может установить более старую версию поверх более новой. Tern делает это только для релиза, который вы выбираете из истории приложения, и никогда в фоне или при Обновить все.</string>
+    <string name="option_highest_version">Брать самую высокую версию, как это делал Tern 0.1.0</string>
+    <string name="option_highest_version_effect">Предлагает ссылку с самой высокой версией на странице, независимо от ее места, и применяет шаблон версии к версии, прочитанной из каждой ссылки. В выключенном состоянии страница читается так, как это делает Obtainium: последняя ссылка по порядку является самой новой.</string>
+    <string name="settings_remove_uninstalled_keeps_pins">Приложение, которое вы удаляете вне Tern, также исчезает из списка. Архивированное приложение остается. При повторном добавлении из того же места приложение закрепляется за сертификатом, который у него был; при удалении в Tern он забывается.</string>
+    <string name="link_check_title">Проверить обновления сейчас?</string>
+    <string name="link_check_one">Ссылка попросила Tern проверить %1$s на наличие обновлений. Его источник опрашивается, и ничего не устанавливается.</string>
+    <plurals name="link_check_all">
+        <item quantity="one">Ссылка попросила Tern проверить %d приложение в вашем списке на наличие обновлений. Его источник опрашивается, и ничего не устанавливается.</item>
+        <item quantity="few">Ссылка попросила Tern проверить %d приложения в вашем списке на наличие обновлений. Их источники опрашиваются, и ничего не устанавливается.</item>
+        <item quantity="many">Ссылка попросила Tern проверить %d приложений в вашем списке на наличие обновлений. Их источники опрашиваются, и ничего не устанавливается.</item>
+        <item quantity="other">Ссылка попросила Tern проверить %d приложений в вашем списке на наличие обновлений. Их источники опрашиваются, и ничего не устанавливается.</item>
+    </plurals>
+    <string name="link_check_confirm">Проверить</string>
+    <string name="link_check_not_now">Не сейчас</string>
+    <string name="engine_installer_fell_back">%1$s не был готов, поэтому для этого приложения был использован установщик Android.</string>
+    <string name="about_track_tern_fdroid_effect">F-Droid установил эту копию, поэтому Tern следит за ее записью там: обновления это сборки, которые F-Droid сделал и проверил, так же, как их получает приложение F-Droid.</string>
+    <string name="about_track_tern_github">Следить за релизами GitHub</string>
+    <string name="about_track_tern_github_effect">Обновления приходят с GitHub сразу после их публикации, до того как F-Droid их соберет и проверит. Это пропускает проверки F-Droid. Tern по-прежнему проверяет каждый файл и закрепляет его за собственным сертификатом.</string>
+</resources>
diff --git a/app/src/main/res/values-ru/strings_settings_more.xml b/app/src/main/res/values-ru/strings_settings_more.xml
index ca5cf5ff..81d22dfa 100644
--- a/app/src/main/res/values-ru/strings_settings_more.xml
+++ b/app/src/main/res/values-ru/strings_settings_more.xml
@@ -39,9 +39,7 @@
     <string name="settings_auto_installs">Обновления устанавливаются самостоятельно</string>
     <string name="settings_auto_installs_effect">Приложения, настроенные обновляться самостоятельно, делают это после фоновой проверки. Если выключено, они только сообщают, что обновление есть, а выбор каждого из них сохраняется на потом.</string>
     <string name="settings_unmetered_installs">Устанавливать только по Wi-Fi</string>
-    <string name="settings_unmetered_installs_effect">Проверки выполняются в любой сети. Обновление, которое установилось бы само, ждет подключения к Wi-Fi или кабелю, как в Obtainium.</string>
     <string name="settings_charging_installs">Устанавливать только при зарядке</string>
-    <string name="settings_charging_installs_effect">Проверки выполняются и при работе от батареи. Обновление, которое установилось бы само, ждет, пока устройство не начнет заряжаться.</string>
     <string name="engine_unreadable_app">Сохраненное приложение %1$s не удалось прочитать, поэтому оно не показано в списке. Ничего не удалено: более новая версия Tern может его прочитать.</string>
     <string name="settings_pin_certificates">Закреплять сертификаты хостингов кода</string>
     <string name="settings_pin_certificates_effect">Как и в Obtainium, GitHub, GitLab и Codeberg должны предъявлять сертификат от центра сертификации, которым, как известно, пользуется каждый из них. Сертификат, который был выдан другим центром сертификации под принуждением, тогда отклоняется. Если хостинг кода сменит центр сертификации, проверки на нем будут завершаться ошибкой, пока эта настройка не выключена.</string>
diff --git a/app/src/main/res/values-ru/strings_sources_more.xml b/app/src/main/res/values-ru/strings_sources_more.xml
index 01e42a17..8c1eb10b 100644
--- a/app/src/main/res/values-ru/strings_sources_more.xml
+++ b/app/src/main/res/values-ru/strings_sources_more.xml
@@ -18,10 +18,7 @@
     <string name="step_arch">Предпочитать процессор этого устройства</string>
     <string name="step_add">Добавить страницу</string>
     <string name="step_remove">Удалить эту страницу</string>
-    <string name="option_file_version">Использовать имя файла как версию</string>
-    <string name="option_file_version_effect">Тогда каждый файл считается отдельным релизом.</string>
     <string name="github_proxy_title">GitHub через hubproxy</string>
-    <string name="github_proxy_effect">Каждый запрос к GitHub идет на этот хост, который видит все запросы. Токен через него не передается, поэтому приватные проекты и GitHub Actions так отслеживать нельзя.</string>
     <string name="github_proxy_host">Хост hubproxy</string>
     <string name="github_proxy_help">Только имя хоста, например gh-proxy.com. Tern обращается к нему по HTTPS.</string>
     <string name="github_proxy_invalid">Это не имя хоста, которое может использовать Tern</string>
diff --git a/app/src/main/res/values-ru/strings_starters.xml b/app/src/main/res/values-ru/strings_starters.xml
new file mode 100644
index 00000000..695a820b
--- /dev/null
+++ b/app/src/main/res/values-ru/strings_starters.xml
@@ -0,0 +1,7 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="starter_in_list">В вашем списке</string>
+    <string name="starter_on_phone">На этом телефоне</string>
+    <string name="starter_on_phone_other">На этом телефоне с другой подписью</string>
+    <string name="starter_on_phone_other_explain">Ваша копия подписана другим ключом, поэтому Tern не может обновить ее с этого адреса.</string>
+</resources>
diff --git a/app/src/main/res/values-ru/strings_stores.xml b/app/src/main/res/values-ru/strings_stores.xml
new file mode 100644
index 00000000..8f8ced0e
--- /dev/null
+++ b/app/src/main/res/values-ru/strings_stores.xml
@@ -0,0 +1,27 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="option_headers_help_own_agent">По одному на строку, как Имя: значение. Никогда не пароль, cookie или User-Agent: Tern сообщает каждому сайту, что он Tern.</string>
+    <string name="origin_republished_first">%1$s снова предлагает то, что разработчики публикуют в другом месте, и не является разработчиком. Пока приложение не закреплено за сертификатом, первый файл, который Tern устанавливает из него, определяет, какой сертификат должно содержать каждое последующее обновление.</string>
+    <string name="origin_republished_pinned">%1$s снова предлагает то, что разработчики публикуют в другом месте, и не является разработчиком. Его файлы должны содержать сертификат, за которым закреплено это приложение.</string>
+    <string name="origin_store_first">%1$s это магазин, а не собственный сайт разработчика. Пока приложение не закреплено за сертификатом, первый файл, который Tern устанавливает из него, определяет, какой сертификат должно содержать каждое последующее обновление.</string>
+    <string name="origin_store_pinned">%1$s это магазин, а не собственный сайт разработчика. Его файлы должны содержать сертификат, за которым закреплено это приложение.</string>
+    <string name="stores_refused_modified">Tern не читает сайты, предлагающие измененные приложения. Их файлы изменены кем-то, кроме разработчика, и подписаны тем, кто их изменил.</string>
+    <string name="stores_refused_impersonation">Tern не может прочитать этот магазин, не притворяясь его приложением, поэтому он его не читает.</string>
+    <string name="stores_checksum_source">%1$s, который не является разработчиком</string>
+    <string name="stores_off_title">%1$s это сторонний магазин</string>
+    <string name="stores_off_body">Сторонние магазины отключены. Магазин предоставляет собственные копии приложений, а не файлы с собственного сайта разработчика, и Tern читает его через интерфейс, который магазин создал для своего собственного приложения или веб-сайта. Когда они включены, Tern запрашивает у магазина только те приложения, которые вы из него добавляете, и пока приложение не закреплено за сертификатом, первый файл, который Tern устанавливает из магазина, определяет, какой сертификат должны содержать его обновления.</string>
+    <string name="stores_turn_on">Включить сторонние магазины</string>
+    <string name="stores_advice">Включите сторонние магазины в настройках, чтобы проверить это приложение снова.</string>
+    <string name="stores_status_paused">Приостановлено</string>
+    <string name="stores_row_paused">Сторонние магазины отключены</string>
+    <string name="stores_setting">Сторонние магазины</string>
+    <string name="stores_setting_effect">APKPure, Aptoide, APKCombo, APKMirror, Tencent, Huawei AppGallery, Galaxy Store и vivo. Они предоставляют собственные копии приложений, а не файлы с собственного сайта разработчика, и Tern читает их через интерфейсы, которые они создали для своих собственных приложений и веб-сайтов. В выключенном состоянии Tern ничего у них не спрашивает, поиск их игнорирует, а приложения из них приостанавливаются.</string>
+    <string name="stores_off_tag">отключено в настройках</string>
+    <string name="stores_checksum_matched">Файл совпадает с контрольной суммой магазина</string>
+    <string name="stores_explain_checksum_matched">Контрольная сумма это отпечаток самого файла. Магазин предоставил одну, и у файла, который скачал Tern, такая же, поэтому он прибыл в том виде, в каком он есть в магазине. Магазин не является разработчиком, поэтому это ничего не говорит о том, кто создал файл. Об этом говорит сертификат.</string>
+    <string name="stores_import_from_stores">Они происходят из сторонних магазинов, которые предоставляют собственные копии приложений. Пока приложение не закреплено за сертификатом, первый файл, который Tern устанавливает из своего магазина, определяет, какой сертификат должны содержать его обновления.</string>
+    <string name="stores_import_paused">Сторонние магазины отключены, поэтому эти приложения приостановлены. Tern ничего не спрашивает у этих магазинов, пока вы их не включите.</string>
+    <string name="stores_import_names">Из сторонних магазинов</string>
+    <string name="share_obtainium_link">Поделиться ссылкой Obtainium</string>
+    <string name="share_obtainium_links">Поделиться ссылками Obtainium</string>
+</resources>
diff --git a/app/src/main/res/values-ru/strings_tv.xml b/app/src/main/res/values-ru/strings_tv.xml
new file mode 100644
index 00000000..1f64f56b
--- /dev/null
+++ b/app/src/main/res/values-ru/strings_tv.xml
@@ -0,0 +1,5 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="interval_turn_off">Отключить фоновые проверки</string>
+    <string name="interval_turn_on">Включить фоновые проверки</string>
+</resources>
diff --git a/app/src/main/res/values-sv/strings.xml b/app/src/main/res/values-sv/strings.xml
index e760372c..a8131e47 100644
--- a/app/src/main/res/values-sv/strings.xml
+++ b/app/src/main/res/values-sv/strings.xml
@@ -369,7 +369,6 @@
     <string name="settings_import_effect">Från en Tern- eller Obtainium-export</string>
     <string name="settings_export">Exportera appar</string>
     <string name="settings_exporting">Exporterar</string>
-    <string name="settings_export_effect">Sparar din lista och dina inställningar till en fil. Tokens inkluderas aldrig.</string>
     <plurals name="exported">
         <item quantity="one">Exporterade %d app</item>
         <item quantity="other">Exporterade %d appar</item>
diff --git a/app/src/main/res/values-sv/strings_accept.xml b/app/src/main/res/values-sv/strings_accept.xml
new file mode 100644
index 00000000..1c5d8ac1
--- /dev/null
+++ b/app/src/main/res/values-sv/strings_accept.xml
@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="stores_paused_reason">Tredjepartsbutiker är av, så Tern frågar inte denna butik något. Slå på dem i Inställningar för att kontrollera den igen.</string>
+</resources>
diff --git a/app/src/main/res/values-sv/strings_checks.xml b/app/src/main/res/values-sv/strings_checks.xml
index d8954345..913c6d9a 100644
--- a/app/src/main/res/values-sv/strings_checks.xml
+++ b/app/src/main/res/values-sv/strings_checks.xml
@@ -17,13 +17,11 @@
     <string name="settings_only_installed">Kontrollera endast installerade appar</string>
     <string name="settings_only_installed_effect">Appar som endast följs kontrolleras också. En app du öppnar kontrolleras alltid.</string>
     <string name="settings_remove_uninstalled">Ta bort appar som avinstallerats någon annanstans</string>
-    <string name="settings_remove_uninstalled_effect">En app du avinstallerar utanför Tern försvinner också från listan.</string>
     <string name="settings_file_filter">Filter för filer</string>
     <string name="settings_file_filter_effect">Ett mönster som varje app utan eget filter väljer sin fil efter.</string>
     <string name="settings_file_filter_none">Inget</string>
     <string name="settings_file_filter_invalid">Detta mönster kan inte läsas.</string>
     <string name="settings_allow_downgrades">Tillåt äldre versioner</string>
-    <string name="settings_allow_downgrades_effect">Let Me Downgrade är installerad, så Android får installera en äldre version över en nyare.</string>
     <string name="settings_collapse_groups">Börja med grupperna hopfällda</string>
     <string name="settings_haptics">Haptisk återkoppling</string>
     <string name="settings_haptics_effect">En lätt vibration när en svepning eller ett långt tryck gör något.</string>
@@ -38,7 +36,6 @@
     <string name="sources_repositories">Lagringsplatser</string>
     <string name="sources_stores">Butiker</string>
     <string name="sources_mirrors">Butiker som återpublicerar appar</string>
-    <string name="sources_modified">Webbplatser med ändrade appar</string>
     <string name="sources_other">Andra platser</string>
     <string name="sources_web_page">En webbsida med länkar till filer</string>
     <string name="sources_direct">En direktlänk till en fil</string>
@@ -48,8 +45,6 @@
     <string name="shared_configs_title">Konfigurationer som delas av Obtainiums användare</string>
     <string name="shared_configs_effect">En webbplats med färdiga inställningar för appar. Dess länkar öppnas i Tern när Öppna Obtainium-länkar är på i Inställningar.</string>
     <string name="engine_inner_filter_nothing">Filtret för filer i arkiv matchar ingen av APK-filerna i detta arkiv.</string>
-    <string name="preview_republished">%1$s erbjuder på nytt det som utvecklare publicerar på annat håll. Tern kräver utvecklarens certifikat för dess filer när det är känt, så fäst ett eller installera från utvecklaren först när du kan.</string>
-    <string name="preview_modified">%1$s erbjuder appar som ändrats av någon annan än deras utvecklare. De är signerade av den som ändrade dem, och Tern kan inte avgöra vad som ändrades.</string>
     <string name="about_track_tern">Håll Tern själv uppdaterad</string>
     <string name="about_track_tern_effect">Lägger till Terns egna utgåvor i listan, kontrollerade och verifierade som vilken app som helst.</string>
     <string name="engine_channel_tracked">Nya utgåvor av följda appar</string>
diff --git a/app/src/main/res/values-sv/strings_options.xml b/app/src/main/res/values-sv/strings_options.xml
index 77c19001..8a5bcbdd 100644
--- a/app/src/main/res/values-sv/strings_options.xml
+++ b/app/src/main/res/values-sv/strings_options.xml
@@ -62,10 +62,6 @@
     <string name="option_workflow">Arbetsflödesfil</string>
     <string name="option_workflow_help">Till exempel build.yml.</string>
     <string name="option_branch">Gren</string>
-    <string name="option_device_model">Enhetsmodell</string>
-    <string name="option_device_model_help">Galaxy Store ger varje modell ett eget bygge, till exempel SM-S948B.</string>
-    <string name="option_csc">Regionkod (CSC)</string>
-    <string name="option_csc_help">Tre bokstäver, till exempel DBT.</string>
     <string name="option_link_filter">Filter för nedladdningslänkar</string>
     <string name="option_link_filter_help">Endast länkar som matchar räknas som nedladdningar.</string>
     <string name="option_page_order">Behåll sidans ordning</string>
@@ -76,11 +72,14 @@
     <string name="version_from_text">Länkens text</string>
     <string name="version_from_page">Hela sidan</string>
     <string name="option_headers">Förfrågningshuvuden</string>
-    <string name="option_headers_help">En per rad, som Name: value. Aldrig ett lösenord eller en cookie.</string>
     <string name="option_pseudo">När det inte finns någon version</string>
     <string name="pseudo_default">Skilj filer åt som servern gör</string>
     <string name="pseudo_hash">Efter en hash av filens början</string>
     <string name="pseudo_link">Efter filens adress</string>
     <string name="pseudo_etag">Efter serverns ETag</string>
     <string name="option_invalid">Detta kan inte användas som det är.</string>
+    <string name="option_device_model">Enhetsmodell</string>
+    <string name="option_device_model_help">Galaxy Store ger varje modell ett eget bygge, till exempel SM-S948B.</string>
+    <string name="option_csc">Regionkod (CSC)</string>
+    <string name="option_csc_help">Tre bokstäver, till exempel DBT.</string>
 </resources>
diff --git a/app/src/main/res/values-sv/strings_safety.xml b/app/src/main/res/values-sv/strings_safety.xml
new file mode 100644
index 00000000..b65d769c
--- /dev/null
+++ b/app/src/main/res/values-sv/strings_safety.xml
@@ -0,0 +1,29 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="settings_export_effect_plain">Sparar din lista och dina inställningar till en fil. Token inkluderas aldrig, och inte heller något begärandehuvud som skulle kunna innehålla en nyckel.</string>
+    <string name="engine_checksum_github_proxy">GitHub-utgåvans digest, så som hubproxyn %1$s vidarebefordrade den</string>
+    <string name="github_proxy_effect_trust">Varje förfrågan till GitHub går till denna värd. Den ser var och en och kan ändra det som kommer tillbaka: utgåvorna, deras digest och filerna. Appar du har förblir fästa vid sina certifikat, men en första installation genom den litar lika mycket på hubproxyn som på GitHub, och certifikatfästning når den inte. Ingen token skickas genom den, så privata projekt och GitHub Actions kan inte följas på detta sätt.</string>
+    <string name="settings_unmetered_checks">Kontrollera endast via Wi-Fi</string>
+    <string name="settings_unmetered_checks_effect">Bakgrundskontroller väntar på Wi-Fi eller en kabel, så de använder ingen mobildata.</string>
+    <string name="settings_charging_checks">Kontrollera endast vid laddning</string>
+    <string name="settings_charging_checks_effect">Bakgrundskontroller väntar tills enheten laddas.</string>
+    <string name="settings_unmetered_installs_wait">En uppdatering som skulle installeras av sig själv väntar på Wi-Fi eller en kabel, som i Obtainium.</string>
+    <string name="settings_charging_installs_wait">En uppdatering som skulle installeras av sig själv väntar tills enheten laddas.</string>
+    <string name="engine_downgrade_not_as_named">Källan angav versionskod %2$d, men denna fil är %1$d, äldre än den installerade. Den läggs inte över den nyare.</string>
+    <string name="settings_allow_downgrades_picked">Let Me Downgrade är installerad, så Android kan lägga en äldre version över en nyare. Tern gör det endast för en utgåva du väljer från en apps historik, aldrig i bakgrunden eller med Uppdatera alla.</string>
+    <string name="option_highest_version">Ta den högsta versionen, som Tern 0.1.0 gjorde</string>
+    <string name="option_highest_version_effect">Erbjuder länken med den högsta versionen på sidan, oavsett dess plats, och kör versionsmönstret över versionen som läses från varje länk. När det är av läses sidan på samma sätt som Obtainium gör: den sista länken i ordningen är den senaste.</string>
+    <string name="settings_remove_uninstalled_keeps_pins">En app du avinstallerar utanför Tern lämnar också listan. En arkiverad app blir kvar. Om den läggs till igen från samma plats är appen fäst vid det certifikat den hade; tas den bort i Tern glöms det bort.</string>
+    <string name="link_check_title">Kontrollera uppdateringar nu?</string>
+    <string name="link_check_one">En länk bad Tern att kontrollera %1$s efter uppdateringar. Dess källa tillfrågas, och inget installeras.</string>
+    <plurals name="link_check_all">
+        <item quantity="one">En länk bad Tern att kontrollera %d app i din lista efter uppdateringar. Dess källa tillfrågas, och inget installeras.</item>
+        <item quantity="other">En länk bad Tern att kontrollera de %d apparna i din lista efter uppdateringar. Deras källor tillfrågas, och inget installeras.</item>
+    </plurals>
+    <string name="link_check_confirm">Kontrollera</string>
+    <string name="link_check_not_now">Inte nu</string>
+    <string name="engine_installer_fell_back">%1$s var inte redo, så Androids installationsprogram användes för denna.</string>
+    <string name="about_track_tern_fdroid_effect">F-Droid installerade denna kopia, så Tern följer dess post där: uppdateringar är de byggen F-Droid gjorde och kontrollerade, så som F-Droid-appen hämtar dem.</string>
+    <string name="about_track_tern_github">Följ GitHub-utgåvor istället</string>
+    <string name="about_track_tern_github_effect">Uppdateringar kommer från GitHub så fort de publiceras, innan F-Droid har byggt och kontrollerat dem. Detta hoppar över F-Droids kontroller. Tern kontrollerar fortfarande varje fil och håller den till dess eget certifikat.</string>
+</resources>
diff --git a/app/src/main/res/values-sv/strings_settings_more.xml b/app/src/main/res/values-sv/strings_settings_more.xml
index 07349d24..5b891ecb 100644
--- a/app/src/main/res/values-sv/strings_settings_more.xml
+++ b/app/src/main/res/values-sv/strings_settings_more.xml
@@ -37,9 +37,7 @@
     <string name="settings_auto_installs">Uppdateringar installeras av sig själva</string>
     <string name="settings_auto_installs_effect">Appar som är inställda på att uppdatera sig själva gör det efter en bakgrundskontroll. När det är av säger de bara att en uppdatering finns, och var och en behåller sitt eget val till senare.</string>
     <string name="settings_unmetered_installs">Installera endast på Wi-Fi</string>
-    <string name="settings_unmetered_installs_effect">Kontroller körs på alla nätverk. En uppdatering som skulle installeras av sig själv väntar på Wi-Fi eller en nätverkskabel, som i Obtainium.</string>
     <string name="settings_charging_installs">Installera endast under laddning</string>
-    <string name="settings_charging_installs_effect">Kontroller körs även på batteri. En uppdatering som skulle installeras av sig själv väntar tills enheten laddas.</string>
     <string name="engine_unreadable_app">Den sparade appen %1$s kunde inte läsas, så den lämnas utanför listan. Inget har raderats: en nyare version av Tern kan kanske läsa den.</string>
     <string name="settings_pin_certificates">Fäst kodplattformarnas certifikat</string>
     <string name="settings_pin_certificates_effect">GitHub, GitLab och Codeberg måste visa ett certifikat från den certifikatutfärdare som var och en är känd för att använda, som i Obtainium. Ett certifikat som en annan utfärdare har förmåtts att utfärda avvisas då. Om en kodplattform byter utfärdare misslyckas kontroller där tills detta är av.</string>
diff --git a/app/src/main/res/values-sv/strings_sources_more.xml b/app/src/main/res/values-sv/strings_sources_more.xml
index a820bcaa..ddd62826 100644
--- a/app/src/main/res/values-sv/strings_sources_more.xml
+++ b/app/src/main/res/values-sv/strings_sources_more.xml
@@ -18,10 +18,7 @@
     <string name="step_arch">Föredra denna enhets processor</string>
     <string name="step_add">Lägg till en sida</string>
     <string name="step_remove">Ta bort denna sida</string>
-    <string name="option_file_version">Använd filnamnet som version</string>
-    <string name="option_file_version_effect">Varje fil räknas då som en egen utgåva.</string>
     <string name="github_proxy_title">GitHub via en hubproxy</string>
-    <string name="github_proxy_effect">Varje förfrågan till GitHub går till denna värd, som ser varenda en. Ingen token skickas genom den, så privata projekt och GitHub Actions kan inte följas på detta sätt.</string>
     <string name="github_proxy_host">Hubproxy-värd</string>
     <string name="github_proxy_help">Enbart ett värdnamn, till exempel gh-proxy.com. Tern når den via HTTPS.</string>
     <string name="github_proxy_invalid">Det är inte ett värdnamn som Tern kan använda</string>
diff --git a/app/src/main/res/values-sv/strings_starters.xml b/app/src/main/res/values-sv/strings_starters.xml
new file mode 100644
index 00000000..2415bfc4
--- /dev/null
+++ b/app/src/main/res/values-sv/strings_starters.xml
@@ -0,0 +1,7 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="starter_in_list">I din lista</string>
+    <string name="starter_on_phone">På denna telefon</string>
+    <string name="starter_on_phone_other">På denna telefon från en annan signerare</string>
+    <string name="starter_on_phone_other_explain">Kopian du har är signerad med en annan nyckel, så Tern kan inte uppdatera den från denna adress.</string>
+</resources>
diff --git a/app/src/main/res/values-sv/strings_stores.xml b/app/src/main/res/values-sv/strings_stores.xml
new file mode 100644
index 00000000..356b7755
--- /dev/null
+++ b/app/src/main/res/values-sv/strings_stores.xml
@@ -0,0 +1,27 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="option_headers_help_own_agent">En per rad, som Namn: värde. Aldrig ett lösenord, en cookie eller en User-Agent: Tern talar om för varje webbplats att den är Tern.</string>
+    <string name="origin_republished_first">%1$s erbjuder igen det som utvecklare publicerar någon annanstans, och är inte utvecklaren. Tills appen är fäst vid ett certifikat avgör den första filen som Tern installerar från den vilket certifikat varje senare uppdatering måste ha.</string>
+    <string name="origin_republished_pinned">%1$s erbjuder igen det som utvecklare publicerar någon annanstans, och är inte utvecklaren. Dess filer måste ha det certifikat som denna app är fäst vid.</string>
+    <string name="origin_store_first">%1$s är en butik, inte utvecklarens egen webbplats. Tills appen är fäst vid ett certifikat avgör den första filen som Tern installerar från den vilket certifikat varje senare uppdatering måste ha.</string>
+    <string name="origin_store_pinned">%1$s är en butik, inte utvecklarens egen webbplats. Dess filer måste ha det certifikat som denna app är fäst vid.</string>
+    <string name="stores_refused_modified">Tern läser inte webbplatser som erbjuder modifierade appar. Deras filer är ändrade av någon annan än utvecklaren och signerade av den som ändrade dem.</string>
+    <string name="stores_refused_impersonation">Tern kan inte läsa denna butik utan att låtsas vara dess app, så den läser den inte.</string>
+    <string name="stores_checksum_source">%1$s, som inte är utvecklaren</string>
+    <string name="stores_off_title">%1$s är en tredjepartsbutik</string>
+    <string name="stores_off_body">Tredjepartsbutiker är avstängda. En butik tillhandahåller sina egna kopior av appar, inte filer från utvecklarens egen webbplats, och Tern läser den genom gränssnittet som butiken gjorde för sin egen app eller webbplats. När de är på frågar Tern en butik endast om de appar du lägger till från den, och tills en app är fäst vid ett certifikat avgör den första filen som Tern installerar från en butik vilket certifikat dess uppdateringar måste ha.</string>
+    <string name="stores_turn_on">Slå på tredjepartsbutiker</string>
+    <string name="stores_advice">Slå på Tredjepartsbutiker i Inställningar för att kontrollera denna app igen.</string>
+    <string name="stores_status_paused">Pausad</string>
+    <string name="stores_row_paused">Tredjepartsbutiker är avstängda</string>
+    <string name="stores_setting">Tredjepartsbutiker</string>
+    <string name="stores_setting_effect">APKPure, Aptoide, APKCombo, APKMirror, Tencent, Huawei AppGallery, Galaxy Store och vivo. De tillhandahåller sina egna kopior av appar, inte filer från utvecklarens egen webbplats, och Tern läser dem genom de gränssnitt de gjorde för sina egna appar och webbplatser. När de är av frågar Tern ingen av dem något, en sökning utelämnar dem och appar från dem är pausade.</string>
+    <string name="stores_off_tag">av i Inställningar</string>
+    <string name="stores_checksum_matched">Filen matchar butikens kontrollsumma</string>
+    <string name="stores_explain_checksum_matched">En kontrollsumma är ett fingeravtryck av själva filen. Butiken gav en, och filen Tern laddade ned har samma, så den anlände som butiken har den. Butiken är inte utvecklaren, så detta säger ingenting om vem som gjorde filen. Det gör certifikatet.</string>
+    <string name="stores_import_from_stores">Dessa kommer från tredjepartsbutiker, som tillhandahåller sina egna kopior av appar. Tills en app är fäst vid ett certifikat avgör den första filen som Tern installerar från dess butik vilket certifikat dess uppdateringar måste ha.</string>
+    <string name="stores_import_paused">Tredjepartsbutiker är avstängda, så dessa appar är pausade. Tern frågar inte dessa butiker något förrän du slår på dem.</string>
+    <string name="stores_import_names">Från tredjepartsbutiker</string>
+    <string name="share_obtainium_link">Dela som en Obtainium-länk</string>
+    <string name="share_obtainium_links">Dela som Obtainium-länkar</string>
+</resources>
diff --git a/app/src/main/res/values-sv/strings_tv.xml b/app/src/main/res/values-sv/strings_tv.xml
new file mode 100644
index 00000000..9eedea13
--- /dev/null
+++ b/app/src/main/res/values-sv/strings_tv.xml
@@ -0,0 +1,5 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="interval_turn_off">Stäng av bakgrundskontroller</string>
+    <string name="interval_turn_on">Slå på bakgrundskontroller</string>
+</resources>
diff --git a/app/src/main/res/values-tr/strings.xml b/app/src/main/res/values-tr/strings.xml
index 955ab00f..97bfd9de 100644
--- a/app/src/main/res/values-tr/strings.xml
+++ b/app/src/main/res/values-tr/strings.xml
@@ -365,7 +365,6 @@
     <string name="settings_import_effect">Bir Tern veya Obtainium dışa aktarımından</string>
     <string name="settings_export">Uygulamaları dışa aktar</string>
     <string name="settings_exporting">Dışa aktarılıyor</string>
-    <string name="settings_export_effect">Listenizi ve ayarlarınızı bir dosyaya kaydeder. Belirteçler asla dahil edilmez.</string>
     <plurals name="exported">
         <item quantity="one">%d uygulama dışa aktarıldı</item>
         <item quantity="other">%d uygulama dışa aktarıldı</item>
diff --git a/app/src/main/res/values-tr/strings_accept.xml b/app/src/main/res/values-tr/strings_accept.xml
new file mode 100644
index 00000000..c0367908
--- /dev/null
+++ b/app/src/main/res/values-tr/strings_accept.xml
@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="stores_paused_reason">Üçüncü taraf mağazalar kapalı, bu nedenle Tern bu mağazaya hiçbir şey sormuyor. Tekrar denetlemek için bunları Ayarlar\'dan açın.</string>
+</resources>
diff --git a/app/src/main/res/values-tr/strings_checks.xml b/app/src/main/res/values-tr/strings_checks.xml
index 758be17f..0a44469e 100644
--- a/app/src/main/res/values-tr/strings_checks.xml
+++ b/app/src/main/res/values-tr/strings_checks.xml
@@ -17,13 +17,11 @@
     <string name="settings_only_installed">Yalnızca yüklü uygulamaları denetle</string>
     <string name="settings_only_installed_effect">Yalnızca izlenen uygulamalar da denetlenir. Açtığınız bir uygulama her zaman denetlenir.</string>
     <string name="settings_remove_uninstalled">Başka yerden kaldırılan uygulamaları listeden çıkar</string>
-    <string name="settings_remove_uninstalled_effect">Tern dışında kaldırdığınız bir uygulama listeden de çıkar.</string>
     <string name="settings_file_filter">Dosya filtresi</string>
     <string name="settings_file_filter_effect">Kendi filtresi olmayan her uygulamanın dosyasını seçerken kullandığı bir kalıp.</string>
     <string name="settings_file_filter_none">Yok</string>
     <string name="settings_file_filter_invalid">Bu kalıp okunamıyor.</string>
     <string name="settings_allow_downgrades">Eski sürümlere izin ver</string>
-    <string name="settings_allow_downgrades_effect">Let Me Downgrade yüklü, bu yüzden Android daha yeni bir sürümün üzerine daha eski bir sürüm yükleyebilir.</string>
     <string name="settings_collapse_groups">Gruplar daraltılmış olarak başla</string>
     <string name="settings_haptics">Dokunsal geri bildirim</string>
     <string name="settings_haptics_effect">Bir kaydırma veya uzun basma bir şey yaptığında hafif bir titreşim.</string>
@@ -38,7 +36,6 @@
     <string name="sources_repositories">Depolar</string>
     <string name="sources_stores">Mağazalar</string>
     <string name="sources_mirrors">Uygulamaları yeniden yayınlayan mağazalar</string>
-    <string name="sources_modified">Değiştirilmiş uygulamalar sunan siteler</string>
     <string name="sources_other">Diğer yerler</string>
     <string name="sources_web_page">Dosya bağlantıları içeren bir web sayfası</string>
     <string name="sources_direct">Bir dosyaya doğrudan bağlantı</string>
@@ -48,8 +45,6 @@
     <string name="shared_configs_title">Obtainium kullanıcılarının paylaştığı yapılandırmalar</string>
     <string name="shared_configs_effect">Uygulamalar için hazır ayarlar içeren bir site. Ayarlar\'da Obtainium bağlantılarını aç seçeneği açıkken bağlantıları Tern\'de açılır.</string>
     <string name="engine_inner_filter_nothing">Arşivlerin içindeki dosyalar için filtre, bu arşivdeki APK\'lerin hiçbiriyle eşleşmiyor.</string>
-    <string name="preview_republished">%1$s, geliştiricilerin başka yerde yayınladıklarını yeniden sunar. Tern geliştiricinin sertifikasını öğrendiğinde bu dosyaları o sertifikaya tabi tutar, bu yüzden mümkünse bir sertifika sabitleyin veya önce geliştiriciden yükleyin.</string>
-    <string name="preview_modified">%1$s, geliştiricilerinden başka biri tarafından değiştirilmiş uygulamalar sunar. Bunlar, onları değiştiren kişi tarafından imzalanır ve Tern neyin değiştirildiğini anlayamaz.</string>
     <string name="about_track_tern">Tern\'in kendisini güncel tut</string>
     <string name="about_track_tern_effect">Tern\'in kendi sürümlerini listeye ekler, herhangi bir uygulama gibi denetlenir ve doğrulanır.</string>
     <string name="engine_channel_tracked">İzlenen uygulamaların yeni sürümleri</string>
diff --git a/app/src/main/res/values-tr/strings_options.xml b/app/src/main/res/values-tr/strings_options.xml
index f68212e6..82f0da68 100644
--- a/app/src/main/res/values-tr/strings_options.xml
+++ b/app/src/main/res/values-tr/strings_options.xml
@@ -62,10 +62,6 @@
     <string name="option_workflow">İş akışı dosyası</string>
     <string name="option_workflow_help">Örneğin build.yml.</string>
     <string name="option_branch">Dal</string>
-    <string name="option_device_model">Cihaz modeli</string>
-    <string name="option_device_model_help">Galaxy Store her modele kendi derlemesini verir, örneğin SM-S948B.</string>
-    <string name="option_csc">Bölge kodu (CSC)</string>
-    <string name="option_csc_help">Üç harf, örneğin DBT.</string>
     <string name="option_link_filter">İndirme bağlantıları için filtre</string>
     <string name="option_link_filter_help">Yalnızca eşleşen bağlantılar indirme sayılır.</string>
     <string name="option_page_order">Sayfanın sırasını koru</string>
@@ -76,11 +72,14 @@
     <string name="version_from_text">Bağlantının metni</string>
     <string name="version_from_page">Tüm sayfa</string>
     <string name="option_headers">İstek başlıkları</string>
-    <string name="option_headers_help">Her satıra bir tane, Name: value biçiminde. Asla parola veya çerez yazmayın.</string>
     <string name="option_pseudo">Sürüm olmadığında</string>
     <string name="pseudo_default">Dosyaları sunucunun yaptığı gibi ayırt et</string>
     <string name="pseudo_hash">Dosyanın başlangıcının bir özetiyle</string>
     <string name="pseudo_link">Dosyanın adresiyle</string>
     <string name="pseudo_etag">Sunucunun ETag değeriyle</string>
     <string name="option_invalid">Bu, olduğu haliyle kullanılamaz.</string>
+    <string name="option_device_model">Cihaz modeli</string>
+    <string name="option_device_model_help">Galaxy Store her modele kendi derlemesini verir, örneğin SM-S948B.</string>
+    <string name="option_csc">Bölge kodu (CSC)</string>
+    <string name="option_csc_help">Üç harf, örneğin DBT.</string>
 </resources>
diff --git a/app/src/main/res/values-tr/strings_safety.xml b/app/src/main/res/values-tr/strings_safety.xml
new file mode 100644
index 00000000..d99e41e1
--- /dev/null
+++ b/app/src/main/res/values-tr/strings_safety.xml
@@ -0,0 +1,29 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="settings_export_effect_plain">Listenizi ve ayarlarınızı bir dosyaya kaydeder. Belirteçler asla dahil edilmez, anahtar tutabilecek bir istek başlığı da öyle.</string>
+    <string name="engine_checksum_github_proxy">%1$s hubproxy\'sinin ilettiği şekliyle GitHub sürüm özeti</string>
+    <string name="github_proxy_effect_trust">GitHub\'a giden her istek bu sunucuya gider. Her birini görür ve geri gelenleri değiştirebilir: sürümler, özetleri ve dosyalar. Sahip olduğunuz uygulamalar sertifikalarına tabi kalır, ancak bunun üzerinden yapılan ilk yükleme hubproxy\'ye GitHub kadar güvenir ve sertifika sabitlemesi ona ulaşmaz. Üzerinden hiçbir belirteç gönderilmez, bu yüzden özel projeler ve GitHub Actions bu şekilde izlenemez.</string>
+    <string name="settings_unmetered_checks">Yalnızca Wi-Fi\'da denetle</string>
+    <string name="settings_unmetered_checks_effect">Arka plan denetimleri Wi-Fi veya kablo bağlantısını bekler, böylece hiç mobil veri kullanmazlar.</string>
+    <string name="settings_charging_checks">Yalnızca şarj olurken denetle</string>
+    <string name="settings_charging_checks_effect">Arka plan denetimleri cihaz şarj olana kadar bekler.</string>
+    <string name="settings_unmetered_installs_wait">Kendi kendine yüklenecek bir güncelleme, Obtainium\'da olduğu gibi Wi-Fi veya kablo bağlantısını bekler.</string>
+    <string name="settings_charging_installs_wait">Kendi kendine yüklenecek bir güncelleme cihaz şarj olana kadar bekler.</string>
+    <string name="engine_downgrade_not_as_named">Kaynak %2$d sürüm kodunu belirtti, ancak bu dosya yüklü olandan daha eski olan %1$d sürümüdür. Daha yeni olanın üzerine yüklenmez.</string>
+    <string name="settings_allow_downgrades_picked">Let Me Downgrade yüklü, bu nedenle Android daha eski bir sürümü daha yeni bir sürümün üzerine yükleyebilir. Tern bunu yalnızca bir uygulamanın geçmişinden seçtiğiniz bir sürüm için yapar, asla arka planda veya Tümünü güncelle ile yapmaz.</string>
+    <string name="option_highest_version">Tern 0.1.0\'ın yaptığı gibi en yüksek sürümü al</string>
+    <string name="option_highest_version_effect">Yeri ne olursa olsun sayfadaki en yüksek sürüme sahip bağlantıyı sunar ve her bağlantıdan okunan sürüm üzerinde sürüm kalıbını çalıştırır. Kapalı olduğunda sayfayı Obtainium\'un okuduğu gibi okur: sıradaki en son bağlantı en yenisidir.</string>
+    <string name="settings_remove_uninstalled_keeps_pins">Tern dışında kaldırdığınız bir uygulama listeden de çıkar. Arşivlenmiş bir uygulama kalır. Aynı yerden tekrar eklendiğinde, bir uygulama sahip olduğu sertifikaya tabi tutulur; onu Tern\'de kaldırmak bunu unutur.</string>
+    <string name="link_check_title">Şimdi güncellemeler denetlensin mi?</string>
+    <string name="link_check_one">Bir bağlantı Tern\'den %1$s için güncellemeleri denetlemesini istedi. Kaynağına sorulur ve hiçbir şey yüklenmez.</string>
+    <plurals name="link_check_all">
+        <item quantity="one">Bir bağlantı Tern\'den listenizdeki %d uygulamayı güncellemeler için denetlemesini istedi. Kaynağına sorulur ve hiçbir şey yüklenmez.</item>
+        <item quantity="other">Bir bağlantı Tern\'den listenizdeki %d uygulamayı güncellemeler için denetlemesini istedi. Kaynaklarına sorulur ve hiçbir şey yüklenmez.</item>
+    </plurals>
+    <string name="link_check_confirm">Denetle</string>
+    <string name="link_check_not_now">Şimdi değil</string>
+    <string name="engine_installer_fell_back">%1$s hazır değildi, bu yüzden bunun için Android\'in yükleyicisi kullanıldı.</string>
+    <string name="about_track_tern_fdroid_effect">Bu kopyayı F-Droid yükledi, bu yüzden Tern oradaki girişini izler: güncellemeler, F-Droid uygulamasının aldığı gibi F-Droid\'in yapıp denetlediği derlemelerdir.</string>
+    <string name="about_track_tern_github">Bunun yerine GitHub sürümlerini izle</string>
+    <string name="about_track_tern_github_effect">Güncellemeler yayınlanır yayınlanmaz, F-Droid onları derlemeden ve denetlemeden önce GitHub\'dan gelir. Bu, F-Droid\'in denetimlerini atlar. Tern yine de her dosyayı denetler ve onu kendi sertifikasına tabi tutar.</string>
+</resources>
diff --git a/app/src/main/res/values-tr/strings_settings_more.xml b/app/src/main/res/values-tr/strings_settings_more.xml
index e3cbb3aa..70147acb 100644
--- a/app/src/main/res/values-tr/strings_settings_more.xml
+++ b/app/src/main/res/values-tr/strings_settings_more.xml
@@ -37,9 +37,7 @@
     <string name="settings_auto_installs">Güncellemeler kendiliğinden yüklenir</string>
     <string name="settings_auto_installs_effect">Kendiliğinden güncellenecek şekilde ayarlanan uygulamalar bunu bir arka plan denetiminden sonra yapar. Kapalıyken yalnızca bir güncelleme olduğunu bildirirler ve her biri kendi seçimini sonrası için korur.</string>
     <string name="settings_unmetered_installs">Yalnızca Wi-Fi bağlantısında yükle</string>
-    <string name="settings_unmetered_installs_effect">Denetimler her ağda çalışır. Kendiliğinden yüklenecek bir güncelleme, Obtainium\'daki gibi Wi-Fi bağlantısını veya bir ağ kablosunu bekler.</string>
     <string name="settings_charging_installs">Yalnızca şarj olurken yükle</string>
-    <string name="settings_charging_installs_effect">Denetimler pilde de çalışır. Kendiliğinden yüklenecek bir güncelleme, cihaz şarj olana kadar bekler.</string>
     <string name="engine_unreadable_app">Kaydedilen %1$s uygulaması okunamadı, bu yüzden listenin dışında bırakıldı. Hiçbir şey silinmedi: Tern\'in daha yeni bir sürümü onu okuyabilir.</string>
     <string name="settings_pin_certificates">Kod platformlarının sertifikalarını sabitle</string>
     <string name="settings_pin_certificates_effect">GitHub, GitLab ve Codeberg, her birinin kullandığı bilinen sertifika yetkilisinden bir sertifika göstermelidir; Obtainium\'da olduğu gibi. Başka bir sertifika yetkilisinin vermeye zorlandığı bir sertifika ise reddedilir. Bir kod platformu sertifika yetkilisini değiştirirse, bu ayar kapatılana kadar oradaki denetimler başarısız olur.</string>
diff --git a/app/src/main/res/values-tr/strings_sources_more.xml b/app/src/main/res/values-tr/strings_sources_more.xml
index 381196f2..a47eb37e 100644
--- a/app/src/main/res/values-tr/strings_sources_more.xml
+++ b/app/src/main/res/values-tr/strings_sources_more.xml
@@ -18,10 +18,7 @@
     <string name="step_arch">Bu cihazın işlemcisini tercih et</string>
     <string name="step_add">Sayfa ekle</string>
     <string name="step_remove">Bu sayfayı kaldır</string>
-    <string name="option_file_version">Dosya adını sürüm olarak kullan</string>
-    <string name="option_file_version_effect">Böylece her dosya ayrı bir sürüm sayılır.</string>
     <string name="github_proxy_title">GitHub, bir hubproxy üzerinden</string>
-    <string name="github_proxy_effect">GitHub\'a giden her istek, hepsini gören bu sunucuya gider. Üzerinden hiçbir belirteç gönderilmez, bu yüzden gizli projeler ve GitHub Actions bu yolla izlenemez.</string>
     <string name="github_proxy_host">Hubproxy sunucusu</string>
     <string name="github_proxy_help">Yalnızca bir sunucu adı, örneğin gh-proxy.com. Tern ona HTTPS üzerinden ulaşır.</string>
     <string name="github_proxy_invalid">Bu, Tern\'in kullanabileceği bir sunucu adı değil</string>
diff --git a/app/src/main/res/values-tr/strings_starters.xml b/app/src/main/res/values-tr/strings_starters.xml
new file mode 100644
index 00000000..020a5f16
--- /dev/null
+++ b/app/src/main/res/values-tr/strings_starters.xml
@@ -0,0 +1,7 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="starter_in_list">Listenizde</string>
+    <string name="starter_on_phone">Bu telefonda</string>
+    <string name="starter_on_phone_other">Bu telefonda başka bir imzalayandan</string>
+    <string name="starter_on_phone_other_explain">Sahip olduğunuz kopya farklı bir anahtarla imzalanmış, bu yüzden Tern onu bu adresten güncelleyemez.</string>
+</resources>
diff --git a/app/src/main/res/values-tr/strings_stores.xml b/app/src/main/res/values-tr/strings_stores.xml
new file mode 100644
index 00000000..e9a33a47
--- /dev/null
+++ b/app/src/main/res/values-tr/strings_stores.xml
@@ -0,0 +1,27 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="option_headers_help_own_agent">Her satıra bir tane, Ad: değer şeklinde. Asla bir parola, çerez veya User-Agent değil: Tern her siteye kendisinin Tern olduğunu söyler.</string>
+    <string name="origin_republished_first">%1$s, geliştiricilerin başka bir yerde yayınladıklarını tekrar sunar ve geliştirici değildir. Uygulama bir sertifikaya sabitlenene kadar, Tern\'in ondan yüklediği ilk dosya her sonraki güncellemenin taşıması gereken sertifikayı belirler.</string>
+    <string name="origin_republished_pinned">%1$s, geliştiricilerin başka bir yerde yayınladıklarını tekrar sunar ve geliştirici değildir. Dosyaları bu uygulamanın tabi olduğu sertifikayı taşımalıdır.</string>
+    <string name="origin_store_first">%1$s bir mağazadır, geliştiricinin kendi sitesi değildir. Uygulama bir sertifikaya sabitlenene kadar, Tern\'in ondan yüklediği ilk dosya her sonraki güncellemenin taşıması gereken sertifikayı belirler.</string>
+    <string name="origin_store_pinned">%1$s bir mağazadır, geliştiricinin kendi sitesi değildir. Dosyaları bu uygulamanın tabi olduğu sertifikayı taşımalıdır.</string>
+    <string name="stores_refused_modified">Tern, değiştirilmiş uygulamalar sunan siteleri okumaz. Dosyaları geliştirici dışında biri tarafından değiştirilmiş ve kim değiştirdiyse onun tarafından imzalanmıştır.</string>
+    <string name="stores_refused_impersonation">Tern bu mağazayı onun uygulamasıymış gibi davranmadan okuyamaz, bu yüzden onu okumaz.</string>
+    <string name="stores_checksum_source">Geliştirici olmayan %1$s</string>
+    <string name="stores_off_title">%1$s üçüncü taraf bir mağazadır</string>
+    <string name="stores_off_body">Üçüncü taraf mağazalar kapalı. Bir mağaza, geliştiricinin kendi sitesinden dosyaları değil, uygulamaların kendi kopyalarını sunar ve Tern onu mağazanın kendi uygulaması veya web sitesi için yaptığı arayüz üzerinden okur. Açık olduklarında, Tern bir mağazaya yalnızca ondan eklediğiniz uygulamaları sorar ve uygulama bir sertifikaya sabitlenene kadar, Tern\'in bir mağazadan yüklediği ilk dosya güncellemelerinin taşıması gereken sertifikayı belirler.</string>
+    <string name="stores_turn_on">Üçüncü taraf mağazaları aç</string>
+    <string name="stores_advice">Bu uygulamayı tekrar denetlemek için Ayarlar\'da Üçüncü taraf mağazalar\'ı açın.</string>
+    <string name="stores_status_paused">Duraklatıldı</string>
+    <string name="stores_row_paused">Üçüncü taraf mağazalar kapalı</string>
+    <string name="stores_setting">Üçüncü taraf mağazalar</string>
+    <string name="stores_setting_effect">APKPure, Aptoide, APKCombo, APKMirror, Tencent, Huawei AppGallery, Galaxy Store ve vivo. Geliştiricinin kendi sitesinden dosyaları değil, uygulamaların kendi kopyalarını sunarlar ve Tern onları kendi uygulamaları ve web siteleri için yaptıkları arayüzler üzerinden okur. Kapalıyken Tern hiçbirine hiçbir şey sormaz, arama onları dışarıda bırakır ve onlardan gelen uygulamalar duraklatılır.</string>
+    <string name="stores_off_tag">Ayarlar\'da kapalı</string>
+    <string name="stores_checksum_matched">Dosya, mağazanın sağlama toplamıyla eşleşiyor</string>
+    <string name="stores_explain_checksum_matched">Sağlama toplamı, dosyanın kendisinin bir parmak izidir. Mağaza bir tane verdi ve Tern\'in indirdiği dosya aynı şeye sahip, yani mağazada olduğu gibi geldi. Mağaza geliştirici değildir, bu yüzden bu, dosyayı kimin yaptığı hakkında hiçbir şey söylemez. Sertifika söyler.</string>
+    <string name="stores_import_from_stores">Bunlar, uygulamaların kendi kopyalarını sunan üçüncü taraf mağazalardan geliyor. Bir uygulama bir sertifikaya sabitlenene kadar, Tern\'in o uygulamanın mağazasından yüklediği ilk dosya, güncellemelerinin taşıması gereken sertifikayı belirler.</string>
+    <string name="stores_import_paused">Üçüncü taraf mağazalar kapalı, bu yüzden bu uygulamalar duraklatıldı. Siz onları açana kadar Tern bu mağazalara hiçbir şey sormaz.</string>
+    <string name="stores_import_names">Üçüncü taraf mağazalardan</string>
+    <string name="share_obtainium_link">Obtainium bağlantısı olarak paylaş</string>
+    <string name="share_obtainium_links">Obtainium bağlantıları olarak paylaş</string>
+</resources>
diff --git a/app/src/main/res/values-tr/strings_tv.xml b/app/src/main/res/values-tr/strings_tv.xml
new file mode 100644
index 00000000..d1153e94
--- /dev/null
+++ b/app/src/main/res/values-tr/strings_tv.xml
@@ -0,0 +1,5 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="interval_turn_off">Arka plan denetimlerini kapat</string>
+    <string name="interval_turn_on">Arka plan denetimlerini aç</string>
+</resources>
diff --git a/app/src/main/res/values-uk/strings.xml b/app/src/main/res/values-uk/strings.xml
index 0eed218a..0cc157c6 100644
--- a/app/src/main/res/values-uk/strings.xml
+++ b/app/src/main/res/values-uk/strings.xml
@@ -399,7 +399,6 @@
     <string name="settings_import_effect">З файлу експорту Tern або Obtainium</string>
     <string name="settings_export">Експортувати програми</string>
     <string name="settings_exporting">Експортування</string>
-    <string name="settings_export_effect">Зберігає ваш список і налаштування у файл. Маркери ніколи не включаються.</string>
     <plurals name="exported">
         <item quantity="one">Експортовано %d програму</item>
         <item quantity="few">Експортовано %d програми</item>
diff --git a/app/src/main/res/values-uk/strings_accept.xml b/app/src/main/res/values-uk/strings_accept.xml
new file mode 100644
index 00000000..b6718602
--- /dev/null
+++ b/app/src/main/res/values-uk/strings_accept.xml
@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="stores_paused_reason">Сторонні магазини вимкнено, тому Tern нічого не запитує в цього магазину. Увімкніть їх у Налаштуваннях, щоб перевірити його знову.</string>
+</resources>
diff --git a/app/src/main/res/values-uk/strings_checks.xml b/app/src/main/res/values-uk/strings_checks.xml
index 29886ec7..0c52f466 100644
--- a/app/src/main/res/values-uk/strings_checks.xml
+++ b/app/src/main/res/values-uk/strings_checks.xml
@@ -21,13 +21,11 @@
     <string name="settings_only_installed">Перевіряти лише встановлені програми</string>
     <string name="settings_only_installed_effect">Програми, які лише відстежуються, теж перевіряються. Програма, яку ви відкриваєте, перевіряється завжди.</string>
     <string name="settings_remove_uninstalled">Вилучати програми, видалені в іншому місці</string>
-    <string name="settings_remove_uninstalled_effect">Програма, яку ви видаляєте не через Tern, також зникає зі списку.</string>
     <string name="settings_file_filter">Фільтр файлів</string>
     <string name="settings_file_filter_effect">Шаблон, за яким вибирають файл усі програми без власного фільтра.</string>
     <string name="settings_file_filter_none">Немає</string>
     <string name="settings_file_filter_invalid">Цей шаблон неможливо прочитати.</string>
     <string name="settings_allow_downgrades">Дозволити старіші версії</string>
-    <string name="settings_allow_downgrades_effect">Встановлено Let Me Downgrade, тому Android може встановити старішу версію поверх новішої.</string>
     <string name="settings_collapse_groups">Спочатку згортати групи</string>
     <string name="settings_haptics">Тактильний відгук</string>
     <string name="settings_haptics_effect">Легка вібрація, коли свайп або довге натискання щось робить.</string>
@@ -42,7 +40,6 @@
     <string name="sources_repositories">Репозиторії</string>
     <string name="sources_stores">Магазини</string>
     <string name="sources_mirrors">Магазини, що повторно публікують програми</string>
-    <string name="sources_modified">Сайти зі зміненими програмами</string>
     <string name="sources_other">Інші місця</string>
     <string name="sources_web_page">Вебсторінка з посиланнями на файли</string>
     <string name="sources_direct">Пряме посилання на файл</string>
@@ -52,8 +49,6 @@
     <string name="shared_configs_title">Конфігурації від користувачів Obtainium</string>
     <string name="shared_configs_effect">Сайт із готовими налаштуваннями для програм. Його посилання відкриваються в Tern, якщо в Налаштуваннях увімкнено «Відкривати посилання Obtainium».</string>
     <string name="engine_inner_filter_nothing">Фільтр файлів усередині архівів не збігається з жодним APK у цьому архіві.</string>
-    <string name="preview_republished">%1$s повторно публікує те, що розробники випускають деінде. Його файли звіряються із сертифікатом розробника, щойно Tern його знає, тож за можливості закріпіть сертифікат або спершу встановіть програму від розробника.</string>
-    <string name="preview_modified">%1$s пропонує програми, змінені не їхнім розробником. Вони підписані тим, хто їх змінив, і Tern не може визначити, що саме змінено.</string>
     <string name="about_track_tern">Оновлювати сам Tern</string>
     <string name="about_track_tern_effect">Додає до списку випуски самого Tern: вони перевіряються та звіряються, як у будь-якої програми.</string>
     <string name="engine_channel_tracked">Нові випуски відстежуваних програм</string>
diff --git a/app/src/main/res/values-uk/strings_options.xml b/app/src/main/res/values-uk/strings_options.xml
index 9d7a4f47..c108a9ae 100644
--- a/app/src/main/res/values-uk/strings_options.xml
+++ b/app/src/main/res/values-uk/strings_options.xml
@@ -66,10 +66,6 @@
     <string name="option_workflow">Файл робочого процесу</string>
     <string name="option_workflow_help">Наприклад, build.yml.</string>
     <string name="option_branch">Гілка</string>
-    <string name="option_device_model">Модель пристрою</string>
-    <string name="option_device_model_help">Galaxy Store має для кожної моделі власну збірку, наприклад SM-S948B.</string>
-    <string name="option_csc">Код регіону (CSC)</string>
-    <string name="option_csc_help">Три літери, наприклад DBT.</string>
     <string name="option_link_filter">Фільтр посилань на завантаження</string>
     <string name="option_link_filter_help">Завантаженнями вважаються лише відповідні посилання.</string>
     <string name="option_page_order">Зберігати порядок сторінки</string>
@@ -80,11 +76,14 @@
     <string name="version_from_text">Текст посилання</string>
     <string name="version_from_page">Уся сторінка</string>
     <string name="option_headers">Заголовки запиту</string>
-    <string name="option_headers_help">По одному на рядок, у вигляді Name: value. Ніколи не вказуйте пароль чи cookie.</string>
     <string name="option_pseudo">Коли версії немає</string>
     <string name="pseudo_default">Розрізняти файли так, як це робить сервер</string>
     <string name="pseudo_hash">За хешем початку файлу</string>
     <string name="pseudo_link">За адресою файлу</string>
     <string name="pseudo_etag">За ETag сервера</string>
     <string name="option_invalid">Це не можна використати в такому вигляді.</string>
+    <string name="option_device_model">Модель пристрою</string>
+    <string name="option_device_model_help">Galaxy Store має для кожної моделі власну збірку, наприклад SM-S948B.</string>
+    <string name="option_csc">Код регіону (CSC)</string>
+    <string name="option_csc_help">Три літери, наприклад DBT.</string>
 </resources>
diff --git a/app/src/main/res/values-uk/strings_safety.xml b/app/src/main/res/values-uk/strings_safety.xml
new file mode 100644
index 00000000..2f1a89d3
--- /dev/null
+++ b/app/src/main/res/values-uk/strings_safety.xml
@@ -0,0 +1,31 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="settings_export_effect_plain">Зберігає ваш список і налаштування у файл. Маркери ніколи туди не потрапляють, як і заголовок запиту, що міг би містити ключ.</string>
+    <string name="engine_checksum_github_proxy">Дайджест випуску GitHub, як його передав hubproxy %1$s</string>
+    <string name="github_proxy_effect_trust">Кожен запит до GitHub надходить на цей хост. Він бачить кожен із них і може змінювати те, що повертається: випуски, їхні дайджести та файли. Програми, які ви маєте, залишаються закріпленими за своїм сертифікатом, але перше встановлення через нього довіряє hubproxy так само, як GitHub, і закріплення сертифіката до нього не застосовується. Через нього не надсилається жоден маркер, тому приватні проєкти та GitHub Actions неможливо відстежувати в такий спосіб.</string>
+    <string name="settings_unmetered_checks">Перевіряти лише через Wi-Fi</string>
+    <string name="settings_unmetered_checks_effect">Фонові перевірки чекають на Wi-Fi або кабель, тому вони не використовують мобільні дані.</string>
+    <string name="settings_charging_checks">Перевіряти лише під час заряджання</string>
+    <string name="settings_charging_checks_effect">Фонові перевірки чекають, поки пристрій заряджається.</string>
+    <string name="settings_unmetered_installs_wait">Оновлення, яке б встановилося самостійно, чекає на Wi-Fi або кабель, як у Obtainium.</string>
+    <string name="settings_charging_installs_wait">Оновлення, яке б встановилося самостійно, чекає, поки пристрій заряджається.</string>
+    <string name="engine_downgrade_not_as_named">Джерело вказало код версії %2$d, але цей файл має %1$d, що є старішим за встановлений. Його не буде встановлено поверх новішого.</string>
+    <string name="settings_allow_downgrades_picked">Let Me Downgrade встановлено, тому Android може встановити старішу версію поверх новішої. Tern робить це лише для випуску, який ви вибрали з історії програми, і ніколи у фоновому режимі або за допомогою функції «Оновити всі».</string>
+    <string name="option_highest_version">Брати найвищу версію, як це робив Tern 0.1.0</string>
+    <string name="option_highest_version_effect">Пропонує посилання з найвищою версією на сторінці, незалежно від його місця, і застосовує шаблон версії до версії, зчитаної з кожного посилання. Якщо вимкнено, сторінка читається так, як це робить Obtainium: останнє посилання по порядку є найновішим.</string>
+    <string name="settings_remove_uninstalled_keeps_pins">Програма, яку ви видаляєте поза Tern, також зникає зі списку. Архівована програма залишається. Додана знову з того самого місця, програма закріплюється за сертифікатом, який вона мала; її видалення в Tern змушує забути про це.</string>
+    <string name="link_check_title">Перевірити наявність оновлень зараз?</string>
+    <string name="link_check_one">Посилання попросило Tern перевірити %1$s на наявність оновлень. Tern звертається до її джерела, і нічого не встановлюється.</string>
+    <plurals name="link_check_all">
+        <item quantity="one">Посилання попросило Tern перевірити %d програму з вашого списку на наявність оновлень. Відправляється запит до її джерела, і нічого не встановлюється.</item>
+        <item quantity="few">Посилання попросило Tern перевірити %d програми з вашого списку на наявність оновлень. Відправляється запит до їхніх джерел, і нічого не встановлюється.</item>
+        <item quantity="many">Посилання попросило Tern перевірити %d програм з вашого списку на наявність оновлень. Відправляється запит до їхніх джерел, і нічого не встановлюється.</item>
+        <item quantity="other">Посилання попросило Tern перевірити %d програми з вашого списку на наявність оновлень. Відправляється запит до їхніх джерел, і нічого не встановлюється.</item>
+    </plurals>
+    <string name="link_check_confirm">Перевірити</string>
+    <string name="link_check_not_now">Не зараз</string>
+    <string name="engine_installer_fell_back">%1$s не був готовий, тому для цього використано інсталятор Android.</string>
+    <string name="about_track_tern_fdroid_effect">F-Droid встановив цю копію, тому Tern відстежує її запис там: оновлення є збірками, які створив і перевірив F-Droid, так само, як їх отримує програма F-Droid.</string>
+    <string name="about_track_tern_github">Натомість відстежувати випуски GitHub</string>
+    <string name="about_track_tern_github_effect">Оновлення надходять із GitHub одразу після їх публікації, ще до того, як F-Droid їх збере та перевірить. Це пропускає перевірки F-Droid. Tern і далі перевіряє кожен файл і закріплює його за власним сертифікатом.</string>
+</resources>
diff --git a/app/src/main/res/values-uk/strings_settings_more.xml b/app/src/main/res/values-uk/strings_settings_more.xml
index 537fa1a7..69cbd5d0 100644
--- a/app/src/main/res/values-uk/strings_settings_more.xml
+++ b/app/src/main/res/values-uk/strings_settings_more.xml
@@ -39,9 +39,7 @@
     <string name="settings_auto_installs">Оновлення встановлюються самостійно</string>
     <string name="settings_auto_installs_effect">Програми, налаштовані оновлюватися самостійно, роблять це після фонової перевірки. Якщо вимкнено, вони лише повідомляють, що є оновлення, а вибір кожної з них зберігається на потім.</string>
     <string name="settings_unmetered_installs">Встановлювати лише через Wi-Fi</string>
-    <string name="settings_unmetered_installs_effect">Перевірки виконуються в будь-якій мережі. Оновлення, яке встановилося б само, чекає на Wi-Fi або кабель, як в Obtainium.</string>
     <string name="settings_charging_installs">Встановлювати лише під час заряджання</string>
-    <string name="settings_charging_installs_effect">Перевірки виконуються й від батареї. Оновлення, яке встановилося б само, чекає, доки пристрій не почне заряджатися.</string>
     <string name="engine_unreadable_app">Збережену програму %1$s не вдалося прочитати, тому її не показано в списку. Нічого не видалено: новіша версія Tern може її прочитати.</string>
     <string name="settings_pin_certificates">Закріплювати сертифікати хостингів коду</string>
     <string name="settings_pin_certificates_effect">Як і в Obtainium, GitHub, GitLab і Codeberg мають надавати сертифікат від центру сертифікації, яким, як відомо, користується кожен із них. Сертифікат, який інший центр сертифікації видав під примусом, тоді відхиляється. Якщо хостинг коду змінить центр сертифікації, перевірки на ньому завершуватимуться помилкою, доки цей параметр не вимкнено.</string>
diff --git a/app/src/main/res/values-uk/strings_sources_more.xml b/app/src/main/res/values-uk/strings_sources_more.xml
index 7a5de69f..d08959d4 100644
--- a/app/src/main/res/values-uk/strings_sources_more.xml
+++ b/app/src/main/res/values-uk/strings_sources_more.xml
@@ -18,10 +18,7 @@
     <string name="step_arch">Віддавати перевагу процесору цього пристрою</string>
     <string name="step_add">Додати сторінку</string>
     <string name="step_remove">Вилучити цю сторінку</string>
-    <string name="option_file_version">Використовувати назву файлу як версію</string>
-    <string name="option_file_version_effect">Тоді кожен файл вважається окремим випуском.</string>
     <string name="github_proxy_title">GitHub через hubproxy</string>
-    <string name="github_proxy_effect">Кожен запит до GitHub іде на цей хост, який бачить усі запити. Маркер через нього не надсилається, тому приватні проєкти та GitHub Actions так відстежувати не можна.</string>
     <string name="github_proxy_host">Хост hubproxy</string>
     <string name="github_proxy_help">Лише назва хоста, наприклад gh-proxy.com. Tern звертається до нього через HTTPS.</string>
     <string name="github_proxy_invalid">Це не назва хоста, яку може використовувати Tern</string>
diff --git a/app/src/main/res/values-uk/strings_starters.xml b/app/src/main/res/values-uk/strings_starters.xml
new file mode 100644
index 00000000..00dd29de
--- /dev/null
+++ b/app/src/main/res/values-uk/strings_starters.xml
@@ -0,0 +1,7 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="starter_in_list">У вашому списку</string>
+    <string name="starter_on_phone">На цьому телефоні</string>
+    <string name="starter_on_phone_other">На цьому телефоні від іншого підписувача</string>
+    <string name="starter_on_phone_other_explain">Вашу копію підписано іншим ключем, тому Tern не може оновити її з цієї адреси.</string>
+</resources>
diff --git a/app/src/main/res/values-uk/strings_stores.xml b/app/src/main/res/values-uk/strings_stores.xml
new file mode 100644
index 00000000..6531c4f0
--- /dev/null
+++ b/app/src/main/res/values-uk/strings_stores.xml
@@ -0,0 +1,27 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="option_headers_help_own_agent">По одному в рядку у форматі Name: value. Ніколи не пароль, файл cookie чи User-Agent: Tern повідомляє кожному сайту, що він є Tern.</string>
+    <string name="origin_republished_first">%1$s знову пропонує те, що розробники публікують деінде, і не є розробником. Поки програма не буде закріплена за сертифікатом, перший файл, який Tern встановлює з нього, вирішує, який сертифікат повинне містити кожне наступне оновлення.</string>
+    <string name="origin_republished_pinned">%1$s знову пропонує те, що розробники публікують деінде, і не є розробником. Його файли мають містити сертифікат, за яким закріплено цю програму.</string>
+    <string name="origin_store_first">%1$s є магазином, а не власним сайтом розробника. Поки програма не буде закріплена за сертифікатом, перший файл, який Tern встановлює з нього, вирішує, який сертифікат повинне містити кожне наступне оновлення.</string>
+    <string name="origin_store_pinned">%1$s є магазином, а не власним сайтом розробника. Його файли мають містити сертифікат, за яким закріплено цю програму.</string>
+    <string name="stores_refused_modified">Tern не читає сайти, що пропонують змінені програми. Їхні файли змінені кимось іншим, а не розробником, і підписані тим, хто їх змінив.</string>
+    <string name="stores_refused_impersonation">Tern не може прочитати цей магазин, не видаючи себе за його програму, тому він його не читає.</string>
+    <string name="stores_checksum_source">%1$s, який не є розробником</string>
+    <string name="stores_off_title">%1$s є стороннім магазином</string>
+    <string name="stores_off_body">Сторонні магазини вимкнено. Магазин надає власні копії програм, а не файли з власного сайту розробника, і Tern читає його через інтерфейс, який магазин створив для власної програми або вебсайту. Якщо їх увімкнено, Tern запитує магазин лише про програми, які ви додаєте з нього, і поки програма не буде закріплена за сертифікатом, перший файл, який Tern встановлює з магазину, вирішує, який сертифікат повинні містити її оновлення.</string>
+    <string name="stores_turn_on">Увімкнути сторонні магазини</string>
+    <string name="stores_advice">Увімкніть сторонні магазини в Налаштуваннях, щоб перевірити цю програму знову.</string>
+    <string name="stores_status_paused">Призупинено</string>
+    <string name="stores_row_paused">Сторонні магазини вимкнено</string>
+    <string name="stores_setting">Сторонні магазини</string>
+    <string name="stores_setting_effect">APKPure, Aptoide, APKCombo, APKMirror, Tencent, Huawei AppGallery, Galaxy Store та vivo. Вони надають власні копії програм, а не файли з власного сайту розробника, і Tern читає їх через інтерфейси, які вони створили для своїх власних програм і вебсайтів. Якщо їх вимкнено, Tern нічого не запитує в жодного з них, пошук їх пропускає, а програми з них призупиняються.</string>
+    <string name="stores_off_tag">вимкнено в Налаштуваннях</string>
+    <string name="stores_checksum_matched">Файл відповідає контрольній сумі магазину</string>
+    <string name="stores_explain_checksum_matched">Контрольна сума є відбитком самого файлу. Магазин надав її, і файл, який завантажив Tern, має таку саму, тому він надійшов таким, яким його має магазин. Магазин не є розробником, тому це нічого не говорить про те, хто створив файл. Про це говорить сертифікат.</string>
+    <string name="stores_import_from_stores">Вони походять зі сторонніх магазинів, які надають власні копії програм. Поки програма не буде закріплена за сертифікатом, перший файл, який Tern встановлює з її магазину, вирішує, який сертифікат повинні містити її оновлення.</string>
+    <string name="stores_import_paused">Сторонні магазини вимкнено, тому ці програми призупинено. Tern нічого не запитує в цих магазинів, поки ви їх не ввімкнете.</string>
+    <string name="stores_import_names">Зі сторонніх магазинів</string>
+    <string name="share_obtainium_link">Поділитися як посиланням Obtainium</string>
+    <string name="share_obtainium_links">Поділитися як посиланнями Obtainium</string>
+</resources>
diff --git a/app/src/main/res/values-uk/strings_tv.xml b/app/src/main/res/values-uk/strings_tv.xml
new file mode 100644
index 00000000..bf2c0f81
--- /dev/null
+++ b/app/src/main/res/values-uk/strings_tv.xml
@@ -0,0 +1,5 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="interval_turn_off">Вимкнути фонові перевірки</string>
+    <string name="interval_turn_on">Увімкнути фонові перевірки</string>
+</resources>
diff --git a/app/src/main/res/values-vi/strings.xml b/app/src/main/res/values-vi/strings.xml
index 9c4536ed..1c64f461 100644
--- a/app/src/main/res/values-vi/strings.xml
+++ b/app/src/main/res/values-vi/strings.xml
@@ -354,7 +354,6 @@
     <string name="settings_import_effect">Từ tệp xuất của Tern hoặc Obtainium</string>
     <string name="settings_export">Xuất ứng dụng</string>
     <string name="settings_exporting">Đang xuất</string>
-    <string name="settings_export_effect">Lưu danh sách và cài đặt vào tệp. Không bao gồm mã thông báo.</string>
     <plurals name="exported">
         <item quantity="other">Đã xuất %d ứng dụng</item>
     </plurals>
diff --git a/app/src/main/res/values-vi/strings_accept.xml b/app/src/main/res/values-vi/strings_accept.xml
new file mode 100644
index 00000000..5dfdc95b
--- /dev/null
+++ b/app/src/main/res/values-vi/strings_accept.xml
@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="stores_paused_reason">Cửa hàng bên thứ ba đang tắt, nên Tern không yêu cầu gì từ cửa hàng này. Bật chúng trong Cài đặt để kiểm tra lại.</string>
+</resources>
diff --git a/app/src/main/res/values-vi/strings_checks.xml b/app/src/main/res/values-vi/strings_checks.xml
index b39eeebd..ee9be818 100644
--- a/app/src/main/res/values-vi/strings_checks.xml
+++ b/app/src/main/res/values-vi/strings_checks.xml
@@ -15,13 +15,11 @@
     <string name="settings_only_installed">Chỉ kiểm tra ứng dụng đã cài đặt</string>
     <string name="settings_only_installed_effect">Ứng dụng chỉ được theo dõi vẫn được kiểm tra. Ứng dụng bạn mở luôn được kiểm tra.</string>
     <string name="settings_remove_uninstalled">Xóa ứng dụng đã gỡ cài đặt ở nơi khác</string>
-    <string name="settings_remove_uninstalled_effect">Ứng dụng bạn gỡ cài đặt bên ngoài Tern cũng sẽ rời khỏi danh sách.</string>
     <string name="settings_file_filter">Bộ lọc tệp</string>
     <string name="settings_file_filter_effect">Mẫu mà mọi ứng dụng không có bộ lọc riêng dùng để chọn tệp.</string>
     <string name="settings_file_filter_none">Không có</string>
     <string name="settings_file_filter_invalid">Không thể đọc mẫu này.</string>
     <string name="settings_allow_downgrades">Cho phép phiên bản cũ hơn</string>
-    <string name="settings_allow_downgrades_effect">Let Me Downgrade đã được cài đặt, nên Android có thể cài phiên bản cũ đè lên phiên bản mới hơn.</string>
     <string name="settings_collapse_groups">Bắt đầu với các nhóm được thu gọn</string>
     <string name="settings_haptics">Phản hồi xúc giác</string>
     <string name="settings_haptics_effect">Rung nhẹ khi thao tác vuốt hoặc nhấn giữ thực hiện một việc gì đó.</string>
@@ -36,7 +34,6 @@
     <string name="sources_repositories">Kho lưu trữ</string>
     <string name="sources_stores">Cửa hàng</string>
     <string name="sources_mirrors">Cửa hàng đăng lại ứng dụng</string>
-    <string name="sources_modified">Trang có ứng dụng đã bị sửa đổi</string>
     <string name="sources_other">Nơi khác</string>
     <string name="sources_web_page">Trang web có liên kết đến tệp</string>
     <string name="sources_direct">Liên kết trực tiếp đến tệp</string>
@@ -46,8 +43,6 @@
     <string name="shared_configs_title">Cấu hình do người dùng Obtainium chia sẻ</string>
     <string name="shared_configs_effect">Một trang web chứa các thiết lập làm sẵn cho ứng dụng. Liên kết của trang sẽ mở trong Tern khi bật \"Mở liên kết Obtainium\" trong Cài đặt.</string>
     <string name="engine_inner_filter_nothing">Bộ lọc cho tệp bên trong tệp lưu trữ không khớp với APK nào trong tệp này.</string>
-    <string name="preview_republished">%1$s cung cấp lại những gì nhà phát triển xuất bản ở nơi khác. Khi Tern đã biết chứng chỉ của nhà phát triển, tệp từ đây phải khớp với chứng chỉ đó, vì vậy khi có thể, hãy ghim một chứng chỉ hoặc cài đặt từ nhà phát triển trước.</string>
-    <string name="preview_modified">%1$s cung cấp các ứng dụng đã bị người khác ngoài nhà phát triển sửa đổi. Chúng được ký bởi người đã sửa đổi, và Tern không thể biết những gì đã bị thay đổi.</string>
     <string name="about_track_tern">Giữ cho chính Tern luôn được cập nhật</string>
     <string name="about_track_tern_effect">Thêm các bản phát hành của chính Tern vào danh sách, được kiểm tra và xác minh như mọi ứng dụng.</string>
     <string name="engine_channel_tracked">Bản phát hành mới của ứng dụng đang theo dõi</string>
diff --git a/app/src/main/res/values-vi/strings_options.xml b/app/src/main/res/values-vi/strings_options.xml
index 4965c6cc..32c3c76b 100644
--- a/app/src/main/res/values-vi/strings_options.xml
+++ b/app/src/main/res/values-vi/strings_options.xml
@@ -60,10 +60,6 @@
     <string name="option_workflow">Tệp workflow</string>
     <string name="option_workflow_help">Chẳng hạn build.yml.</string>
     <string name="option_branch">Nhánh</string>
-    <string name="option_device_model">Mẫu thiết bị</string>
-    <string name="option_device_model_help">Galaxy Store cung cấp bản dựng riêng cho từng mẫu máy, chẳng hạn SM-S948B.</string>
-    <string name="option_csc">Mã vùng (CSC)</string>
-    <string name="option_csc_help">Ba chữ cái, chẳng hạn DBT.</string>
     <string name="option_link_filter">Bộ lọc liên kết tải xuống</string>
     <string name="option_link_filter_help">Chỉ những liên kết khớp mới được tính là tải xuống.</string>
     <string name="option_page_order">Giữ thứ tự của trang</string>
@@ -74,11 +70,14 @@
     <string name="version_from_text">Văn bản của liên kết</string>
     <string name="version_from_page">Toàn bộ trang</string>
     <string name="option_headers">Tiêu đề yêu cầu</string>
-    <string name="option_headers_help">Mỗi dòng một mục, dạng Name: value. Không bao giờ nhập mật khẩu hay cookie.</string>
     <string name="option_pseudo">Khi không có phiên bản</string>
     <string name="pseudo_default">Phân biệt tệp theo cách của máy chủ</string>
     <string name="pseudo_hash">Theo mã băm phần đầu tệp</string>
     <string name="pseudo_link">Theo địa chỉ của tệp</string>
     <string name="pseudo_etag">Theo ETag của máy chủ</string>
     <string name="option_invalid">Không thể dùng nguyên trạng như vậy.</string>
+    <string name="option_device_model">Mẫu thiết bị</string>
+    <string name="option_device_model_help">Galaxy Store cung cấp bản dựng riêng cho từng mẫu máy, chẳng hạn SM-S948B.</string>
+    <string name="option_csc">Mã vùng (CSC)</string>
+    <string name="option_csc_help">Ba chữ cái, chẳng hạn DBT.</string>
 </resources>
diff --git a/app/src/main/res/values-vi/strings_safety.xml b/app/src/main/res/values-vi/strings_safety.xml
new file mode 100644
index 00000000..e853b7e5
--- /dev/null
+++ b/app/src/main/res/values-vi/strings_safety.xml
@@ -0,0 +1,28 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="settings_export_effect_plain">Lưu danh sách và cài đặt của bạn vào một tệp. Các mã thông báo không bao giờ được đưa vào, và tiêu đề yêu cầu có thể chứa khóa cũng không bao giờ được đưa vào.</string>
+    <string name="engine_checksum_github_proxy">Digest bản phát hành GitHub, do hubproxy %1$s chuyển đến</string>
+    <string name="github_proxy_effect_trust">Mọi yêu cầu đến GitHub đều đi đến máy chủ này. Nó thấy từng yêu cầu và có thể thay đổi những gì trả về: các bản phát hành, digest của chúng và các tệp. Các ứng dụng bạn có vẫn giữ nguyên chứng chỉ của chúng, nhưng lần cài đặt đầu tiên thông qua nó tin tưởng hubproxy nhiều như GitHub, và việc ghim chứng chỉ không áp dụng cho nó. Không có mã thông báo nào được gửi qua nó, nên không thể theo dõi các dự án riêng tư và GitHub Actions theo cách này.</string>
+    <string name="settings_unmetered_checks">Chỉ kiểm tra khi dùng Wi-Fi</string>
+    <string name="settings_unmetered_checks_effect">Kiểm tra trong nền chờ Wi-Fi hoặc cáp, nên chúng không dùng dữ liệu di động.</string>
+    <string name="settings_charging_checks">Chỉ kiểm tra khi đang sạc</string>
+    <string name="settings_charging_checks_effect">Kiểm tra trong nền chờ cho đến khi thiết bị đang sạc.</string>
+    <string name="settings_unmetered_installs_wait">Một bản cập nhật tự cài đặt sẽ chờ Wi-Fi hoặc cáp, giống như trong Obtainium.</string>
+    <string name="settings_charging_installs_wait">Một bản cập nhật tự cài đặt sẽ chờ cho đến khi thiết bị đang sạc.</string>
+    <string name="engine_downgrade_not_as_named">Nguồn đã gọi mã phiên bản %2$d, nhưng tệp này là %1$d, cũ hơn bản đã cài đặt. Nó không được đặt đè lên bản mới hơn.</string>
+    <string name="settings_allow_downgrades_picked">Let Me Downgrade đã được cài đặt, nên Android có thể đặt phiên bản cũ hơn đè lên bản mới hơn. Tern chỉ làm vậy đối với bản phát hành bạn chọn từ lịch sử của ứng dụng, không bao giờ trong nền hoặc với Cập nhật tất cả.</string>
+    <string name="option_highest_version">Lấy phiên bản cao nhất, như Tern 0.1.0 đã làm</string>
+    <string name="option_highest_version_effect">Đề xuất liên kết có phiên bản cao nhất trên trang, bất kể vị trí của nó, và chạy mẫu phiên bản trên phiên bản đọc được từ mỗi liên kết. Khi tắt sẽ đọc trang theo cách Obtainium làm: liên kết cuối cùng theo thứ tự là mới nhất.</string>
+    <string name="settings_remove_uninstalled_keeps_pins">Một ứng dụng bạn gỡ cài đặt bên ngoài Tern cũng sẽ rời khỏi danh sách. Một ứng dụng đã lưu trữ vẫn được giữ lại. Nếu được thêm lại từ cùng một nơi, ứng dụng sẽ phải mang chứng chỉ mà nó đã có; việc xóa nó trong Tern sẽ quên đi điều đó.</string>
+    <string name="link_check_title">Kiểm tra bản cập nhật ngay?</string>
+    <string name="link_check_one">Một liên kết đã yêu cầu Tern kiểm tra các bản cập nhật của %1$s. Nguồn của nó được hỏi, và không có gì được cài đặt.</string>
+    <plurals name="link_check_all">
+        <item quantity="other">Một liên kết đã yêu cầu Tern kiểm tra %d ứng dụng trong danh sách của bạn để tìm bản cập nhật. Các nguồn của chúng được hỏi, và không có gì được cài đặt.</item>
+    </plurals>
+    <string name="link_check_confirm">Kiểm tra</string>
+    <string name="link_check_not_now">Không phải bây giờ</string>
+    <string name="engine_installer_fell_back">%1$s chưa sẵn sàng, nên trình cài đặt của Android đã được dùng cho việc này.</string>
+    <string name="about_track_tern_fdroid_effect">F-Droid đã cài đặt bản sao này, nên Tern theo dõi mục của nó ở đó: các bản cập nhật là những bản dựng do F-Droid tạo ra và kiểm tra, giống như cách ứng dụng F-Droid nhận được chúng.</string>
+    <string name="about_track_tern_github">Theo dõi bản phát hành GitHub thay thế</string>
+    <string name="about_track_tern_github_effect">Bản cập nhật đến từ GitHub ngay khi chúng được xuất bản, trước khi F-Droid dựng và kiểm tra chúng. Điều này bỏ qua các kiểm tra của F-Droid. Tern vẫn kiểm tra từng tệp và buộc nó phải mang chứng chỉ của riêng nó.</string>
+</resources>
diff --git a/app/src/main/res/values-vi/strings_settings_more.xml b/app/src/main/res/values-vi/strings_settings_more.xml
index 259d46cd..05c91503 100644
--- a/app/src/main/res/values-vi/strings_settings_more.xml
+++ b/app/src/main/res/values-vi/strings_settings_more.xml
@@ -36,9 +36,7 @@
     <string name="settings_auto_installs">Tự động cài đặt bản cập nhật</string>
     <string name="settings_auto_installs_effect">Ứng dụng được đặt tự cập nhật sẽ cập nhật sau khi kiểm tra trong nền. Khi tắt, chúng chỉ báo là có bản cập nhật, và mỗi ứng dụng vẫn giữ lựa chọn riêng để dùng sau.</string>
     <string name="settings_unmetered_installs">Chỉ cài đặt trên Wi-Fi</string>
-    <string name="settings_unmetered_installs_effect">Việc kiểm tra chạy trên mọi mạng. Bản cập nhật lẽ ra sẽ tự cài đặt sẽ chờ đến khi có Wi-Fi hoặc cáp mạng, giống như Obtainium.</string>
     <string name="settings_charging_installs">Chỉ cài đặt khi đang sạc</string>
-    <string name="settings_charging_installs_effect">Việc kiểm tra cũng chạy khi dùng pin. Bản cập nhật lẽ ra sẽ tự cài đặt sẽ chờ đến khi thiết bị đang sạc.</string>
     <string name="engine_unreadable_app">Không thể đọc ứng dụng đã lưu %1$s, nên nó bị loại khỏi danh sách. Không có gì bị xóa: phiên bản Tern mới hơn có thể đọc được nó.</string>
     <string name="settings_pin_certificates">Ghim chứng chỉ của các nền tảng mã nguồn</string>
     <string name="settings_pin_certificates_effect">GitHub, GitLab và Codeberg phải xuất trình chứng chỉ từ tổ chức cấp chứng chỉ mà mỗi nền tảng được biết là đang dùng, giống như Obtainium. Chứng chỉ mà một tổ chức khác bị buộc phải cấp sẽ bị từ chối. Nếu một nền tảng mã nguồn đổi tổ chức cấp chứng chỉ, việc kiểm tra ở đó sẽ thất bại cho đến khi tắt tùy chọn này.</string>
diff --git a/app/src/main/res/values-vi/strings_sources_more.xml b/app/src/main/res/values-vi/strings_sources_more.xml
index f25d8534..2015ccd6 100644
--- a/app/src/main/res/values-vi/strings_sources_more.xml
+++ b/app/src/main/res/values-vi/strings_sources_more.xml
@@ -18,10 +18,7 @@
     <string name="step_arch">Ưu tiên bộ xử lý của thiết bị này</string>
     <string name="step_add">Thêm trang</string>
     <string name="step_remove">Xóa trang này</string>
-    <string name="option_file_version">Dùng tên tệp làm phiên bản</string>
-    <string name="option_file_version_effect">Khi đó mỗi tệp được tính là một bản phát hành riêng.</string>
     <string name="github_proxy_title">GitHub qua hubproxy</string>
-    <string name="github_proxy_effect">Mọi yêu cầu đến GitHub đều đi tới máy chủ này, và máy chủ thấy từng yêu cầu. Không có mã thông báo nào được gửi qua nó, nên không thể theo dõi dự án riêng tư và GitHub Actions theo cách này.</string>
     <string name="github_proxy_host">Máy chủ hubproxy</string>
     <string name="github_proxy_help">Chỉ tên máy chủ, ví dụ gh-proxy.com. Tern kết nối tới nó qua HTTPS.</string>
     <string name="github_proxy_invalid">Đây không phải tên máy chủ mà Tern có thể dùng</string>
diff --git a/app/src/main/res/values-vi/strings_starters.xml b/app/src/main/res/values-vi/strings_starters.xml
new file mode 100644
index 00000000..25898c0f
--- /dev/null
+++ b/app/src/main/res/values-vi/strings_starters.xml
@@ -0,0 +1,7 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="starter_in_list">Trong danh sách của bạn</string>
+    <string name="starter_on_phone">Trên điện thoại này</string>
+    <string name="starter_on_phone_other">Trên điện thoại này từ người ký khác</string>
+    <string name="starter_on_phone_other_explain">Bản sao bạn có được ký bằng khóa khác, nên Tern không thể cập nhật từ địa chỉ này.</string>
+</resources>
diff --git a/app/src/main/res/values-vi/strings_stores.xml b/app/src/main/res/values-vi/strings_stores.xml
new file mode 100644
index 00000000..a436775a
--- /dev/null
+++ b/app/src/main/res/values-vi/strings_stores.xml
@@ -0,0 +1,27 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="option_headers_help_own_agent">Mỗi dòng một mục, dạng Tên: giá trị. Không bao giờ là mật khẩu, cookie hoặc User-Agent: Tern cho mọi trang web biết nó là Tern.</string>
+    <string name="origin_republished_first">%1$s đề xuất lại những gì nhà phát triển xuất bản ở nơi khác, và không phải là nhà phát triển. Cho đến khi ứng dụng được ghim vào một chứng chỉ, tệp đầu tiên Tern cài đặt từ nó sẽ quyết định chứng chỉ mà mọi bản cập nhật sau này phải mang.</string>
+    <string name="origin_republished_pinned">%1$s đề xuất lại những gì nhà phát triển xuất bản ở nơi khác, và không phải là nhà phát triển. Các tệp của nó phải mang chứng chỉ mà ứng dụng này đang giữ.</string>
+    <string name="origin_store_first">%1$s là một cửa hàng, không phải trang web riêng của nhà phát triển. Cho đến khi ứng dụng được ghim vào một chứng chỉ, tệp đầu tiên Tern cài đặt từ cửa hàng này sẽ quyết định chứng chỉ mà mọi bản cập nhật sau này phải mang.</string>
+    <string name="origin_store_pinned">%1$s là một cửa hàng, không phải trang web riêng của nhà phát triển. Các tệp của nó phải mang chứng chỉ mà ứng dụng này đang giữ.</string>
+    <string name="stores_refused_modified">Tern không đọc các trang web cung cấp ứng dụng đã sửa đổi. Tệp của chúng bị người khác không phải nhà phát triển thay đổi và được ký bởi người đã thay đổi chúng.</string>
+    <string name="stores_refused_impersonation">Tern không thể đọc cửa hàng này mà không giả làm ứng dụng của nó, nên nó không đọc cửa hàng này.</string>
+    <string name="stores_checksum_source">%1$s, không phải là nhà phát triển</string>
+    <string name="stores_off_title">%1$s là cửa hàng của bên thứ ba</string>
+    <string name="stores_off_body">Các cửa hàng của bên thứ ba đang tắt. Một cửa hàng phục vụ các bản sao ứng dụng của riêng nó, không phải tệp từ trang web riêng của nhà phát triển, và Tern đọc nó qua giao diện mà cửa hàng tạo cho ứng dụng hoặc trang web của chính nó. Khi bật, Tern chỉ hỏi cửa hàng về những ứng dụng bạn thêm từ nó, và cho đến khi một ứng dụng được ghim vào một chứng chỉ, tệp đầu tiên Tern cài đặt từ một cửa hàng sẽ quyết định chứng chỉ mà các bản cập nhật của nó phải mang.</string>
+    <string name="stores_turn_on">Bật cửa hàng bên thứ ba</string>
+    <string name="stores_advice">Bật Cửa hàng của bên thứ ba trong Cài đặt để kiểm tra lại ứng dụng này.</string>
+    <string name="stores_status_paused">Đã tạm dừng</string>
+    <string name="stores_row_paused">Cửa hàng bên thứ ba đang tắt</string>
+    <string name="stores_setting">Cửa hàng bên thứ ba</string>
+    <string name="stores_setting_effect">APKPure, Aptoide, APKCombo, APKMirror, Tencent, Huawei AppGallery, Galaxy Store và vivo. Chúng phục vụ các bản sao ứng dụng của riêng chúng, không phải tệp từ trang web riêng của nhà phát triển, và Tern đọc chúng qua các giao diện chúng tạo cho ứng dụng và trang web của chính chúng. Khi tắt, Tern không hỏi chúng điều gì, một tìm kiếm sẽ bỏ qua chúng và các ứng dụng từ chúng bị tạm dừng.</string>
+    <string name="stores_off_tag">tắt trong Cài đặt</string>
+    <string name="stores_checksum_matched">Tệp khớp với tổng kiểm tra của cửa hàng</string>
+    <string name="stores_explain_checksum_matched">Tổng kiểm tra là dấu vân tay của chính tệp đó. Cửa hàng đã đưa ra một tổng kiểm tra, và tệp Tern đã tải xuống có tổng kiểm tra giống hệt, nên nó đến tay giống như cách cửa hàng có nó. Cửa hàng không phải là nhà phát triển, nên điều này không nói lên ai đã tạo ra tệp. Chứng chỉ thì có.</string>
+    <string name="stores_import_from_stores">Những ứng dụng này đến từ các cửa hàng của bên thứ ba, chúng phục vụ các bản sao ứng dụng của riêng chúng. Cho đến khi một ứng dụng được ghim vào một chứng chỉ, tệp đầu tiên Tern cài đặt từ cửa hàng của nó sẽ quyết định chứng chỉ mà các bản cập nhật của nó phải mang.</string>
+    <string name="stores_import_paused">Các cửa hàng của bên thứ ba đang tắt, nên những ứng dụng này bị tạm dừng. Tern không hỏi những cửa hàng đó điều gì cho đến khi bạn bật chúng.</string>
+    <string name="stores_import_names">Từ cửa hàng bên thứ ba</string>
+    <string name="share_obtainium_link">Chia sẻ dưới dạng liên kết Obtainium</string>
+    <string name="share_obtainium_links">Chia sẻ dưới dạng các liên kết Obtainium</string>
+</resources>
diff --git a/app/src/main/res/values-vi/strings_tv.xml b/app/src/main/res/values-vi/strings_tv.xml
new file mode 100644
index 00000000..f6c6dc22
--- /dev/null
+++ b/app/src/main/res/values-vi/strings_tv.xml
@@ -0,0 +1,5 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="interval_turn_off">Tắt kiểm tra trong nền</string>
+    <string name="interval_turn_on">Bật kiểm tra trong nền</string>
+</resources>
diff --git a/app/src/main/res/values-zh-rCN/strings.xml b/app/src/main/res/values-zh-rCN/strings.xml
index 1b52d90e..e4b6237b 100644
--- a/app/src/main/res/values-zh-rCN/strings.xml
+++ b/app/src/main/res/values-zh-rCN/strings.xml
@@ -354,7 +354,6 @@
     <string name="settings_import_effect">从 Tern 或 Obtainium 导出文件</string>
     <string name="settings_export">导出应用</string>
     <string name="settings_exporting">正在导出</string>
-    <string name="settings_export_effect">将列表和设置保存到文件。绝不会包含令牌。</string>
     <plurals name="exported">
         <item quantity="other">已导出 %d 个应用</item>
     </plurals>
diff --git a/app/src/main/res/values-zh-rCN/strings_accept.xml b/app/src/main/res/values-zh-rCN/strings_accept.xml
new file mode 100644
index 00000000..112bed83
--- /dev/null
+++ b/app/src/main/res/values-zh-rCN/strings_accept.xml
@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="stores_paused_reason">第三方商店已关闭，因此 Tern 不会向此商店请求任何内容。请在设置中打开它们以再次检查。</string>
+</resources>
diff --git a/app/src/main/res/values-zh-rCN/strings_checks.xml b/app/src/main/res/values-zh-rCN/strings_checks.xml
index 9bcfd534..b0d6c34a 100644
--- a/app/src/main/res/values-zh-rCN/strings_checks.xml
+++ b/app/src/main/res/values-zh-rCN/strings_checks.xml
@@ -15,13 +15,11 @@
     <string name="settings_only_installed">仅检查已安装的应用</string>
     <string name="settings_only_installed_effect">仅跟踪的应用也会被检查。您打开的应用始终会被检查。</string>
     <string name="settings_remove_uninstalled">移除在别处卸载的应用</string>
-    <string name="settings_remove_uninstalled_effect">在 Tern 之外卸载的应用也会从列表中移除。</string>
     <string name="settings_file_filter">文件过滤器</string>
     <string name="settings_file_filter_effect">所有没有自己过滤器的应用用来挑选文件的模式。</string>
     <string name="settings_file_filter_none">无</string>
     <string name="settings_file_filter_invalid">无法读取此模式。</string>
     <string name="settings_allow_downgrades">允许较旧的版本</string>
-    <string name="settings_allow_downgrades_effect">已安装 Let Me Downgrade，因此 Android 可以用较旧的版本覆盖较新的版本。</string>
     <string name="settings_collapse_groups">分组默认折叠</string>
     <string name="settings_haptics">触感反馈</string>
     <string name="settings_haptics_effect">滑动或长按触发操作时轻轻振动。</string>
@@ -36,7 +34,6 @@
     <string name="sources_repositories">存储库</string>
     <string name="sources_stores">商店</string>
     <string name="sources_mirrors">重新发布应用的商店</string>
-    <string name="sources_modified">提供修改版应用的网站</string>
     <string name="sources_other">其他地方</string>
     <string name="sources_web_page">包含文件链接的网页</string>
     <string name="sources_direct">文件的直接链接</string>
@@ -46,8 +43,6 @@
     <string name="shared_configs_title">Obtainium 用户分享的配置</string>
     <string name="shared_configs_effect">一个提供现成应用设置的网站。在设置中开启“打开 Obtainium 链接”后，其链接会在 Tern 中打开。</string>
     <string name="engine_inner_filter_nothing">压缩包内文件的过滤器与此压缩包中的任何 APK 都不匹配。</string>
-    <string name="preview_republished">%1$s 会重新提供开发者在别处发布的内容。一旦 Tern 知道开发者的证书，其文件就必须符合该证书，因此请尽可能固定一个证书，或先从开发者处安装。</string>
-    <string name="preview_modified">%1$s 提供由开发者以外的人修改过的应用。这些应用由修改者签名，Tern 无法判断修改了什么。</string>
     <string name="about_track_tern">让 Tern 自身保持最新</string>
     <string name="about_track_tern_effect">将 Tern 自己的发布添加到列表，像其他应用一样检查和验证。</string>
     <string name="engine_channel_tracked">跟踪应用的新发布</string>
diff --git a/app/src/main/res/values-zh-rCN/strings_options.xml b/app/src/main/res/values-zh-rCN/strings_options.xml
index 7264f128..139a55c0 100644
--- a/app/src/main/res/values-zh-rCN/strings_options.xml
+++ b/app/src/main/res/values-zh-rCN/strings_options.xml
@@ -60,10 +60,6 @@
     <string name="option_workflow">工作流文件</string>
     <string name="option_workflow_help">例如 build.yml。</string>
     <string name="option_branch">分支</string>
-    <string name="option_device_model">设备型号</string>
-    <string name="option_device_model_help">Galaxy Store 为每个型号提供单独的版本，例如 SM-S948B。</string>
-    <string name="option_csc">地区代码 (CSC)</string>
-    <string name="option_csc_help">三个字母，例如 DBT。</string>
     <string name="option_link_filter">下载链接过滤器</string>
     <string name="option_link_filter_help">仅匹配的链接算作下载。</string>
     <string name="option_page_order">保留页面上的顺序</string>
@@ -74,11 +70,14 @@
     <string name="version_from_text">链接文本</string>
     <string name="version_from_page">整个页面</string>
     <string name="option_headers">请求标头</string>
-    <string name="option_headers_help">每行一个，格式为 Name: value。绝不要填写密码或 Cookie。</string>
     <string name="option_pseudo">没有版本时</string>
     <string name="pseudo_default">按服务器的方式区分文件</string>
     <string name="pseudo_hash">按文件开头的哈希值</string>
     <string name="pseudo_link">按文件的地址</string>
     <string name="pseudo_etag">按服务器的 ETag</string>
     <string name="option_invalid">此内容无法直接使用。</string>
+    <string name="option_device_model">设备型号</string>
+    <string name="option_device_model_help">Galaxy Store 为每个型号提供单独的版本，例如 SM-S948B。</string>
+    <string name="option_csc">地区代码 (CSC)</string>
+    <string name="option_csc_help">三个字母，例如 DBT。</string>
 </resources>
diff --git a/app/src/main/res/values-zh-rCN/strings_safety.xml b/app/src/main/res/values-zh-rCN/strings_safety.xml
new file mode 100644
index 00000000..f2bbb9b8
--- /dev/null
+++ b/app/src/main/res/values-zh-rCN/strings_safety.xml
@@ -0,0 +1,28 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="settings_export_effect_plain">将您的列表和设置保存到文件。令牌绝不会包含在内，可能包含密钥的请求标头也不会包含在内。</string>
+    <string name="engine_checksum_github_proxy">GitHub 发布版本的摘要，由 hubproxy %1$s 传递</string>
+    <string name="github_proxy_effect_trust">每个发往 GitHub 的请求都会发送到此主机。它可以查看每个请求，并能更改返回的内容：发布版本、其摘要与文件。您现有的应用仍受其证书约束，但通过它进行的首次安装将像信任 GitHub 一样信任 hubproxy，且固定证书对其无效。令牌不会通过它发送，因此无法通过这种方式跟踪私人项目和 GitHub Actions。</string>
+    <string name="settings_unmetered_checks">仅在 Wi-Fi 下检查</string>
+    <string name="settings_unmetered_checks_effect">后台检查会等待连接 Wi-Fi 或有线网络，因此不会消耗移动数据流量。</string>
+    <string name="settings_charging_checks">仅在充电时检查</string>
+    <string name="settings_charging_checks_effect">后台检查会等待设备充电时再进行。</string>
+    <string name="settings_unmetered_installs_wait">自动安装的更新会等待连接 Wi-Fi 或有线网络，与 Obtainium 相同。</string>
+    <string name="settings_charging_installs_wait">自动安装的更新会等待设备充电时再进行。</string>
+    <string name="engine_downgrade_not_as_named">来源指定的版本号为 %2$d，但此文件为 %1$d，比已安装的版本旧。它不会覆盖较新的版本。</string>
+    <string name="settings_allow_downgrades_picked">已安装 Let Me Downgrade，因此 Android 可能会用旧版本覆盖新版本。Tern 仅在您从应用历史记录中挑选发布版本时才会执行此操作，绝不会在后台或使用“全部更新”时执行。</string>
+    <string name="option_highest_version">像 Tern 0.1.0 一样选取最高版本</string>
+    <string name="option_highest_version_effect">提供页面上版本最高的链接（无论其位置如何），并对从每个链接读取的版本运行版本模式。关闭时，将按照 Obtainium 的方式读取页面：排序后的最后一个链接即为最新。</string>
+    <string name="settings_remove_uninstalled_keeps_pins">在 Tern 之外卸载的应用也会从列表中移除。已归档的应用会保留。从同一位置再次添加时，应用仍受其原有证书约束；但在 Tern 中将其移除则会清除该记录。</string>
+    <string name="link_check_title">立即检查更新？</string>
+    <string name="link_check_one">有链接请求 Tern 检查 %1$s 的更新。将请求其来源，且不会安装任何内容。</string>
+    <plurals name="link_check_all">
+        <item quantity="other">有链接请求 Tern 检查您列表中的 %d 个应用的更新。将请求它们的来源，且不会安装任何内容。</item>
+    </plurals>
+    <string name="link_check_confirm">检查</string>
+    <string name="link_check_not_now">暂不</string>
+    <string name="engine_installer_fell_back">%1$s 未准备就绪，因此此应用使用了 Android 的安装程序。</string>
+    <string name="about_track_tern_fdroid_effect">此副本由 F-Droid 安装，因此 Tern 会跟踪其在 F-Droid 上的条目：更新为 F-Droid 构建并检查过的版本，与 F-Droid 应用获取的相同。</string>
+    <string name="about_track_tern_github">改为跟踪 GitHub 发布</string>
+    <string name="about_track_tern_github_effect">更新会在 GitHub 上发布后立即获取，在 F-Droid 构建和检查它们之前。这会跳过 F-Droid 的检查。Tern 仍会检查每个文件并使其受自己的证书约束。</string>
+</resources>
diff --git a/app/src/main/res/values-zh-rCN/strings_settings_more.xml b/app/src/main/res/values-zh-rCN/strings_settings_more.xml
index b090ea74..1b44e34d 100644
--- a/app/src/main/res/values-zh-rCN/strings_settings_more.xml
+++ b/app/src/main/res/values-zh-rCN/strings_settings_more.xml
@@ -36,9 +36,7 @@
     <string name="settings_auto_installs">自动安装更新</string>
     <string name="settings_auto_installs_effect">设为自动更新的应用会在后台检查后自行更新。关闭后，它们只会提示有可用更新，各应用会保留各自的选择供日后使用。</string>
     <string name="settings_unmetered_installs">仅在 Wi-Fi 下安装</string>
-    <string name="settings_unmetered_installs_effect">检查在任何网络下都会运行。原本会自动安装的更新将等待 Wi-Fi 或有线网络，与 Obtainium 相同。</string>
     <string name="settings_charging_installs">仅在充电时安装</string>
-    <string name="settings_charging_installs_effect">使用电池时也会运行检查。原本会自动安装的更新将等到设备正在充电时再安装。</string>
     <string name="engine_unreadable_app">无法读取已保存的应用 %1$s，因此已将其排除在列表之外。未删除任何内容：较新版本的 Tern 可能可以读取它。</string>
     <string name="settings_pin_certificates">固定代码托管平台的证书</string>
     <string name="settings_pin_certificates_effect">与 Obtainium 相同，GitHub、GitLab 和 Codeberg 必须出示由其已知所用证书颁发机构签发的证书。另一家证书颁发机构被迫签发的证书会被拒绝。如果某个代码托管平台更换了证书颁发机构，在关闭此选项之前，对它的检查都会失败。</string>
diff --git a/app/src/main/res/values-zh-rCN/strings_sources_more.xml b/app/src/main/res/values-zh-rCN/strings_sources_more.xml
index ed27f1d8..61330aa9 100644
--- a/app/src/main/res/values-zh-rCN/strings_sources_more.xml
+++ b/app/src/main/res/values-zh-rCN/strings_sources_more.xml
@@ -18,10 +18,7 @@
     <string name="step_arch">优先选择此设备的处理器</string>
     <string name="step_add">添加页面</string>
     <string name="step_remove">移除此页面</string>
-    <string name="option_file_version">使用文件名作为版本</string>
-    <string name="option_file_version_effect">这样每个文件都算作一个独立的发布。</string>
     <string name="github_proxy_title">通过 hubproxy 访问 GitHub</string>
-    <string name="github_proxy_effect">对 GitHub 的每个请求都会发送到此主机，该主机能看到每一个请求。不会通过它发送令牌，因此无法通过这种方式跟踪私有项目和 GitHub Actions。</string>
     <string name="github_proxy_host">hubproxy 主机</string>
     <string name="github_proxy_help">只填主机名，例如 gh-proxy.com。Tern 通过 HTTPS 连接它。</string>
     <string name="github_proxy_invalid">这不是 Tern 可以使用的主机名</string>
diff --git a/app/src/main/res/values-zh-rCN/strings_starters.xml b/app/src/main/res/values-zh-rCN/strings_starters.xml
new file mode 100644
index 00000000..46480c88
--- /dev/null
+++ b/app/src/main/res/values-zh-rCN/strings_starters.xml
@@ -0,0 +1,7 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="starter_in_list">在您的列表中</string>
+    <string name="starter_on_phone">在此手机上</string>
+    <string name="starter_on_phone_other">在此手机上，来自其他签名者</string>
+    <string name="starter_on_phone_other_explain">您拥有的副本使用了不同的密钥签名，因此 Tern 无法从此地址更新它。</string>
+</resources>
diff --git a/app/src/main/res/values-zh-rCN/strings_stores.xml b/app/src/main/res/values-zh-rCN/strings_stores.xml
new file mode 100644
index 00000000..4254ac6b
--- /dev/null
+++ b/app/src/main/res/values-zh-rCN/strings_stores.xml
@@ -0,0 +1,27 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="option_headers_help_own_agent">每行一个，格式为 名称: 值。切勿填写密码、Cookie 或 User-Agent：Tern 会告诉每个网站它是 Tern。</string>
+    <string name="origin_republished_first">%1$s 再次提供开发者在别处发布的内容，而它本身不是开发者。在该应用固定证书之前，Tern 从此处安装的第一个文件将决定其后每次更新必须携带的证书。</string>
+    <string name="origin_republished_pinned">%1$s 再次提供开发者在别处发布的内容，而它本身不是开发者。其文件必须携带此应用所固定的证书。</string>
+    <string name="origin_store_first">%1$s 是一个商店，不是开发者自己的网站。在该应用固定证书之前，Tern 从此处安装的第一个文件将决定其后每次更新必须携带的证书。</string>
+    <string name="origin_store_pinned">%1$s 是一个商店，不是开发者自己的网站。其文件必须携带此应用所固定的证书。</string>
+    <string name="stores_refused_modified">Tern 不会读取提供修改版应用的网站。这些文件被开发者以外的人修改过，并由修改者签名。</string>
+    <string name="stores_refused_impersonation">Tern 必须伪装成该商店的应用才能读取它，因此 Tern 不会读取它。</string>
+    <string name="stores_checksum_source">%1$s，并非开发者</string>
+    <string name="stores_off_title">%1$s 是第三方商店</string>
+    <string name="stores_off_body">第三方商店已关闭。商店提供其自己的应用副本，而不是开发者自己网站上的文件，而且 Tern 是通过该商店为其自有应用或网站制作的接口来读取它的。打开它们后，Tern 仅会向商店请求您从中添加的应用，并且在该应用固定证书之前，Tern 从商店安装的第一个文件将决定其更新必须携带的证书。</string>
+    <string name="stores_turn_on">打开第三方商店</string>
+    <string name="stores_advice">在设置中打开第三方商店以再次检查此应用。</string>
+    <string name="stores_status_paused">已暂停</string>
+    <string name="stores_row_paused">第三方商店已关闭</string>
+    <string name="stores_setting">第三方商店</string>
+    <string name="stores_setting_effect">APKPure、Aptoide、APKCombo、APKMirror、Tencent、Huawei AppGallery、Galaxy Store 和 vivo。它们提供其自己的应用副本，而不是开发者自己网站上的文件，而且 Tern 是通过它们为其自有应用或网站制作的接口来读取它们的。关闭时，Tern 不会向它们发出任何请求，搜索时会排除它们，并且来自它们的应用将被暂停。</string>
+    <string name="stores_off_tag">在设置中已关闭</string>
+    <string name="stores_checksum_matched">文件与商店的校验和相符</string>
+    <string name="stores_explain_checksum_matched">校验和是文件本身的指纹。商店提供了一个校验和，而 Tern 下载的文件拥有相同的校验和，因此它与商店中的文件完全一致。商店并非开发者，因此这无法说明该文件是谁制作的，只有证书可以。</string>
+    <string name="stores_import_from_stores">这些应用来自第三方商店，它们提供其自己复制的应用。在该应用固定证书之前，Tern 从商店安装的第一个文件将决定其更新必须携带的证书。</string>
+    <string name="stores_import_paused">第三方商店已关闭，因此这些应用被暂停。在您打开它们之前，Tern 不会向这些商店发出任何请求。</string>
+    <string name="stores_import_names">来自第三方商店</string>
+    <string name="share_obtainium_link">分享为 Obtainium 链接</string>
+    <string name="share_obtainium_links">分享为 Obtainium 链接</string>
+</resources>
diff --git a/app/src/main/res/values-zh-rCN/strings_tv.xml b/app/src/main/res/values-zh-rCN/strings_tv.xml
new file mode 100644
index 00000000..73517d27
--- /dev/null
+++ b/app/src/main/res/values-zh-rCN/strings_tv.xml
@@ -0,0 +1,5 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="interval_turn_off">关闭后台检查</string>
+    <string name="interval_turn_on">打开后台检查</string>
+</resources>
diff --git a/app/src/main/res/values-zh-rTW/strings.xml b/app/src/main/res/values-zh-rTW/strings.xml
index 828a14cd..4b8f0935 100644
--- a/app/src/main/res/values-zh-rTW/strings.xml
+++ b/app/src/main/res/values-zh-rTW/strings.xml
@@ -354,7 +354,6 @@
     <string name="settings_import_effect">從 Tern 或 Obtainium 的匯出檔</string>
     <string name="settings_export">匯出應用程式</string>
     <string name="settings_exporting">正在匯出</string>
-    <string name="settings_export_effect">將您的清單與設定儲存至檔案。絕不會包含權杖。</string>
     <plurals name="exported">
         <item quantity="other">已匯出 %d 個應用程式</item>
     </plurals>
diff --git a/app/src/main/res/values-zh-rTW/strings_accept.xml b/app/src/main/res/values-zh-rTW/strings_accept.xml
new file mode 100644
index 00000000..bc60d588
--- /dev/null
+++ b/app/src/main/res/values-zh-rTW/strings_accept.xml
@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="stores_paused_reason">第三方商店已關閉，因此 Tern 不會向此商店查詢任何資訊。在「設定」中將其開啟以再次檢查。</string>
+</resources>
diff --git a/app/src/main/res/values-zh-rTW/strings_checks.xml b/app/src/main/res/values-zh-rTW/strings_checks.xml
index e85652c8..1521cac9 100644
--- a/app/src/main/res/values-zh-rTW/strings_checks.xml
+++ b/app/src/main/res/values-zh-rTW/strings_checks.xml
@@ -15,13 +15,11 @@
     <string name="settings_only_installed">只檢查已安裝的應用程式</string>
     <string name="settings_only_installed_effect">僅追蹤的應用程式也會檢查。您開啟的應用程式一律會檢查。</string>
     <string name="settings_remove_uninstalled">移除在其他地方解除安裝的應用程式</string>
-    <string name="settings_remove_uninstalled_effect">在 Tern 以外解除安裝的應用程式也會從清單中移除。</string>
     <string name="settings_file_filter">檔案篩選器</string>
     <string name="settings_file_filter_effect">所有沒有自己篩選器的應用程式用來挑選檔案的模式。</string>
     <string name="settings_file_filter_none">無</string>
     <string name="settings_file_filter_invalid">無法讀取這個模式。</string>
     <string name="settings_allow_downgrades">允許較舊的版本</string>
-    <string name="settings_allow_downgrades_effect">已安裝 Let Me Downgrade，因此 Android 可以用較舊的版本覆蓋較新的版本。</string>
     <string name="settings_collapse_groups">群組預設為摺疊</string>
     <string name="settings_haptics">觸覺回饋</string>
     <string name="settings_haptics_effect">滑動或長按觸發動作時輕微震動。</string>
@@ -36,7 +34,6 @@
     <string name="sources_repositories">軟體庫</string>
     <string name="sources_stores">商店</string>
     <string name="sources_mirrors">重新發佈應用程式的商店</string>
-    <string name="sources_modified">提供修改版應用程式的網站</string>
     <string name="sources_other">其他地方</string>
     <string name="sources_web_page">含有檔案連結的網頁</string>
     <string name="sources_direct">檔案的直接連結</string>
@@ -46,8 +43,6 @@
     <string name="shared_configs_title">Obtainium 使用者分享的設定</string>
     <string name="shared_configs_effect">提供現成應用程式設定的網站。在「設定」中開啟「開啟 Obtainium 連結」時，其連結會在 Tern 中開啟。</string>
     <string name="engine_inner_filter_nothing">壓縮檔內檔案的篩選器不符合此壓縮檔中的任何 APK。</string>
-    <string name="preview_republished">%1$s 會重新提供開發者在其他地方發佈的內容。一旦 Tern 知道開發者的憑證，其檔案就必須符合該憑證，因此請盡可能釘選一個憑證，或先從開發者那裡安裝。</string>
-    <string name="preview_modified">%1$s 提供由開發者以外的人修改過的應用程式。這些應用程式由修改者簽署，Tern 無法得知修改了什麼。</string>
     <string name="about_track_tern">讓 Tern 本身保持最新</string>
     <string name="about_track_tern_effect">將 Tern 自己的發行版本加入清單，並像其他應用程式一樣檢查與驗證。</string>
     <string name="engine_channel_tracked">追蹤中應用程式的新發行版本</string>
diff --git a/app/src/main/res/values-zh-rTW/strings_options.xml b/app/src/main/res/values-zh-rTW/strings_options.xml
index bf09f482..cef5323f 100644
--- a/app/src/main/res/values-zh-rTW/strings_options.xml
+++ b/app/src/main/res/values-zh-rTW/strings_options.xml
@@ -60,10 +60,6 @@
     <string name="option_workflow">工作流程檔案</string>
     <string name="option_workflow_help">例如 build.yml。</string>
     <string name="option_branch">分支</string>
-    <string name="option_device_model">裝置型號</string>
-    <string name="option_device_model_help">Galaxy Store 會為每個型號提供各自的版本，例如 SM-S948B。</string>
-    <string name="option_csc">地區代碼 (CSC)</string>
-    <string name="option_csc_help">三個字母，例如 DBT。</string>
     <string name="option_link_filter">下載連結篩選器</string>
     <string name="option_link_filter_help">只有符合的連結才算是下載連結。</string>
     <string name="option_page_order">保留頁面的順序</string>
@@ -74,11 +70,14 @@
     <string name="version_from_text">連結文字</string>
     <string name="version_from_page">整個頁面</string>
     <string name="option_headers">要求標頭</string>
-    <string name="option_headers_help">每行一個，格式為 Name: value。絕不要填入密碼或 Cookie。</string>
     <string name="option_pseudo">沒有版本時</string>
     <string name="pseudo_default">依伺服器的方式區分檔案</string>
     <string name="pseudo_hash">依檔案開頭的雜湊值</string>
     <string name="pseudo_link">依檔案的網址</string>
     <string name="pseudo_etag">依伺服器的 ETag</string>
     <string name="option_invalid">這無法直接使用。</string>
+    <string name="option_device_model">裝置型號</string>
+    <string name="option_device_model_help">Galaxy Store 會為每個型號提供各自的版本，例如 SM-S948B。</string>
+    <string name="option_csc">地區代碼 (CSC)</string>
+    <string name="option_csc_help">三個字母，例如 DBT。</string>
 </resources>
diff --git a/app/src/main/res/values-zh-rTW/strings_safety.xml b/app/src/main/res/values-zh-rTW/strings_safety.xml
new file mode 100644
index 00000000..20da366b
--- /dev/null
+++ b/app/src/main/res/values-zh-rTW/strings_safety.xml
@@ -0,0 +1,28 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="settings_export_effect_plain">將您的清單和設定儲存到檔案中。權杖絕對不會包含在內，可能包含金鑰的請求標頭也不會。</string>
+    <string name="engine_checksum_github_proxy">GitHub 發行版本摘要，由 hubproxy %1$s 所傳遞</string>
+    <string name="github_proxy_effect_trust">每個前往 GitHub 的請求都會傳送至此主機。它會看到每個請求，並可能更改傳回的內容：發行版本、其摘要與檔案。您擁有的應用程式會保留其憑證限制，但透過它進行的首次安裝會信任 hubproxy 就像信任 GitHub 一樣，且憑證釘選無法觸及它。不會有權杖透過它傳送，因此無法以這種方式追蹤私人專案與 GitHub Actions。</string>
+    <string name="settings_unmetered_checks">僅在 Wi-Fi 下檢查</string>
+    <string name="settings_unmetered_checks_effect">背景檢查會等待 Wi-Fi 或有線網路連線，因此不會使用行動數據。</string>
+    <string name="settings_charging_checks">僅在充電時檢查</string>
+    <string name="settings_charging_checks_effect">背景檢查會等到裝置充電時才進行。</string>
+    <string name="settings_unmetered_installs_wait">將會自行安裝的更新會等待 Wi-Fi 或有線網路連線，與 Obtainium 一樣。</string>
+    <string name="settings_charging_installs_wait">將會自行安裝的更新會等到裝置充電時才進行。</string>
+    <string name="engine_downgrade_not_as_named">來源標示的版本代碼為 %2$d，但此檔案為 %1$d，比已安裝的版本舊。它不會覆寫較新的版本。</string>
+    <string name="settings_allow_downgrades_picked">已經安裝 Let Me Downgrade，因此 Android 可能會將較舊的版本覆寫到較新的版本上。Tern 僅針對您從應用程式歷史紀錄中挑選的發行版本執行此操作，絕不會在背景中或使用「全部更新」時執行。</string>
+    <string name="option_highest_version">採用最高版本，如 Tern 0.1.0 的做法</string>
+    <string name="option_highest_version_effect">提供頁面上版本最高的連結，無論其位置為何，並對從每個連結讀取的版本執行版本模式比對。關閉時會以 Obtainium 的方式讀取頁面：排序後的最後一個連結就是最新版本。</string>
+    <string name="settings_remove_uninstalled_keeps_pins">您在 Tern 之外解除安裝的應用程式也會從清單中移除。已封存的應用程式則會保留。從相同位置再次新增時，應用程式會受到其原有憑證的限制；在 Tern 中將其移除則會忘記該憑證。</string>
+    <string name="link_check_title">現在檢查更新？</string>
+    <string name="link_check_one">一個連結要求 Tern 檢查 %1$s 的更新。會向其來源提出要求，且不會安裝任何東西。</string>
+    <plurals name="link_check_all">
+        <item quantity="other">一個連結要求 Tern 檢查您清單中的 %d 個應用程式是否有更新。會向它們的來源提出要求，且不會安裝任何東西。</item>
+    </plurals>
+    <string name="link_check_confirm">檢查</string>
+    <string name="link_check_not_now">暫不</string>
+    <string name="engine_installer_fell_back">%1$s 尚未準備就緒，因此這次使用了 Android 的安裝程式。</string>
+    <string name="about_track_tern_fdroid_effect">F-Droid 安裝了這個副本，所以 Tern 會追蹤它在那裡的項目：更新是由 F-Droid 建置並檢查的版本，就像 F-Droid 應用程式取得它們一樣。</string>
+    <string name="about_track_tern_github">改為追蹤 GitHub 發行版本</string>
+    <string name="about_track_tern_github_effect">更新在發佈後會立即從 GitHub 取得，早於 F-Droid 建置並檢查它們之前。這會跳過 F-Droid 的檢查。Tern 仍然會檢查每個檔案，並限制它必須帶有其專屬的憑證。</string>
+</resources>
diff --git a/app/src/main/res/values-zh-rTW/strings_settings_more.xml b/app/src/main/res/values-zh-rTW/strings_settings_more.xml
index 5a8eca1e..1d3a77c5 100644
--- a/app/src/main/res/values-zh-rTW/strings_settings_more.xml
+++ b/app/src/main/res/values-zh-rTW/strings_settings_more.xml
@@ -36,9 +36,7 @@
     <string name="settings_auto_installs">自行安裝更新</string>
     <string name="settings_auto_installs_effect">設為自動更新的應用程式會在背景檢查後自行更新。關閉後，它們只會提示有更新，各應用程式會保留各自的選擇供日後使用。</string>
     <string name="settings_unmetered_installs">僅在 Wi-Fi 下安裝</string>
-    <string name="settings_unmetered_installs_effect">在任何網路下都會進行檢查。原本會自動安裝的更新將等待 Wi-Fi 或有線網路，與 Obtainium 相同。</string>
     <string name="settings_charging_installs">僅在充電時安裝</string>
-    <string name="settings_charging_installs_effect">使用電池時同樣會進行檢查。原本會自動安裝的更新會等到裝置正在充電時才安裝。</string>
     <string name="engine_unreadable_app">無法讀取已儲存的應用程式 %1$s，因此已將其排除在清單之外。並未刪除任何內容：較新版本的 Tern 可能可以讀取它。</string>
     <string name="settings_pin_certificates">釘選程式碼託管平台的憑證</string>
     <string name="settings_pin_certificates_effect">與 Obtainium 相同，GitHub、GitLab 和 Codeberg 必須出示由其已知所用憑證機構簽發的憑證。其他憑證機構被迫簽發的憑證會被拒絕。如果某個程式碼託管平台更換了憑證機構，在關閉此選項之前，對它的檢查都會失敗。</string>
diff --git a/app/src/main/res/values-zh-rTW/strings_sources_more.xml b/app/src/main/res/values-zh-rTW/strings_sources_more.xml
index 654a000b..8a7ffbe6 100644
--- a/app/src/main/res/values-zh-rTW/strings_sources_more.xml
+++ b/app/src/main/res/values-zh-rTW/strings_sources_more.xml
@@ -18,10 +18,7 @@
     <string name="step_arch">優先使用此裝置的處理器</string>
     <string name="step_add">新增頁面</string>
     <string name="step_remove">移除此頁面</string>
-    <string name="option_file_version">使用檔案名稱作為版本</string>
-    <string name="option_file_version_effect">這樣每個檔案都會視為獨立的發行版本。</string>
     <string name="github_proxy_title">透過 hubproxy 存取 GitHub</string>
-    <string name="github_proxy_effect">每個對 GitHub 的請求都會送到此主機，該主機看得到每一個請求。權杖不會透過它傳送，因此無法用這種方式追蹤私有專案和 GitHub Actions。</string>
     <string name="github_proxy_host">hubproxy 主機</string>
     <string name="github_proxy_help">只填主機名稱，例如 gh-proxy.com。Tern 會透過 HTTPS 連線。</string>
     <string name="github_proxy_invalid">這不是 Tern 可以使用的主機名稱</string>
diff --git a/app/src/main/res/values-zh-rTW/strings_starters.xml b/app/src/main/res/values-zh-rTW/strings_starters.xml
new file mode 100644
index 00000000..53e60d99
--- /dev/null
+++ b/app/src/main/res/values-zh-rTW/strings_starters.xml
@@ -0,0 +1,7 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="starter_in_list">在您的清單中</string>
+    <string name="starter_on_phone">在此手機上</string>
+    <string name="starter_on_phone_other">在此手機上，但來自另一個簽署者</string>
+    <string name="starter_on_phone_other_explain">您擁有的副本是使用不同的金鑰簽署，因此 Tern 無法從這個網址更新它。</string>
+</resources>
diff --git a/app/src/main/res/values-zh-rTW/strings_stores.xml b/app/src/main/res/values-zh-rTW/strings_stores.xml
new file mode 100644
index 00000000..464314e3
--- /dev/null
+++ b/app/src/main/res/values-zh-rTW/strings_stores.xml
@@ -0,0 +1,27 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="option_headers_help_own_agent">每行一個，格式為 Name: value。絕不可包含密碼、cookie 或 User-Agent：Tern 會向每個網站表明它是 Tern。</string>
+    <string name="origin_republished_first">%1$s 再次提供開發者在其他地方發佈的內容，且它並非開發者。在應用程式釘選到憑證之前，Tern 從它安裝的第一個檔案將決定之後每個更新必須帶有哪個憑證。</string>
+    <string name="origin_republished_pinned">%1$s 再次提供開發者在其他地方發佈的內容，且它並非開發者。它的檔案必須帶有釘選於此應用程式的憑證。</string>
+    <string name="origin_store_first">%1$s 是一家商店，不是開發者自己的網站。在應用程式釘選到憑證之前，Tern 從它安裝的第一個檔案將決定之後每個更新必須帶有哪個憑證。</string>
+    <string name="origin_store_pinned">%1$s 是一家商店，不是開發者自己的網站。它的檔案必須帶有釘選於此應用程式的憑證。</string>
+    <string name="stores_refused_modified">Tern 不會讀取提供經過修改之應用程式的網站。它們的檔案是由開發者以外的人所變更，並由變更者簽署。</string>
+    <string name="stores_refused_impersonation">Tern 必須偽裝成該商店的應用程式才能讀取此商店，因此 Tern 不會讀取它。</string>
+    <string name="stores_checksum_source">%1$s，它不是開發者</string>
+    <string name="stores_off_title">%1$s 是第三方商店</string>
+    <string name="stores_off_body">第三方商店已關閉。商店提供他們自己的應用程式副本，而非來自開發者自己網站的檔案，而 Tern 透過該商店為其自身應用程式或網站製作的介面來讀取它。開啟後，Tern 只會向商店請求您從該處新增的應用程式，且在應用程式釘選到憑證之前，Tern 從商店安裝的第一個檔案將決定其更新必須帶有哪個憑證。</string>
+    <string name="stores_turn_on">開啟第三方商店</string>
+    <string name="stores_advice">請在設定中開啟第三方商店，以再次檢查此應用程式。</string>
+    <string name="stores_status_paused">已暫停</string>
+    <string name="stores_row_paused">第三方商店已關閉</string>
+    <string name="stores_setting">第三方商店</string>
+    <string name="stores_setting_effect">APKPure、Aptoide、APKCombo、APKMirror、Tencent、Huawei AppGallery、Galaxy Store 和 vivo。它們提供自己的應用程式副本，而非來自開發者自己網站的檔案，而 Tern 透過它們為其自身應用程式和網站製作的介面來讀取它們。關閉時，Tern 不會向它們提出任何要求，搜尋會略過它們，且來自它們的應用程式會被暫停。</string>
+    <string name="stores_off_tag">已在設定中關閉</string>
+    <string name="stores_checksum_matched">檔案符合商店的檢查碼</string>
+    <string name="stores_explain_checksum_matched">檢查碼是檔案本身的指紋。商店提供了一個，而 Tern 下載的檔案與其相同，因此它和商店擁有的檔案一樣。商店不是開發者，所以這無法說明是誰製作了這個檔案。憑證才可以。</string>
+    <string name="stores_import_from_stores">這些來自第三方商店，它們提供自己的應用程式副本。在應用程式釘選到憑證之前，Tern 從其商店安裝的第一個檔案將決定其更新必須帶有哪個憑證。</string>
+    <string name="stores_import_paused">第三方商店已關閉，因此這些應用程式已暫停。在您開啟它們之前，Tern 不會向這些商店提出任何要求。</string>
+    <string name="stores_import_names">來自第三方商店</string>
+    <string name="share_obtainium_link">分享為 Obtainium 連結</string>
+    <string name="share_obtainium_links">分享為 Obtainium 連結</string>
+</resources>
diff --git a/app/src/main/res/values-zh-rTW/strings_tv.xml b/app/src/main/res/values-zh-rTW/strings_tv.xml
new file mode 100644
index 00000000..cb04b0d0
--- /dev/null
+++ b/app/src/main/res/values-zh-rTW/strings_tv.xml
@@ -0,0 +1,5 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="interval_turn_off">關閉背景檢查</string>
+    <string name="interval_turn_on">開啟背景檢查</string>
+</resources>
diff --git a/app/src/main/res/values/strings.xml b/app/src/main/res/values/strings.xml
index 988c6365..013e5085 100644
--- a/app/src/main/res/values/strings.xml
+++ b/app/src/main/res/values/strings.xml
@@ -432,7 +432,6 @@
     <string name="settings_import_effect">From a Tern or Obtainium export</string>
     <string name="settings_export">Export apps</string>
     <string name="settings_exporting">Exporting</string>
-    <string name="settings_export_effect">Saves your list and settings to a file. Tokens are never included.</string>
     <plurals name="exported">
         <item quantity="one">Exported %d app</item>
         <item quantity="other">Exported %d apps</item>
diff --git a/app/src/main/res/values/strings_accept.xml b/app/src/main/res/values/strings_accept.xml
new file mode 100644
index 00000000..a45fa106
--- /dev/null
+++ b/app/src/main/res/values/strings_accept.xml
@@ -0,0 +1,5 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <!-- Why an app of a third-party store is not checked. Shown after the status "Paused", so it does not say paused again. -->
+    <string name="stores_paused_reason">Third-party stores are off, so Tern asks this store nothing. Turn them on in Settings to check it again.</string>
+</resources>
diff --git a/app/src/main/res/values/strings_checks.xml b/app/src/main/res/values/strings_checks.xml
index eaed913e..264270cd 100644
--- a/app/src/main/res/values/strings_checks.xml
+++ b/app/src/main/res/values/strings_checks.xml
@@ -17,13 +17,11 @@
     <string name="settings_only_installed">Only check installed apps</string>
     <string name="settings_only_installed_effect">Apps that are only tracked are checked too. An app you open is always checked.</string>
     <string name="settings_remove_uninstalled">Remove apps uninstalled elsewhere</string>
-    <string name="settings_remove_uninstalled_effect">An app you uninstall outside Tern leaves the list as well.</string>
     <string name="settings_file_filter">Filter for files</string>
     <string name="settings_file_filter_effect">A pattern every app without a filter of its own picks its file by.</string>
     <string name="settings_file_filter_none">None</string>
     <string name="settings_file_filter_invalid">This pattern cannot be read.</string>
     <string name="settings_allow_downgrades">Allow older versions</string>
-    <string name="settings_allow_downgrades_effect">Let Me Downgrade is installed, so Android may put an older version over a newer one.</string>
     <string name="settings_collapse_groups">Start with groups folded</string>
     <string name="settings_haptics">Haptic feedback</string>
     <string name="settings_haptics_effect">A light tap when a swipe or a long press does something.</string>
@@ -38,7 +36,6 @@
     <string name="sources_repositories">Repositories</string>
     <string name="sources_stores">Stores</string>
     <string name="sources_mirrors">Stores that republish apps</string>
-    <string name="sources_modified">Sites with changed apps</string>
     <string name="sources_other">Other places</string>
     <string name="sources_web_page">A web page with links to files</string>
     <string name="sources_direct">A direct link to a file</string>
@@ -48,8 +45,6 @@
     <string name="shared_configs_title">Configurations shared by Obtainium\'s users</string>
     <string name="shared_configs_effect">A site of ready-made settings for apps. Its links open in Tern when Open Obtainium links is on in Settings.</string>
     <string name="engine_inner_filter_nothing">The filter for files inside archives matches none of the APKs in this one.</string>
-    <string name="preview_republished">%1$s offers again what developers publish elsewhere. Its files are held to the developer\'s certificate once Tern knows it, so pin one or install from the developer first when you can.</string>
-    <string name="preview_modified">%1$s offers apps changed by someone other than their developer. They are signed by whoever changed them, and Tern cannot tell what was changed.</string>
     <string name="about_track_tern">Keep Tern itself up to date</string>
     <string name="about_track_tern_effect">Adds Tern\'s own releases to the list, checked and verified like any app.</string>
     <string name="engine_channel_tracked">New releases of tracked apps</string>
diff --git a/app/src/main/res/values/strings_options.xml b/app/src/main/res/values/strings_options.xml
index 5b8d665c..07a3dbbf 100644
--- a/app/src/main/res/values/strings_options.xml
+++ b/app/src/main/res/values/strings_options.xml
@@ -62,10 +62,6 @@
     <string name="option_workflow">Workflow file</string>
     <string name="option_workflow_help">Such as build.yml.</string>
     <string name="option_branch">Branch</string>
-    <string name="option_device_model">Device model</string>
-    <string name="option_device_model_help">The Galaxy Store gives each model its own build, such as SM-S948B.</string>
-    <string name="option_csc">Region code (CSC)</string>
-    <string name="option_csc_help">Three letters, such as DBT.</string>
     <string name="option_link_filter">Filter for download links</string>
     <string name="option_link_filter_help">Only links that match count as downloads.</string>
     <string name="option_page_order">Keep the order of the page</string>
@@ -76,11 +72,14 @@
     <string name="version_from_text">The link\'s text</string>
     <string name="version_from_page">The whole page</string>
     <string name="option_headers">Request headers</string>
-    <string name="option_headers_help">One a line, as Name: value. Never a password or a cookie.</string>
     <string name="option_pseudo">When there is no version</string>
     <string name="pseudo_default">Tell files apart as the server does</string>
     <string name="pseudo_hash">By a hash of the file\'s start</string>
     <string name="pseudo_link">By the address of the file</string>
     <string name="pseudo_etag">By the server\'s ETag</string>
     <string name="option_invalid">This cannot be used as it is.</string>
+    <string name="option_device_model">Device model</string>
+    <string name="option_device_model_help">The Galaxy Store gives each model its own build, such as SM-S948B.</string>
+    <string name="option_csc">Region code (CSC)</string>
+    <string name="option_csc_help">Three letters, such as DBT.</string>
 </resources>
diff --git a/app/src/main/res/values/strings_safety.xml b/app/src/main/res/values/strings_safety.xml
new file mode 100644
index 00000000..b7b7b32b
--- /dev/null
+++ b/app/src/main/res/values/strings_safety.xml
@@ -0,0 +1,29 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="settings_export_effect_plain">Saves your list and settings to a file. Tokens never go in, and neither does a request header that could hold a key.</string>
+    <string name="engine_checksum_github_proxy">GitHub release digest, as the hubproxy %1$s passed it on</string>
+    <string name="github_proxy_effect_trust">Every request to GitHub goes to this host. It sees each one and can change what comes back: the releases, their digests and the files. Apps you have stay held to their certificate, but a first install through it trusts the hubproxy as much as GitHub, and certificate pinning does not reach it. No token is sent through it, so private projects and GitHub Actions cannot be followed this way.</string>
+    <string name="settings_unmetered_checks">Check only on Wi-Fi</string>
+    <string name="settings_unmetered_checks_effect">Background checks wait for Wi-Fi or a cable, so they use no mobile data.</string>
+    <string name="settings_charging_checks">Check only while charging</string>
+    <string name="settings_charging_checks_effect">Background checks wait until the device is charging.</string>
+    <string name="settings_unmetered_installs_wait">An update that would install by itself waits for Wi-Fi or a cable, as in Obtainium.</string>
+    <string name="settings_charging_installs_wait">An update that would install by itself waits until the device is charging.</string>
+    <string name="engine_downgrade_not_as_named">The source named version code %2$d, but this file is %1$d, older than the one installed. It is not put over the newer one.</string>
+    <string name="settings_allow_downgrades_picked">Let Me Downgrade is installed, so Android may put an older version over a newer one. Tern does it only for a release you pick from an app\'s history, never in the background or with Update all.</string>
+    <string name="option_highest_version">Take the highest version, as Tern 0.1.0 did</string>
+    <string name="option_highest_version_effect">Offers the link with the highest version on the page, whatever its place, and runs the version pattern over the version read from each link. Off reads the page the way Obtainium does: the last link in order is the latest.</string>
+    <string name="settings_remove_uninstalled_keeps_pins">An app you uninstall outside Tern leaves the list as well. An archived app stays. Added again from the same place, an app is held to the certificate it had; removing it in Tern forgets that.</string>
+    <string name="link_check_title">Check for updates now?</string>
+    <string name="link_check_one">A link asked Tern to check %1$s for updates. Its source is asked, and nothing is installed.</string>
+    <plurals name="link_check_all">
+        <item quantity="one">A link asked Tern to check the app in your list for updates. Its source is asked, and nothing is installed.</item>
+        <item quantity="other">A link asked Tern to check the %d apps in your list for updates. Their sources are asked, and nothing is installed.</item>
+    </plurals>
+    <string name="link_check_confirm">Check</string>
+    <string name="link_check_not_now">Not now</string>
+    <string name="engine_installer_fell_back">%1$s was not ready, so Android\'s installer was used for this one.</string>
+    <string name="about_track_tern_fdroid_effect">F-Droid installed this copy, so Tern follows its entry there: updates are the builds F-Droid made and checked, as the F-Droid app gets them.</string>
+    <string name="about_track_tern_github">Follow GitHub releases instead</string>
+    <string name="about_track_tern_github_effect">Updates come from GitHub as soon as they are published, before F-Droid has built and checked them. This skips F-Droid\'s checks. Tern still checks each file and holds it to its own certificate.</string>
+</resources>
diff --git a/app/src/main/res/values/strings_settings_more.xml b/app/src/main/res/values/strings_settings_more.xml
index a89ae011..d42e7aac 100644
--- a/app/src/main/res/values/strings_settings_more.xml
+++ b/app/src/main/res/values/strings_settings_more.xml
@@ -37,9 +37,7 @@
     <string name="settings_auto_installs">Updates install by themselves</string>
     <string name="settings_auto_installs_effect">Apps set to update by themselves do so after a background check. Off, they only say an update is there, and each keeps its own choice for later.</string>
     <string name="settings_unmetered_installs">Install only on Wi-Fi</string>
-    <string name="settings_unmetered_installs_effect">Checks run on any network. An update that would install by itself waits for Wi-Fi or a cable, as in Obtainium.</string>
     <string name="settings_charging_installs">Install only while charging</string>
-    <string name="settings_charging_installs_effect">Checks run on battery too. An update that would install by itself waits until the device is charging.</string>
     <string name="engine_unreadable_app">The saved app %1$s could not be read, so it is left out of the list. Nothing was deleted: a newer version of Tern may read it.</string>
     <string name="settings_pin_certificates">Pin the certificates of the forges</string>
     <string name="settings_pin_certificates_effect">GitHub, GitLab and Codeberg must show a certificate from the authority each is known to use, as in Obtainium. A certificate another authority was made to issue is then refused. If a forge changes its authority, checks there fail until this is off.</string>
diff --git a/app/src/main/res/values/strings_sources_more.xml b/app/src/main/res/values/strings_sources_more.xml
index 9f7da266..e7c777de 100644
--- a/app/src/main/res/values/strings_sources_more.xml
+++ b/app/src/main/res/values/strings_sources_more.xml
@@ -18,10 +18,7 @@
     <string name="step_arch">Prefer this device\'s processor</string>
     <string name="step_add">Add a page</string>
     <string name="step_remove">Remove this page</string>
-    <string name="option_file_version">Use the file name as the version</string>
-    <string name="option_file_version_effect">Each file then counts as a release of its own.</string>
     <string name="github_proxy_title">GitHub through a hubproxy</string>
-    <string name="github_proxy_effect">Every request to GitHub goes to this host, which sees each one. No token is sent through it, so private projects and GitHub Actions cannot be followed this way.</string>
     <string name="github_proxy_host">Hubproxy host</string>
     <string name="github_proxy_help">A host name alone, such as gh-proxy.com. Tern reaches it over HTTPS.</string>
     <string name="github_proxy_invalid">That is not a host name Tern can use</string>
diff --git a/app/src/main/res/values/strings_starters.xml b/app/src/main/res/values/strings_starters.xml
new file mode 100644
index 00000000..b03145ed
--- /dev/null
+++ b/app/src/main/res/values/strings_starters.xml
@@ -0,0 +1,7 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="starter_in_list">In your list</string>
+    <string name="starter_on_phone">On this phone</string>
+    <string name="starter_on_phone_other">On this phone from another signer</string>
+    <string name="starter_on_phone_other_explain">The copy you have is signed with a different key, so Tern cannot update it from this address.</string>
+</resources>
diff --git a/app/src/main/res/values/strings_stores.xml b/app/src/main/res/values/strings_stores.xml
new file mode 100644
index 00000000..3fe43ae3
--- /dev/null
+++ b/app/src/main/res/values/strings_stores.xml
@@ -0,0 +1,35 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="option_headers_help_own_agent">One a line, as Name: value. Never a password, a cookie or a User-Agent: Tern tells every site that it is Tern.</string>
+    <!-- %1$s is a store, such as APKPure. Shown on the Add preview, an app's page and after an import. -->
+    <string name="origin_republished_first">%1$s offers again what developers publish elsewhere, and is not the developer. Until the app is pinned to a certificate, the first file Tern installs from it decides which certificate every later update must carry.</string>
+    <!-- %1$s is a store, such as APKPure. -->
+    <string name="origin_republished_pinned">%1$s offers again what developers publish elsewhere, and is not the developer. Its files must carry the certificate this app is held to.</string>
+    <!-- %1$s is a store, such as Galaxy Store. -->
+    <string name="origin_store_first">%1$s is a store, not the developer\'s own site. Until the app is pinned to a certificate, the first file Tern installs from it decides which certificate every later update must carry.</string>
+    <!-- %1$s is a store, such as Galaxy Store. -->
+    <string name="origin_store_pinned">%1$s is a store, not the developer\'s own site. Its files must carry the certificate this app is held to.</string>
+    <string name="stores_refused_modified">Tern does not read sites that offer modified apps. Their files are changed by someone other than the developer and signed by whoever changed them.</string>
+    <string name="stores_refused_impersonation">Tern cannot read this store without pretending to be its app, so it does not read it.</string>
+    <!-- %1$s is a store, such as APKPure. Said of a checksum, after "From:". -->
+    <string name="stores_checksum_source">%1$s, which is not the developer</string>
+    <!-- %1$s is a store, such as APKPure. -->
+    <string name="stores_off_title">%1$s is a third-party store</string>
+    <string name="stores_off_body">Third-party stores are off. A store serves its own copies of apps, not files from the developer\'s own site, and Tern reads it through the interface the store made for its own app or website. With them on, Tern asks a store only for the apps you add from it, and until an app is pinned to a certificate, the first file Tern installs from a store decides which certificate its updates must carry.</string>
+    <string name="stores_turn_on">Turn on third-party stores</string>
+    <string name="stores_advice">Turn on Third-party stores in Settings to check this app again.</string>
+    <string name="stores_status_paused">Paused</string>
+    <string name="stores_row_paused">Third-party stores are off</string>
+    <string name="stores_setting">Third-party stores</string>
+    <string name="stores_setting_effect">APKPure, Aptoide, APKCombo, APKMirror, Tencent, Huawei AppGallery, the Galaxy Store and vivo. They serve their own copies of apps, not files from the developer\'s own site, and Tern reads them through the interfaces they made for their own apps and websites. Off, Tern asks none of them anything, a search leaves them out and apps from them are paused.</string>
+    <!-- Put after a store's name in the list of sources, next to "search" and "track only", while third-party stores are off. -->
+    <string name="stores_off_tag">off in Settings</string>
+    <string name="stores_checksum_matched">The file matches the store\'s checksum</string>
+    <string name="stores_explain_checksum_matched">A checksum is a fingerprint of the file itself. The store gave one, and the file Tern downloaded has the same, so it arrived as the store has it. The store is not the developer, so this says nothing about who made the file. The certificate does.</string>
+    <string name="stores_import_from_stores">These come from third-party stores, which serve their own copies of apps. Until an app is pinned to a certificate, the first file Tern installs from its store decides which certificate its updates must carry.</string>
+    <string name="stores_import_paused">Third-party stores are off, so these apps are paused. Tern asks those stores nothing until you turn them on.</string>
+    <string name="stores_import_names">From third-party stores</string>
+    <!-- The link goes through Obtainium's web page, which is sent all of the app's settings. -->
+    <string name="share_obtainium_link">Share as an Obtainium link</string>
+    <string name="share_obtainium_links">Share as Obtainium links</string>
+</resources>
diff --git a/app/src/main/res/values/strings_tv.xml b/app/src/main/res/values/strings_tv.xml
new file mode 100644
index 00000000..6713503c
--- /dev/null
+++ b/app/src/main/res/values/strings_tv.xml
@@ -0,0 +1,5 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="interval_turn_off">Turn background checks off</string>
+    <string name="interval_turn_on">Turn background checks on</string>
+</resources>
diff --git a/app/src/main/res/xml-v36/network_security_config.xml b/app/src/main/res/xml-v36/network_security_config.xml
index 2b4d9ba8..3038b015 100644
--- a/app/src/main/res/xml-v36/network_security_config.xml
+++ b/app/src/main/res/xml-v36/network_security_config.xml
@@ -6,18 +6,4 @@
         </trust-anchors>
         <certificateTransparency enabled="true" />
     </base-config>
-    <!--
-        RuStore serves part of its addresses with a certificate of Russia's national authority,
-        which Android does not trust. It is trusted for RuStore's own addresses and for nothing
-        else, as Obtainium does; every file from there still passes every check.
-    -->
-    <domain-config cleartextTrafficPermitted="false">
-        <domain includeSubdomains="true">rustore.ru</domain>
-        <trust-anchors>
-            <certificates src="system" />
-            <certificates src="@raw/russian_trusted_root" />
-        </trust-anchors>
-        <!-- Such certificates are in no log Android could check. -->
-        <certificateTransparency enabled="false" />
-    </domain-config>
 </network-security-config>
diff --git a/app/src/main/res/xml/network_security_config.xml b/app/src/main/res/xml/network_security_config.xml
index 2fd1bce6..683208ff 100644
--- a/app/src/main/res/xml/network_security_config.xml
+++ b/app/src/main/res/xml/network_security_config.xml
@@ -5,16 +5,4 @@
             <certificates src="system" />
         </trust-anchors>
     </base-config>
-    <!--
-        RuStore serves part of its addresses with a certificate of Russia's national authority,
-        which Android does not trust. It is trusted for RuStore's own addresses and for nothing
-        else, as Obtainium does; every file from there still passes every check.
-    -->
-    <domain-config cleartextTrafficPermitted="false">
-        <domain includeSubdomains="true">rustore.ru</domain>
-        <trust-anchors>
-            <certificates src="system" />
-            <certificates src="@raw/russian_trusted_root" />
-        </trust-anchors>
-    </domain-config>
 </network-security-config>
diff --git a/app/src/test/kotlin/io/github/munzzyy/tern/data/CrashReportTest.kt b/app/src/test/kotlin/io/github/munzzyy/tern/data/CrashReportTest.kt
index b3427386..196d935d 100644
--- a/app/src/test/kotlin/io/github/munzzyy/tern/data/CrashReportTest.kt
+++ b/app/src/test/kotlin/io/github/munzzyy/tern/data/CrashReportTest.kt
@@ -1,6 +1,8 @@
 package io.github.munzzyy.tern.data
 
+import java.io.IOException
 import org.junit.Assert.assertEquals
+import org.junit.Assert.assertFalse
 import org.junit.Assert.assertTrue
 import org.junit.Test
 
@@ -18,4 +20,19 @@ class CrashReportTest {
         val deep = RuntimeException("x".repeat(40_000))
         assertEquals(CrashReport.MAX_CHARS, CrashReport.text("worker", deep, "0.2.0", 29, 0).length)
     }
+
+    @Test
+    fun whatCouldOpenAnAccountLeavesTheReportAndTheFramesStay() {
+        val error = RuntimeException("check failed", IOException("https://u:p@h.example/x?sig=deadbeef password=hunter2 ghp_A1b2C3d4E5f6G7h8I9j0K1l2"))
+        val report = CrashReport.text("worker", error, "0.2.0", 34, 0)
+        for (secret in listOf("u:p@", "sig=", "deadbeef", "hunter2", "ghp_")) assertFalse(report, secret in report)
+        assertTrue(report, "Caused by: java.io.IOException: https://h.example/x" in report)
+        assertTrue(report, "at io.github.munzzyy.tern.data.CrashReportTest.whatCouldOpenAnAccountLeavesTheReportAndTheFramesStay(CrashReportTest.kt:" in report)
+    }
+
+    @Test
+    fun aReportAnOlderTernWroteIsScrubbedBeforeItIsShownOrShared() {
+        val old = "Tern 0.1.0 on Android API 34\njava.io.IOException: Authorization: Bearer abc.def\n\tat a.B.c(B.kt:1)"
+        assertEquals("Tern 0.1.0 on Android API 34\njava.io.IOException: Authorization: Bearer \u2026\n\tat a.B.c(B.kt:1)", CrashReport.scrubbed(old))
+    }
 }
diff --git a/app/src/test/kotlin/io/github/munzzyy/tern/data/KeptPinsTest.kt b/app/src/test/kotlin/io/github/munzzyy/tern/data/KeptPinsTest.kt
new file mode 100644
index 00000000..953c315a
--- /dev/null
+++ b/app/src/test/kotlin/io/github/munzzyy/tern/data/KeptPinsTest.kt
@@ -0,0 +1,69 @@
+package io.github.munzzyy.tern.data
+
+import io.github.munzzyy.tern.core.model.AppConfig
+import io.github.munzzyy.tern.core.model.SourceSpec
+import io.github.munzzyy.tern.core.source.SourceOptions
+import io.github.munzzyy.tern.core.source.SourceTypes
+import io.github.munzzyy.tern.engine.real.RealEngine
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertFalse
+import org.junit.Assert.assertNotEquals
+import org.junit.Assert.assertNull
+import org.junit.Assert.assertTrue
+import org.junit.Test
+
+class KeptPinsTest {
+    private val pin = "a894d999" + "0".repeat(56)
+    private val other = "b".repeat(64)
+    private val key = "c".repeat(64)
+    private val github = AppConfig("a", SourceSpec(SourceTypes.GITHUB, "https://github.com/example/app"), "App", pinnedSigners = listOf(pin))
+
+    @Test
+    fun aDroppedAppAddedAgainIsHeldToWhatItWasHeldTo() {
+        val kept = KeptPins.Kept.decode(KeptPins.Kept.of(github, 5)!!.encode())!!
+        assertEquals(5L, kept.atMs)
+        // Added again, the first file served would otherwise become the pin.
+        val again = kept.onto(github.copy(pinnedSigners = emptyList()))
+        assertEquals(listOf(pin), again.pinnedSigners)
+    }
+
+    @Test
+    fun pinsTheAppAlreadyHasAreNeverReplaced() {
+        val kept = KeptPins.Kept(listOf(pin), null)
+        assertEquals(listOf(other), kept.onto(github.copy(pinnedSigners = listOf(other))).pinnedSigners)
+    }
+
+    @Test
+    fun theKeyOfARepositoryComesBackToo() {
+        val repo = AppConfig(
+            "r", SourceSpec(SourceTypes.FDROID_REPO, "https://repo.example.org/repo", mapOf(SourceOptions.PACKAGE to "org.example", SourceOptions.FINGERPRINT to key)), "Repo",
+        )
+        val kept = KeptPins.Kept.of(repo, 1)!!
+        val bare = repo.copy(source = repo.source.copy(options = mapOf(SourceOptions.PACKAGE to "org.example")))
+        assertEquals(key, kept.onto(bare).source.option(SourceOptions.FINGERPRINT))
+    }
+
+    @Test
+    fun anAppHeldToNothingLeavesNothing() {
+        assertNull(KeptPins.Kept.of(github.copy(pinnedSigners = emptyList()), 1))
+        assertNull(KeptPins.Kept.decode("{\"signers\":[\"not a hash\"]}"))
+        assertNull(KeptPins.Kept.decode("not json"))
+    }
+
+    @Test
+    fun eachAppOfARepositoryIsKeptApart() {
+        val one = SourceSpec(SourceTypes.FDROID_REPO, "https://Repo.example.org/repo", mapOf(SourceOptions.PACKAGE to "org.one"))
+        val two = one.copy(options = mapOf(SourceOptions.PACKAGE to "org.two"))
+        assertNotEquals(KeptPins.key(one), KeptPins.key(two))
+        assertEquals(KeptPins.key(github.source), KeptPins.key(github.source.copy(url = "https://GitHub.com/example/app")))
+    }
+
+    @Test
+    fun archivingAnAppOrReplacingItIsNoUninstall() {
+        val removed = "android.intent.action.PACKAGE_REMOVED"
+        assertTrue(RealEngine.removedForGood(removed, replacing = false, archival = false))
+        assertFalse(RealEngine.removedForGood(removed, replacing = false, archival = true))
+        assertFalse(RealEngine.removedForGood(removed, replacing = true, archival = false))
+        assertFalse(RealEngine.removedForGood("android.intent.action.PACKAGE_ADDED", replacing = false, archival = false))
+    }
+}
diff --git a/app/src/test/kotlin/io/github/munzzyy/tern/data/SettingsJsonTest.kt b/app/src/test/kotlin/io/github/munzzyy/tern/data/SettingsJsonTest.kt
index d9b98e81..c40980b9 100644
--- a/app/src/test/kotlin/io/github/munzzyy/tern/data/SettingsJsonTest.kt
+++ b/app/src/test/kotlin/io/github/munzzyy/tern/data/SettingsJsonTest.kt
@@ -36,6 +36,17 @@ class SettingsJsonTest {
         assertEquals(chosen, back)
     }
 
+    @Test
+    fun noFileOrLinkTurnsThirdPartyStoresOn() {
+        assertFalse(Settings().thirdPartyStores)
+        assertFalse("thirdPartyStores" in SettingsJson.encode(Settings().copy(thirdPartyStores = true)).fields.keys)
+        val file = Json.parseObject("""{"thirdPartyStores":true,"theme":"DARK"}""")
+        assertFalse(SettingsJson.apply(file, Settings()).thirdPartyStores)
+        val obtainium = ObtainiumSettings.toTern(Json.parseObject("""{"thirdPartyStores":true,"enableThirdPartyStores":true}"""))
+        assertFalse(SettingsJson.apply(obtainium, Settings()).thirdPartyStores)
+        assertTrue("one who has them on keeps them on", SettingsJson.apply(file, Settings().copy(thirdPartyStores = true)).thirdPartyStores)
+    }
+
     @Test
     fun whatReachesPastThePhoneNeverTravels() {
         val guarded = Settings().copy(
@@ -45,7 +56,7 @@ class SettingsJsonTest {
             exportFolder = "content://com.android.externalstorage.documents/tree/primary%3ABackups",
             autoExport = true,
             otherInstallerActivity = "com.example.installer.InstallActivity",
-            shareToVerifier = false,
+            shareToVerifier = true,
         )
         val keys = SettingsJson.encode(guarded).fields.keys
         for (key in listOf("proxy", "proxyHost", "installer", "otherInstaller", "exportFolder", "autoExport", "openObtainiumLinks", "otherInstallerActivity", "shareToVerifier")) {
diff --git a/app/src/test/kotlin/io/github/munzzyy/tern/data/V010SettingsTest.kt b/app/src/test/kotlin/io/github/munzzyy/tern/data/V010SettingsTest.kt
new file mode 100644
index 00000000..811b1048
--- /dev/null
+++ b/app/src/test/kotlin/io/github/munzzyy/tern/data/V010SettingsTest.kt
@@ -0,0 +1,71 @@
+package io.github.munzzyy.tern.data
+
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertFalse
+import org.junit.Assert.assertTrue
+import org.junit.Test
+
+/** Settings v0.1.0 wrote mean after the update what they meant before it. */
+class V010SettingsTest {
+    /** Every key v0.1.0's SettingsStore.save() wrote, with the type it wrote it as (git show 8399259cb464^). */
+    private fun v010(hours: Int = 6, unmetered: Boolean = true, charging: Boolean = false): Map<String, Any?> = mapOf(
+        "checkEveryHours" to hours,
+        "onlyOnUnmetered" to unmetered,
+        "onlyWhileCharging" to charging,
+        "defaultUpdateMode" to "NOTIFY",
+        "includePrereleasesByDefault" to false,
+        "minAgeDaysByDefault" to 0,
+        "notifyUpdates" to true,
+        "notifyInstalled" to true,
+        "notifyFailures" to false,
+        "notifyNames" to true,
+        "keepInstallers" to false,
+        "claimUpdateOwnership" to false,
+        "openObtainiumLinks" to false,
+        "theme" to "SYSTEM",
+        "colorSource" to "WALLPAPER",
+        "palette" to "INK",
+        "customHue" to 250,
+        "contrast" to "STANDARD",
+        "pureBlack" to false,
+        "density" to "COMFORTABLE",
+        "corners" to "ROUND",
+        "iconShape" to "CIRCLE",
+        "sourceIcons" to true,
+        "proxy" to "NONE",
+        "proxyHost" to "127.0.0.1",
+        "proxyPort" to 9050,
+    )
+
+    @Test
+    fun wifiOnlyInV010KeepsHoldingTheChecksBack() {
+        val stored = v010(unmetered = true, charging = true)
+        assertTrue(SettingsStore.checkLimit(stored, "checkOnlyOnUnmetered", "onlyOnUnmetered"))
+        assertTrue(SettingsStore.checkLimit(stored, "checkOnlyWhileCharging", "onlyWhileCharging"))
+        assertEquals(360, SettingsStore.storedMinutes(stored, 360))
+        assertEquals(24 * 60, SettingsStore.storedMinutes(v010(hours = 24), 360))
+        assertEquals(0, SettingsStore.storedMinutes(v010(hours = 0), 360))
+    }
+
+    @Test
+    fun v010SwitchesThatWereOffStayOff() {
+        val stored = v010(unmetered = false, charging = false)
+        assertFalse(SettingsStore.checkLimit(stored, "checkOnlyOnUnmetered", "onlyOnUnmetered"))
+        assertFalse(SettingsStore.checkLimit(stored, "checkOnlyWhileCharging", "onlyWhileCharging"))
+    }
+
+    @Test
+    fun onceSavedTheCheckSwitchesStandOnTheirOwn() {
+        // save() writes the new keys and takes checkEveryHours out.
+        val saved = mapOf("checkEveryMinutes" to 90, "onlyOnUnmetered" to true, "checkOnlyOnUnmetered" to false, "checkOnlyWhileCharging" to true)
+        assertFalse(SettingsStore.checkLimit(saved, "checkOnlyOnUnmetered", "onlyOnUnmetered"))
+        assertTrue(SettingsStore.checkLimit(saved, "checkOnlyWhileCharging", "onlyWhileCharging"))
+        assertEquals(90, SettingsStore.storedMinutes(saved, 360))
+    }
+
+    @Test
+    fun aNewInstallChecksOnAnyNetwork() {
+        assertFalse(SettingsStore.checkLimit(emptyMap<String, Any?>(), "checkOnlyOnUnmetered", "onlyOnUnmetered"))
+        assertFalse(SettingsStore.checkLimit(mapOf("onlyOnUnmetered" to true), "checkOnlyOnUnmetered", "onlyOnUnmetered"))
+    }
+}
diff --git a/app/src/test/kotlin/io/github/munzzyy/tern/engine/BuiltInPinsTest.kt b/app/src/test/kotlin/io/github/munzzyy/tern/engine/BuiltInPinsTest.kt
index 27bfd951..1d9f1aa6 100644
--- a/app/src/test/kotlin/io/github/munzzyy/tern/engine/BuiltInPinsTest.kt
+++ b/app/src/test/kotlin/io/github/munzzyy/tern/engine/BuiltInPinsTest.kt
@@ -8,10 +8,12 @@ import io.github.munzzyy.tern.core.engine.UpdateDecision
 import io.github.munzzyy.tern.core.model.AppConfig
 import io.github.munzzyy.tern.core.model.Release
 import io.github.munzzyy.tern.core.model.SourceSpec
+import io.github.munzzyy.tern.core.source.SourceTypes
 import io.github.munzzyy.tern.core.suggest.Catalog
 import io.github.munzzyy.tern.core.suggest.ConfirmedBy
 import io.github.munzzyy.tern.core.suggest.SuggestedApp
 import io.github.munzzyy.tern.core.suggest.SuggestedKind
+import io.github.munzzyy.tern.engine.real.Arrivals
 import io.github.munzzyy.tern.engine.real.BuiltInPins
 import io.github.munzzyy.tern.engine.real.Suggestions
 import org.junit.Assert.assertEquals
@@ -40,7 +42,7 @@ class BuiltInPinsTest {
     private fun fileSignedBy(signer: String, lineage: List<String> = emptyList()) = Inspection("org.example.app", 1, "1.0", listOf(signer), lineage)
 
     private fun firstInstall(url: String, signer: String, lineage: List<String> = emptyList(), carriedWithALink: List<String> = emptyList()): Decision {
-        val held = pins.orElse(url, carriedWithALink)
+        val held = pins.orElse(SourceSpec("forgejo", url), "org.example.app", carriedWithALink)
         return UpdateDecision.decide(release, installed = null, record = null, inspection = fileSignedBy(signer, lineage), expectedPackage = "org.example.app", pinnedSigners = held)
     }
 
@@ -67,7 +69,7 @@ class BuiltInPinsTest {
     fun whatCameWithALinkCannotTakeTheCarriedCertificatesPlace() {
         val decision = firstInstall(address, stranger, carriedWithALink = listOf(stranger))
         assertEquals(Block.PIN_MISMATCH, (decision as Decision.Blocked).block)
-        assertEquals(listOf(developer, later), pins.orElse(address, listOf(stranger)))
+        assertEquals(listOf(developer, later), pins.orElse(SourceSpec("forgejo", address), "org.example.app", listOf(stranger)))
     }
 
     @Test
@@ -75,10 +77,57 @@ class BuiltInPinsTest {
         for (url in listOf(plain.url, "https://forge.example.org/example/other", "https://forge.example.org/example/app-fork", "")) {
             assertEquals(url, emptyList<String>(), pins.of(url))
             assertTrue(url, firstInstall(url, stranger) is Decision.NotInstalled)
-            assertEquals(url, listOf(stranger), pins.orElse(url, listOf(stranger)))
+            assertEquals(url, listOf(stranger), pins.orElse(SourceSpec("forgejo", url), "org.example.app", listOf(stranger)))
         }
     }
 
+    private val store = SourceSpec(SourceTypes.APKPURE, "https://apkpure.com/example/org.example.app")
+
+    private fun firstInstallFrom(spec: SourceSpec, signer: String, packageName: String? = "org.example.app"): Decision =
+        UpdateDecision.decide(
+            release, installed = null, record = null, inspection = fileSignedBy(signer), expectedPackage = packageName,
+            pinnedSigners = pins.orElse(spec, packageName, emptyList()),
+        )
+
+    @Test
+    fun aCarriedAppAddedFromAStoreIsHeldToTheDevelopersCertificateByItsPackage() {
+        assertEquals(listOf(developer, later), pins.forApp(store, "org.example.app"))
+        assertEquals(Block.PIN_MISMATCH, (firstInstallFrom(store, stranger) as Decision.Blocked).block)
+        assertTrue(firstInstallFrom(store, developer) is Decision.NotInstalled)
+        for (type in SourceTypes.THIRD_PARTY_STORES + listOf(SourceTypes.HTML, SourceTypes.DIRECT)) {
+            val elsewhere = SourceSpec(type, "https://mirror.example.net/org.example.app")
+            assertEquals(type, Block.PIN_MISMATCH, (firstInstallFrom(elsewhere, stranger) as Decision.Blocked).block)
+        }
+        assertTrue(pins.hold(AppConfig(id = "s", source = store, name = "Example", packageName = "org.example.app", pinnedSigners = listOf(developer))))
+    }
+
+    @Test
+    fun aPackageFromSeveralEntriesIsHeldToAllOfTheirCertificates() {
+        val other = carried.copy(name = "Example Nightly", url = "https://forge.example.org/example/nightly", signers = listOf(stranger.uppercase()))
+        val both = BuiltInPins(listOf(carried, other, plain))
+        assertEquals(listOf(developer, later, stranger), both.ofPackage("org.example.app"))
+        assertEquals(emptyList<String>(), both.ofPackage("org.example.unknown"))
+        assertEquals(emptyList<String>(), both.ofPackage(null))
+    }
+
+    @Test
+    fun aForkOnAForgeAndAnFDroidRepositoryAreNotHeldByPackage() {
+        for (type in listOf(SourceTypes.GITHUB, SourceTypes.GITLAB, SourceTypes.FORGEJO, SourceTypes.FDROID, SourceTypes.FDROID_REPO, SourceTypes.ITCHIO)) {
+            val spec = SourceSpec(type, "https://elsewhere.example.org/fork/app")
+            assertEquals(type, emptyList<String>(), pins.forApp(spec, "org.example.app"))
+            assertTrue(type, firstInstallFrom(spec, stranger) is Decision.NotInstalled)
+        }
+        assertEquals("an app of an unknown package is held to nothing new", emptyList<String>(), pins.forApp(store, "org.example.other"))
+    }
+
+    @Test
+    fun anImportedAppFromAStoreIsStoredWithTheCarriedCertificate() {
+        val imported = AppConfig(id = "x", source = store, name = "Example", packageName = "org.example.app")
+        assertEquals(listOf(developer, later), Arrivals.stored(imported, "x", pins).pinnedSigners)
+        val unknown = imported.copy(packageName = null)
+        assertEquals(emptyList<String>(), Arrivals.stored(unknown, "x", pins).pinnedSigners)
+    }
+
     @Test
     fun theAddressIsFoundInAnyCaseAndWithATrailingSlash() {
         assertEquals(listOf(developer, later), pins.of("https://forge.example.org/Example/APP"))
diff --git a/app/src/test/kotlin/io/github/munzzyy/tern/engine/ImportDecoderTest.kt b/app/src/test/kotlin/io/github/munzzyy/tern/engine/ImportDecoderTest.kt
index dfe2fc14..5570f23a 100644
--- a/app/src/test/kotlin/io/github/munzzyy/tern/engine/ImportDecoderTest.kt
+++ b/app/src/test/kotlin/io/github/munzzyy/tern/engine/ImportDecoderTest.kt
@@ -24,6 +24,25 @@ class ImportDecoderTest {
         assertEquals(listOf("Copy" to "Tern could not read this address as an app on APKPure"), decoded.skipped)
     }
 
+    @Test
+    fun anAppOfASiteTernRefusesIsLeftOutWithTheReasonInEitherFormat() {
+        val obtainium = decode(
+            """[{"url":"https://github.com/example/wren","name":"Wren"},
+               {"url":"https://liteapks.com/wren.html","name":"Unlocked","overrideSource":"LiteAPKs"},
+               {"url":"https://www.rustore.ru/catalog/app/org.example.wren","name":"Copy","overrideSource":"RuStore"}]""",
+        )
+        assertEquals(listOf("Wren"), obtainium.apps.map { it.name })
+        assertEquals(listOf("Unlocked" to "importRefused(MODIFIED_APPS)", "Copy" to "importRefused(IMPERSONATION)"), obtainium.skipped)
+
+        val stored = exportOf("Wren").replace(
+            "\"apps\": [",
+            "\"apps\": [{\"id\": \"x\", \"name\": \"Copy\", \"source\": {\"type\": \"uptodown\", \"url\": \"https://wren.en.uptodown.com/android/download\"}},",
+        )
+        val tern = decode(stored)
+        assertEquals(listOf("Wren"), tern.apps.map { it.name })
+        assertEquals(listOf("Copy" to "importRefused(IMPERSONATION)"), tern.skipped)
+    }
+
     @Test
     fun anAppOnALocalNetworkIsLeftOutAndNamed() {
         val decoded = decode(
diff --git a/app/src/test/kotlin/io/github/munzzyy/tern/engine/ImportSentences.kt b/app/src/test/kotlin/io/github/munzzyy/tern/engine/ImportSentences.kt
index c4831d3e..67037619 100644
--- a/app/src/test/kotlin/io/github/munzzyy/tern/engine/ImportSentences.kt
+++ b/app/src/test/kotlin/io/github/munzzyy/tern/engine/ImportSentences.kt
@@ -3,6 +3,7 @@ package io.github.munzzyy.tern.engine
 import io.github.munzzyy.tern.core.interop.TernExport
 import io.github.munzzyy.tern.core.model.AppConfig
 import io.github.munzzyy.tern.core.model.SourceSpec
+import io.github.munzzyy.tern.core.source.Refusal
 import io.github.munzzyy.tern.core.source.SourceTypes
 import io.github.munzzyy.tern.engine.real.ImportTexts
 import org.junit.Assert.assertEquals
@@ -25,6 +26,7 @@ object ImportSentences : ImportTexts {
     override fun linkNotAnExport() = "linkNotAnExport"
     override fun serverStatus(code: Int) = "serverStatus($code)"
     override fun checkRateLimited(untilMs: Long?) = "checkRateLimited($untilMs)"
+    override fun importRefused(refusal: Refusal) = "importRefused($refusal)"
 }
 
 fun exportOf(vararg names: String): String = TernExport.write(
diff --git a/app/src/test/kotlin/io/github/munzzyy/tern/engine/SearchHitTest.kt b/app/src/test/kotlin/io/github/munzzyy/tern/engine/SearchHitTest.kt
index 5a80bf91..8bc2acab 100644
--- a/app/src/test/kotlin/io/github/munzzyy/tern/engine/SearchHitTest.kt
+++ b/app/src/test/kotlin/io/github/munzzyy/tern/engine/SearchHitTest.kt
@@ -51,6 +51,7 @@ class SearchHitTest {
     @Test
     fun onlyThePlacesPickedAreAsked() = runBlocking {
         val asked = ArrayList<String>()
+        var storesOn = true
         val store = object : Searchable {
             override val origin = "Aptoide"
             override fun search(query: String, context: CheckContext): List<Hit> {
@@ -63,13 +64,18 @@ class SearchHitTest {
                 override fun execute(request: HttpRequest): HttpResponse = throw IOException("no network in this test")
             },
             TokenProvider.NONE,
-            listOf(store),
+            { if (storesOn) listOf(store) else emptyList() },
         )
         assertEquals(listOf("GitHub", "Codeberg", "GitLab", "Aptoide"), both.origins)
         assertEquals(emptyList<SearchHit>(), both.search("maps", setOf("Somewhere else")).hits)
         assertEquals(emptyList<String>(), asked)
         assertEquals(listOf("Found"), both.search("maps", setOf("Aptoide")).hits.map { it.name })
         assertEquals(listOf("maps"), asked)
+
+        storesOn = false
+        assertEquals("a store switched off is no place to search", listOf("GitHub", "Codeberg", "GitLab"), both.origins)
+        assertEquals(emptyList<SearchHit>(), both.search("maps", setOf("Aptoide")).hits)
+        assertEquals(listOf("maps"), asked)
     }
 
     @Test
diff --git a/app/src/test/kotlin/io/github/munzzyy/tern/engine/SearchPlacesMissedTest.kt b/app/src/test/kotlin/io/github/munzzyy/tern/engine/SearchPlacesMissedTest.kt
index 6d5e8cd9..3eeffa84 100644
--- a/app/src/test/kotlin/io/github/munzzyy/tern/engine/SearchPlacesMissedTest.kt
+++ b/app/src/test/kotlin/io/github/munzzyy/tern/engine/SearchPlacesMissedTest.kt
@@ -26,7 +26,7 @@ class SearchPlacesMissedTest {
             answer(request)
         },
         tokens,
-        stores,
+        { stores },
         log = {},
     )
 
diff --git a/app/src/test/kotlin/io/github/munzzyy/tern/engine/StarterHereTest.kt b/app/src/test/kotlin/io/github/munzzyy/tern/engine/StarterHereTest.kt
new file mode 100644
index 00000000..b213e9d1
--- /dev/null
+++ b/app/src/test/kotlin/io/github/munzzyy/tern/engine/StarterHereTest.kt
@@ -0,0 +1,48 @@
+package io.github.munzzyy.tern.engine
+
+import io.github.munzzyy.tern.core.suggest.SuggestedApp
+import io.github.munzzyy.tern.core.suggest.SuggestedKind
+import io.github.munzzyy.tern.engine.real.Suggestions
+import org.junit.Assert.assertEquals
+import org.junit.Test
+
+class StarterHereTest {
+    private val developer = "a".repeat(64)
+    private val rotatedFrom = "b".repeat(64)
+    private val store = "c".repeat(64)
+    private val carried = SuggestedApp(
+        "Example", "https://github.com/example/app", SuggestedKind.TOOLS, television = false, summaryKey = "example",
+        packageName = "org.example.app", signers = listOf(developer),
+    )
+    private val unpinned = carried.copy(signers = emptyList())
+
+    @Test
+    fun anAppInTheListIsSaidToBeThereWhateverIsInstalled() {
+        assertEquals(StarterHere.IN_LIST, Suggestions.here(carried, followed = true, installedSigners = listOf(store)))
+    }
+
+    @Test
+    fun anAppNotOnThePhoneIsOfferedPlainly() {
+        assertEquals(StarterHere.NONE, Suggestions.here(carried, followed = false, installedSigners = null))
+    }
+
+    @Test
+    fun theDevelopersOwnCopyIsOnThePhone() {
+        assertEquals(StarterHere.ON_PHONE, Suggestions.here(carried, followed = false, installedSigners = listOf(developer.uppercase())))
+    }
+
+    @Test
+    fun aCopyWhoseKeyRotatedFromTheDevelopersCounts() {
+        assertEquals(StarterHere.ON_PHONE, Suggestions.here(carried, followed = false, installedSigners = listOf(store, developer)))
+    }
+
+    @Test
+    fun aCopySignedBySomeoneElseIsSaidToBe() {
+        assertEquals(StarterHere.ON_PHONE_OTHER_SIGNER, Suggestions.here(carried, followed = false, installedSigners = listOf(store, rotatedFrom)))
+    }
+
+    @Test
+    fun withoutACarriedCertificateAnInstalledCopyIsOnlyOnThePhone() {
+        assertEquals(StarterHere.ON_PHONE, Suggestions.here(unpinned, followed = false, installedSigners = listOf(store)))
+    }
+}
diff --git a/app/src/test/kotlin/io/github/munzzyy/tern/engine/real/EvaluatorTest.kt b/app/src/test/kotlin/io/github/munzzyy/tern/engine/real/EvaluatorTest.kt
index 5d29c3fb..ceba5a19 100644
--- a/app/src/test/kotlin/io/github/munzzyy/tern/engine/real/EvaluatorTest.kt
+++ b/app/src/test/kotlin/io/github/munzzyy/tern/engine/real/EvaluatorTest.kt
@@ -138,4 +138,24 @@ class EvaluatorTest {
         }
         assertTrue(chosen.asset.name != bestByNameAlone.asset.name)
     }
+
+    @Test
+    fun aDigestThatCameThroughAHubproxyIsCreditedToIt() {
+        val github = io.github.munzzyy.tern.core.model.SourceSpec("github", "https://github.com/example/app")
+        assertEquals("gh-proxy.example", Evaluator.digestProxy(github, "gh-proxy.example"))
+        assertEquals("gh-proxy.example", Evaluator.digestProxy(github.copy(type = "github-actions"), "gh-proxy.example"))
+        assertNull(Evaluator.digestProxy(github, null))
+        // A GitHub of its own host and other sources never go through it.
+        assertNull(Evaluator.digestProxy(github.copy(url = "https://git.example.org/example/app"), "gh-proxy.example"))
+        assertNull(Evaluator.digestProxy(io.github.munzzyy.tern.core.model.SourceSpec("fdroid", "https://f-droid.org/packages/org.example"), "gh-proxy.example"))
+    }
+
+    @Test
+    fun theHubproxySettingSaysItCanChangeWhatGitHubSeemsToPublish() {
+        val text = java.io.File("src/main/res/values/strings_safety.xml").readText()
+        val effect = Regex("""name="github_proxy_effect_trust">([^<]*)<""").find(text)!!.groupValues[1]
+        assertTrue(effect, "can change what comes back" in effect)
+        assertTrue(effect, "first install through it trusts the hubproxy" in effect)
+        assertTrue(effect, "pinning does not reach it" in effect)
+    }
 }
diff --git a/app/src/test/kotlin/io/github/munzzyy/tern/engine/real/InstallerChoiceTest.kt b/app/src/test/kotlin/io/github/munzzyy/tern/engine/real/InstallerChoiceTest.kt
index 075f83d6..c586bf47 100644
--- a/app/src/test/kotlin/io/github/munzzyy/tern/engine/real/InstallerChoiceTest.kt
+++ b/app/src/test/kotlin/io/github/munzzyy/tern/engine/real/InstallerChoiceTest.kt
@@ -3,6 +3,7 @@ package io.github.munzzyy.tern.engine.real
 import io.github.munzzyy.tern.engine.InstallerMode
 import io.github.munzzyy.tern.engine.InstallerReadiness
 import org.junit.Assert.assertEquals
+import org.junit.Assert.assertNull
 import org.junit.Test
 
 /** Which installer an install goes to while the one chosen cannot be used. */
@@ -23,4 +24,14 @@ class InstallerChoiceTest {
         assertEquals(InstallerMode.SYSTEM, effectiveInstaller(InstallerMode.OTHER_APP, InstallerReadiness.NO_OTHER_APP))
         assertEquals(InstallerMode.SYSTEM, effectiveInstaller(InstallerMode.SYSTEM, InstallerReadiness.READY))
     }
+
+    @Test
+    fun anInstallThatGoesToAnotherInstallerSaysWhichOneWasChosen() {
+        assertEquals(InstallerMode.SHIZUKU, fellBackFrom(InstallerMode.SHIZUKU, InstallerReadiness.SHIZUKU_NOT_RUNNING))
+        assertEquals(InstallerMode.ROOT, fellBackFrom(InstallerMode.ROOT, InstallerReadiness.NO_ROOT))
+        assertEquals(InstallerMode.OTHER_APP, fellBackFrom(InstallerMode.OTHER_APP, InstallerReadiness.NO_OTHER_APP))
+        assertNull(fellBackFrom(InstallerMode.SHIZUKU, InstallerReadiness.READY))
+        assertNull(fellBackFrom(InstallerMode.SYSTEM, InstallerReadiness.READY))
+        assertNull(fellBackFrom(InstallerMode.DHIZUKU, InstallerReadiness.DHIZUKU_NOT_ANSWERING))
+    }
 }
diff --git a/app/src/test/kotlin/io/github/munzzyy/tern/engine/real/ProjectPagesTest.kt b/app/src/test/kotlin/io/github/munzzyy/tern/engine/real/ProjectPagesTest.kt
index f5e9bc96..1246be71 100644
--- a/app/src/test/kotlin/io/github/munzzyy/tern/engine/real/ProjectPagesTest.kt
+++ b/app/src/test/kotlin/io/github/munzzyy/tern/engine/real/ProjectPagesTest.kt
@@ -31,6 +31,24 @@ class ProjectPagesTest {
         assertTrue(blocks.first() is NoteBlock.Heading)
     }
 
+    @Test
+    fun aForgejoReadmeGoesWithTheTokenForItsHostAsAuthorization() {
+        val forgejo = object : HttpClient {
+            override fun execute(request: HttpRequest): HttpResponse {
+                asked += request
+                val body = "{\"content\":\"${java.util.Base64.getEncoder().encodeToString("# Maps".toByteArray())}\"}"
+                return HttpResponse(200, Headers.of(emptyMap()), ByteArrayInputStream(body.toByteArray()), request.url)
+            }
+        }
+        val tokens = TokenProvider { host -> if (host == "codeberg.org") "T" else null }
+        val blocks = ProjectPages(forgejo, tokens).read(SourceSpec(SourceTypes.FORGEJO, "https://codeberg.org/example/maps"))!!
+        assertTrue(blocks.first() is NoteBlock.Heading)
+        val request = asked.single()
+        assertEquals("https://codeberg.org/api/v1/repos/example/maps/contents/README.md", request.url)
+        assertEquals("token T", request.authorization)
+        assertTrue(request.headers.keys.none { it.equals("Authorization", ignoreCase = true) })
+    }
+
     @Test
     fun aSourceWithoutAProjectPageAsksNothing() {
         assertNull(ProjectPages(http, TokenProvider.NONE).read(SourceSpec(SourceTypes.APKPURE, "https://apkpure.com/maps/org.example.maps")))
diff --git a/app/src/test/kotlin/io/github/munzzyy/tern/install/DowngradeTest.kt b/app/src/test/kotlin/io/github/munzzyy/tern/install/DowngradeTest.kt
new file mode 100644
index 00000000..a0158a37
--- /dev/null
+++ b/app/src/test/kotlin/io/github/munzzyy/tern/install/DowngradeTest.kt
@@ -0,0 +1,37 @@
+package io.github.munzzyy.tern.install
+
+import io.github.munzzyy.tern.engine.real.Installs
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertFalse
+import org.junit.Assert.assertTrue
+import org.junit.Test
+
+class DowngradeTest {
+    @Test
+    fun onlyAReleaseThePersonPickedMayGoBack() {
+        assertTrue(Installs.allowsDowngrade(picked = true, setting = true) { true })
+        // The background check, Update all and Install latest all start with no release picked.
+        assertFalse(Installs.allowsDowngrade(picked = false, setting = true) { true })
+        assertFalse(Installs.allowsDowngrade(picked = true, setting = false) { true })
+        assertFalse(Installs.allowsDowngrade(picked = true, setting = true) { false })
+        assertFalse(Installs.allowsDowngrade(picked = false, setting = true) { throw AssertionError("asked the device for nothing") })
+    }
+
+    @Test
+    fun anOlderFileGoesInOnlyWhereItIsAllowed() {
+        assertEquals(Downgrade.NONE, downgrade(file = 5, installed = null, allowed = false, claimed = null))
+        assertEquals(Downgrade.NONE, downgrade(file = 5, installed = 5, allowed = false, claimed = 5))
+        assertEquals(Downgrade.REFUSED, downgrade(file = 4, installed = 5, allowed = false, claimed = 4))
+        assertEquals(Downgrade.ALLOWED, downgrade(file = 4, installed = 5, allowed = true, claimed = 4))
+        assertEquals(Downgrade.ALLOWED, downgrade(file = 4, installed = 5, allowed = true, claimed = null))
+    }
+
+    @Test
+    fun aSourceThatNamedANewerVersionThanItServedCannotRollTheAppBack() {
+        // The store said 6, served a signed 4, and 5 is installed.
+        assertEquals(Downgrade.NOT_AS_NAMED, downgrade(file = 4, installed = 5, allowed = true, claimed = 6))
+        assertEquals(Downgrade.NOT_AS_NAMED, downgrade(file = 4, installed = 5, allowed = false, claimed = 6))
+        // An update whose file differs from what was named still goes, as long as it goes forward.
+        assertEquals(Downgrade.NONE, downgrade(file = 7, installed = 5, allowed = false, claimed = 8))
+    }
+}
diff --git a/app/src/test/kotlin/io/github/munzzyy/tern/install/PartsZipTest.kt b/app/src/test/kotlin/io/github/munzzyy/tern/install/PartsZipTest.kt
index 71f6e388..c0fd1789 100644
--- a/app/src/test/kotlin/io/github/munzzyy/tern/install/PartsZipTest.kt
+++ b/app/src/test/kotlin/io/github/munzzyy/tern/install/PartsZipTest.kt
@@ -91,7 +91,7 @@ class PartsZipTest {
 
     @Test
     fun aSplitIsNamedForTheLastPartOfItsAddress() {
-        assertEquals("config.arm64_v8a.zip", PartsZip.nameOf("https://static.rustore.ru/2026/9/16/ab/config.arm64_v8a.zip"))
+        assertEquals("config.arm64_v8a.zip", PartsZip.nameOf("https://files.example.org/2026/9/16/ab/config.arm64_v8a.zip"))
         assertEquals("split.zip", PartsZip.nameOf("https://example.org/files/split.zip?token=abc#part"))
         assertEquals("split", PartsZip.nameOf("https://example.org/"))
         assertEquals("config.xxhdpi.apk", PartsZip.apkName("config.xxhdpi.zip"))
diff --git a/app/src/test/kotlin/io/github/munzzyy/tern/install/VerifiedAppsTest.kt b/app/src/test/kotlin/io/github/munzzyy/tern/install/VerifiedAppsTest.kt
index f783cbdf..23d326df 100644
--- a/app/src/test/kotlin/io/github/munzzyy/tern/install/VerifiedAppsTest.kt
+++ b/app/src/test/kotlin/io/github/munzzyy/tern/install/VerifiedAppsTest.kt
@@ -1,5 +1,6 @@
 package io.github.munzzyy.tern.install
 
+import io.github.munzzyy.tern.engine.Settings
 import org.junit.Assert.assertEquals
 import org.junit.Assert.assertFalse
 import org.junit.Assert.assertNull
@@ -7,15 +8,41 @@ import org.junit.Assert.assertTrue
 import org.junit.Test
 
 class VerifiedAppsTest {
+    private val genuine: (String) -> List<String>? = { listOfNotNull(VerifiedApps.CERTIFICATES[it]) }
+
     @Test
     fun everyBuildObtainiumKnowsIsLookedFor() {
         assertEquals(
             setOf("dev.soupslurpr.appverifier", "com.roundsalmon4.appverifier", "org.privacyguides.verifiedapps", "org.privacyguides.verifiedapps.play"),
             VerifiedApps.PACKAGES.toSet(),
         )
-        assertEquals("dev.soupslurpr.appverifier", VerifiedApps.first { it == "dev.soupslurpr.appverifier" })
-        assertEquals("org.privacyguides.verifiedapps", VerifiedApps.first { true })
-        assertNull(VerifiedApps.first { false })
+        assertEquals("dev.soupslurpr.appverifier", VerifiedApps.first(genuine) { it == "dev.soupslurpr.appverifier" })
+        assertEquals("org.privacyguides.verifiedapps", VerifiedApps.first(genuine) { true })
+        assertNull(VerifiedApps.first(genuine) { false })
+    }
+
+    @Test
+    fun eachIsPinnedToTheCertificateItsMakersPublish() {
+        assertEquals(VerifiedApps.PACKAGES.toSet(), VerifiedApps.CERTIFICATES.keys)
+        assertEquals("405c6bd2ca7c3aae8f463c6f8b55bcf0ddac431c5ed8eaff65d106c9817a207f", VerifiedApps.CERTIFICATES["org.privacyguides.verifiedapps"])
+        assertEquals("3a04a80b2a88334c747485f0b2151640a38bb3d2d73a8eab81df503e0f0202b2", VerifiedApps.CERTIFICATES["dev.soupslurpr.appverifier"])
+        for (hash in VerifiedApps.CERTIFICATES.values) assertTrue(hash, hash.matches(Regex("[0-9a-f]{64}")))
+    }
+
+    @Test
+    fun anAppThatTookTheNameButNotTheCertificateGetsNothing() {
+        val impostor = "aa".repeat(32)
+        val signers = { pkg: String -> if (pkg == "org.privacyguides.verifiedapps") listOf(impostor) else genuine(pkg) }
+        assertEquals("org.privacyguides.verifiedapps.play", VerifiedApps.first(signers) { true })
+        assertNull(VerifiedApps.first({ listOf(impostor) }) { true })
+        assertNull(VerifiedApps.first({ null }) { true })
+        assertFalse(VerifiedApps.genuine("org.privacyguides.verifiedapps", emptyList()))
+        assertFalse(VerifiedApps.genuine("org.example.other", listOf(impostor)))
+    }
+
+    @Test
+    fun theHandOffIsOffUntilThePersonTurnsItOn() {
+        assertFalse(Settings().shareToVerifier)
     }
 
     @Test
diff --git a/app/src/test/kotlin/io/github/munzzyy/tern/log/ScrubTest.kt b/app/src/test/kotlin/io/github/munzzyy/tern/log/ScrubTest.kt
index bd7e6dfe..394c7d5d 100644
--- a/app/src/test/kotlin/io/github/munzzyy/tern/log/ScrubTest.kt
+++ b/app/src/test/kotlin/io/github/munzzyy/tern/log/ScrubTest.kt
@@ -127,6 +127,26 @@ class ScrubTest {
         assertEquals("credentials …", scrubbed("credentials 5f4dcc3b5aa765d61d8327deb882cf99"))
     }
 
+    @Test
+    fun aSessionOrACookieGoes() {
+        assertEquals("Cookie: …", scrubbed("Cookie: sessionid=abc; csrftoken=Zx9; theme=dark"))
+        assertEquals("Set-Cookie: …\nnext line", scrubbed("Set-Cookie: sid=a1; Path=/; HttpOnly\nnext line"))
+        assertEquals("session_id=…", scrubbed("session_id=5f4dcc3b5aa765d6"))
+        assertEquals("JSESSIONID: …", scrubbed("JSESSIONID: q8ne1bc7vd0d2k1p"))
+        assertEquals("sid=… sent", scrubbed("sid=Zm9vYmFyYmF6 sent"))
+        assertEquals("cookie=…", scrubbed("cookie=x1"))
+    }
+
+    @Test
+    fun aShortPasswordGoesOnceItIsSet() {
+        assertEquals("password: …", scrubbed("password: hunter2"))
+        assertEquals("login failed, pwd=…", scrubbed("login failed, pwd=abc"))
+        assertEquals("{\"passphrase\":\"…\"}", scrubbed("{\"passphrase\":\"tern\"}"))
+        unchanged("Wrong password for user")
+        unchanged("The password was not accepted")
+        unchanged("Considered 12 apps")
+    }
+
     @Test
     fun aCodeOfLettersAloneGoesWhenItIsLongOrMixed() {
         assertEquals("token …", scrubbed("token abcdefghijklmnopqrstuvwxyz"))
@@ -182,6 +202,8 @@ class ScrubTest {
             "Authorization: Bearer abc and ghp_0123456789abcdef",
             "key=0123456789abcdef, mail me@example.org",
             "obtainium://add/https%3A%2F%2Fme%3Asecret%40github.com%2Fo%2Fr",
+            "Cookie: sid=abc; pass=1",
+            "pwd=pass1",
         )
         for (sample in samples) {
             val once = scrubbed(sample)
diff --git a/app/src/test/kotlin/io/github/munzzyy/tern/net/NetworkSecurityConfigTest.kt b/app/src/test/kotlin/io/github/munzzyy/tern/net/NetworkSecurityConfigTest.kt
new file mode 100644
index 00000000..9dd3ae76
--- /dev/null
+++ b/app/src/test/kotlin/io/github/munzzyy/tern/net/NetworkSecurityConfigTest.kt
@@ -0,0 +1,47 @@
+package io.github.munzzyy.tern.net
+
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertTrue
+import org.junit.Test
+import org.w3c.dom.Element
+import java.io.File
+import javax.xml.parsers.DocumentBuilderFactory
+
+/**
+ * Tern trusts the certificate authorities Android trusts and no other, for every host, and never
+ * turns Certificate Transparency off. A store that needs more is not read.
+ */
+class NetworkSecurityConfigTest {
+    private val res = File("src/main/res")
+    private val configs = listOf("xml/network_security_config.xml", "xml-v36/network_security_config.xml").map { File(res, it) }
+
+    private fun elements(file: File, tag: String): List<Element> {
+        val document = DocumentBuilderFactory.newInstance().newDocumentBuilder().parse(file)
+        val nodes = document.getElementsByTagName(tag)
+        return (0 until nodes.length).map { nodes.item(it) as Element }
+    }
+
+    @Test
+    fun onlyTheSystemsAuthoritiesAreTrusted() {
+        for (config in configs) {
+            assertTrue("$config exists", config.isFile)
+            val sources = elements(config, "certificates").map { it.getAttribute("src") }
+            assertEquals("$config", listOf("system"), sources)
+            assertEquals("$config names no host of its own", emptyList<Element>(), elements(config, "domain-config"))
+        }
+    }
+
+    @Test
+    fun certificateTransparencyIsNeverTurnedOff() {
+        for (config in configs) {
+            assertTrue("$config", elements(config, "certificateTransparency").none { it.getAttribute("enabled") == "false" })
+        }
+        assertEquals(listOf("true"), elements(configs[1], "certificateTransparency").map { it.getAttribute("enabled") })
+    }
+
+    @Test
+    fun noCertificateShipsInTheApp() {
+        val found = res.walkTopDown().filter { it.isFile && it.extension.lowercase() in setOf("pem", "crt", "cer", "der", "p12", "pfx", "bks") }.toList()
+        assertEquals(emptyList<File>(), found)
+    }
+}
diff --git a/app/src/test/kotlin/io/github/munzzyy/tern/ui/AskedTest.kt b/app/src/test/kotlin/io/github/munzzyy/tern/ui/AskedTest.kt
new file mode 100644
index 00000000..d0312d7b
--- /dev/null
+++ b/app/src/test/kotlin/io/github/munzzyy/tern/ui/AskedTest.kt
@@ -0,0 +1,52 @@
+package io.github.munzzyy.tern.ui
+
+import java.io.File
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertFalse
+import org.junit.Assert.assertNull
+import org.junit.Assert.assertTrue
+import org.junit.Test
+
+/** Another app or a web page cannot start Update all, Add or a check without the person. */
+class AskedTest {
+    @Test
+    fun ternsOwnShortcutsDoWhatTheySay() {
+        assertEquals(Asked.UpdateAll, asked(ACTION_UPDATE_ALL, null, ours = true))
+        assertEquals(Asked.Add, asked(ACTION_ADD, null, ours = true))
+        assertEquals(Asked.Check(RefreshLink.All), asked(ACTION_CHECK, null, ours = true))
+    }
+
+    @Test
+    fun anotherAppSendingTheSameIntentGetsNothingDone() {
+        // As in am start -n io.github.munzzyy.tern/.MainActivity -a io.github.munzzyy.tern.action.UPDATE_ALL
+        assertNull(asked(ACTION_UPDATE_ALL, null, ours = false))
+        assertNull(asked(ACTION_ADD, null, ours = false))
+        assertNull(asked(ACTION_CHECK, null, ours = false))
+    }
+
+    @Test
+    fun aRefreshLinkFromOutsideIsAskedAboutFirst() {
+        assertEquals(Asked.Confirm(RefreshLink.All), asked(ACTION_VIEW, "tern://refresh", ours = false))
+        assertEquals(Asked.Confirm(RefreshLink.One("org.example")), asked(ACTION_VIEW, "obtainium://refresh?id=org.example", ours = false))
+        assertNull(asked(ACTION_VIEW, "tern://add?url=https%3A%2F%2Fexample.org", ours = false))
+        assertNull(asked(ACTION_SEND, null, ours = false))
+    }
+
+    @Test
+    fun aLinkCannotKeepTernChecking() {
+        assertTrue(linkCheckAllowed(null, 1_000))
+        assertFalse(linkCheckAllowed(1_000, 1_000 + LINK_CHECK_GAP_MS - 1))
+        assertTrue(linkCheckAllowed(1_000, 1_000 + LINK_CHECK_GAP_MS))
+    }
+
+    @Test
+    fun theShortcutsComeThroughAnAliasNoOtherAppCanStart() {
+        val manifest = File("src/main/AndroidManifest.xml").readText()
+        val alias = Regex("""<activity-alias\s+android:name="\.Shortcuts"[^>]*>""").find(manifest)!!.value
+        assertTrue(alias, "android:exported=\"false\"" in alias)
+        assertTrue(alias, "android:targetActivity=\".MainActivity\"" in alias)
+        assertTrue(SHORTCUTS.endsWith(".Shortcuts"))
+        // The main activity has to stay exported for the launcher, so it is the alias that is trusted, never the main one.
+        assertFalse(Regex("""<intent-filter>(?:(?!</intent-filter>).)*action\.(UPDATE_ALL|ADD|CHECK)""", RegexOption.DOT_MATCHES_ALL).containsMatchIn(manifest))
+    }
+}
diff --git a/app/src/test/kotlin/io/github/munzzyy/tern/ui/IncomingLinksTest.kt b/app/src/test/kotlin/io/github/munzzyy/tern/ui/IncomingLinksTest.kt
index 97667852..d402bf5c 100644
--- a/app/src/test/kotlin/io/github/munzzyy/tern/ui/IncomingLinksTest.kt
+++ b/app/src/test/kotlin/io/github/munzzyy/tern/ui/IncomingLinksTest.kt
@@ -44,6 +44,14 @@ class IncomingLinksTest {
         assertEquals("https://a.example.org/x", fromLink("tern://add?foo=1&url=https%3A%2F%2Fa.example.org%2Fx#frag"))
     }
 
+    @Test
+    fun ternAppLinksFromTheAddPageReachTheAddScreenWhole() {
+        val link = "tern://app/%7B%22id%22%3A%22org.example.app%22%2C%22url%22%3A%22https%3A%2F%2Fgithub.com%2Fexample%2Fapp%22%7D"
+        assertEquals(link, fromLink(link))
+        assertEquals(link, incomingAddInput(ACTION_VIEW, link, null))
+        assertNull(fromLink("tern://app/"))
+    }
+
     @Test
     fun ternLinkRefusesAnythingButHttps() {
         assertNull(fromLink("tern://add?url=http%3A%2F%2Fexample.org"))
diff --git a/app/src/test/kotlin/io/github/munzzyy/tern/ui/TwoPanesTest.kt b/app/src/test/kotlin/io/github/munzzyy/tern/ui/TwoPanesTest.kt
new file mode 100644
index 00000000..92f805d7
--- /dev/null
+++ b/app/src/test/kotlin/io/github/munzzyy/tern/ui/TwoPanesTest.kt
@@ -0,0 +1,23 @@
+package io.github.munzzyy.tern.ui
+
+import androidx.compose.ui.unit.dp
+import org.junit.Assert.assertFalse
+import org.junit.Assert.assertTrue
+import org.junit.Test
+
+class TwoPanesTest {
+    @Test
+    fun aTelevisionShowsOnePaneAtLargeText() {
+        assertTrue(twoPanesFit(960.dp, 1f))
+        assertTrue(twoPanesFit(960.dp, 1.3f))
+        assertFalse(twoPanesFit(960.dp, 1.5f))
+        assertFalse(twoPanesFit(960.dp, 2f))
+    }
+
+    @Test
+    fun aWideTabletKeepsTwoPanesUntilTheTextOutgrowsThem() {
+        assertTrue(twoPanesFit(1280.dp, 1.5f))
+        assertFalse(twoPanesFit(1280.dp, 2f))
+        assertFalse(twoPanesFit(600.dp, 1f))
+    }
+}
diff --git a/app/src/test/kotlin/io/github/munzzyy/tern/ui/activity/ActivityTextTest.kt b/app/src/test/kotlin/io/github/munzzyy/tern/ui/activity/ActivityTextTest.kt
index d2f9ca92..bfc079eb 100644
--- a/app/src/test/kotlin/io/github/munzzyy/tern/ui/activity/ActivityTextTest.kt
+++ b/app/src/test/kotlin/io/github/munzzyy/tern/ui/activity/ActivityTextTest.kt
@@ -4,6 +4,8 @@ import io.github.munzzyy.tern.engine.Event
 import io.github.munzzyy.tern.engine.EventKind
 import java.time.ZoneOffset
 import org.junit.Assert.assertEquals
+import org.junit.Assert.assertFalse
+import org.junit.Assert.assertTrue
 import org.junit.Test
 
 class ActivityTextTest {
@@ -29,4 +31,17 @@ class ActivityTextTest {
     fun onlyTheProblemsAreSharedWhenOnlyTheyAreShown() {
         assertEquals("2023-11-14 22:14 · Notes · GitHub did not answer", activityText(events, ZoneOffset.UTC, problemsOnly = true))
     }
+
+    @Test
+    fun whatTheSharedLogCarriesIsScrubbedWhateverWroteIt() {
+        val raw = listOf(
+            Event(4, 1_700_000_000_000, "c", "Beta", EventKind.ADDED, "Added https://example.org/a.apk?token=abc123XYZ"),
+            Event(5, 1_700_000_060_000, "c", "Beta", EventKind.CHECK_FAILED, "HTTP 401: Authorization: token ghp_A1b2C3d4E5f6G7h8I9j0K1l2M3n4O5p6Q7r8"),
+            Event(6, 1_700_000_120_000, "d", "Mail", EventKind.FAILED, "Failed to fetch https://u:hunter2@mail.example/x.apk (Cookie: sid=q9; theme=dark)"),
+        )
+        val shared = activityText(raw, ZoneOffset.UTC, problemsOnly = false)
+        for (secret in listOf("abc123XYZ", "ghp_", "hunter2", "sid=q9", "theme=dark")) assertFalse(shared, secret in shared)
+        assertTrue(shared, "Added https://example.org/a.apk" in shared)
+        assertTrue(shared, "Failed to fetch https://mail.example/x.apk" in shared)
+    }
 }
diff --git a/app/src/test/kotlin/io/github/munzzyy/tern/ui/add/FilterAndReadingTest.kt b/app/src/test/kotlin/io/github/munzzyy/tern/ui/add/FilterAndReadingTest.kt
index 07380095..4c447eda 100644
--- a/app/src/test/kotlin/io/github/munzzyy/tern/ui/add/FilterAndReadingTest.kt
+++ b/app/src/test/kotlin/io/github/munzzyy/tern/ui/add/FilterAndReadingTest.kt
@@ -58,13 +58,20 @@ class FilterAndReadingTest {
     }
 
     @Test
-    fun everyKindAPersonMayPickIsOfferedAndVivoAndCoolApkAreNot() {
+    fun everyKindAPersonMayPickIsOfferedAndVivoIsNot() {
         assertEquals(null, READ_AS_CHOICES.first())
         for (type in listOf(SourceTypes.HTML, SourceTypes.DIRECT, SourceTypes.GITHUB, SourceTypes.GITLAB, SourceTypes.FORGEJO, SourceTypes.FDROID_REPO, SourceTypes.JENKINS)) {
             assertTrue(type, type in READ_AS_CHOICES)
         }
         assertFalse(SourceTypes.VIVO in READ_AS_CHOICES)
-        assertFalse(SourceTypes.COOLAPK in READ_AS_CHOICES)
+    }
+
+    @Test
+    fun withStoresOffNoStoreIsOfferedToReadAnAddressAs() {
+        assertTrue(SourceTypes.APKPURE in readAsChoices(storesOn = true))
+        val off = readAsChoices(storesOn = false)
+        assertTrue(off.none { it in SourceTypes.THIRD_PARTY_STORES })
+        assertTrue(SourceTypes.ITCHIO in off && SourceTypes.HTML in off && null in off)
     }
 
     @Test
diff --git a/app/src/test/kotlin/io/github/munzzyy/tern/ui/add/OriginNoteTest.kt b/app/src/test/kotlin/io/github/munzzyy/tern/ui/add/OriginNoteTest.kt
index 26da1263..8e13cecc 100644
--- a/app/src/test/kotlin/io/github/munzzyy/tern/ui/add/OriginNoteTest.kt
+++ b/app/src/test/kotlin/io/github/munzzyy/tern/ui/add/OriginNoteTest.kt
@@ -1,5 +1,6 @@
 package io.github.munzzyy.tern.ui.add
 
+import io.github.munzzyy.tern.R
 import io.github.munzzyy.tern.core.model.SourceSpec
 import io.github.munzzyy.tern.core.source.SourceTypes
 import org.junit.Assert.assertEquals
@@ -8,11 +9,22 @@ import org.junit.Test
 
 class OriginNoteTest {
     @Test
-    fun aStoreThatRepublishesAndASiteThatModifiesAreToldApart() {
+    fun aStoreThatRepublishesAndAStoreDevelopersUploadToAreToldApart() {
         assertEquals(OriginNote.REPUBLISHED, originNote(SourceTypes.APKPURE))
-        assertEquals(OriginNote.MODIFIED, originNote(SourceTypes.LITEAPKS))
+        assertEquals(OriginNote.REPUBLISHED, originNote(SourceTypes.TENCENT))
+        assertEquals(OriginNote.STORE, originNote(SourceTypes.HUAWEI))
+        assertEquals(OriginNote.STORE, originNote(SourceTypes.SAMSUNG))
         assertNull(originNote(SourceTypes.GITHUB))
-        assertNull(originNote(SourceTypes.HUAWEI))
+        assertNull(originNote(SourceTypes.ITCHIO))
+        assertNull(originNote(SourceTypes.TELEGRAM))
+    }
+
+    @Test
+    fun theNoteSaysWhatTheFirstInstallDecidesUnlessAPinDoes() {
+        assertEquals(R.string.origin_republished_first, originText(OriginNote.REPUBLISHED, pinned = false))
+        assertEquals(R.string.origin_republished_pinned, originText(OriginNote.REPUBLISHED, pinned = true))
+        assertEquals(R.string.origin_store_first, originText(OriginNote.STORE, pinned = false))
+        assertEquals(R.string.origin_store_pinned, originText(OriginNote.STORE, pinned = true))
     }
 
     @Test
diff --git a/app/src/test/kotlin/io/github/munzzyy/tern/ui/add/SupportedSourcesTest.kt b/app/src/test/kotlin/io/github/munzzyy/tern/ui/add/SupportedSourcesTest.kt
index b1a0f154..7d8b5e0e 100644
--- a/app/src/test/kotlin/io/github/munzzyy/tern/ui/add/SupportedSourcesTest.kt
+++ b/app/src/test/kotlin/io/github/munzzyy/tern/ui/add/SupportedSourcesTest.kt
@@ -14,7 +14,8 @@ class SupportedSourcesTest {
         assertTrue(SourceTypes.GITHUB in byKind.getValue(SourceKind.FORGES))
         assertTrue(SourceTypes.HUAWEI in byKind.getValue(SourceKind.STORES))
         assertTrue(SourceTypes.APKPURE in byKind.getValue(SourceKind.MIRRORS))
-        assertTrue(SourceTypes.LITEAPKS in byKind.getValue(SourceKind.MODIFIED))
+        assertTrue(SourceTypes.TENCENT in byKind.getValue(SourceKind.MIRRORS))
+        assertTrue(SourceTypes.ITCHIO in byKind.getValue(SourceKind.OTHER))
         assertTrue(SourceTypes.HTML in byKind.getValue(SourceKind.OTHER))
     }
 }
diff --git a/app/src/test/kotlin/io/github/munzzyy/tern/ui/apps/AppListTest.kt b/app/src/test/kotlin/io/github/munzzyy/tern/ui/apps/AppListTest.kt
index 016746f9..8ded1071 100644
--- a/app/src/test/kotlin/io/github/munzzyy/tern/ui/apps/AppListTest.kt
+++ b/app/src/test/kotlin/io/github/munzzyy/tern/ui/apps/AppListTest.kt
@@ -130,6 +130,29 @@ class AppListTest {
         assertEquals(listOf("Maps", "Tools"), arrange(rows, ListQuery(grouping = AppGrouping.CATEGORY), Locale.US).groups.map { it.title })
     }
 
+    @Test
+    fun focusLandsOnTheFirstAppDrawnOrOnTheHeaderOfAFoldedFirstGroup() {
+        val grouped = arrange(rows, ListQuery(grouping = AppGrouping.CATEGORY, updatesFirst = false), Locale.US)
+        assertEquals("c:Maps" + "c", firstPlace(grouped, emptySet()))
+        assertEquals("g-c:Maps", firstPlace(grouped, setOf("c:Maps")))
+        assertEquals("g-c:Maps", firstPlace(grouped, grouped.groups.map { it.key }.toSet()))
+        assertEquals("a", firstPlace(arrange(rows, ListQuery(grouping = AppGrouping.CATEGORY), Locale.US), setOf("c:Maps")))
+        assertEquals("a", firstPlace(arrange(rows, ListQuery(), Locale.US), emptySet()))
+        assertEquals("b", firstPlace(arrange(rows, ListQuery(text = "birch", updatesFirst = false), Locale.US), emptySet()))
+        assertEquals(null, firstPlace(AppSections(emptyList(), emptyList()), emptySet()))
+    }
+
+    @Test
+    fun selectAllTakesOnlyWhatIsShownAndAnAppShownTwiceOnce() {
+        val grouped = arrange(rows, ListQuery(grouping = AppGrouping.CATEGORY, updatesFirst = false), Locale.US)
+        assertEquals(listOf("c", "b", "a", "d", "e"), shownIds(grouped, emptySet()))
+        assertEquals(listOf("b", "c", "a", "d", "e"), shownIds(grouped, setOf("c:Maps")))
+        assertEquals(listOf("c"), shownIds(grouped, setOf("c:Tools", "c:")))
+        val updatesOnTop = arrange(rows, ListQuery(grouping = AppGrouping.CATEGORY), Locale.US)
+        assertEquals(listOf("a", "d", "e"), shownIds(updatesOnTop, updatesOnTop.groups.map { it.key }.toSet()))
+        assertEquals(listOf("a", "d", "e", "b", "c"), shownIds(arrange(rows, ListQuery(), Locale.US), emptySet()))
+    }
+
     @Test
     fun groupsBySourceAreNamedAsPeopleKnowThem() {
         val s = arrange(rows, ListQuery(grouping = AppGrouping.SOURCE, updatesFirst = false), Locale.US)
diff --git a/app/src/test/kotlin/io/github/munzzyy/tern/ui/detail/SourceOptionsTest.kt b/app/src/test/kotlin/io/github/munzzyy/tern/ui/detail/SourceOptionsTest.kt
index b578ad1e..02ea5ab9 100644
--- a/app/src/test/kotlin/io/github/munzzyy/tern/ui/detail/SourceOptionsTest.kt
+++ b/app/src/test/kotlin/io/github/munzzyy/tern/ui/detail/SourceOptionsTest.kt
@@ -26,7 +26,7 @@ class SourceOptionsTest {
         val draft = OptionsDraft.of(page)
         assertEquals(listOf(HtmlStep("releases"), HtmlStep("arm64", byText = true, arch = true)), draft.steps)
         val typed = draft.steps + HtmlStep(" latest ", pageOrder = true, firstLink = true, lastSegment = true, anyText = true)
-        val saved = draft.copy(steps = typed, headers = "User-Agent: Mozilla/5.0").applyTo(page)
+        val saved = draft.copy(steps = typed, headers = "Referer: https://example.com/").applyTo(page)
         val steps = Json.parseArray(saved.option(SourceOptions.STEPS)!!)
         assertEquals("releases", (steps[0] as io.github.munzzyy.tern.core.json.JsonString).value)
         assertEquals(Json.parseObject("""{"filter":"arm64","text":true,"arch":true}"""), steps[1])
@@ -34,7 +34,7 @@ class SourceOptionsTest {
         assertTrue("steps" in draft.copy(steps = listOf(HtmlStep(" "))).invalid(SourceTypes.HTML))
         assertTrue("steps" in draft.copy(steps = listOf(HtmlStep("("))).invalid(SourceTypes.HTML))
         assertEquals("page", saved.option(SourceOptions.SORT))
-        assertEquals("""{"User-Agent":"Mozilla/5.0"}""", saved.option(SourceOptions.HEADERS))
+        assertEquals("""{"Referer":"https://example.com/"}""", saved.option(SourceOptions.HEADERS))
         assertNull(draft.copy(linkFilter = "  ").applyTo(page).option(SourceOptions.LINK_FILTER))
     }
 
@@ -48,6 +48,7 @@ class SourceOptionsTest {
         assertTrue("linkFilter" in OptionsDraft(linkFilter = "(").invalid(SourceTypes.HTML))
         assertTrue("workflow" in OptionsDraft(workflow = "build").invalid(SourceTypes.GITHUB_ACTIONS))
         assertEquals(emptySet<String>(), OptionsDraft(workflow = "build.yml", branch = "main").invalid(SourceTypes.GITHUB_ACTIONS))
-        assertTrue("csc" in OptionsDraft(csc = "EUROPE").invalid(SourceTypes.SAMSUNG))
+        assertNull("Tern says who it is to every site", OptionsDraft.headerMap("User-Agent: Mozilla/5.0"))
+        assertTrue("headers" in OptionsDraft(headers = "user-agent: Example/1.0").invalid(SourceTypes.HTML))
     }
 }
diff --git a/app/src/test/kotlin/io/github/munzzyy/tern/ui/settings/IntervalButtonsTest.kt b/app/src/test/kotlin/io/github/munzzyy/tern/ui/settings/IntervalButtonsTest.kt
new file mode 100644
index 00000000..0abe5d86
--- /dev/null
+++ b/app/src/test/kotlin/io/github/munzzyy/tern/ui/settings/IntervalButtonsTest.kt
@@ -0,0 +1,32 @@
+package io.github.munzzyy.tern.ui.settings
+
+import io.github.munzzyy.tern.R
+import io.github.munzzyy.tern.ui.text.intervalStops
+import org.junit.Assert.assertEquals
+import org.junit.Test
+
+class IntervalButtonsTest {
+    private val stops = intervalStops(60)
+
+    @Test
+    fun theMinusButtonSaysWhenItTurnsTheChecksOff() {
+        assertEquals(R.string.interval_turn_off, minusLabel(stops, stops.indexOf(15)))
+        assertEquals(R.string.interval_more_often, minusLabel(stops, stops.indexOf(20)))
+        assertEquals(R.string.interval_more_often, minusLabel(stops, stops.lastIndex))
+    }
+
+    @Test
+    fun thePlusButtonSaysWhenItTurnsTheChecksOn() {
+        assertEquals(R.string.interval_turn_on, plusLabel(stops, stops.indexOf(0)))
+        assertEquals(R.string.interval_less_often, plusLabel(stops, stops.indexOf(15)))
+        assertEquals(R.string.interval_less_often, plusLabel(stops, stops.lastIndex))
+    }
+
+    @Test
+    fun anIntervalOfItsOwnBelowAQuarterOfAnHourStillTurnsOffOneStepDown() {
+        val own = intervalStops(5)
+        assertEquals(listOf(0, 5, 15), own.take(3))
+        assertEquals(R.string.interval_turn_off, minusLabel(own, 1))
+        assertEquals(R.string.interval_more_often, minusLabel(own, 2))
+    }
+}
diff --git a/app/src/test/kotlin/io/github/munzzyy/tern/ui/settings/SelfSourceTest.kt b/app/src/test/kotlin/io/github/munzzyy/tern/ui/settings/SelfSourceTest.kt
new file mode 100644
index 00000000..df0f3dbb
--- /dev/null
+++ b/app/src/test/kotlin/io/github/munzzyy/tern/ui/settings/SelfSourceTest.kt
@@ -0,0 +1,40 @@
+package io.github.munzzyy.tern.ui.settings
+
+import java.io.File
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertFalse
+import org.junit.Assert.assertTrue
+import org.junit.Test
+
+/** A copy of Tern that F-Droid installed keeps getting F-Droid's builds. */
+class SelfSourceTest {
+    @Test
+    fun aCopyAnFDroidClientInstalledFollowsFDroid() {
+        for (client in listOf("org.fdroid.fdroid", "org.fdroid.basic", "org.fdroid.fdroid.privileged", "com.looker.droidify", "com.machiav3lli.fdroid", "eu.bubu1.fdroidclassic")) {
+            assertEquals(client, FDROID_URL, selfSource(client))
+        }
+    }
+
+    @Test
+    fun anyOtherCopyFollowsGitHub() {
+        for (installer in listOf(null, "com.google.android.packageinstaller", "com.android.shell", "io.github.munzzyy.tern", "dev.imranr.obtainium")) {
+            assertEquals(installer.toString(), SOURCE_URL, selfSource(installer))
+        }
+    }
+
+    @Test
+    fun followingFDroidCountsAsTracked() {
+        assertTrue(tracksItself(listOf(FDROID_URL to null), "io.github.munzzyy.tern"))
+        assertTrue(tracksItself(listOf("https://github.com/munzzyy/tern/" to null), "io.github.munzzyy.tern"))
+        assertFalse(tracksItself(listOf("https://github.com/example/app" to "org.example"), "io.github.munzzyy.tern"))
+    }
+
+    @Test
+    fun choosingGitHubOnAnFDroidCopySaysItSkipsFDroidsChecks() {
+        val text = File("src/main/res/values/strings_safety.xml").readText()
+        val github = Regex("""name="about_track_tern_github_effect">([^<]*)<""").find(text)!!.groupValues[1]
+        assertTrue(github, "skips F-Droid\\'s checks" in github)
+        val fdroid = Regex("""name="about_track_tern_fdroid_effect">([^<]*)<""").find(text)!!.groupValues[1]
+        assertTrue(fdroid, "F-Droid made and checked" in fdroid)
+    }
+}
diff --git a/app/src/test/kotlin/io/github/munzzyy/tern/ui/text/EvidenceTest.kt b/app/src/test/kotlin/io/github/munzzyy/tern/ui/text/EvidenceTest.kt
index 80921044..e192aaac 100644
--- a/app/src/test/kotlin/io/github/munzzyy/tern/ui/text/EvidenceTest.kt
+++ b/app/src/test/kotlin/io/github/munzzyy/tern/ui/text/EvidenceTest.kt
@@ -1,12 +1,14 @@
 package io.github.munzzyy.tern.ui.text
 
 import io.github.munzzyy.tern.R
+import io.github.munzzyy.tern.core.source.SourceTypes
 import io.github.munzzyy.tern.engine.AppStatus
 import io.github.munzzyy.tern.engine.ChecksumState
 import io.github.munzzyy.tern.engine.Problem
 import io.github.munzzyy.tern.engine.ProblemKind
 import io.github.munzzyy.tern.engine.SignerState
 import io.github.munzzyy.tern.engine.Verification
+import io.github.munzzyy.tern.engine.real.Evaluator
 import io.github.munzzyy.tern.ui.testRow
 import org.junit.Assert.assertEquals
 import org.junit.Assert.assertFalse
@@ -39,6 +41,21 @@ class EvidenceTest {
         assertEquals(R.string.checksum_not_published, checksumLine(v(SignerState.MATCHES_PIN, true, ChecksumState.NOT_PUBLISHED)).text)
     }
 
+    @Test
+    fun aStoresChecksumIsCalledTheStoresAndNotThePublishers() {
+        val store = v(SignerState.FIRST_SEEN, true).copy(checksumFromStore = true)
+        assertEquals(R.string.stores_checksum_matched, checksumLine(store).text)
+        assertEquals(R.string.stores_explain_checksum_matched, checksumExplanation(store))
+        assertEquals(R.string.checksum_matched, checksumLine(v(SignerState.FIRST_SEEN, true)).text)
+        assertEquals(R.string.explain_checksum_matched, checksumExplanation(v(SignerState.FIRST_SEEN, true)))
+
+        assertTrue(Evaluator.fromStore(SourceTypes.APKPURE, ChecksumState.MATCHED))
+        assertTrue(Evaluator.fromStore(SourceTypes.HUAWEI, ChecksumState.PENDING))
+        assertFalse(Evaluator.fromStore(SourceTypes.APKPURE, ChecksumState.NOT_PUBLISHED))
+        assertFalse(Evaluator.fromStore(SourceTypes.GITHUB, ChecksumState.MATCHED))
+        assertFalse(Evaluator.fromStore(SourceTypes.ITCHIO, ChecksumState.MATCHED))
+    }
+
     @Test
     fun fingerprintIsColonPairsUppercase() {
         assertEquals("AB:CD:01", formatFingerprint("abcd01"))
diff --git a/app/src/test/kotlin/io/github/munzzyy/tern/ui/text/StatusTest.kt b/app/src/test/kotlin/io/github/munzzyy/tern/ui/text/StatusTest.kt
index 4f2e52c9..f518bdba 100644
--- a/app/src/test/kotlin/io/github/munzzyy/tern/ui/text/StatusTest.kt
+++ b/app/src/test/kotlin/io/github/munzzyy/tern/ui/text/StatusTest.kt
@@ -6,6 +6,7 @@ import io.github.munzzyy.tern.engine.Phase
 import io.github.munzzyy.tern.engine.Problem
 import io.github.munzzyy.tern.engine.ProblemKind
 import io.github.munzzyy.tern.engine.Progress
+import io.github.munzzyy.tern.engine.real.Checks
 import io.github.munzzyy.tern.ui.testRow
 import org.junit.Assert.assertEquals
 import org.junit.Assert.assertFalse
@@ -34,6 +35,21 @@ class StatusTest {
         assertEquals(StatusLabel.DOWNLOADING, statusLabel(row.copy(progress = Progress(Phase.DOWNLOADING, 1, 2))))
     }
 
+    @Test
+    fun anAppPausedWhileStoresAreOffOffersNothingButTurningThemOn() {
+        val paused = Checks.paused("paused")
+        val row = testRow(status = paused.status, problem = paused.problem, offered = "2.0")
+        assertEquals(StatusLabel.PAUSED, statusLabel(row))
+        assertEquals(Tone.NEUTRAL, statusLabel(row).tone)
+        assertTrue(isPaused(row))
+        assertNull(primaryAction(row))
+        assertNull(inlineAction(row))
+        assertFalse(canPickInstall(row))
+        assertFalse(canInstallNow(row))
+        assertFalse(canUpdateNow(row))
+        assertEquals(R.string.stores_advice, problemAdvice(ProblemKind.STORES_OFF))
+    }
+
     @Test
     fun rateLimitGetsItsOwnLabel() {
         val row = testRow(status = AppStatus.ERROR, problem = Problem(ProblemKind.RATE_LIMITED, "slow down", 5))
diff --git a/app/src/test/kotlin/io/github/munzzyy/tern/work/SchedulerTest.kt b/app/src/test/kotlin/io/github/munzzyy/tern/work/SchedulerTest.kt
new file mode 100644
index 00000000..058b216c
--- /dev/null
+++ b/app/src/test/kotlin/io/github/munzzyy/tern/work/SchedulerTest.kt
@@ -0,0 +1,49 @@
+package io.github.munzzyy.tern.work
+
+import android.app.job.JobInfo
+import io.github.munzzyy.tern.engine.Settings
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertFalse
+import org.junit.Assert.assertTrue
+import org.junit.Test
+
+class SchedulerTest {
+    private val held = Settings(autoInstalls = true, onlyOnUnmetered = true, onlyWhileCharging = true)
+    private val never = { throw AssertionError("the waiting job asked the device again") }
+
+    @Test
+    fun theWaitingJobInstallsWhateverTheDeviceSaysAndNeverAsksIt() {
+        // JobScheduler counted a charger paused at 80 % as charging; BatteryManager would say no.
+        assertTrue(Scheduler.installsNow(held, waitingJob = true, unmetered = never, charging = never))
+        assertFalse(Scheduler.installsNow(held.copy(autoInstalls = false), waitingJob = true, unmetered = never, charging = never))
+    }
+
+    @Test
+    fun theWaitingJobNeverSetsItselfAgain() {
+        assertFalse(Scheduler.armsWaiting(held, waitingJob = true, waited = true))
+        assertFalse(Scheduler.armsWaiting(held, waitingJob = true, waited = false))
+    }
+
+    @Test
+    fun aPeriodicRunThatHeldInstallsBackSetsOneWaitingJob() {
+        assertFalse(Scheduler.installsNow(held, waitingJob = false, unmetered = { false }, charging = { true }))
+        assertFalse(Scheduler.installsNow(held, waitingJob = false, unmetered = { true }, charging = { false }))
+        assertTrue(Scheduler.installsNow(held, waitingJob = false, unmetered = { true }, charging = { true }))
+        assertTrue(Scheduler.armsWaiting(held, waitingJob = false, waited = true))
+        assertFalse(Scheduler.armsWaiting(held, waitingJob = false, waited = false))
+        assertFalse(Scheduler.armsWaiting(held.copy(autoInstalls = false), waitingJob = false, waited = true))
+    }
+
+    @Test
+    fun theWaitingJobWaitsAQuarterOfAnHourAtLeast() {
+        assertEquals(15 * 60 * 1000L, Scheduler.WAITING_LATENCY_MS)
+    }
+
+    @Test
+    fun checksWaitForWiFiOnlyWhenTheCheckSettingSaysSo() {
+        assertEquals(JobInfo.NETWORK_TYPE_ANY, Scheduler.checkNetwork(Settings(onlyOnUnmetered = true)))
+        assertEquals(JobInfo.NETWORK_TYPE_UNMETERED, Scheduler.checkNetwork(Settings(checkOnlyOnUnmetered = true)))
+        assertEquals(JobInfo.NETWORK_TYPE_UNMETERED, Scheduler.installNetwork(Settings(onlyOnUnmetered = true)))
+        assertEquals(JobInfo.NETWORK_TYPE_ANY, Scheduler.installNetwork(Settings(checkOnlyOnUnmetered = true)))
+    }
+}
diff --git a/core/build.gradle.kts b/core/build.gradle.kts
index 4156cdee..f9a1bbd5 100644
--- a/core/build.gradle.kts
+++ b/core/build.gradle.kts
@@ -26,6 +26,8 @@ tasks.test {
     // CatalogTest reads these from disk, so a change to one of them has to run the tests again.
     inputs.files("../docs/SUGGESTIONS.md", "../app/src/main/res/values/strings_suggest.xml")
         .withPropertyName("catalogFiles").withPathSensitivity(PathSensitivity.RELATIVE)
+    // PrivacyHostsTest reads PRIVACY.md.
+    inputs.files("../PRIVACY.md").withPropertyName("privacyPolicy").withPathSensitivity(PathSensitivity.RELATIVE)
     systemProperty("tern.live", System.getProperty("tern.live") ?: "false")
     systemProperty("tern.index", System.getProperty("tern.index") ?: "")
     testLogging.showStandardStreams = System.getProperty("tern.live") == "true" || System.getProperty("tern.index") != null
diff --git a/core/src/main/kotlin/io/github/munzzyy/tern/core/compress/Lzma2.kt b/core/src/main/kotlin/io/github/munzzyy/tern/core/compress/Lzma2.kt
index 7ec39579..538e65f3 100644
--- a/core/src/main/kotlin/io/github/munzzyy/tern/core/compress/Lzma2.kt
+++ b/core/src/main/kotlin/io/github/munzzyy/tern/core/compress/Lzma2.kt
@@ -4,8 +4,8 @@ package io.github.munzzyy.tern.core.compress
  * The data of one xz block: LZMA2 chunks up to the one that ends it. A chunk is stored as it is, or
  * packed with LZMA; either way it goes through the same dictionary.
  */
-internal class Lzma2(private val input: Counted, dictionary: Int) {
-    private val window = Window(maxOf(MIN_DICTIONARY, (dictionary + 15) and 15.inv()))
+internal class Lzma2(private val input: Counted, dictionary: Int, firstWindow: Int = XzInputStream.FIRST_WINDOW) {
+    private val window = Window(maxOf(MIN_DICTIONARY, (dictionary + 15) and 15.inv()), firstWindow)
     private val range = RangeDecoder()
     private var lzma: Lzma? = null
     private var left = 0
@@ -92,10 +92,12 @@ internal class Lzma2(private val input: Counted, dictionary: Int) {
 /**
  * The last [size] bytes given out, which matches copy from. What was decoded but not yet handed on
  * lies between start and pos; a match cut short by the end of what was asked for is finished first
- * the next time.
+ * the next time. The buffer starts at [first] bytes and grows as the data fills it, and it wraps
+ * only once it is [size] long, so no distance within [size] is ever lost to a smaller one.
+ * [allocate] makes each buffer; running out of memory for one refuses the data.
  */
-internal class Window(size: Int) {
-    private val buf = ByteArray(size)
+internal class Window(private val size: Int, first: Int = size, private val allocate: (Int) -> ByteArray = ::ByteArray) {
+    private var buf = make(minOf(size, maxOf(MIN_FIRST, (first + 15) and 15.inv())))
     private var start = 0
     var pos = 0
         private set
@@ -104,6 +106,9 @@ internal class Window(size: Int) {
     private var pendingLength = 0
     private var pendingDistance = 0
 
+    /** How much memory the dictionary holds now. */
+    val capacity: Int get() = buf.size
+
     fun reset() {
         start = 0
         pos = 0
@@ -114,6 +119,7 @@ internal class Window(size: Int) {
     }
 
     fun limit(most: Int) {
+        room(most)
         limit = if (buf.size - pos <= most) buf.size else pos + most
     }
 
@@ -153,6 +159,7 @@ internal class Window(size: Int) {
     }
 
     fun copy(input: Counted, length: Int) {
+        room(length)
         val size = minOf(buf.size - pos, length)
         input.fully(buf, pos, size)
         pos += size
@@ -161,11 +168,33 @@ internal class Window(size: Int) {
 
     fun flush(out: ByteArray, off: Int): Int {
         val size = pos - start
-        if (pos == buf.size) pos = 0
         System.arraycopy(buf, start, out, off, size)
+        if (pos == buf.size) {
+            if (buf.size < this.size) grow(buf.size + 1) else pos = 0
+        }
         start = pos
         return size
     }
+
+    /** Grows the buffer, while it has not wrapped yet, so that [length] more bytes fit after pos. */
+    private fun room(length: Int) {
+        if (buf.size < size && full == pos && buf.size - pos < length) grow(pos + length)
+    }
+
+    private fun grow(need: Int) {
+        val next = minOf(size.toLong(), (maxOf(need.toLong(), buf.size * 2L) + 15) and 15L.inv()).toInt()
+        buf = make(next).also { System.arraycopy(buf, 0, it, 0, pos) }
+    }
+
+    private fun make(length: Int): ByteArray = try {
+        allocate(length)
+    } catch (_: OutOfMemoryError) {
+        throw CompressedDataException("This xz data needs a dictionary of ${size / (1024 * 1024)} MiB, more memory than this device gives Tern")
+    }
+
+    private companion object {
+        const val MIN_FIRST = 4096
+    }
 }
 
 /** The range decoder over one chunk, which is read whole first; it may not read past the chunk. */
diff --git a/core/src/main/kotlin/io/github/munzzyy/tern/core/compress/XzInputStream.kt b/core/src/main/kotlin/io/github/munzzyy/tern/core/compress/XzInputStream.kt
index 5a561a37..838eef02 100644
--- a/core/src/main/kotlin/io/github/munzzyy/tern/core/compress/XzInputStream.kt
+++ b/core/src/main/kotlin/io/github/munzzyy/tern/core/compress/XzInputStream.kt
@@ -9,12 +9,16 @@ import java.util.zip.CRC32
  * otherwise: one stream, or several one after the other. Every header, block, index and footer is
  * held to its CRC, and what each block holds to the check the stream names (CRC32, CRC64 or
  * SHA-256). The dictionary is nearly all the memory this takes, and one larger than
- * [maxDictionary] is refused. No more than [maxOutput] bytes come out.
+ * [maxDictionary] is refused. It is made [firstWindow] bytes long and grows only as far as the
+ * data fills it, so a small file names 64 MiB and takes little; where the device has no memory
+ * for the rest, the data is refused like any other it cannot read. No more than [maxOutput]
+ * bytes come out.
  */
 class XzInputStream(
     input: InputStream,
     private val maxOutput: Long = Long.MAX_VALUE,
     private val maxDictionary: Int = MAX_DICTIONARY,
+    private val firstWindow: Int = FIRST_WINDOW,
 ) : InputStream() {
     private val raw = Counted(input)
     private var streams = 0
@@ -134,7 +138,7 @@ class XzInputStream(
         }
         reader.zeros()
         check.reset()
-        block = Block(size, compressedSize, uncompressedSize, raw.count, Lzma2(raw, dictionary))
+        block = Block(size, compressedSize, uncompressedSize, raw.count, Lzma2(raw, dictionary, firstWindow))
     }
 
     private fun endBlock(ended: Block) {
@@ -255,6 +259,8 @@ class XzInputStream(
         /** What xz -9 uses. */
         const val MAX_DICTIONARY = 64 * 1024 * 1024
 
+        const val FIRST_WINDOW = 1024 * 1024
+
         private const val STREAM_HEADER = 12
         private const val MAX_NUMBER_BYTES = 9
         private const val LZMA2_FILTER = 0x21L
diff --git a/core/src/main/kotlin/io/github/munzzyy/tern/core/icon/IconAddresses.kt b/core/src/main/kotlin/io/github/munzzyy/tern/core/icon/IconAddresses.kt
index e83c2ea6..b16a3611 100644
--- a/core/src/main/kotlin/io/github/munzzyy/tern/core/icon/IconAddresses.kt
+++ b/core/src/main/kotlin/io/github/munzzyy/tern/core/icon/IconAddresses.kt
@@ -17,8 +17,6 @@ object IconAddresses {
         "appgallery.huawei.ru" to setOf("appimg-dra.dbankcdn.com", "appimg-drcn.dbankcdn.com"),
         "detail-browser.vivo.com.cn" to setOf("imgwsdl.vivo.com.cn", "appstoreimg-ipv6.vivo.com.cn"),
         "sj.qq.com" to setOf("pp.myapp.com"),
-        "www.coolapk.com" to setOf("pp.myapp.com"),
-        "www.rustore.ru" to setOf("static.rustore.ru"),
         "apkpure.com" to setOf("image.winudf.com"),
         "apkpure.net" to setOf("image.winudf.com"),
         "www.apkmirror.com" to setOf("downloadr2.apkmirror.com"),
@@ -27,7 +25,6 @@ object IconAddresses {
     /** The same, for stores that give every app a host of its own under theirs, as in app.en.aptoide.com. */
     val OTHER_HOSTS_UNDER: Map<String, Set<String>> = mapOf(
         "aptoide.com" to setOf("pool.img.aptoide.com"),
-        "uptodown.com" to setOf("img.utdstc.com"),
     )
 
     /** What is left of [candidates], in their order, for a source at [sourceUrl]: HTTPS only, and no host but the allowed ones. */
diff --git a/core/src/main/kotlin/io/github/munzzyy/tern/core/interop/AppConfigJson.kt b/core/src/main/kotlin/io/github/munzzyy/tern/core/interop/AppConfigJson.kt
index 93e4fd57..c8239a4a 100644
--- a/core/src/main/kotlin/io/github/munzzyy/tern/core/interop/AppConfigJson.kt
+++ b/core/src/main/kotlin/io/github/munzzyy/tern/core/interop/AppConfigJson.kt
@@ -12,14 +12,20 @@ import io.github.munzzyy.tern.core.model.UpdateMode
 import io.github.munzzyy.tern.core.model.VersionFrom
 import io.github.munzzyy.tern.core.apk.BinaryManifest
 import io.github.munzzyy.tern.core.net.Urls
+import io.github.munzzyy.tern.core.source.SourceOptions
 import io.github.munzzyy.tern.core.source.SourceTypes
+import io.github.munzzyy.tern.core.source.web.HtmlStep
 import io.github.munzzyy.tern.core.text.Shown
 import io.github.munzzyy.tern.core.verify.Fingerprints
 
 class AppConfigJsonException(message: String) : Exception(message)
 
 object AppConfigJson {
-    const val SCHEMA = 1
+    /**
+     * 2 since web page apps read their pages the way Obtainium does. A row of 1 that names no
+     * release order was written by Tern 0.1.0 and is read as that version meant it: see [fromV010].
+     */
+    const val SCHEMA = 2
 
     fun encode(config: AppConfig): JsonObject = Json.obj(
         "schema" to SCHEMA,
@@ -65,6 +71,33 @@ object AppConfigJson {
     )
 
     fun decode(obj: JsonObject): AppConfig {
+        val config = decodeAsWritten(obj)
+        val v010 = (obj.long("schema") ?: 1L) < 2L && obj.obj("releases")?.fields?.containsKey("order") != true
+        return if (v010) fromV010(config) else config
+    }
+
+    /**
+     * What an app saved by Tern 0.1.0 meant, in the terms of this one. 0.1.0 always wrote a wait
+     * of 0 days, which was no choice of the person's, so it follows the setting now. A web page app
+     * took the first link that matched each step in the order of the page, and on the last page the
+     * highest version, with its version pattern run over the version it guessed.
+     */
+    internal fun fromV010(config: AppConfig): AppConfig {
+        var releases = config.releases
+        if (releases.minAgeDays == 0) releases = releases.copy(minAgeDays = null)
+        var source = config.source
+        if (source.type == SourceTypes.HTML) {
+            val steps = HtmlStep.parse(source.option(SourceOptions.STEPS))
+                ?.map { it.copy(pageOrder = true, firstLink = true) }
+                ?.let(HtmlStep::write)
+            var options = source.options + (SourceOptions.HIGHEST_VERSION to "true")
+            if (steps != null) options = options + (SourceOptions.STEPS to steps)
+            source = source.copy(options = options)
+        }
+        return config.copy(releases = releases, source = source)
+    }
+
+    private fun decodeAsWritten(obj: JsonObject): AppConfig {
         val id = short(obj.string("id"), "id") ?: throw AppConfigJsonException("Missing id")
         val sourceObj = obj.obj("source") ?: throw AppConfigJsonException("Missing source")
         val type = sourceObj.string("type") ?: throw AppConfigJsonException("Missing source.type")
diff --git a/core/src/main/kotlin/io/github/munzzyy/tern/core/interop/ConfigLink.kt b/core/src/main/kotlin/io/github/munzzyy/tern/core/interop/ConfigLink.kt
index ec64c836..c1b108e5 100644
--- a/core/src/main/kotlin/io/github/munzzyy/tern/core/interop/ConfigLink.kt
+++ b/core/src/main/kotlin/io/github/munzzyy/tern/core/interop/ConfigLink.kt
@@ -4,16 +4,16 @@ import io.github.munzzyy.tern.core.json.Json
 import io.github.munzzyy.tern.core.json.JsonObject
 import io.github.munzzyy.tern.core.json.JsonValue
 import io.github.munzzyy.tern.core.model.AppConfig
-import io.github.munzzyy.tern.core.model.SourceSpec
 import io.github.munzzyy.tern.core.net.Urls
-import io.github.munzzyy.tern.core.source.SourceOptions
 import io.github.munzzyy.tern.core.source.web.RequestHeaders
 
 /**
- * An app's settings as a link, the way Obtainium shares them: obtainium://app/ and the app as
- * Obtainium stores it, and the same link behind Obtainium's web page for chat apps that only
- * make web addresses clickable. Tern and Obtainium both open either, and show what the link
- * carries before anything is stored.
+ * An app's settings as a link: obtainium://app/ and the app as Obtainium stores it, which Tern
+ * and Obtainium both open, and two web addresses for chat apps that only make those clickable.
+ * [tern] is Tern's own page with the app after '#', which a browser keeps to itself, so no server
+ * learns what was shared. [web] is Obtainium's page, which is sent the whole link; it is offered
+ * only by name, for someone who uses Obtainium. Both apps show what a link carries before
+ * anything is stored.
  *
  * A token is never part of one: Tern keeps tokens apart from an app's settings, and a request
  * header goes along only when it is one of a few that say how to ask and never who asks. What
@@ -25,12 +25,12 @@ object ConfigLink {
 
     private const val PREFIX = "obtainium://app/"
 
+    /** Tern's page that opens an app in Tern, or offers Tern to whoever does not have it yet. */
+    const val ADD_PAGE = "https://tern.munzzyy.dev/add/"
+
     /** The keys of Obtainium's own links. The rest of what it stores of an app is how the app stands on one device. */
     private val KEYS = listOf("id", "url", "author", "name", "preferredApkIndex", "additionalSettings", "overrideSource")
 
-    /** Headers that carry no secret. Any other can hold a key, so it stays out of a link. */
-    private val PLAIN_HEADERS = setOf("user-agent", "accept", "accept-language", "referer")
-
     /** The obtainium:// link to [app]; null when Obtainium has no source for it, or when Tern could not read it back. */
     fun of(app: AppConfig): String? {
         // Without a package name the id is one Obtainium replaces at the first install, as the export writes it.
@@ -40,16 +40,15 @@ object ConfigLink {
         return (PREFIX + Urls.encodeSegment(Json.write(JsonObject(fields)))).takeIf { it.length <= MAX_LENGTH }
     }
 
-    /** [of] behind Obtainium's web page, which hands it on to Tern or Obtainium, whichever opens such links. */
+    /** [of] behind Obtainium's web page, which hands it on to Tern or Obtainium, whichever opens such links. Obtainium's server sees all of it. */
     fun web(app: AppConfig): String? = of(app)?.let { ObtainiumLink.WEB_REDIRECT + it }?.takeIf { it.length <= MAX_LENGTH }
 
-    private fun shared(app: AppConfig): AppConfig =
-        app.copy(notes = null, categories = emptyList(), favorite = false, source = withPlainHeaders(app.source))
+    /** The app of [of] on Tern's page, after '#app='. The page makes a tern://app/ link of it. */
+    fun tern(app: AppConfig): String? = of(app)?.let { ADD_PAGE + "#app=" + it.removePrefix(PREFIX) }?.takeIf { it.length <= MAX_LENGTH }
 
-    private fun withPlainHeaders(spec: SourceSpec): SourceSpec {
-        val raw = spec.option(SourceOptions.HEADERS) ?: return spec
-        val plain = runCatching { RequestHeaders.parse(raw) }.getOrDefault(emptyMap()).filterKeys { it.lowercase() in PLAIN_HEADERS }
-        val options = if (plain.isEmpty()) spec.options - SourceOptions.HEADERS else spec.options + (SourceOptions.HEADERS to RequestHeaders.write(plain))
-        return spec.copy(options = options)
-    }
+    /** Tern's page for the app at [sourceUrl], with the address after '#url='. */
+    fun ternAddress(sourceUrl: String): String = ADD_PAGE + "#url=" + Urls.encodeSegment(sourceUrl)
+
+    private fun shared(app: AppConfig): AppConfig =
+        app.copy(notes = null, categories = emptyList(), favorite = false, source = RequestHeaders.plainOnly(app.source))
 }
diff --git a/core/src/main/kotlin/io/github/munzzyy/tern/core/interop/ObtainiumExport.kt b/core/src/main/kotlin/io/github/munzzyy/tern/core/interop/ObtainiumExport.kt
index b9700cd2..67863d6b 100644
--- a/core/src/main/kotlin/io/github/munzzyy/tern/core/interop/ObtainiumExport.kt
+++ b/core/src/main/kotlin/io/github/munzzyy/tern/core/interop/ObtainiumExport.kt
@@ -2,7 +2,6 @@ package io.github.munzzyy.tern.core.interop
 
 import io.github.munzzyy.tern.core.json.Json
 import io.github.munzzyy.tern.core.json.JsonObject
-import io.github.munzzyy.tern.core.json.JsonString
 import io.github.munzzyy.tern.core.json.JsonValue
 import io.github.munzzyy.tern.core.model.AppConfig
 import io.github.munzzyy.tern.core.model.ReleaseOrder
@@ -13,6 +12,7 @@ import io.github.munzzyy.tern.core.source.SourceOptions
 import io.github.munzzyy.tern.core.source.SourceTypes
 import io.github.munzzyy.tern.core.source.web.HtmlStep
 import io.github.munzzyy.tern.core.source.web.PseudoVersion
+import io.github.munzzyy.tern.core.source.web.RequestHeaders
 import io.github.munzzyy.tern.core.verify.Fingerprints
 import java.text.SimpleDateFormat
 import java.util.Date
@@ -122,11 +122,6 @@ object ObtainiumExport {
                 settings["appIdOrName"] = pkg
                 url = "$url?appId=${Urls.encodeSegment(pkg)}"
             }
-            SourceTypes.SAMSUNG -> {
-                app.source.option(SourceOptions.DEVICE_MODEL)?.let { settings["deviceId"] = it }
-                app.source.option(SourceOptions.CSC)?.let { settings["csc"] = it }
-            }
-            SourceTypes.FARSROID -> if (app.source.flag(SourceOptions.FILE_VERSION)) settings["releaseTitleAsVersion"] = true
         }
         return Json.obj(
             "id" to (app.packageName ?: temporaryId(app.source.url)),
@@ -175,12 +170,11 @@ object ObtainiumExport {
         "matchLinksOutsideATags" to step.anyText,
     )
 
-    /** The request headers and the way to tell files apart that the HTML and direct link sources share with Obtainium's. */
+    /** The request headers that hold no key, and the way to tell files apart that the HTML and direct link sources share with Obtainium's. */
     private fun web(app: AppConfig, settings: MutableMap<String, Any?>) {
         val spec = app.source
-        spec.option(SourceOptions.HEADERS)?.let { raw ->
-            val headers = runCatching { Json.parseObject(raw).fields }.getOrDefault(emptyMap())
-                .mapNotNull { (name, value) -> (value as? JsonString)?.value?.let { mapOf("requestHeader" to "$name: $it") } }
+        RequestHeaders.plainOnly(spec).option(SourceOptions.HEADERS)?.let { raw ->
+            val headers = RequestHeaders.parse(raw).map { (name, value) -> mapOf("requestHeader" to "$name: $value") }
             if (headers.isNotEmpty()) settings["requestHeader"] = headers
         }
         when (spec.option(SourceOptions.PSEUDO)) {
@@ -220,19 +214,12 @@ object ObtainiumExport {
         SourceTypes.SAMSUNG to "SamsungGalaxyStore",
         SourceTypes.VIVO to "VivoAppStore",
         SourceTypes.TENCENT to "Tencent",
-        SourceTypes.RUSTORE to "RuStore",
-        SourceTypes.COOLAPK to "CoolApk",
         SourceTypes.ITCHIO to "ItchIO",
         SourceTypes.TELEGRAM to "TelegramApp",
         SourceTypes.NEUTRONCODE to "NeutronCode",
         SourceTypes.APKPURE to "APKPure",
         SourceTypes.APTOIDE to "Aptoide",
-        SourceTypes.UPTODOWN to "Uptodown",
         SourceTypes.APKCOMBO to "APKCombo",
         SourceTypes.APKMIRROR to "APKMirror",
-        SourceTypes.FARSROID to "Farsroid",
-        SourceTypes.LITEAPKS to "LiteAPKs",
-        SourceTypes.APK4FREE to "Apk4Free",
-        SourceTypes.ROCKMODS to "RockMods",
     )
 }
diff --git a/core/src/main/kotlin/io/github/munzzyy/tern/core/interop/ObtainiumImport.kt b/core/src/main/kotlin/io/github/munzzyy/tern/core/interop/ObtainiumImport.kt
index 17b7c3c2..decf2ed9 100644
--- a/core/src/main/kotlin/io/github/munzzyy/tern/core/interop/ObtainiumImport.kt
+++ b/core/src/main/kotlin/io/github/munzzyy/tern/core/interop/ObtainiumImport.kt
@@ -14,6 +14,7 @@ import io.github.munzzyy.tern.core.model.SourceSpec
 import io.github.munzzyy.tern.core.model.UpdateMode
 import io.github.munzzyy.tern.core.model.VersionFrom
 import io.github.munzzyy.tern.core.net.Urls
+import io.github.munzzyy.tern.core.source.Refusal
 import io.github.munzzyy.tern.core.source.SourceOptions
 import io.github.munzzyy.tern.core.source.SourceRegistry
 import io.github.munzzyy.tern.core.source.SourceTypes
@@ -34,7 +35,8 @@ import io.github.munzzyy.tern.core.verify.Fingerprints
 
 class ObtainiumImportException(message: String) : Exception(message)
 
-data class Skipped(val name: String, val url: String, val reason: String)
+/** An app that was not brought over. [refusal] is set when Tern reads nothing from its site at all, and says why in the app's words. */
+data class Skipped(val name: String, val url: String, val reason: String, val refusal: Refusal? = null)
 
 /** [settings] are those of the file Tern has a setting for, under Tern's names; null when it carries none. */
 data class ImportResult(val apps: List<AppConfig>, val skipped: List<Skipped>, val settings: JsonObject? = null)
@@ -63,6 +65,11 @@ object ObtainiumImport {
                 ?: entry.string("additionalSettings")?.let { raw -> runCatching { Json.parseObject(raw) }.getOrNull() }
                 ?: JsonObject(emptyMap())
 
+            val refusal = Refusal.ofObtainium(overrideSource) ?: Refusal.ofUrl(url)
+            if (refusal != null) {
+                skipped.add(Skipped(Shown.line(name, MAX_NAME), Shown.line(url, MAX_NAME), SourceRegistry.refusalText(refusal), refusal))
+                continue
+            }
             val source = mapSource(url, overrideSource, settings)?.let { withOptions(it, settings) }
             if (source == null) {
                 val reason = if (Urls.normalize(url) == null) "Its address is not a web address Tern can open" else unsupportedReason(overrideSource)
@@ -101,7 +108,7 @@ object ObtainiumImport {
                         minAgeDays = settingInt(settings, "minimumUpdateAgeDays")?.coerceIn(0, 365),
                         fallbackToOlder = settingBool(settings, "fallbackToOlderReleases") ?: true,
                         matchGroup = matchGroup(settings, versionExtract),
-                        versionFrom = versionFrom(settings, source.type),
+                        versionFrom = versionFrom(settings),
                         order = order(settings),
                         stayBehind = if (settingBool(settings, "stayOneVersionBehind") == true) 1 else 0,
                         versionFilter = settingString(settings, "filterVersionsByRegEx"),
@@ -251,10 +258,9 @@ object ObtainiumImport {
         return named.takeUnless { it.removePrefix("$") == ObtainiumOptions.defaultGroup(versionExtract) }
     }
 
-    /** On Farsroid, releaseTitleAsVersion names the file instead, which is an option of that source; see [store]. */
-    private fun versionFrom(settings: JsonObject, type: String): VersionFrom = when {
+    private fun versionFrom(settings: JsonObject): VersionFrom = when {
         settingBool(settings, "releaseDateAsVersion") == true || settingString(settings, "versionDetection") == "releaseDateAsVersion" -> VersionFrom.DATE
-        settingBool(settings, "releaseTitleAsVersion") == true && type != SourceTypes.FARSROID -> VersionFrom.TITLE
+        settingBool(settings, "releaseTitleAsVersion") == true -> VersionFrom.TITLE
         else -> VersionFrom.TAG
     }
 
@@ -286,18 +292,14 @@ object ObtainiumImport {
         return "Tern could not read this address as an app on $name"
     }
 
-    /** A store source by its type, with the options Obtainium keeps for it that Tern reads too. */
+    /** A store source by its type. The Galaxy Store's device and region settings are not read: Tern asks every store as itself. */
+    /** A store source by its type, with the Galaxy Store model and region Obtainium keeps for it. */
     private fun store(type: String, address: String, settings: JsonObject): SourceSpec? {
         val spec = REGISTRY.get(type)?.match(address) ?: return null
+        if (type != SourceTypes.SAMSUNG) return spec
         val options = LinkedHashMap(spec.options)
-        when (type) {
-            SourceTypes.SAMSUNG -> {
-                settingString(settings, "deviceId")?.let { options[SourceOptions.DEVICE_MODEL] = it.take(40) }
-                settingString(settings, "csc")?.let { options[SourceOptions.CSC] = it.take(10) }
-            }
-            // Farsroid's "release title as version" takes the name of the file.
-            SourceTypes.FARSROID -> if (settingBool(settings, "releaseTitleAsVersion") == true) options[SourceOptions.FILE_VERSION] = "true"
-        }
+        settingString(settings, "deviceId")?.let { options[SourceOptions.DEVICE_MODEL] = it.take(40) }
+        settingString(settings, "csc")?.let { options[SourceOptions.CSC] = it.take(10) }
         return if (options == spec.options) spec else spec.copy(options = options)
     }
 
@@ -330,20 +332,13 @@ object ObtainiumImport {
         "SamsungGalaxyStore" to SourceTypes.SAMSUNG,
         "VivoAppStore" to SourceTypes.VIVO,
         "Tencent" to SourceTypes.TENCENT,
-        "RuStore" to SourceTypes.RUSTORE,
-        "CoolApk" to SourceTypes.COOLAPK,
         "ItchIO" to SourceTypes.ITCHIO,
         "TelegramApp" to SourceTypes.TELEGRAM,
         "NeutronCode" to SourceTypes.NEUTRONCODE,
         "APKPure" to SourceTypes.APKPURE,
         "Aptoide" to SourceTypes.APTOIDE,
-        "Uptodown" to SourceTypes.UPTODOWN,
         "APKCombo" to SourceTypes.APKCOMBO,
         "APKMirror" to SourceTypes.APKMIRROR,
-        "Farsroid" to SourceTypes.FARSROID,
-        "LiteAPKs" to SourceTypes.LITEAPKS,
-        "Apk4Free" to SourceTypes.APK4FREE,
-        "RockMods" to SourceTypes.ROCKMODS,
     )
 
     private val REGISTRY = SourceRegistry.standard()
diff --git a/core/src/main/kotlin/io/github/munzzyy/tern/core/interop/ObtainiumLink.kt b/core/src/main/kotlin/io/github/munzzyy/tern/core/interop/ObtainiumLink.kt
index 24ab16f1..4a4cfe0d 100644
--- a/core/src/main/kotlin/io/github/munzzyy/tern/core/interop/ObtainiumLink.kt
+++ b/core/src/main/kotlin/io/github/munzzyy/tern/core/interop/ObtainiumLink.kt
@@ -7,6 +7,9 @@ sealed interface ObtainiumLink {
 
     companion object {
         private const val PREFIX = "obtainium://"
+
+        /** Tern's own links of the same kinds, which the page at [ConfigLink.ADD_PAGE] makes. */
+        private const val TERN = "tern://"
         private const val MAX_LENGTH = 200_000
 
         /**
@@ -17,14 +20,18 @@ sealed interface ObtainiumLink {
 
         private val REDIRECT = Regex("^https://apps\\.obtainium\\.imranr\\.dev/redirect/?\\?(.*)$", RegexOption.IGNORE_CASE)
 
+        /** Tern's add page, with what it carries after '#', or after '?' in the links made before it used '#'. */
+        private val ADD_PAGE = Regex("^https://tern\\.munzzyy\\.dev/add/?(?:\\?([^#]*))?(?:#(.*))?$", RegexOption.IGNORE_CASE)
+
         /**
          * Read by hand: payloads arrive with raw braces and quotes that a strict URI parser refuses.
          * A link behind [WEB_REDIRECT] is read as the link it carries; the page itself is never asked.
          */
         fun parse(uri: String): ObtainiumLink? {
             val text = carried(uri.trim()) ?: return null
-            if (text.length > MAX_LENGTH || !text.startsWith(PREFIX, ignoreCase = true)) return null
-            val rest = text.substring(PREFIX.length)
+            val prefix = listOf(PREFIX, TERN).firstOrNull { text.startsWith(it, ignoreCase = true) } ?: return null
+            if (text.length > MAX_LENGTH) return null
+            val rest = text.substring(prefix.length)
             val action = rest.substringBefore('/').substringBefore('?').lowercase()
             val afterAction = rest.substring(action.length)
             val data = when {
@@ -40,8 +47,16 @@ sealed interface ObtainiumLink {
             }
         }
 
-        /** [text] as it is, or the obtainium:// link that Obtainium's web page carries in it; null when that page carries none. */
+        /**
+         * [text] as it is, or the link that Tern's add page or Obtainium's web page carries in it;
+         * null when the page carries none. Neither page is asked for anything.
+         */
         private fun carried(text: String): String? {
+            ADD_PAGE.matchEntire(text)?.let { page ->
+                val parts = page.groupValues[2].split('&') + page.groupValues[1].split('&')
+                parts.firstOrNull { it.startsWith("app=") }?.let { return TERN + "app/" + it.removePrefix("app=") }
+                return parts.firstOrNull { it.startsWith("url=") }?.let { TERN + "add?url=" + it.removePrefix("url=") }
+            }
             val query = REDIRECT.matchEntire(text)?.groupValues?.get(1) ?: return text
             val raw = query.split('&').firstOrNull { it.startsWith("r=") }?.removePrefix("r=") ?: return null
             // Obtainium leaves the link after r= as it is and only its payload encoded; some pages encode the whole of it.
diff --git a/core/src/main/kotlin/io/github/munzzyy/tern/core/interop/TernExport.kt b/core/src/main/kotlin/io/github/munzzyy/tern/core/interop/TernExport.kt
index f7fb218b..09df5ed3 100644
--- a/core/src/main/kotlin/io/github/munzzyy/tern/core/interop/TernExport.kt
+++ b/core/src/main/kotlin/io/github/munzzyy/tern/core/interop/TernExport.kt
@@ -4,24 +4,35 @@ import io.github.munzzyy.tern.core.json.Json
 import io.github.munzzyy.tern.core.json.JsonArray
 import io.github.munzzyy.tern.core.json.JsonObject
 import io.github.munzzyy.tern.core.model.AppConfig
+import io.github.munzzyy.tern.core.source.Refusal
+import io.github.munzzyy.tern.core.source.SourceRegistry
+import io.github.munzzyy.tern.core.source.web.RequestHeaders
+import io.github.munzzyy.tern.core.text.Shown
 
 class TernExportException(message: String) : Exception(message)
 
-/** What an export file holds: the apps, and the settings when the person chose to include them. */
-data class TernExportFile(val apps: List<AppConfig>, val settings: JsonObject?)
+/**
+ * What an export file holds: the apps, and the settings when the person chose to include them.
+ * [skipped] are the apps of sites Tern no longer reads, which a file from an older build can name.
+ */
+data class TernExportFile(val apps: List<AppConfig>, val settings: JsonObject?, val skipped: List<Skipped> = emptyList())
 
 object TernExport {
     const val SCHEMA = 1
     private const val FORMAT = "tern-export"
+    private const val MAX_NAME = 200
 
-    /** [settings] go in only when given; the file never holds a token, whatever they are. */
+    /**
+     * [settings] go in only when given. The file never holds a token, whatever they are, nor a
+     * request header that could hold a key.
+     */
     fun write(apps: List<AppConfig>, exportedAtMs: Long, appVersion: String, settings: JsonObject? = null): String {
         val fields = mutableListOf<Pair<String, Any?>>(
             "format" to FORMAT,
             "schema" to SCHEMA,
             "exportedAt" to exportedAtMs,
             "appVersion" to appVersion,
-            "apps" to JsonArray(apps.map { AppConfigJson.encode(it) }),
+            "apps" to JsonArray(apps.map { AppConfigJson.encode(it.copy(source = RequestHeaders.plainOnly(it.source))) }),
         )
         if (settings != null) fields += "settings" to settings
         return Json.write(Json.obj(*fields.toTypedArray()), indent = true)
@@ -39,13 +50,23 @@ object TernExport {
         val schema = root.long("schema") ?: throw TernExportException("Missing schema version")
         if (schema != SCHEMA.toLong()) throw TernExportException("Unsupported export schema $schema")
         val apps = root.array("apps") ?: throw TernExportException("Missing apps array")
-        val configs = apps.objects().map { obj ->
-            try {
+        val configs = ArrayList<AppConfig>()
+        val skipped = ArrayList<Skipped>()
+        for (obj in apps.objects()) {
+            val source = obj.obj("source")
+            val url = source?.string("url").orEmpty()
+            val refusal = Refusal.ofType(source?.string("type")) ?: Refusal.ofUrl(url)
+            if (refusal != null) {
+                val name = obj.string("customName")?.takeIf { it.isNotBlank() } ?: obj.string("name")?.takeIf { it.isNotBlank() } ?: url
+                skipped += Skipped(Shown.line(name, MAX_NAME), Shown.line(url, MAX_NAME), SourceRegistry.refusalText(refusal), refusal)
+                continue
+            }
+            configs += try {
                 shown(AppConfigJson.decode(obj))
             } catch (e: AppConfigJsonException) {
                 throw TernExportException("Invalid app entry: ${e.message}")
             }
         }
-        return TernExportFile(configs, root.obj("settings"))
+        return TernExportFile(configs, root.obj("settings"), skipped)
     }
 }
diff --git a/core/src/main/kotlin/io/github/munzzyy/tern/core/select/FileOrigin.kt b/core/src/main/kotlin/io/github/munzzyy/tern/core/select/FileOrigin.kt
index cb027bee..f5a558a3 100644
--- a/core/src/main/kotlin/io/github/munzzyy/tern/core/select/FileOrigin.kt
+++ b/core/src/main/kotlin/io/github/munzzyy/tern/core/select/FileOrigin.kt
@@ -44,11 +44,9 @@ object FileOrigin {
         SourceTypes.HUAWEI to setOf("dbankcloud.com", "dbankcloud.ru", "dbankcdn.com"),
         SourceTypes.TENCENT to setOf("myapp.com"),
         SourceTypes.SAMSUNG to setOf("samsungapps.com", "galaxyappstore.com"),
-        SourceTypes.COOLAPK to setOf("coolapkmarket.com"),
         SourceTypes.APKPURE to setOf("winudf.com"),
         SourceTypes.APKCOMBO to setOf("apks.39b7cb94d40914bac590886981b0ed6e.r2.cloudflarestorage.com"),
         SourceTypes.ITCHIO to setOf("itchio-mirror.cb031a832f44726753d6267436f3b414.r2.cloudflarestorage.com"),
-        SourceTypes.UPTODOWN to setOf("uptodown.net"),
         SourceTypes.TELEGRAM to setOf("telesco.pe"),
     )
 }
diff --git a/core/src/main/kotlin/io/github/munzzyy/tern/core/source/Refusal.kt b/core/src/main/kotlin/io/github/munzzyy/tern/core/source/Refusal.kt
new file mode 100644
index 00000000..d45443a1
--- /dev/null
+++ b/core/src/main/kotlin/io/github/munzzyy/tern/core/source/Refusal.kt
@@ -0,0 +1,60 @@
+package io.github.munzzyy.tern.core.source
+
+import io.github.munzzyy.tern.core.net.Urls
+
+/** Why Tern reads nothing from a site, not even as a plain web page. */
+enum class Refusal {
+    /** The site offers apps changed by someone other than their developer, such as unlocked or "mod" builds. */
+    MODIFIED_APPS,
+
+    /** The store answers only its own app, so reading it means pretending to be that app. */
+    IMPERSONATION,
+    ;
+
+    companion object {
+        private val SITES: Map<String, Refusal> = mapOf(
+            "liteapks.com" to MODIFIED_APPS,
+            "apk4free.net" to MODIFIED_APPS,
+            "rockmods.net" to MODIFIED_APPS,
+            "farsroid.com" to MODIFIED_APPS,
+            "rustore.ru" to IMPERSONATION,
+            "uptodown.com" to IMPERSONATION,
+            "uptodown.net" to IMPERSONATION,
+            "uptodown.app" to IMPERSONATION,
+            "coolapk.com" to IMPERSONATION,
+            "coolapkmarket.com" to IMPERSONATION,
+        )
+
+        /** The types Tern once had for these sites, which an older export or list may still name. */
+        private val TYPES: Map<String, Refusal> = mapOf(
+            "liteapks" to MODIFIED_APPS,
+            "apk4free" to MODIFIED_APPS,
+            "rockmods" to MODIFIED_APPS,
+            "farsroid" to MODIFIED_APPS,
+            "rustore" to IMPERSONATION,
+            "uptodown" to IMPERSONATION,
+            "coolapk" to IMPERSONATION,
+        )
+
+        /** The same sites under the names Obtainium's exports give them. */
+        private val OBTAINIUM: Map<String, Refusal> = mapOf(
+            "LiteAPKs" to MODIFIED_APPS,
+            "Apk4Free" to MODIFIED_APPS,
+            "RockMods" to MODIFIED_APPS,
+            "Farsroid" to MODIFIED_APPS,
+            "RuStore" to IMPERSONATION,
+            "Uptodown" to IMPERSONATION,
+            "CoolApk" to IMPERSONATION,
+        )
+
+        /** The refusal for an address on one of these sites or a host under it; null for every other address. */
+        fun ofUrl(url: String): Refusal? {
+            val host = Urls.parseHttps(url)?.host?.lowercase()?.trimEnd('.') ?: return null
+            return SITES.entries.firstOrNull { (site, _) -> host == site || host.endsWith(".$site") }?.value
+        }
+
+        fun ofType(type: String?): Refusal? = TYPES[type]
+
+        fun ofObtainium(name: String?): Refusal? = OBTAINIUM[name]
+    }
+}
diff --git a/core/src/main/kotlin/io/github/munzzyy/tern/core/source/Source.kt b/core/src/main/kotlin/io/github/munzzyy/tern/core/source/Source.kt
index 7bfd5a41..f36e6493 100644
--- a/core/src/main/kotlin/io/github/munzzyy/tern/core/source/Source.kt
+++ b/core/src/main/kotlin/io/github/munzzyy/tern/core/source/Source.kt
@@ -146,6 +146,13 @@ interface Source {
      * the same checks, but the person should know the file does not come from the developer.
      */
     val republishes: Boolean get() = false
+
+    /**
+     * The domains this source asks, each with the hosts under it, for a store whose every request
+     * can be told by its host. While third-party stores are off none of them is asked, whatever an
+     * address is read as. Empty for the sources that may be anywhere.
+     */
+    val domains: Set<String> get() = emptySet()
 }
 
 /** A source that can be searched by name. Each search is one or two requests and stores nothing. */
diff --git a/core/src/main/kotlin/io/github/munzzyy/tern/core/source/SourceRegistry.kt b/core/src/main/kotlin/io/github/munzzyy/tern/core/source/SourceRegistry.kt
index bf2524ca..43f16fa7 100644
--- a/core/src/main/kotlin/io/github/munzzyy/tern/core/source/SourceRegistry.kt
+++ b/core/src/main/kotlin/io/github/munzzyy/tern/core/source/SourceRegistry.kt
@@ -8,21 +8,14 @@ import io.github.munzzyy.tern.core.source.forge.ForgejoSource
 import io.github.munzzyy.tern.core.source.forge.GitHubActionsSource
 import io.github.munzzyy.tern.core.source.forge.GitHubSource
 import io.github.munzzyy.tern.core.source.forge.GitLabSource
-import io.github.munzzyy.tern.core.source.store.Apk4FreeSource
 import io.github.munzzyy.tern.core.source.store.ApkComboSource
 import io.github.munzzyy.tern.core.source.store.ApkMirrorSource
 import io.github.munzzyy.tern.core.source.store.ApkPureSource
 import io.github.munzzyy.tern.core.source.store.AptoideSource
-import io.github.munzzyy.tern.core.source.store.CoolApkSource
-import io.github.munzzyy.tern.core.source.store.FarsroidSource
 import io.github.munzzyy.tern.core.source.store.HuaweiSource
 import io.github.munzzyy.tern.core.source.store.ItchIoSource
-import io.github.munzzyy.tern.core.source.store.LiteApksSource
-import io.github.munzzyy.tern.core.source.store.RockModsSource
-import io.github.munzzyy.tern.core.source.store.RuStoreSource
 import io.github.munzzyy.tern.core.source.store.SamsungSource
 import io.github.munzzyy.tern.core.source.store.TencentSource
-import io.github.munzzyy.tern.core.source.store.UptodownSource
 import io.github.munzzyy.tern.core.source.store.VivoSource
 import io.github.munzzyy.tern.core.source.web.DirectSource
 import io.github.munzzyy.tern.core.source.web.HtmlSource
@@ -35,15 +28,53 @@ import io.github.munzzyy.tern.core.model.Asset
 import io.github.munzzyy.tern.core.text.Shown
 import java.io.IOException
 
-class SourceRegistry(val sources: List<Source>) {
+/**
+ * Every source Tern reads, and what it will not read: the sites [Refusal] names, always, and the
+ * [SourceTypes.THIRD_PARTY_STORES] while [storesAllowed] says no.
+ */
+class SourceRegistry(val sources: List<Source>, private val storesAllowed: () -> Boolean = { true }) {
     fun get(type: String): Source? = sources.firstOrNull { it.type == type }
 
+    /** Why an address is not read now. */
+    sealed interface Closed {
+        data class Refused(val refusal: Refusal) : Closed
+
+        /** It belongs to the third-party store [type], and those are off. */
+        data class StoresOff(val type: String) : Closed
+    }
+
+    /** Why [url] is not read now, or null when it may be. Nothing is asked of the network. */
+    fun closed(url: String): Closed? {
+        Refusal.ofUrl(url)?.let { return Closed.Refused(it) }
+        if (storesAllowed()) return null
+        val host = Urls.parseHttps(url)?.host?.lowercase()?.trimEnd('.')
+        val candidates = listOfNotNull(Urls.hashRouted(url), Urls.normalize(url))
+        val store = sources.firstOrNull { source ->
+            source.type in SourceTypes.THIRD_PARTY_STORES &&
+                (source.domains.any { host == it || host?.endsWith(".$it") == true } || candidates.any { source.match(it) != null })
+        }
+        return store?.let { Closed.StoresOff(it.type) }
+    }
+
+    /**
+     * True for an app of a third-party store while those are off, whatever it is read as: it is
+     * kept, and nothing of it is asked for.
+     */
+    fun paused(spec: SourceSpec): Boolean =
+        !storesAllowed() && (spec.type in SourceTypes.THIRD_PARTY_STORES || closed(spec.url) is Closed.StoresOff)
+
+    private fun refuseClosed(spec: SourceSpec) {
+        (Refusal.ofType(spec.type) ?: Refusal.ofUrl(spec.url))?.let { throw SourceException(SourceErrorKind.UNSUPPORTED, refusalText(it)) }
+        if (paused(spec)) throw SourceException(SourceErrorKind.UNSUPPORTED, "Third-party stores are off")
+    }
+
     /**
      * The one way to run a check: transactional validators, every failure as a SourceException,
      * and every text of the listing that a person will read fit to be shown.
      */
     @Throws(SourceException::class)
     fun check(spec: SourceSpec, context: CheckContext): CheckResult {
+        refuseClosed(spec)
         val source = get(spec.type) ?: throw SourceException(SourceErrorKind.UNSUPPORTED, "Unknown source type ${spec.type}")
         return when (val result = guarded(context) { source.check(spec, it) }) {
             is CheckResult.Listing -> CheckResult.Listing(shown(result.listing))
@@ -57,6 +88,7 @@ class SourceRegistry(val sources: List<Source>) {
      */
     @Throws(SourceException::class)
     fun resolve(spec: SourceSpec, asset: Asset, context: CheckContext): Download {
+        refuseClosed(spec)
         val source = get(spec.type) ?: return Download(asset.url)
         val download = guarded(context) { source.resolve(spec, asset, it) }
         val url = download.url.takeIf { Urls.isHttps(it) }?.let(Urls::normalize)
@@ -65,9 +97,10 @@ class SourceRegistry(val sources: List<Source>) {
     }
 
     /** Sources that can be searched by name, in the order their hits are shown. */
-    val searchable: List<Searchable> get() = sources.filterIsInstance<Searchable>()
+    val searchable: List<Searchable> get() = sources.filter { storesAllowed() || it.type !in SourceTypes.THIRD_PARTY_STORES }.filterIsInstance<Searchable>()
 
     fun match(url: String): SourceSpec? {
+        if (closed(url) != null) return null
         // A store that routes its pages after '#' reads the address as typed; a page reader would only see its front page.
         Urls.hashRouted(url)?.let { routed ->
             for (source in sources) {
@@ -87,7 +120,8 @@ class SourceRegistry(val sources: List<Source>) {
      * reads it. Null when the address cannot be read that way, or [type] is not one a person may pick.
      */
     fun readAs(url: String, type: String, context: CheckContext): SourceSpec? {
-        if (type !in SourceTypes.OVERRIDABLE) return null
+        if (type !in SourceTypes.OVERRIDABLE || closed(url) != null) return null
+        if (type in SourceTypes.THIRD_PARTY_STORES && !storesAllowed()) return null
         val source = get(type) ?: return null
         if (type != SourceTypes.HTML && type != SourceTypes.DIRECT) {
             Urls.hashRouted(url)?.let { routed -> source.match(routed)?.let { return it } }
@@ -104,6 +138,7 @@ class SourceRegistry(val sources: List<Source>) {
 
     fun detect(url: String, context: CheckContext): SourceSpec? {
         val normalized = Urls.normalize(url) ?: return null
+        if (closed(url) != null) return null
         match(url)?.let { return it }
         for (source in sources) {
             val spec = try {
@@ -152,16 +187,25 @@ class SourceRegistry(val sources: List<Source>) {
          * Every source, in the order detection tries them: forges, then repositories, then stores
          * and other sites, then a bare download address, and the HTML page reader last.
          */
-        fun standard(trackedInRepository: (repositoryUrl: String) -> Set<String> = { emptySet() }): SourceRegistry = SourceRegistry(
+        fun standard(
+            trackedInRepository: (repositoryUrl: String) -> Set<String> = { emptySet() },
+            storesAllowed: () -> Boolean = { true },
+        ): SourceRegistry = SourceRegistry(
             listOf(
                 GitHubSource(), GitHubActionsSource(), GitLabSource(), ForgejoSource(),
                 FDroidSource(), FDroidRepoSource(trackedInRepository),
-                HuaweiSource(), SamsungSource(), VivoSource(), TencentSource(), RuStoreSource(), CoolApkSource(), ItchIoSource(),
+                HuaweiSource(), SamsungSource(), VivoSource(), TencentSource(), ItchIoSource(),
                 TelegramSource(), NeutronCodeSource(),
-                ApkPureSource(), AptoideSource(), UptodownSource(), ApkComboSource(), ApkMirrorSource(),
-                FarsroidSource(), LiteApksSource(), Apk4FreeSource(), RockModsSource(),
+                ApkPureSource(), AptoideSource(), ApkComboSource(), ApkMirrorSource(),
                 SourceForgeSource(), SourceHutSource(), JenkinsSource(), DirectSource(), HtmlSource(),
             ),
+            storesAllowed,
         )
+
+        /** What a refusal is called in a failure of a source, which is read by people who work on Tern. */
+        fun refusalText(refusal: Refusal): String = when (refusal) {
+            Refusal.MODIFIED_APPS -> "Tern does not read sites that offer modified apps"
+            Refusal.IMPERSONATION -> "Tern cannot read this store without pretending to be its app"
+        }
     }
 }
diff --git a/core/src/main/kotlin/io/github/munzzyy/tern/core/source/SourceTypes.kt b/core/src/main/kotlin/io/github/munzzyy/tern/core/source/SourceTypes.kt
index dfb44e7b..f74b144a 100644
--- a/core/src/main/kotlin/io/github/munzzyy/tern/core/source/SourceTypes.kt
+++ b/core/src/main/kotlin/io/github/munzzyy/tern/core/source/SourceTypes.kt
@@ -14,61 +14,58 @@ object SourceTypes {
     const val SOURCEHUT = "sourcehut"
     const val SOURCEFORGE = "sourceforge"
 
-    // Stores where developers publish their own apps.
+    // Stores that developers upload their own apps to.
     const val HUAWEI = "huawei"
     const val SAMSUNG = "samsung"
     const val VIVO = "vivo"
-    const val TENCENT = "tencent"
-    const val RUSTORE = "rustore"
-    const val COOLAPK = "coolapk"
-    const val ITCHIO = "itchio"
 
-    // The developer's own site, for one app.
+    // The developer's own channel, for one app or all of theirs.
+    const val ITCHIO = "itchio"
     const val TELEGRAM = "telegram"
     const val NEUTRONCODE = "neutroncode"
 
-    // Sites that republish apps somebody else built.
+    // Sites that republish apps somebody else built, and a store that hosts copies others upload.
     const val APKPURE = "apkpure"
     const val APTOIDE = "aptoide"
-    const val UPTODOWN = "uptodown"
     const val APKCOMBO = "apkcombo"
     const val APKMIRROR = "apkmirror"
-    const val FARSROID = "farsroid"
-    const val LITEAPKS = "liteapks"
-    const val APK4FREE = "apk4free"
-    const val ROCKMODS = "rockmods"
+    const val TENCENT = "tencent"
 
     /** Every type, in the order detection tries them. An export naming another type is refused. */
     val ALL: List<String> = listOf(
         GITHUB, GITHUB_ACTIONS, GITLAB, FORGEJO, FDROID, FDROID_REPO,
-        HUAWEI, SAMSUNG, VIVO, TENCENT, RUSTORE, COOLAPK, ITCHIO, TELEGRAM, NEUTRONCODE,
-        APKPURE, APTOIDE, UPTODOWN, APKCOMBO, APKMIRROR, FARSROID, LITEAPKS, APK4FREE, ROCKMODS,
+        HUAWEI, SAMSUNG, VIVO, TENCENT, ITCHIO, TELEGRAM, NEUTRONCODE,
+        APKPURE, APTOIDE, APKCOMBO, APKMIRROR,
         SOURCEFORGE, SOURCEHUT, JENKINS, DIRECT, HTML,
     )
 
-    /** Sites that offer apps changed by someone other than their developer. Said plainly before an app is added from one. */
-    val MODIFIED: Set<String> = setOf(LITEAPKS, APK4FREE, ROCKMODS)
-
     /**
      * Stores and mirrors that offer again what developers published elsewhere, each source of which
-     * says so through [Source.republishes]. Their files are held to the developer's certificate
-     * like any other, once one is known.
+     * says so through [Source.republishes]. The first file Tern installs from one decides the
+     * certificate later updates must carry, unless Tern already knows the developer's.
      */
-    val REPUBLISHING: Set<String> = setOf(APKPURE, APTOIDE, UPTODOWN, APKCOMBO, APKMIRROR, FARSROID) + MODIFIED
+    val REPUBLISHING: Set<String> = setOf(APKPURE, APTOIDE, APKCOMBO, APKMIRROR, TENCENT)
+
+    /**
+     * The stores behind the setting "Third-party stores", off until the person turns it on. Tern
+     * reads them through interfaces they made for their own apps and sites, not for others, and
+     * what they serve does not come from the developer.
+     */
+    val THIRD_PARTY_STORES: Set<String> = REPUBLISHING + setOf(HUAWEI, SAMSUNG, VIVO)
 
     /**
      * Sources that only tell of new releases and offer no file Tern may install, each of which says
      * so through [Source.trackOnly]. Every app of one is track-only, whatever it was made or saved with.
      */
-    val TRACK_ONLY: Set<String> = setOf(APKMIRROR, ROCKMODS)
+    val TRACK_ONLY: Set<String> = setOf(APKMIRROR)
 
     /**
      * The kinds a person may say an address is, in the order the Add screen offers them: the
      * general ones and those that are hosted anywhere first. Obtainium lets no address be read as
-     * vivo's or CoolApk's store, and neither does Tern.
+     * vivo's store, and neither does Tern.
      */
     val OVERRIDABLE: List<String> = listOf(HTML, DIRECT, GITHUB, GITHUB_ACTIONS, GITLAB, FORGEJO, FDROID_REPO, JENKINS, SOURCEHUT).let { first ->
-        first + ALL.filter { it !in first && it != VIVO && it != COOLAPK }
+        first + ALL.filter { it !in first && it != VIVO }
     }
 
     /**
@@ -93,20 +90,13 @@ object SourceTypes {
         SAMSUNG -> "Galaxy Store"
         VIVO -> "vivo App Store"
         TENCENT -> "Tencent App Store"
-        RUSTORE -> "RuStore"
-        COOLAPK -> "CoolApk"
         ITCHIO -> "itch.io"
         TELEGRAM -> "Telegram"
         NEUTRONCODE -> "Neutron Code"
         APKPURE -> "APKPure"
         APTOIDE -> "Aptoide"
-        UPTODOWN -> "Uptodown"
         APKCOMBO -> "APKCombo"
         APKMIRROR -> "APKMirror"
-        FARSROID -> "Farsroid"
-        LITEAPKS -> "LiteAPKs"
-        APK4FREE -> "APK4Free"
-        ROCKMODS -> "RockMods"
         else -> null
     }
 }
@@ -187,10 +177,15 @@ object SourceOptions {
      */
     const val SORT = "sort"
 
-    /** farsroid: "true" to take the name of each file as a version, each file then a release of its own. */
-    const val FILE_VERSION = "fileVersion"
+    /**
+     * html: "true" to take the release with the highest version, as Tern 0.1.0 did. No link is
+     * marked as the latest by its place, and the app's version pattern reads the version guessed
+     * from each link rather than the link itself. Apps saved by 0.1.0 have it, so an update
+     * leaves them offering what they offered before.
+     */
+    const val HIGHEST_VERSION = "highestVersion"
 
-    /** samsung: the device model the store is asked for, such as "SM-S948B". */
+    /** samsung: the device model the store is asked for, as the model number printed in a Galaxy phone's settings. */
     const val DEVICE_MODEL = "deviceModel"
 
     /** samsung: the country and carrier code the store is asked for, such as "DBT". */
diff --git a/core/src/main/kotlin/io/github/munzzyy/tern/core/source/store/Apk4FreeSource.kt b/core/src/main/kotlin/io/github/munzzyy/tern/core/source/store/Apk4FreeSource.kt
deleted file mode 100644
index 7183d4e6..00000000
--- a/core/src/main/kotlin/io/github/munzzyy/tern/core/source/store/Apk4FreeSource.kt
+++ /dev/null
@@ -1,183 +0,0 @@
-package io.github.munzzyy.tern.core.source.store
-
-import io.github.munzzyy.tern.core.model.Asset
-import io.github.munzzyy.tern.core.model.AssetKind
-import io.github.munzzyy.tern.core.model.Release
-import io.github.munzzyy.tern.core.model.SourceSpec
-import io.github.munzzyy.tern.core.net.HttpRequest
-import io.github.munzzyy.tern.core.net.Urls
-import io.github.munzzyy.tern.core.source.CheckContext
-import io.github.munzzyy.tern.core.source.CheckResult
-import io.github.munzzyy.tern.core.source.Source
-import io.github.munzzyy.tern.core.source.SourceErrorKind
-import io.github.munzzyy.tern.core.source.SourceException
-import io.github.munzzyy.tern.core.source.SourceListing
-import io.github.munzzyy.tern.core.source.SourceTypes
-import io.github.munzzyy.tern.core.source.forge.Iso8601
-import io.github.munzzyy.tern.core.source.guarded
-import io.github.munzzyy.tern.core.source.web.ServedFile
-import io.github.munzzyy.tern.core.source.web.VersionGuess
-import io.github.munzzyy.tern.core.version.Version
-import io.github.munzzyy.tern.core.xml.XmlScanner
-
-/**
- * An app page on apk4free.net. The page names the app and its version and links to a download page,
- * whose buttons lead to the files on the site's own file server. A download page often holds several
- * versions at once, so the files are grouped into releases by the version in their names, and a file
- * whose name has none belongs to the version the page names.
- */
-class Apk4FreeSource : Source {
-    override val type: String = SourceTypes.APK4FREE
-
-    override val republishes: Boolean get() = true
-
-    override fun match(url: String): SourceSpec? {
-        val uri = Urls.parseHttps(url) ?: return null
-        if (uri.host?.lowercase()?.removePrefix("www.") != HOST) return null
-        val slug = uri.rawPath.orEmpty().split('/').firstOrNull { it.isNotEmpty() }?.takeIf { SLUG.matches(it) && it !in RESERVED } ?: return null
-        return SourceSpec(type, "https://$HOST/$slug/")
-    }
-
-    override fun check(spec: SourceSpec, context: CheckContext): CheckResult = guarded(context) { checkOnce(spec, it) }
-
-    private class Page(val url: String, val html: String)
-
-    private class Anchor(val href: String, val text: String, val button: Boolean)
-
-    private class FileLink(val url: String, val name: String, val text: String)
-
-    private fun checkOnce(spec: SourceSpec, context: CheckContext): CheckResult {
-        val page = page(spec.url, context)
-        val headingTag = HEADING.find(page.html)
-        val headingText = headingTag?.let { inside(page.html, it.range.last + 1, "</h1") }
-        val heading = headingText?.let(::plain)
-        // The page's own version stands right after its heading; related apps further down name theirs.
-        val versionTag = if (headingTag == null || headingText == null) {
-            VERSION_DIV.find(page.html)
-        } else {
-            val headingEnd = headingTag.range.last + 1 + headingText.length
-            VERSION_DIV.find(page.html, headingEnd)?.takeIf { it.range.first - headingEnd <= NEAR_HEADING }
-        }
-        val pageVersion = versionTag?.let { inside(page.html, it.range.last + 1, "</div") }?.let(::plain)?.takeIf { it.isNotEmpty() }
-            ?: heading?.let { TITLE_VERSION.find(it)?.groupValues?.get(1) }
-        val anchors = anchors(page.html)
-        val downloadPage = (anchors.filter { it.button } + anchors).asSequence()
-            .mapNotNull { Urls.resolve(page.url, it.href) }
-            .firstOrNull { "/download/" in it && Urls.host(it).removePrefix("www.") == HOST }
-            ?: throw SourceException(SourceErrorKind.NO_RELEASES, "${spec.url} links to no download page")
-
-        val downloads = page(downloadPage, context)
-        val links = anchors(downloads.html)
-        val chosen = links.filter { it.button }.ifEmpty { links.filter { Asset.kindOf(it.href) in INSTALLABLE } }
-        val files = chosen.mapNotNull { file(downloads.url, it) }.distinctBy { it.url }.take(MAX_FILES)
-        if (files.isEmpty()) throw SourceException(SourceErrorKind.NO_RELEASES, "${spec.url} offers no file on the site's own servers")
-
-        val grouped = LinkedHashMap<String, MutableList<FileLink>>()
-        for (file in files) {
-            val version = VersionGuess.find(file.name) ?: VersionGuess.find(file.text) ?: pageVersion ?: continue
-            grouped.getOrPut(version) { ArrayList() }.add(file)
-        }
-        if (grouped.isEmpty()) throw SourceException(SourceErrorKind.PARSE, "${spec.url} names no version")
-        val modified = MODIFIED.find(page.html)?.groupValues?.get(1)?.let(Iso8601::parseMs)
-        val releases = grouped.entries
-            .sortedWith(compareByDescending { Version.parse(it.key) })
-            .take(MAX_RELEASES)
-            .map { (version, group) ->
-                Release(
-                    id = version,
-                    version = version,
-                    title = group.first().text.takeIf { it.isNotEmpty() },
-                    // The page's date is when its post last changed, which is when its own version came.
-                    publishedAtMs = modified?.takeIf { version == pageVersion },
-                    prerelease = group.all { STAGE.containsMatchIn(it.text) || STAGE.containsMatchIn(it.name) },
-                    pageUrl = spec.url,
-                    assets = group.map { Asset(name = it.name, url = it.url) },
-                )
-            }
-        val name = heading?.let(::cleanTitle)?.takeIf { it.isNotEmpty() } ?: Urls.segments(spec.url).lastOrNull()
-        return CheckResult.Listing(SourceListing(releases = releases, name = name))
-    }
-
-    private fun page(url: String, context: CheckContext): Page = context.http.execute(HttpRequest(url)).use {
-        if (it.status == 404) throw SourceException(SourceErrorKind.NOT_FOUND, "There is no page at $url")
-        if (!it.isSuccess) throw SourceException(SourceErrorKind.NETWORK, "Unexpected status ${it.status} for $url")
-        Page(Urls.normalize(it.url) ?: url, it.text(PAGE_CAP))
-    }
-
-    private fun file(base: String, anchor: Anchor): FileLink? {
-        val url = Urls.resolve(base, anchor.href)?.takeIf { isFileHost(Urls.host(it)) } ?: return null
-        val name = Urls.segments(url).lastOrNull()?.let(ServedFile::clean) ?: return null
-        return FileLink(url, name, anchor.text)
-    }
-
-    private fun anchors(html: String): List<Anchor> = ANCHOR.findAll(html).take(MAX_ANCHORS).mapNotNull { m ->
-        val attributes = m.groupValues[1]
-        val href = HREF.find(attributes)?.groupValues?.drop(1)?.firstOrNull { it.isNotEmpty() }?.let(XmlScanner::decode)?.trim()
-            ?: return@mapNotNull null
-        val classes = CLASS.find(attributes)?.groupValues?.drop(1)?.firstOrNull { it.isNotEmpty() }.orEmpty()
-        Anchor(href, plain(m.groupValues[2]), classes.split(' ').contains(BUTTON_CLASS))
-    }.toList()
-
-    private fun inside(html: String, from: Int, closing: String): String? {
-        val close = html.indexOf(closing, from, ignoreCase = true)
-        if (close < 0 || close - from > WINDOW) return null
-        return html.substring(from, close)
-    }
-
-    private fun plain(html: String): String =
-        XmlScanner.decode(TAG.replace(html, " ").replace("&nbsp;", " ")).replace(SPACES, " ").trim()
-
-    /** The app's name without what the site adds to it: the version, "MOD APK", "(Unlocked)" and the like. */
-    private fun cleanTitle(title: String): String = title.take(MAX_TITLE)
-        .replace(BRACKETS, "")
-        .replace(TYPE_WORDS, "")
-        .replace(MOD_NOTES, "")
-        .replace(VERSION_TAIL, "")
-        .replace(JOINERS, " ")
-        .replace(SPACES, " ")
-        .trim()
-
-    companion object {
-        /** The site's own file server. */
-        val FILE_HOSTS: Set<String> = setOf("apps.apk4free.net")
-
-        private const val HOST = "apk4free.net"
-        private const val PAGE_CAP = 4 * 1024 * 1024
-        private const val WINDOW = 4096
-        private const val NEAR_HEADING = 200
-        private const val MAX_ANCHORS = 5000
-        private const val MAX_FILES = 40
-        private const val MAX_RELEASES = 30
-        private const val MAX_TITLE = 300
-        private const val BUTTON_CLASS = "downloadAPK"
-        private val INSTALLABLE = setOf(AssetKind.APK, AssetKind.BUNDLE)
-        private val SLUG = Regex("[A-Za-z0-9_-]{1,200}")
-        private val RESERVED = setOf(
-            "apps", "games", "blog", "about", "contact-us", "dmca-copyright", "privacy-policy", "editors-choice",
-            "category", "tag", "page", "author", "feed", "search", "wp-content", "wp-json", "wp-admin",
-        )
-
-        fun isFileHost(host: String): Boolean = host == HOST || host == "www.$HOST" || host in FILE_HOSTS
-
-        private val HEADING = Regex("""<h1\s[^>]{0,1000}?class="(?:[^"]{0,500}\s)?main-box-title(?:\s[^"]{0,500})?"[^>]{0,1000}>""", RegexOption.IGNORE_CASE)
-        private val VERSION_DIV = Regex("""<div\s[^>]{0,1000}?class="(?:[^"]{0,500}\s)?version(?:\s[^"]{0,500})?"[^>]{0,1000}>""", RegexOption.IGNORE_CASE)
-        private val ANCHOR = Regex("""<a\s([^>]{0,2000})>(.{0,4000}?)</a\s*>""", setOf(RegexOption.IGNORE_CASE, RegexOption.DOT_MATCHES_ALL))
-        private val HREF = Regex("""(?:^|\s)href\s*=\s*(?:"([^"]*)"|'([^']*)')""", RegexOption.IGNORE_CASE)
-        private val CLASS = Regex("""(?:^|\s)class\s*=\s*(?:"([^"]*)"|'([^']*)')""", RegexOption.IGNORE_CASE)
-        private val MODIFIED = Regex(""""dateModified"\s*:\s*"([^"]{1,40})"""")
-        private val TITLE_VERSION = Regex("""v?(\d+(?:\.\d+)+)""")
-        private val STAGE = Regex("""(?<![a-z])(nightly|beta|alpha|canary|preview)(?![a-z])""", RegexOption.IGNORE_CASE)
-        private val TAG = Regex("<[^>]*>")
-        private val SPACES = Regex("\\s+")
-
-        // What Obtainium takes out of a title to leave the app's name.
-        private val BRACKETS = Regex("""\[.*?]|\{.*?}""")
-        private val TYPE_WORDS = Regex("""\b(APK|MOD|XAPK|HACK)\b""", RegexOption.IGNORE_CASE)
-        private val MOD_NOTES = Regex(
-            """\((?:[^)]*?(?:Unlocked|Mod|Premium|Money|Menu|Full|Patched|Subscribed|AdFree|BG Play|Paid|Unlimited|God Mode)[^)]*?)\)""",
-            RegexOption.IGNORE_CASE,
-        )
-        private val VERSION_TAIL = Regex("""\s+v?\d+(\.\d+)+.*$""", RegexOption.IGNORE_CASE)
-        private val JOINERS = Regex("""\s+[+\-]\s+""")
-    }
-}
diff --git a/core/src/main/kotlin/io/github/munzzyy/tern/core/source/store/ApkComboSource.kt b/core/src/main/kotlin/io/github/munzzyy/tern/core/source/store/ApkComboSource.kt
index f2a664d2..2d921954 100644
--- a/core/src/main/kotlin/io/github/munzzyy/tern/core/source/store/ApkComboSource.kt
+++ b/core/src/main/kotlin/io/github/munzzyy/tern/core/source/store/ApkComboSource.kt
@@ -34,6 +34,8 @@ class ApkComboSource : Source {
 
     override val republishes: Boolean get() = true
 
+    override val domains: Set<String> get() = setOf("apkcombo.com") + FILE_HOSTS
+
     override fun match(url: String): SourceSpec? {
         val uri = Urls.parseHttps(url) ?: return null
         val host = uri.host?.lowercase() ?: return null
@@ -196,8 +198,7 @@ class ApkComboSource : Source {
         private const val TABLE_WINDOW = 16 * 1024
         private const val MAX_VARIANTS = 20
 
-        /** What gets past APKCombo's shield. */
-        private val HEADERS = mapOf("User-Agent" to "curl/8.0.1", "Accept" to "*/*")
+        private val HEADERS = mapOf("Accept" to "*/*")
 
         /** The bucket APKCombo's signed file addresses point into. */
         val FILE_HOSTS = setOf("apks.39b7cb94d40914bac590886981b0ed6e.r2.cloudflarestorage.com")
diff --git a/core/src/main/kotlin/io/github/munzzyy/tern/core/source/store/ApkMirrorSource.kt b/core/src/main/kotlin/io/github/munzzyy/tern/core/source/store/ApkMirrorSource.kt
index d3980f51..9032c439 100644
--- a/core/src/main/kotlin/io/github/munzzyy/tern/core/source/store/ApkMirrorSource.kt
+++ b/core/src/main/kotlin/io/github/munzzyy/tern/core/source/store/ApkMirrorSource.kt
@@ -38,6 +38,8 @@ class ApkMirrorSource : Source {
 
     override val trackOnly: Boolean get() = true
 
+    override val domains: Set<String> get() = setOf("apkmirror.com")
+
     override fun match(url: String): SourceSpec? {
         val uri = Urls.parseHttps(url) ?: return null
         val host = uri.host?.lowercase()
@@ -53,7 +55,7 @@ class ApkMirrorSource : Source {
         val feedUrl = "${spec.url}/feed/"
         val key = validatorKey(spec, feedUrl)
         val conditional = context.validators.get(key)?.conditionalHeaders().orEmpty()
-        val (channel, validator) = context.http.execute(HttpRequest(feedUrl, headers = HEADERS + conditional)).use {
+        val (channel, validator) = context.http.execute(HttpRequest(feedUrl, headers = conditional)).use {
             if (it.isNotModified) return CheckResult.Unchanged
             if (it.status == 404) throw SourceException(SourceErrorKind.NOT_FOUND, "APKMirror has no app at ${spec.url}")
             if (!it.isSuccess) throw SourceException(SourceErrorKind.NETWORK, "Unexpected status ${it.status} for $feedUrl")
@@ -110,7 +112,7 @@ class ApkMirrorSource : Source {
 
     /** A page of APKMirror, or null when it cannot be read: what it tells is never needed to follow the app. */
     private fun fetch(url: String, context: CheckContext): String? = try {
-        context.http.execute(HttpRequest(url, headers = HEADERS)).use { if (it.isSuccess) it.text(PAGE_CAP) else null }
+        context.http.execute(HttpRequest(url)).use { if (it.isSuccess) it.text(PAGE_CAP) else null }
     } catch (_: IOException) {
         null
     }
@@ -134,9 +136,6 @@ class ApkMirrorSource : Source {
         private const val PAGE_CAP = 4 * 1024 * 1024
         private const val MAX_RELEASES = 30
 
-        /** APKMirror lets through only clients whose User-Agent names APKUpdater, as Obtainium's does; the rest is who asks. */
-        private val HEADERS = mapOf("User-Agent" to "APKUpdater-v3.5.9 Tern")
-
         private val HOSTS = setOf("www.apkmirror.com", "apkmirror.com")
         private val SLUG = Regex("[a-z0-9][a-z0-9._-]{0,199}")
         private val SPACE = Regex("\\s+")
diff --git a/core/src/main/kotlin/io/github/munzzyy/tern/core/source/store/ApkPureSource.kt b/core/src/main/kotlin/io/github/munzzyy/tern/core/source/store/ApkPureSource.kt
index f2f39e8f..62632351 100644
--- a/core/src/main/kotlin/io/github/munzzyy/tern/core/source/store/ApkPureSource.kt
+++ b/core/src/main/kotlin/io/github/munzzyy/tern/core/source/store/ApkPureSource.kt
@@ -1,18 +1,14 @@
 package io.github.munzzyy.tern.core.source.store
 
-import io.github.munzzyy.tern.core.json.Json
-import io.github.munzzyy.tern.core.json.JsonObject
 import io.github.munzzyy.tern.core.model.Asset
 import io.github.munzzyy.tern.core.model.AssetKind
 import io.github.munzzyy.tern.core.model.DeviceProfile
-import io.github.munzzyy.tern.core.model.NotesFormat
 import io.github.munzzyy.tern.core.model.Release
 import io.github.munzzyy.tern.core.model.SourceSpec
 import io.github.munzzyy.tern.core.net.HttpRequest
 import io.github.munzzyy.tern.core.net.Urls
 import io.github.munzzyy.tern.core.source.CheckContext
 import io.github.munzzyy.tern.core.source.CheckResult
-import io.github.munzzyy.tern.core.source.Download
 import io.github.munzzyy.tern.core.source.Source
 import io.github.munzzyy.tern.core.source.SourceErrorKind
 import io.github.munzzyy.tern.core.source.SourceException
@@ -20,159 +16,204 @@ import io.github.munzzyy.tern.core.source.SourceListing
 import io.github.munzzyy.tern.core.source.SourceOptions
 import io.github.munzzyy.tern.core.source.SourceTypes
 import io.github.munzzyy.tern.core.source.fdroid.FDroidSource
-import io.github.munzzyy.tern.core.source.forge.Iso8601
 import io.github.munzzyy.tern.core.source.guarded
+import io.github.munzzyy.tern.core.xml.XmlScanner
+import java.time.LocalDate
+import java.time.ZoneOffset
+import java.time.format.DateTimeFormatter
+import java.time.format.DateTimeParseException
+import java.util.Base64
+import java.util.Locale
 
 /**
- * APKPure, read from the version history its own app asks tapi.pureapk.com for. Each version is one
- * release with a file for every variant the store holds of it, named after the package, the version
- * code and the processors the variant is built for. On a known device, variants built only for
- * processors it lacks are left out.
- *
- * A file address carries a token that runs out, so a file is listed by its address without the
- * query, and [resolve] asks the history again for one that works now.
+ * APKPure, read from the app's page of older versions on apkpure.com, as a browser reads it. Each
+ * version is one release, with a file for each build the store holds of it, fetched through the
+ * site's own download address, d.apkpure.com/b/<APK or XAPK>/<package>?versionCode=<code>, which
+ * sends on to the file on data.winudf.com. The page does not say which processors a build is for;
+ * the download page of the newest version does, so that one page is read too when its version has
+ * several builds, and on a known device the builds for processors it lacks are left out.
  */
 class ApkPureSource : Source {
     override val type: String = SourceTypes.APKPURE
 
     override val republishes: Boolean get() = true
 
+    override val domains: Set<String> get() = DOMAINS
+
     override fun match(url: String): SourceSpec? {
         val uri = Urls.parseHttps(url) ?: return null
         val host = uri.host?.lowercase() ?: return null
-        val site = SITES.firstOrNull { host == it || host == "www.$it" || host == "m.$it" } ?: return null
+        if (SITES.none { host == it || host == "www.$it" || host == "m.$it" }) return null
         val segments = Urls.segments(uri.toString())
         // An address may start with a two-letter language, as in /de/<name>/<package>.
         val readings = if (segments.size >= 3 && segments[0].length == 2) listOf(segments.drop(1), segments) else listOf(segments)
         val (slug, pkg) = readings.firstOrNull { it.size >= 2 && it[0].any(Char::isLetterOrDigit) && FDroidSource.isValidPackage(it[1]) } ?: return null
-        return SourceSpec(type, "https://$site/${Urls.encodeSegment(slug)}/$pkg", mapOf(SourceOptions.PACKAGE to pkg))
+        return SourceSpec(type, "$SITE/${Urls.encodeSegment(slug)}/$pkg", mapOf(SourceOptions.PACKAGE to pkg))
     }
 
     override fun check(spec: SourceSpec, context: CheckContext): CheckResult = guarded(context) { checkOnce(spec, it) }
 
     private fun checkOnce(spec: SourceSpec, context: CheckContext): CheckResult {
         val pkg = packageOf(spec)
-        val entries = history(pkg, context)
-        val versions = LinkedHashMap<String, MutableList<JsonObject>>()
-        for (entry in entries) {
-            val version = entry.string("version_name")?.trim().orEmpty()
-            if (version.isEmpty() || entry.string("package_name")?.let { it != pkg } == true) continue
-            versions.getOrPut(version) { ArrayList() }.add(entry)
-        }
-        val releases = versions.entries.asSequence()
-            .mapNotNull { (version, variants) -> release(spec, pkg, version, variants, context.device) }
+        val page = pageOf(spec, pkg)
+        val html = read("$page/versions", context) ?: throw SourceException(SourceErrorKind.NOT_FOUND, "APKPure has no app $pkg")
+        val versions = versions(html, pkg)
+        if (versions.isEmpty()) throw SourceException(SourceErrorKind.NOT_FOUND, "APKPure lists no version of $pkg")
+        val newest = versions.first()
+        val processors = if (newest.builds.size > 1) read("$page/download/${Urls.encodeSegment(newest.name)}", context)?.let(::processorsByCode).orEmpty() else emptyMap()
+        val releases = versions.asSequence()
+            .mapNotNull { release(page, pkg, it, processors, context.device) }
             .take(MAX_RELEASES)
             .toList()
         if (releases.isEmpty()) throw SourceException(SourceErrorKind.NO_RELEASES, "No version of $pkg on APKPure has a file for this device")
-        val first = entries.first()
-        val icon = first.obj("icon")
         val listing = SourceListing(
             releases = releases,
-            name = first.string("title") ?: first.string("label"),
-            author = first.string("developer"),
+            name = text(TITLE, html),
+            author = text(DEVELOPER, html),
             packageName = pkg,
-            description = first.string("description_short"),
+            description = text(SUMMARY, html),
         )
-        return CheckResult.Listing(listing.withIcons(spec.url, listOf(icon?.obj("original")?.string("url"), icon?.obj("thumbnail")?.string("url"))))
+        return CheckResult.Listing(listing.withIcons(spec.url, listOf(ICON.find(html)?.groupValues?.get(1)?.let(XmlScanner::decode))))
     }
 
-    private fun release(spec: SourceSpec, pkg: String, version: String, variants: List<JsonObject>, device: DeviceProfile?): Release? {
-        val files = LinkedHashMap<String, Asset>()
-        val codes = ArrayList<Long>()
-        var published: Long? = null
-        for (variant in variants) {
-            val code = variant.long("version_code") ?: continue
-            val abis = variant.array("native_code")?.strings().orEmpty().filter { ABI.matches(it) }
-            if (!fits(abis, device)) continue
-            val file = variant.obj("asset") ?: continue
-            val extension = file.string("type")?.lowercase()?.takeIf { EXTENSION.matches(it) } ?: continue
-            val address = file.string("url")?.let(::stableAddress) ?: continue
-            val name = "$pkg-$code" + (if (abis.isEmpty()) "" else "-" + abis.joinToString(",")) + ".$extension"
+    /** One build: whether it is a plain APK or APKPure's XAPK, and its version code. */
+    private class Build(val kind: String, val code: Long)
+
+    private class Version(val name: String, val builds: List<Build>, val size: Long?, val publishedAtMs: Long?)
+
+    private fun release(page: String, pkg: String, version: Version, processors: Map<Long, List<String>>, device: DeviceProfile?): Release? {
+        val assets = version.builds.mapNotNull { build ->
+            val abis = processors[build.code].orEmpty()
+            if (device != null && abis.isNotEmpty() && abis.none { it in device.abis }) return@mapNotNull null
+            val name = "$pkg-${build.code}" + (if (abis.isEmpty()) "" else "-" + abis.joinToString(",")) + "." + build.kind.lowercase()
             val kind = Asset.kindOf(name)
-            if ((kind != AssetKind.APK && kind != AssetKind.BUNDLE) || name in files) continue
-            val sha256 = file.string("file_sha256")?.lowercase()?.takeIf { SHA256.matches(it) }
-            files[name] = Asset(name = name, url = address, size = file.long("size")?.takeIf { it > 0 }, sha256 = sha256, kind = kind)
-            codes.add(code)
-            if (published == null) published = variant.string("update_date")?.let(Iso8601::parseMs)
+            if (kind != AssetKind.APK && kind != AssetKind.BUNDLE) return@mapNotNull null
+            val size = version.size.takeIf { version.builds.size == 1 }
+            Asset(name = name, url = "$FILES/${build.kind}/$pkg?versionCode=${build.code}", size = size, kind = kind) to build.code
         }
-        if (files.isEmpty()) return null
-        val notes = variants.firstNotNullOfOrNull { it.string("whatsnew")?.takeIf(String::isNotBlank) }
+        if (assets.isEmpty()) return null
         return Release(
-            id = version,
-            version = version,
-            // Variants of one version may carry different codes; the lowest keeps any of them from reading as out of date.
-            versionCode = codes.min(),
-            notes = notes,
-            notesFormat = NotesFormat.HTML,
-            publishedAtMs = published,
-            prerelease = variants.first().bool("is_beta") == true,
-            pageUrl = spec.url,
-            assets = files.values.toList(),
+            id = version.name,
+            version = version.name,
+            // Builds of one version may carry different codes; the lowest keeps any of them from reading as out of date.
+            versionCode = assets.minOf { it.second },
+            publishedAtMs = version.publishedAtMs,
+            pageUrl = page,
+            assets = assets.map { it.first },
         )
     }
 
-    override fun resolve(spec: SourceSpec, asset: Asset, context: CheckContext): Download = guarded(context) {
-        val pkg = packageOf(spec)
-        val fresh = history(pkg, it).asSequence()
-            .mapNotNull { entry -> entry.obj("asset")?.string("url") }
-            .firstOrNull { address -> stableAddress(address) == asset.url }
-            ?: throw SourceException(SourceErrorKind.NOT_FOUND, "APKPure no longer offers ${asset.name}")
-        Download(Urls.normalize(fresh) ?: throw SourceException(SourceErrorKind.PARSE, "APKPure named a file at an address that cannot be read"))
+    /** The versions the page lists, each once, the newest first by the day each was published. */
+    private fun versions(html: String, pkg: String): List<Version> {
+        val found = LinkedHashMap<String, Version>()
+        for (tag in DIV.findAll(html)) {
+            val attributes = tag.groupValues[1]
+            if (!VERSION_ITEM.containsMatchIn(attributes)) continue
+            val name = attribute(attributes, "data-dt-version")?.trim()?.takeIf { it.isNotEmpty() && it.length <= MAX_VERSION } ?: continue
+            if (name in found) continue
+            val listed = attribute(attributes, "data-dt-apklist")?.split(',').orEmpty() + listOfNotNull(attribute(attributes, "data-dt-apkid"))
+            val builds = listed.mapNotNull { build(it.trim(), pkg) }.distinctBy { it.code }.take(MAX_BUILDS)
+            if (builds.isEmpty()) continue
+            val after = html.substring(tag.range.last + 1, minOf(html.length, tag.range.last + 1 + ITEM_WINDOW))
+            found[name] = Version(
+                name = name,
+                builds = builds,
+                size = attribute(attributes, "data-dt-filesize")?.toLongOrNull()?.takeIf { it > 0 },
+                publishedAtMs = UPDATED.find(after)?.groupValues?.get(1)?.let(::dayMs),
+            )
+            if (found.size >= MAX_VERSIONS) break
+        }
+        // The page pins a version that is popular today near the top, whatever its age.
+        return found.values.sortedByDescending { it.publishedAtMs ?: Long.MIN_VALUE }
     }
 
-    private fun packageOf(spec: SourceSpec): String {
-        val pkg = spec.option(SourceOptions.PACKAGE) ?: Urls.segments(spec.url).lastOrNull()
-        if (pkg == null || !FDroidSource.isValidPackage(pkg)) throw SourceException(SourceErrorKind.UNSUPPORTED, "${spec.url} names no app on APKPure")
-        return pkg
+    /** A build named as the page names it, "b/XAPK/<id>", where the id is the package, the version code and more, joined by "_". */
+    private fun build(apkId: String, pkg: String): Build? {
+        val match = APK_ID.matchEntire(apkId) ?: return null
+        val decoded = try {
+            String(Base64.getUrlDecoder().decode(match.groupValues[2]), Charsets.UTF_8)
+        } catch (_: IllegalArgumentException) {
+            return null
+        }
+        val front = decoded.substringBeforeLast('_', "")
+        if (front.substringBeforeLast('_', "") != pkg) return null
+        val code = front.substringAfterLast('_').toLongOrNull()?.takeIf { it > 0 } ?: return null
+        return Build(match.groupValues[1], code)
     }
 
-    /** The versions of [pkg], newest first, each variant of a version as an entry of its own. */
-    private fun history(pkg: String, context: CheckContext): List<JsonObject> {
-        val sdk = context.device?.sdk ?: DEFAULT_SDK
-        val headers = mapOf(
-            "Ual-Access-Businessid" to "projecta",
-            "Ual-Access-ProjectA" to """{"device_info":{"os_ver":"$sdk"}}""",
-        )
-        val url = "$HISTORY?package_name=$pkg&hl=en"
-        context.http.execute(HttpRequest(url, headers = headers)).use {
-            if (it.status == 404) throw SourceException(SourceErrorKind.NOT_FOUND, "APKPure has no app $pkg")
-            if (!it.isSuccess) throw SourceException(SourceErrorKind.NETWORK, "Unexpected status ${it.status} from APKPure")
-            val answer = Json.parseObject(it.text(BODY_CAP))
-            val code = answer.long("retcode")
-            if (code != null && code != 0L) throw SourceException(SourceErrorKind.NETWORK, "APKPure refused the request: ${answer.string("errmsg").orEmpty()}")
-            val entries = answer.array("version_list") ?: throw SourceException(SourceErrorKind.PARSE, "APKPure sent no version list")
-            return entries.objects().ifEmpty { throw SourceException(SourceErrorKind.NOT_FOUND, "APKPure has no app $pkg") }
+    /** The processors of each build a download page describes, by the build's version code. */
+    private fun processorsByCode(html: String): Map<Long, List<String>> {
+        val found = HashMap<Long, List<String>>()
+        for (code in BUILD_CODE.findAll(html).take(MAX_BUILDS)) {
+            val window = html.substring(code.range.last + 1, minOf(html.length, code.range.last + 1 + BUILD_WINDOW))
+            val said = ARCHITECTURE.find(window)?.groupValues?.get(1) ?: continue
+            val abis = ABI.findAll(said).map { it.value }.filter { it in KNOWN_ABIS }.distinct().toList()
+            val number = code.groupValues[1].toLongOrNull() ?: continue
+            if (abis.isNotEmpty()) found.putIfAbsent(number, abis)
         }
+        return found
     }
 
-    private fun fits(abis: List<String>, device: DeviceProfile?): Boolean =
-        device == null || abis.isEmpty() || abis.any { it in ANY_ABI || it in device.abis }
+    private fun read(url: String, context: CheckContext): String? = context.http.execute(HttpRequest(url)).use {
+        if (it.status == 404) return null
+        if (!it.isSuccess) throw SourceException(SourceErrorKind.NETWORK, "Unexpected status ${it.status} from APKPure")
+        it.text(PAGE_CAP)
+    }
 
-    /** The file's address without the query, whose token runs out; null for anything but an https address on the file host. */
-    private fun stableAddress(url: String): String? {
-        if (!Urls.isHttps(url)) return null
-        val normalized = Urls.normalize(url) ?: return null
-        if (Urls.host(normalized) !in FILE_HOSTS) return null
-        return normalized.substringBefore('?').takeIf { Urls.segments(it).isNotEmpty() }
+    private fun packageOf(spec: SourceSpec): String {
+        val pkg = spec.option(SourceOptions.PACKAGE) ?: Urls.segments(spec.url).lastOrNull()
+        if (pkg == null || !FDroidSource.isValidPackage(pkg)) throw SourceException(SourceErrorKind.UNSUPPORTED, "${spec.url} names no app on APKPure")
+        return pkg
     }
 
-    companion object {
-        private const val HISTORY = "https://tapi.pureapk.com/v3/get_app_his_version"
-        private const val MAX_RELEASES = 30
-        private const val BODY_CAP = 4 * 1024 * 1024
+    /** The app's page on apkpure.com, where an address on another of the store's sites is read too. */
+    private fun pageOf(spec: SourceSpec, pkg: String): String {
+        val slug = Urls.segments(spec.url).firstOrNull()?.takeIf { it != pkg } ?: pkg
+        return "$SITE/${Urls.encodeSegment(slug)}/$pkg"
+    }
 
-        /** Sent as the Android version when the device is not known. */
-        private const val DEFAULT_SDK = 35
+    private fun attribute(attributes: String, name: String): String? =
+        Regex("""(?:^|\s)${Regex.escape(name)}\s*=\s*"([^"]{0,4000})"""").find(attributes)?.groupValues?.get(1)?.let(XmlScanner::decode)
 
-        private val SITES = listOf("apkpure.com", "apkpure.net")
+    private fun text(pattern: Regex, html: String): String? =
+        pattern.find(html)?.groupValues?.get(1)?.let(XmlScanner::decode)?.replace(SPACE, " ")?.trim()?.takeIf { it.isNotEmpty() }
 
-        /** Where the history says APKPure's files are. */
-        val FILE_HOSTS = setOf("data.winudf.com")
+    /** The page writes a day as "Sep 25, 2026", which is read as that day in UTC. */
+    private fun dayMs(text: String): Long? = try {
+        LocalDate.parse(text.trim(), DAY).atStartOfDay(ZoneOffset.UTC).toInstant().toEpochMilli()
+    } catch (_: DateTimeParseException) {
+        null
+    }
 
-        /** What the history says of a variant that runs on every processor. */
-        private val ANY_ABI = setOf("universal", "unlimited")
-        private val ABI = Regex("[A-Za-z0-9_-]{1,20}")
-        private val EXTENSION = Regex("[a-z]{3,4}")
-        private val SHA256 = Regex("[0-9a-f]{64}")
+    private companion object {
+        const val SITE = "https://apkpure.com"
+        const val FILES = "https://d.apkpure.com/b"
+        const val PAGE_CAP = 4 * 1024 * 1024
+        const val MAX_RELEASES = 30
+        const val MAX_VERSIONS = 60
+        const val MAX_VERSION = 100
+        const val MAX_BUILDS = 20
+        const val ITEM_WINDOW = 4000
+        const val BUILD_WINDOW = 1500
+
+        val SITES = listOf("apkpure.com", "apkpure.net")
+
+        /** The store's sites, its download address and where that sends, and where its pictures are. */
+        val DOMAINS = setOf("apkpure.com", "apkpure.net", "winudf.com")
+
+        val KNOWN_ABIS = setOf("arm64-v8a", "armeabi-v7a", "armeabi", "x86", "x86_64")
+        val DAY: DateTimeFormatter = DateTimeFormatter.ofPattern("MMM d, yyyy", Locale.US)
+        val DIV = Regex("""<div\s([^>]{1,4000})>""")
+        val VERSION_ITEM = Regex("""\bclass\s*=\s*"[^"]{0,300}\bver_download_link\b""")
+        val APK_ID = Regex("""b/(APK|XAPK)/([A-Za-z0-9_-]{1,400})""")
+        val UPDATED = Regex("""<span\s[^>]{0,300}class="[^"]{0,100}\bupdate-on\b[^"]{0,100}"[^>]{0,300}>([^<]{1,40})</span>""")
+        val TITLE = Regex("""<a\s[^>]{0,1000}class="ver_title"[^>]{0,1000}>\s*<h1>([^<]{1,300})</h1>""")
+        val DEVELOPER = Regex("""<p\s+class="ver_dev">\s*<a\b[^>]{0,1000}>([^<]{1,300})</a>""")
+        val SUMMARY = Regex("""<p\s+class="ver-des">([^<]{1,2000})</p>""")
+        val ICON = Regex("""<a\s[^>]{0,1000}class="ver-top-l"[^>]{0,1000}>\s*<img\s[^>]{0,2000}?\bsrc="([^"]{1,2000})"""")
+        val BUILD_CODE = Regex("""<span\s+class="additional-info[^"]{0,100}">\((\d{1,18})\)</span>""")
+        val ARCHITECTURE = Regex("""Architecture</span>\s*<span\s+class="value">([^<]{0,200})</span>""")
+        val ABI = Regex("[a-z0-9_-]{1,20}")
+        val SPACE = Regex("\\s+")
     }
 }
diff --git a/core/src/main/kotlin/io/github/munzzyy/tern/core/source/store/AptoideSource.kt b/core/src/main/kotlin/io/github/munzzyy/tern/core/source/store/AptoideSource.kt
index 163670e8..85102033 100644
--- a/core/src/main/kotlin/io/github/munzzyy/tern/core/source/store/AptoideSource.kt
+++ b/core/src/main/kotlin/io/github/munzzyy/tern/core/source/store/AptoideSource.kt
@@ -33,6 +33,8 @@ class AptoideSource : Source, Searchable {
 
     override val origin: String = "Aptoide"
 
+    override val domains: Set<String> get() = setOf("aptoide.com")
+
     override fun match(url: String): SourceSpec? {
         val uri = Urls.parseHttps(url) ?: return null
         val name = APP_HOST.matchEntire(uri.host?.lowercase() ?: return null)?.groupValues?.get(1) ?: return null
diff --git a/core/src/main/kotlin/io/github/munzzyy/tern/core/source/store/CoolApkSource.kt b/core/src/main/kotlin/io/github/munzzyy/tern/core/source/store/CoolApkSource.kt
deleted file mode 100644
index 639cb4b2..00000000
--- a/core/src/main/kotlin/io/github/munzzyy/tern/core/source/store/CoolApkSource.kt
+++ /dev/null
@@ -1,331 +0,0 @@
-package io.github.munzzyy.tern.core.source.store
-
-import io.github.munzzyy.tern.core.apk.BinaryManifest
-import io.github.munzzyy.tern.core.json.Json
-import io.github.munzzyy.tern.core.model.Asset
-import io.github.munzzyy.tern.core.model.NotesFormat
-import io.github.munzzyy.tern.core.model.Release
-import io.github.munzzyy.tern.core.model.SourceSpec
-import io.github.munzzyy.tern.core.net.HttpRequest
-import io.github.munzzyy.tern.core.net.Urls
-import io.github.munzzyy.tern.core.source.CheckContext
-import io.github.munzzyy.tern.core.source.CheckResult
-import io.github.munzzyy.tern.core.source.Download
-import io.github.munzzyy.tern.core.source.Source
-import io.github.munzzyy.tern.core.source.SourceErrorKind
-import io.github.munzzyy.tern.core.source.SourceException
-import io.github.munzzyy.tern.core.source.SourceListing
-import io.github.munzzyy.tern.core.source.SourceOptions
-import io.github.munzzyy.tern.core.source.SourceTypes
-import io.github.munzzyy.tern.core.source.fdroid.packageOption
-import io.github.munzzyy.tern.core.source.guarded
-import io.github.munzzyy.tern.core.text.Shown
-import java.math.BigInteger
-import java.security.MessageDigest
-import java.security.SecureRandom
-import java.util.Base64
-import java.util.Random
-
-/**
- * CoolApk. Reads the app's record from the API CoolApk's own app uses (api2.coolapk.com), which
- * answers only requests that carry that app's headers and a token made from the time and a device
- * code. The file is listed at the API's download address, and [resolve] asks it where the file is.
- */
-class CoolApkSource(private val random: Random = SecureRandom()) : Source {
-    override val type: String = SourceTypes.COOLAPK
-
-    override fun match(url: String): SourceSpec? {
-        val uri = Urls.parseHttps(url) ?: return null
-        if (uri.host?.lowercase()?.removePrefix("www.") != "coolapk.com") return null
-        val segments = Urls.segments(uri.toString())
-        if (segments.size < 2 || segments[0] != "apk") return null
-        val pkg = segments[1]
-        if (!BinaryManifest.isValidName(pkg)) return null
-        return SourceSpec(type, "https://www.coolapk.com/apk/$pkg", mapOf(SourceOptions.PACKAGE to pkg))
-    }
-
-    override fun check(spec: SourceSpec, context: CheckContext): CheckResult = guarded(context) { checkOnce(spec, it) }
-
-    private fun checkOnce(spec: SourceSpec, context: CheckContext): CheckResult {
-        val pkg = packageOption(spec)
-        val root = context.http.execute(HttpRequest("$API/v6/apk/detail?id=$pkg", headers = headers(context))).use { response ->
-            if (response.status == 404) throw SourceException(SourceErrorKind.NOT_FOUND, "CoolApk has no app $pkg")
-            if (!response.isSuccess) throw SourceException(SourceErrorKind.NETWORK, "CoolApk answered ${response.status} for $pkg")
-            Json.parseObject(response.text(MAX_BODY))
-        }
-        val detail = root.obj("data") ?: run {
-            if (root.long("status") == -2L) throw SourceException(SourceErrorKind.NOT_FOUND, "CoolApk has no app $pkg")
-            val reason = root.string("message")?.let { Shown.lineOrNull(it, 200) } ?: "no reason given"
-            throw SourceException(SourceErrorKind.NETWORK, "CoolApk refused the request for $pkg: $reason")
-        }
-        val answered = detail.string("apkname") ?: detail.string("packageName")
-        if (answered != null && answered != pkg) throw SourceException(SourceErrorKind.PARSE, "Asked for $pkg and was answered for another package")
-        val version = detail.string("apkversionname")?.takeIf { it.isNotBlank() }
-            ?: throw SourceException(SourceErrorKind.NO_RELEASES, "CoolApk named no version of $pkg")
-        val versionCode = detail.long("apkversioncode")?.takeIf { it > 0 }
-        val appId = detail.long("id")?.takeIf { it > 0 } ?: throw SourceException(SourceErrorKind.PARSE, "CoolApk named no id for $pkg")
-        val asset = Asset(name = "${pkg}_$version.apk", url = fileUrl(pkg, appId, versionCode), size = detail.long("apklength")?.takeIf { it > 0 })
-        val release = Release(
-            id = versionCode?.toString() ?: version,
-            version = version,
-            versionCode = versionCode,
-            notes = detail.string("changelog")?.takeIf { it.isNotBlank() },
-            notesFormat = NotesFormat.PLAIN,
-            publishedAtMs = detail.long("lastupdate")?.takeIf { it > 0 }?.let { it * 1000 },
-            pageUrl = spec.url,
-            assets = listOf(asset),
-        )
-        val listing = SourceListing(
-            releases = listOf(release),
-            name = detail.string("title"),
-            author = detail.string("developername")?.takeIf { it.isNotBlank() },
-            packageName = pkg,
-            description = detail.string("subtitle")?.takeIf { it.isNotBlank() },
-        )
-        // Logos are named over plain http, on hosts that answer https as well.
-        return CheckResult.Listing(listing.withIcons(spec.url, listOf(detail.string("logo")?.let(Urls::normalize))))
-    }
-
-    /** The download address answers with a redirect to where the file is now, and only to requests with a fresh token. */
-    override fun resolve(spec: SourceSpec, asset: Asset, context: CheckContext): Download = guarded(context) { scoped ->
-        val pkg = packageOption(spec)
-        val appId = Urls.queryParam(asset.url, "aid")?.toLongOrNull()
-        val address = appId?.let { fileUrl(pkg, it, Urls.queryParam(asset.url, "vc")?.toLongOrNull()) }?.takeIf { it == asset.url }
-            ?: throw SourceException(SourceErrorKind.PARSE, "Not a CoolApk download address: ${asset.url}")
-        scoped.http.execute(HttpRequest(address, headers = headers(scoped), followRedirects = false)).use { response ->
-            if (response.status == 404) throw SourceException(SourceErrorKind.NOT_FOUND, "CoolApk has no file of $pkg")
-            if (response.status !in 300..399) throw SourceException(SourceErrorKind.NETWORK, "CoolApk answered ${response.status} for the file of $pkg")
-            val target = response.headers["Location"]?.let { Urls.resolve(address, it) }?.takeIf(::onFileHost)
-                ?: throw SourceException(SourceErrorKind.PARSE, "CoolApk sent the download to a host it does not use")
-            Download(target)
-        }
-    }
-
-    /** The headers CoolApk's app sends, with a new device code and a token for this moment. */
-    private fun headers(context: CheckContext): Map<String, String> {
-        val device = CoolApkToken.deviceCode(ByteArray(16).also(random::nextBytes), ByteArray(6).also(random::nextBytes))
-        return APP_HEADERS + mapOf("X-App-Device" to device, "X-App-Token" to CoolApkToken.token(context.nowMs() / 1000, device))
-    }
-
-    private fun onFileHost(url: String): Boolean {
-        val host = Urls.host(url)
-        return FILE_HOSTS.any { host == it || host.endsWith(".$it") }
-    }
-
-    private companion object {
-        const val API = "https://api2.coolapk.com"
-        const val MAX_BODY = 4 * 1024 * 1024
-
-        /** The API's download address sends to dl.coolapk.com, which sends on to a CDN such as dl-t2.coolapkmarket.com. */
-        val FILE_HOSTS = listOf("coolapk.com", "coolapkmarket.com")
-
-        /** What CoolApk's app says about itself. The version is the one Obtainium sends. */
-        val APP_HEADERS = mapOf(
-            "User-Agent" to "Dalvik/2.1.0 (Linux; U; Android 9; MI 8 SE MIUI/9.5.9) (#Build; Xiaomi; MI 8 SE; PKQ1.181121.001; 9) +CoolMarket/12.4.2-2208241-universal",
-            "X-App-Id" to "com.coolapk.market",
-            "X-Requested-With" to "XMLHttpRequest",
-            "X-Sdk-Int" to "30",
-            "X-App-Mode" to "universal",
-            "X-App-Channel" to "coolapk",
-            "X-Sdk-Locale" to "zh-CN",
-            "X-App-Version" to "12.4.2",
-            "X-Api-Supported" to "2208241",
-            "X-App-Code" to "2208241",
-            "X-Api-Version" to "12",
-            "X-Dark-Mode" to "0",
-        )
-
-        fun fileUrl(pkg: String, appId: Long, versionCode: Long?): String =
-            "$API/v6/apk/download?pn=$pkg&aid=$appId" + (versionCode?.let { "&vc=$it" } ?: "")
-    }
-}
-
-/** The device code and the second version of the token, made the way CoolApk's app makes them and as Obtainium makes them. */
-internal object CoolApkToken {
-    /** A device code from a random Android id and MAC address, for a phone that says it is a Pixel 5a. */
-    fun deviceCode(androidId: ByteArray, mac: ByteArray): String {
-        val id = androidId.joinToString("") { "%02X".format(it) }
-        val address = mac.joinToString(":") { "%02x".format(it) }
-        return base64("$id; ; ; $address; Google; Google; Pixel 5a; SQ1D.220105.007")
-    }
-
-    /** The token for the time in [seconds] and a [deviceCode]. */
-    fun token(seconds: Long, deviceCode: String): String {
-        val time = seconds.toString()
-        val token = "token://com.coolapk.market/dcf01e569c1e3db93a3d0fcf191a622c?${md5(time)}\$${md5(deviceCode)}&com.coolapk.market"
-        val salt = "\$2a\$10\$${base64(time).take(14)}/${md5(token).take(6)}u"
-        val hashed = Bcrypt.hash(md5(base64(token)), salt)
-        return "v2" + base64("\$2y" + hashed.substring(3))
-    }
-
-    private fun base64(text: String): String = Base64.getEncoder().encodeToString(text.toByteArray(Charsets.UTF_8))
-
-    private fun md5(text: String): String =
-        MessageDigest.getInstance("MD5").digest(text.toByteArray(Charsets.UTF_8)).joinToString("") { "%02x".format(it) }
-}
-
-/** bcrypt as jBCrypt computes it, for the "$2a$" salts the token needs. */
-internal object Bcrypt {
-    private const val ALPHABET = "./ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789"
-    private val SALT = Regex("""^\$2a\$(\d\d)\$([./A-Za-z0-9]{22})""")
-
-    /** "OrpheanBeholderScryDoubt", the text bcrypt enciphers, as six big-endian words. */
-    private val MAGIC = intArrayOf(0x4f727068, 0x65616e42, 0x65686f6c, 0x64657253, 0x63727944, 0x6f756274)
-
-    /** [password] hashed with [salt], a string that begins "$2a$", two digits of cost, "$" and 22 characters of salt. */
-    fun hash(password: String, salt: String): String {
-        val match = SALT.find(salt) ?: throw IllegalArgumentException("Not a bcrypt salt")
-        val cost = match.groupValues[1].toInt()
-        require(cost in 4..30) { "bcrypt cost out of range" }
-        val saltBytes = decode(match.groupValues[2], 16)
-        // The "a" revision counts the zero that ends the password as part of it.
-        val key = (password + "\u0000").toByteArray(Charsets.UTF_8)
-        return "\$2a\$${match.groupValues[1]}\$" + encode(saltBytes, 16) + encode(crypt(key, saltBytes, cost), 23)
-    }
-
-    private fun crypt(key: ByteArray, salt: ByteArray, cost: Int): ByteArray {
-        val p = Blowfish.INITIAL.copyOfRange(0, 18)
-        val s = Blowfish.INITIAL.copyOfRange(18, 18 + 1024)
-        expand(p, s, key, salt)
-        repeat(1 shl cost) {
-            expand(p, s, key, null)
-            expand(p, s, salt, null)
-        }
-        val words = MAGIC.copyOf()
-        repeat(64) {
-            for (j in 0 until words.size step 2) encipher(p, s, words, j)
-        }
-        val out = ByteArray(words.size * 4)
-        for ((i, word) in words.withIndex()) {
-            out[4 * i] = (word ushr 24).toByte()
-            out[4 * i + 1] = (word ushr 16).toByte()
-            out[4 * i + 2] = (word ushr 8).toByte()
-            out[4 * i + 3] = word.toByte()
-        }
-        return out
-    }
-
-    /** Blowfish's key schedule; with [data], bcrypt's variant that mixes the salt into every block. */
-    private fun expand(p: IntArray, s: IntArray, key: ByteArray, data: ByteArray?) {
-        val keyAt = IntArray(1)
-        for (i in p.indices) p[i] = p[i] xor word(key, keyAt)
-        val block = IntArray(2)
-        val dataAt = IntArray(1)
-        for (table in listOf(p, s)) {
-            for (i in 0 until table.size step 2) {
-                if (data != null) {
-                    block[0] = block[0] xor word(data, dataAt)
-                    block[1] = block[1] xor word(data, dataAt)
-                }
-                encipher(p, s, block, 0)
-                table[i] = block[0]
-                table[i + 1] = block[1]
-            }
-        }
-    }
-
-    /** The next four bytes of [data] as a word, going round to the start at the end. */
-    private fun word(data: ByteArray, at: IntArray): Int {
-        var word = 0
-        var offset = at[0]
-        repeat(4) {
-            word = (word shl 8) or (data[offset].toInt() and 0xff)
-            offset = (offset + 1) % data.size
-        }
-        at[0] = offset
-        return word
-    }
-
-    private fun encipher(p: IntArray, s: IntArray, block: IntArray, offset: Int) {
-        var left = block[offset] xor p[0]
-        var right = block[offset + 1]
-        var i = 1
-        while (i <= 16) {
-            right = right xor f(s, left) xor p[i]
-            left = left xor f(s, right) xor p[i + 1]
-            i += 2
-        }
-        block[offset] = right xor p[17]
-        block[offset + 1] = left
-    }
-
-    private fun f(s: IntArray, x: Int): Int =
-        ((s[x ushr 24] + s[0x100 or ((x ushr 16) and 0xff)]) xor s[0x200 or ((x ushr 8) and 0xff)]) + s[0x300 or (x and 0xff)]
-
-    private fun encode(data: ByteArray, length: Int): String {
-        val out = StringBuilder()
-        var offset = 0
-        while (offset < length) {
-            var c1 = data[offset++].toInt() and 0xff
-            out.append(ALPHABET[(c1 ushr 2) and 0x3f])
-            c1 = (c1 and 0x03) shl 4
-            if (offset >= length) {
-                out.append(ALPHABET[c1 and 0x3f])
-                break
-            }
-            var c2 = data[offset++].toInt() and 0xff
-            c1 = c1 or ((c2 ushr 4) and 0x0f)
-            out.append(ALPHABET[c1 and 0x3f])
-            c1 = (c2 and 0x0f) shl 2
-            if (offset >= length) {
-                out.append(ALPHABET[c1 and 0x3f])
-                break
-            }
-            c2 = data[offset++].toInt() and 0xff
-            c1 = c1 or ((c2 ushr 6) and 0x03)
-            out.append(ALPHABET[c1 and 0x3f])
-            out.append(ALPHABET[c2 and 0x3f])
-        }
-        return out.toString()
-    }
-
-    private fun decode(text: String, length: Int): ByteArray {
-        val out = ArrayList<Byte>(length)
-        var offset = 0
-        fun next(): Int = ALPHABET.indexOf(text[offset++])
-        while (offset < text.length - 1 && out.size < length) {
-            val c1 = next()
-            val c2 = next()
-            out.add(((c1 shl 2) or ((c2 and 0x30) ushr 4)).toByte())
-            if (out.size >= length || offset >= text.length) break
-            val c3 = next()
-            out.add((((c2 and 0x0f) shl 4) or ((c3 and 0x3c) ushr 2)).toByte())
-            if (out.size >= length || offset >= text.length) break
-            val c4 = next()
-            out.add((((c3 and 0x03) shl 6) or c4).toByte())
-        }
-        return out.toByteArray()
-    }
-
-    /** Blowfish starts from the digits of pi after the point: 18 words for its keys, then its four tables of 256. */
-    private object Blowfish {
-        val INITIAL: IntArray = piFraction(18 + 4 * 256)
-
-        private fun piFraction(words: Int): IntArray {
-            val bits = words * 32
-            val one = BigInteger.ONE.shiftLeft(bits + GUARD)
-            // Machin: pi = 16 atan(1/5) - 4 atan(1/239)
-            val pi = arctanOfInverse(5, one).shiftLeft(4) - arctanOfInverse(239, one).shiftLeft(2)
-            val fraction = (pi - one * BigInteger.valueOf(3)).shiftRight(GUARD)
-            return IntArray(words) { fraction.shiftRight(bits - 32 * (it + 1)).toInt() }
-        }
-
-        /** atan(1/x) in fixed point, with [one] as 1. */
-        private fun arctanOfInverse(x: Int, one: BigInteger): BigInteger {
-            val square = BigInteger.valueOf(x.toLong() * x)
-            var power = one / BigInteger.valueOf(x.toLong())
-            var sum = BigInteger.ZERO
-            var n = 1L
-            while (power.signum() != 0) {
-                val term = power / BigInteger.valueOf(n)
-                sum = if (n % 4 == 1L) sum + term else sum - term
-                power /= square
-                n += 2
-            }
-            return sum
-        }
-
-        /** Bits beyond the last word, so that the rounding of every term is lost below it. */
-        private const val GUARD = 64
-    }
-}
diff --git a/core/src/main/kotlin/io/github/munzzyy/tern/core/source/store/FarsroidSource.kt b/core/src/main/kotlin/io/github/munzzyy/tern/core/source/store/FarsroidSource.kt
deleted file mode 100644
index b60d38f3..00000000
--- a/core/src/main/kotlin/io/github/munzzyy/tern/core/source/store/FarsroidSource.kt
+++ /dev/null
@@ -1,102 +0,0 @@
-package io.github.munzzyy.tern.core.source.store
-
-import io.github.munzzyy.tern.core.json.Json
-import io.github.munzzyy.tern.core.model.Asset
-import io.github.munzzyy.tern.core.model.Release
-import io.github.munzzyy.tern.core.model.SourceSpec
-import io.github.munzzyy.tern.core.net.HttpRequest
-import io.github.munzzyy.tern.core.net.Urls
-import io.github.munzzyy.tern.core.source.CheckContext
-import io.github.munzzyy.tern.core.source.CheckResult
-import io.github.munzzyy.tern.core.source.Source
-import io.github.munzzyy.tern.core.source.SourceErrorKind
-import io.github.munzzyy.tern.core.source.SourceException
-import io.github.munzzyy.tern.core.source.SourceListing
-import io.github.munzzyy.tern.core.source.SourceOptions
-import io.github.munzzyy.tern.core.source.SourceTypes
-import io.github.munzzyy.tern.core.source.guarded
-import io.github.munzzyy.tern.core.source.web.LinkScanner
-import io.github.munzzyy.tern.core.xml.XmlScanner
-
-/**
- * Farsroid. The app's page names the post and the version its download box is for; the site's
- * /api/download-box/ answers with that box, and its links to installable files on Farsroid's own
- * servers become the files of the one release.
- */
-class FarsroidSource : Source {
-    override val type: String = SourceTypes.FARSROID
-
-    override val republishes: Boolean get() = true
-
-    override fun match(url: String): SourceSpec? {
-        val uri = Urls.parseHttps(url) ?: return null
-        val host = uri.host?.lowercase()
-        if (host != "farsroid.com" && host != "www.farsroid.com") return null
-        // An address of a file is left to the source for plain downloads.
-        if (INSTALLABLE.any { uri.path.orEmpty().lowercase().endsWith(it) }) return null
-        val slug = uri.rawPath?.split('/')?.firstOrNull { it.isNotEmpty() } ?: return null
-        if (!SLUG.matches(slug) || slug.lowercase() in NOT_APPS) return null
-        return SourceSpec(type, "$SITE/$slug")
-    }
-
-    override fun check(spec: SourceSpec, context: CheckContext): CheckResult = guarded(context) { checkOnce(spec, it) }
-
-    private fun checkOnce(spec: SourceSpec, context: CheckContext): CheckResult {
-        val html = read(spec.url, context)
-        val box = DOWNLOAD_BOX.find(html)?.value ?: throw SourceException(SourceErrorKind.NO_RELEASES, "The page at ${spec.url} has no download box")
-        val postId = attribute(box, "data-post-id")?.takeIf { NUMBER.matches(it) }
-        val version = attribute(box, "data-post-version")?.trim()?.takeIf { it.isNotEmpty() }
-        if (postId == null || version == null) throw SourceException(SourceErrorKind.NO_RELEASES, "The download box at ${spec.url} names no version")
-
-        val boxUrl = "$SITE/api/download-box/?post_id=$postId&post_version=${Urls.encodeSegment(version)}"
-        val content = Json.parseObject(read(boxUrl, context)).obj("data")?.string("content").orEmpty()
-        val assets = LinkScanner.anchors(content).asSequence()
-            .mapNotNull { Urls.resolve(boxUrl, it.href) }
-            .filter(::isFile)
-            .distinct()
-            .map { Asset(name = Urls.segments(it).last(), url = it) }
-            .take(MAX_FILES)
-            .toList()
-        if (assets.isEmpty()) throw SourceException(SourceErrorKind.NO_RELEASES, "The download box at ${spec.url} offers no file")
-        // Obtainium's "release title as version" takes the file's name; each file is then a release, so the app's filters choose among them.
-        val releases = if (spec.flag(SourceOptions.FILE_VERSION)) {
-            assets.map { Release(id = it.name, version = it.name, pageUrl = spec.url, assets = listOf(it)) }
-        } else {
-            listOf(Release(id = version, version = version, pageUrl = spec.url, assets = assets))
-        }
-        return CheckResult.Listing(SourceListing(releases = releases))
-    }
-
-    private fun read(url: String, context: CheckContext): String = context.http.execute(HttpRequest(url)).use {
-        if (it.status == 404) throw SourceException(SourceErrorKind.NOT_FOUND, "There is nothing at $url")
-        if (!it.isSuccess) throw SourceException(SourceErrorKind.NETWORK, "Unexpected status ${it.status} for $url")
-        it.text(PAGE_CAP)
-    }
-
-    /** An installable file on Farsroid's own servers. */
-    private fun isFile(url: String): Boolean {
-        val host = Urls.host(url)
-        if (host != FILE_DOMAIN && !host.endsWith(".$FILE_DOMAIN")) return false
-        val path = Urls.parseHttps(url)?.path?.lowercase() ?: return false
-        return INSTALLABLE.any { path.endsWith(it) }
-    }
-
-    private fun attribute(tag: String, name: String): String? =
-        Regex("""\s${Regex.escape(name)}\s*=\s*(?:"([^"]*)"|'([^']*)')""", RegexOption.IGNORE_CASE).find(tag)
-            ?.let { XmlScanner.decode(it.groupValues[1].ifEmpty { it.groupValues[2] }) }
-
-    companion object {
-        private const val SITE = "https://www.farsroid.com"
-        private const val PAGE_CAP = 4 * 1024 * 1024
-        private const val MAX_FILES = 20
-
-        /** Farsroid's files are on its own servers under this name, such as dl.farsroid.com. */
-        const val FILE_DOMAIN = "farsroid.com"
-
-        private val SLUG = Regex("(?=.*[A-Za-z0-9])[A-Za-z0-9._~%-]{1,300}")
-        private val NOT_APPS = setOf("api", "wp-admin", "wp-content", "wp-includes", "wp-json", "category", "tag", "page", "author", "feed", "search", "comments")
-        private val NUMBER = Regex("[0-9]{1,18}")
-        private val INSTALLABLE = listOf(".apk", ".xapk", ".apks", ".apkm")
-        private val DOWNLOAD_BOX = Regex("""<[a-z][a-z0-9]*\b[^>]*\sclass\s*=\s*["'](?:[^"']*\s)?download-links(?:\s[^"']*)?["'][^>]*>""", RegexOption.IGNORE_CASE)
-    }
-}
diff --git a/core/src/main/kotlin/io/github/munzzyy/tern/core/source/store/HuaweiSource.kt b/core/src/main/kotlin/io/github/munzzyy/tern/core/source/store/HuaweiSource.kt
index c332001d..14f9a207 100644
--- a/core/src/main/kotlin/io/github/munzzyy/tern/core/source/store/HuaweiSource.kt
+++ b/core/src/main/kotlin/io/github/munzzyy/tern/core/source/store/HuaweiSource.kt
@@ -29,16 +29,20 @@ import java.time.format.DateTimeParseException
 import java.util.Random
 
 /**
- * Huawei AppGallery. Reads the API the AppGallery app uses (a form POST to /hwmarket/api/clientApi):
- * a client.front2 handshake gives a sign and the service zone, which picks the store's host, and
- * client.appDetailById describes the app. The handshake is kept in this object's memory for a day,
- * so most checks make one request, and it is made again when the store stops answering to it.
+ * Huawei AppGallery, read through its store API (a form POST to /hwmarket/api/clientApi) as Tern,
+ * with Tern's own User-Agent and nothing said about the device: a client.front2 handshake gives a
+ * sign and the service zone, which picks the store's host, and client.appDetailById describes the
+ * app. The API wants a device id; each handshake makes up a random one, which names nothing. The
+ * handshake is kept in this object's memory for a day, so most checks make one request, and it
+ * is made again when the store stops answering to it.
  */
 class HuaweiSource(private val random: Random = SecureRandom()) : Source, Searchable {
     override val type: String = SourceTypes.HUAWEI
 
     override val origin: String = "Huawei AppGallery"
 
+    override val domains: Set<String> get() = DOMAINS
+
     private class Session(val host: String, val sign: String, val deviceId: String, val madeAtMs: Long)
 
     @Volatile
@@ -158,14 +162,6 @@ class HuaweiSource(private val random: Random = SecureRandom()) : Source, Search
 
     private fun front2(deviceId: String, context: CheckContext, needServiceZone: Boolean): Map<String, String> = common(deviceId, context) + mapOf(
         "method" to "client.front2",
-        "version" to "16.5.1",
-        "versionCode" to "160501301",
-        "packageName" to "com.huawei.appmarket",
-        "zone" to "1",
-        "phoneType" to "Pixel 8 Pro",
-        "firmwareVersion" to "16",
-        "isFirstLaunch" to "1",
-        "oobe" to "0",
         "needServiceZone" to if (needServiceZone) "1" else "0",
     )
 
@@ -174,18 +170,14 @@ class HuaweiSource(private val random: Random = SecureRandom()) : Source, Search
         "locale" to "en_US",
         "serviceType" to "0",
         "ts" to context.nowMs().toString(),
-        "net" to "1",
-        "brand" to "google",
-        "manufacturer" to "Google",
-        "subBrand" to "0",
         "deviceId" to deviceId,
         "deviceIdType" to "9",
     )
 
-    /** A form with its fields in the order of their names, as the AppGallery app sends it. */
+    /** A form with its fields in the order of their names. */
     private fun post(context: CheckContext, host: String, params: Map<String, String>): JsonObject {
         val form = params.toSortedMap().entries.joinToString("&") { (key, value) -> "${formPart(key)}=${formPart(value)}" }
-        val request = HttpRequest.post("https://$host$API_PATH", form, "application/x-www-form-urlencoded", mapOf("User-Agent" to USER_AGENT, "Accept" to "application/json"))
+        val request = HttpRequest.post("https://$host$API_PATH", form, "application/x-www-form-urlencoded", mapOf("Accept" to "application/json"))
         context.http.execute(request).use { response ->
             if (!response.isSuccess) throw SourceException(SourceErrorKind.NETWORK, "Huawei AppGallery answered ${response.status} at $host")
             return Json.parseObject(response.text(MAX_BODY))
@@ -216,7 +208,6 @@ class HuaweiSource(private val random: Random = SecureRandom()) : Source, Search
 
     private companion object {
         const val API_PATH = "/hwmarket/api/clientApi"
-        const val USER_AGENT = "HiSpace##16.5.1.301##google##Pixel 8 Pro"
         const val MAX_BODY = 2 * 1024 * 1024
         const val MAX_HITS = 25
         const val SESSION_MS = 24 * 60 * 60 * 1000L
@@ -232,6 +223,9 @@ class HuaweiSource(private val random: Random = SecureRandom()) : Source, Search
         /** Where the store keeps its files, such as appdlc-dre.hispace.dbankcloud.com. */
         val FILE_HOSTS = listOf("dbankcloud.com", "dbankcloud.ru")
 
+        /** The store's pages, its API, its files and the CDN its file addresses send on to, such as appdl-12-drcn.dbankcdn.com. */
+        val DOMAINS = HOSTS + FILE_HOSTS + "dbankcdn.com"
+
         val APP_ID = Regex("^C[0-9]{1,20}$")
         val SHA256 = Regex("^[0-9a-f]{64}$")
 
diff --git a/core/src/main/kotlin/io/github/munzzyy/tern/core/source/store/ItchIoSource.kt b/core/src/main/kotlin/io/github/munzzyy/tern/core/source/store/ItchIoSource.kt
index 45f55446..0f534103 100644
--- a/core/src/main/kotlin/io/github/munzzyy/tern/core/source/store/ItchIoSource.kt
+++ b/core/src/main/kotlin/io/github/munzzyy/tern/core/source/store/ItchIoSource.kt
@@ -4,6 +4,7 @@ import io.github.munzzyy.tern.core.json.Json
 import io.github.munzzyy.tern.core.json.JsonException
 import io.github.munzzyy.tern.core.json.JsonObject
 import io.github.munzzyy.tern.core.model.Asset
+import io.github.munzzyy.tern.core.model.AssetKind
 import io.github.munzzyy.tern.core.model.Release
 import io.github.munzzyy.tern.core.model.SourceSpec
 import io.github.munzzyy.tern.core.net.HttpRequest
@@ -18,7 +19,6 @@ import io.github.munzzyy.tern.core.source.SourceListing
 import io.github.munzzyy.tern.core.source.SourceTypes
 import io.github.munzzyy.tern.core.source.guarded
 import io.github.munzzyy.tern.core.source.web.LinkScanner
-import io.github.munzzyy.tern.core.source.web.ServedFile
 import io.github.munzzyy.tern.core.xml.XmlScanner
 import java.time.Instant
 import java.time.LocalDateTime
@@ -33,9 +33,10 @@ import java.util.Locale
  * uploads with the platforms each is for; only the uploads marked for Android are listed. When the
  * page asks for a price first, the free download page itch.io hands out in its place is read. The
  * version is the highest "v1.2.3" or "Version 1.2.3" in the page's main part, else the day of the
- * newest date on the page. itch.io hands out a file at an address that lasts a minute, so a file is
- * listed by the page and its upload id, and [resolve] asks for a fresh address just before the
- * download. None of this needs a cookie: the token in the page is enough.
+ * newest date on the page. A check reads only the page: each file is listed by the page and its
+ * upload id, under the name the page gives it, and [resolve] asks itch.io for the file, at an
+ * address that lasts a minute, just before the download. None of this needs a cookie: the token in
+ * the page is enough.
  */
 class ItchIoSource : Source {
     override val type: String = SourceTypes.ITCHIO
@@ -68,8 +69,9 @@ class ItchIoSource : Source {
         }
         val android = uploads.filter { it.android }.take(MAX_UPLOADS)
         if (android.isEmpty()) throw SourceException(SourceErrorKind.NO_RELEASES, "$base offers no file for Android")
-        val assets = android.mapNotNull { asset(base, it, csrf, context) }
-        if (assets.isEmpty()) throw SourceException(SourceErrorKind.NO_RELEASES, "$base keeps its files for Android outside itch.io")
+        // Asking for a file is what itch.io's download button does, so a check only reads the page.
+        // An upload marked for Android is an APK; the page may call it anything, and the file is read before it is installed.
+        val assets = android.map { Asset(name = it.name, url = "$base/download/${it.id}", kind = Asset.kindOf(it.name).takeIf { kind -> kind != AssetKind.OTHER } ?: AssetKind.APK) }
         val shown = version ?: updated?.let(::dayOf) ?: "latest"
         val release = Release(id = shown, version = shown, publishedAtMs = updated, pageUrl = base, assets = assets)
         val listing = SourceListing(
@@ -100,8 +102,6 @@ class ItchIoSource : Source {
 
     private class Answer(val status: Int, val json: JsonObject?)
 
-    private class Served(val name: String?, val size: Long?)
-
     private fun page(url: String, context: CheckContext): String = context.http.execute(HttpRequest(url)).use {
         if (it.status == 404) throw SourceException(SourceErrorKind.NOT_FOUND, "There is nothing at $url")
         if (!it.isSuccess) throw SourceException(SourceErrorKind.NETWORK, "Unexpected status ${it.status} for $url")
@@ -115,13 +115,6 @@ class ItchIoSource : Source {
         return context.http.execute(HttpRequest(address)).use { if (it.isSuccess) it.text(PAGE_CAP) else null }
     }
 
-    /** The upload as a file: its name and size as the file store gives them, else its name on the page. Null when itch.io keeps it elsewhere. */
-    private fun asset(base: String, upload: Upload, csrf: String?, context: CheckContext): Asset? {
-        val named = csrf?.let { post(fileEndpoint(base, upload.id), it, referer(base, upload.id), context).json?.string("url") }
-        val served = if (named == null) null else served(fileAddress(base, named) ?: return null, context)
-        return Asset(name = served?.name ?: upload.name, url = "$base/download/${upload.id}", size = served?.size)
-    }
-
     /** A POST of the page's token, as the page's own script sends it. */
     private fun post(url: String, csrf: String, headers: Map<String, String>, context: CheckContext): Answer {
         val body = Json.write(Json.obj("csrf_token" to csrf))
@@ -131,16 +124,6 @@ class ItchIoSource : Source {
         }
     }
 
-    /** The name and size of the file at [address], read from the answer for its first byte. */
-    private fun served(address: String, context: CheckContext): Served? {
-        context.http.execute(HttpRequest(address, headers = mapOf("Range" to "bytes=0-0", "Accept-Encoding" to "identity"))).use {
-            if (!it.isSuccess) return null
-            val whole = it.headers["Content-Range"]?.substringAfterLast('/')?.toLongOrNull()
-                ?: if (it.status == 200) it.headers["Content-Length"]?.toLongOrNull() else null
-            return Served(ServedFile.dispositionName(it.headers["Content-Disposition"]), whole?.takeIf { size -> size > 0 })
-        }
-    }
-
     private fun objectOrNull(text: String): JsonObject? = try {
         Json.parse(text) as? JsonObject
     } catch (_: JsonException) {
diff --git a/core/src/main/kotlin/io/github/munzzyy/tern/core/source/store/LiteApksSource.kt b/core/src/main/kotlin/io/github/munzzyy/tern/core/source/store/LiteApksSource.kt
deleted file mode 100644
index f4435964..00000000
--- a/core/src/main/kotlin/io/github/munzzyy/tern/core/source/store/LiteApksSource.kt
+++ /dev/null
@@ -1,114 +0,0 @@
-package io.github.munzzyy.tern.core.source.store
-
-import io.github.munzzyy.tern.core.json.Json
-import io.github.munzzyy.tern.core.json.JsonArray
-import io.github.munzzyy.tern.core.model.Asset
-import io.github.munzzyy.tern.core.model.Release
-import io.github.munzzyy.tern.core.model.SourceSpec
-import io.github.munzzyy.tern.core.net.HttpRequest
-import io.github.munzzyy.tern.core.net.Urls
-import io.github.munzzyy.tern.core.source.CheckContext
-import io.github.munzzyy.tern.core.source.CheckResult
-import io.github.munzzyy.tern.core.source.Download
-import io.github.munzzyy.tern.core.source.Source
-import io.github.munzzyy.tern.core.source.SourceErrorKind
-import io.github.munzzyy.tern.core.source.SourceException
-import io.github.munzzyy.tern.core.source.SourceListing
-import io.github.munzzyy.tern.core.source.SourceTypes
-import io.github.munzzyy.tern.core.source.guarded
-import io.github.munzzyy.tern.core.source.web.ServedFile
-import io.github.munzzyy.tern.core.xml.XmlScanner
-import java.util.Base64
-
-/**
- * An app page on liteapks.com, read through the site's WordPress API: the post of the page's slug
- * gives its id, and the site's own record of that post gives the name, the publisher, the version
- * and the download links. Every request names the page it comes from, as the site wants. The file
- * server wants a token of the time with each download, which [resolve] adds.
- */
-class LiteApksSource : Source {
-    override val type: String = SourceTypes.LITEAPKS
-
-    override val republishes: Boolean get() = true
-
-    override fun match(url: String): SourceSpec? {
-        val uri = Urls.parseHttps(url) ?: return null
-        if (uri.host?.lowercase()?.removePrefix("www.") != HOST) return null
-        val slug = uri.rawPath.orEmpty().split('/').firstOrNull { it.isNotEmpty() }?.removeSuffix(".html") ?: return null
-        if (!SLUG.matches(slug) || slug in RESERVED) return null
-        return SourceSpec(type, "https://$HOST/$slug.html")
-    }
-
-    override fun check(spec: SourceSpec, context: CheckContext): CheckResult = guarded(context) { checkOnce(spec, it) }
-
-    private fun checkOnce(spec: SourceSpec, context: CheckContext): CheckResult {
-        val slug = Urls.segments(spec.url).singleOrNull()?.removeSuffix(".html")?.takeIf { SLUG.matches(it) }
-            ?: throw SourceException(SourceErrorKind.UNSUPPORTED, "${spec.url} is not an app page of LiteAPKs")
-        val posts = Json.parse(get("$ORIGIN/wp-json/wp/v2/posts?slug=$slug", context)) as? JsonArray
-        val id = posts?.objects()?.firstOrNull()?.long("id")?.takeIf { it > 0 }
-            ?: throw SourceException(SourceErrorKind.NOT_FOUND, "LiteAPKs has no post $slug")
-        val data = Json.parseObject(get("$ORIGIN/wp-json/v2/posts/$id", context)).obj("data")
-            ?: throw SourceException(SourceErrorKind.PARSE, "LiteAPKs sent no record of $slug")
-        val latest = data.array("versions")?.objects()?.firstOrNull()
-            ?: throw SourceException(SourceErrorKind.PARSE, "LiteAPKs names no version of $slug")
-        val version = latest.string("version")?.trim()?.takeIf { it.isNotEmpty() }
-            ?: throw SourceException(SourceErrorKind.PARSE, "LiteAPKs names no version of $slug")
-        val assets = latest.array("version_downloads")?.objects().orEmpty()
-            .mapNotNull { it.string("version_download_link")?.let(::asset) }
-            .distinctBy { it.url }
-            .take(MAX_ASSETS)
-        if (assets.isEmpty()) throw SourceException(SourceErrorKind.NO_RELEASES, "LiteAPKs offers no download of $slug on its own servers")
-        val release = Release(id = version, version = version, pageUrl = spec.url, assets = assets)
-        val listing = SourceListing(
-            releases = listOf(release),
-            name = data.string("title")?.let(XmlScanner::decode),
-            author = data.string("publisher")?.let(XmlScanner::decode),
-        )
-        return CheckResult.Listing(listing)
-    }
-
-    /** The link with a fresh token, sent from the app's page. */
-    override fun resolve(spec: SourceSpec, asset: Asset, context: CheckContext): Download {
-        if (!Urls.isHttps(asset.url) || !isFileHost(Urls.host(asset.url))) {
-            throw SourceException(SourceErrorKind.PARSE, "${asset.url} is not a file on LiteAPKs' servers")
-        }
-        val separator = if ('?' in asset.url) '&' else '?'
-        return Download("${asset.url}${separator}token=${token(context.nowMs())}", mapOf("Referer" to spec.url))
-    }
-
-    private fun get(url: String, context: CheckContext): String = context.http.execute(HttpRequest(url, headers = mapOf("Referer" to url))).use {
-        if (it.status == 404) throw SourceException(SourceErrorKind.NOT_FOUND, "Nothing at $url")
-        if (!it.isSuccess) throw SourceException(SourceErrorKind.NETWORK, "Unexpected status ${it.status} for $url")
-        it.text(JSON_CAP)
-    }
-
-    private fun asset(link: String): Asset? {
-        val address = Urls.resolve("$ORIGIN/", link)?.takeIf { isFileHost(Urls.host(it)) } ?: return null
-        val name = Urls.segments(address).lastOrNull()?.let(ServedFile::clean) ?: return null
-        return Asset(name = name, url = address)
-    }
-
-    companion object {
-        /** The site and its own subdomains, which the download links are expected to point to. */
-        const val FILE_DOMAIN = "liteapks.com"
-
-        private const val HOST = "liteapks.com"
-        private const val ORIGIN = "https://liteapks.com"
-        private const val JSON_CAP = 2 * 1024 * 1024
-        private const val MAX_ASSETS = 20
-
-        /** How far ahead of now the file server wants the token's time to be. */
-        private const val TOKEN_AHEAD_SECONDS = 3 * 60 * 60L
-        private val SLUG = Regex("[A-Za-z0-9_-]{1,200}")
-        private val RESERVED = setOf("category", "tag", "page", "author", "search", "download", "feed", "wp-json", "wp-content", "wp-admin")
-
-        fun isFileHost(host: String): Boolean = host == FILE_DOMAIN || host.endsWith(".$FILE_DOMAIN")
-
-        /** The time three hours on, in seconds, in base64 twice over, as the file server takes it. */
-        private fun token(nowMs: Long): String {
-            val seconds = (nowMs / 1000 + TOKEN_AHEAD_SECONDS).toString()
-            val once = Base64.getEncoder().encodeToString(seconds.toByteArray(Charsets.US_ASCII))
-            return Base64.getEncoder().encodeToString(once.toByteArray(Charsets.US_ASCII)).replace("=", "%3D")
-        }
-    }
-}
diff --git a/core/src/main/kotlin/io/github/munzzyy/tern/core/source/store/RockModsSource.kt b/core/src/main/kotlin/io/github/munzzyy/tern/core/source/store/RockModsSource.kt
deleted file mode 100644
index 6f792a69..00000000
--- a/core/src/main/kotlin/io/github/munzzyy/tern/core/source/store/RockModsSource.kt
+++ /dev/null
@@ -1,121 +0,0 @@
-package io.github.munzzyy.tern.core.source.store
-
-import io.github.munzzyy.tern.core.json.Json
-import io.github.munzzyy.tern.core.json.JsonArray
-import io.github.munzzyy.tern.core.json.JsonException
-import io.github.munzzyy.tern.core.json.JsonNumber
-import io.github.munzzyy.tern.core.json.JsonObject
-import io.github.munzzyy.tern.core.json.JsonString
-import io.github.munzzyy.tern.core.json.JsonValue
-import io.github.munzzyy.tern.core.model.Release
-import io.github.munzzyy.tern.core.model.SourceSpec
-import io.github.munzzyy.tern.core.net.HttpRequest
-import io.github.munzzyy.tern.core.net.Urls
-import io.github.munzzyy.tern.core.source.CheckContext
-import io.github.munzzyy.tern.core.source.CheckResult
-import io.github.munzzyy.tern.core.source.Source
-import io.github.munzzyy.tern.core.source.SourceErrorKind
-import io.github.munzzyy.tern.core.source.SourceException
-import io.github.munzzyy.tern.core.source.SourceListing
-import io.github.munzzyy.tern.core.source.SourceTypes
-import io.github.munzzyy.tern.core.source.guarded
-import io.github.munzzyy.tern.core.xml.XmlScanner
-
-/**
- * An app page on rockmods.net, followed without its files: the site is built so that nothing but a
- * browser gets one. The page's JSON-LD SoftwareApplication gives the name, the version, the developer
- * and the description; the page's heading stands in for a missing name.
- */
-class RockModsSource : Source {
-    override val type: String = SourceTypes.ROCKMODS
-
-    override val republishes: Boolean get() = true
-
-    override val trackOnly: Boolean get() = true
-
-    override fun match(url: String): SourceSpec? {
-        val uri = Urls.parseHttps(url) ?: return null
-        if (uri.host?.lowercase()?.removePrefix("www.") != HOST) return null
-        val segments = uri.rawPath.orEmpty().split('/').filter { it.isNotEmpty() }
-        if (segments.size < 2 || !segments[0].equals("apps", ignoreCase = true)) return null
-        val slug = segments[1].takeIf { SLUG.matches(it) } ?: return null
-        return SourceSpec(type, "https://www.$HOST/apps/$slug")
-    }
-
-    override fun check(spec: SourceSpec, context: CheckContext): CheckResult = guarded(context) { checkOnce(spec, it) }
-
-    private fun checkOnce(spec: SourceSpec, context: CheckContext): CheckResult {
-        val html = context.http.execute(HttpRequest(spec.url)).use {
-            if (it.status == 404) throw SourceException(SourceErrorKind.NOT_FOUND, "There is no app page at ${spec.url}")
-            if (!it.isSuccess) throw SourceException(SourceErrorKind.NETWORK, "Unexpected status ${it.status} for ${spec.url}")
-            it.text(PAGE_CAP)
-        }
-        val app = softwareApplication(html) ?: throw SourceException(SourceErrorKind.PARSE, "${spec.url} describes no app")
-        val version = text(app["softwareVersion"]) ?: throw SourceException(SourceErrorKind.PARSE, "${spec.url} names no version")
-        val name = text(app["name"])
-            ?: HEADING.find(html)?.groupValues?.get(1)?.let(::plain)?.takeIf { it.isNotEmpty() }
-            ?: Urls.segments(spec.url).lastOrNull()
-        val author = when (val by = app["author"]) {
-            is JsonObject -> text(by["name"])
-            is JsonArray -> by.objects().firstNotNullOfOrNull { text(it["name"]) }
-            else -> text(by)
-        }
-        val release = Release(id = version, version = version, pageUrl = spec.url)
-        val listing = SourceListing(releases = listOf(release), name = name, author = author, description = text(app["description"]))
-        return CheckResult.Listing(listing.withIcons(spec.url, listOf(text(app["image"]))))
-    }
-
-    /** The first JSON-LD block that is, or holds, a SoftwareApplication. */
-    private fun softwareApplication(html: String): JsonObject? {
-        var pos = 0
-        repeat(MAX_BLOCKS) {
-            val open = LD_JSON.find(html, pos) ?: return null
-            val close = html.indexOf("</script", open.range.last + 1, ignoreCase = true)
-            if (close < 0) return null
-            pos = close
-            val value = try {
-                Json.parse(html.substring(open.range.last + 1, close).trim())
-            } catch (_: JsonException) {
-                return@repeat
-            }
-            find(value, 0)?.let { return it }
-        }
-        return null
-    }
-
-    private fun find(value: JsonValue, depth: Int): JsonObject? = when {
-        depth > MAX_DEPTH -> null
-        value is JsonObject && isApplication(value) -> value
-        value is JsonObject -> value.array("@graph")?.firstNotNullOfOrNull { find(it, depth + 1) }
-        value is JsonArray -> value.firstNotNullOfOrNull { find(it, depth + 1) }
-        else -> null
-    }
-
-    private fun isApplication(value: JsonObject): Boolean = when (val kind = value["@type"]) {
-        is JsonString -> kind.value in APPLICATION_TYPES
-        is JsonArray -> kind.strings().any { it in APPLICATION_TYPES }
-        else -> false
-    }
-
-    private fun text(value: JsonValue?): String? = when (value) {
-        is JsonString -> value.value
-        is JsonNumber -> value.raw
-        else -> null
-    }?.trim()?.takeIf { it.isNotEmpty() }
-
-    private fun plain(html: String): String =
-        XmlScanner.decode(TAG.replace(html, " ").replace("&nbsp;", " ")).replace(SPACES, " ").trim()
-
-    companion object {
-        private const val HOST = "rockmods.net"
-        private const val PAGE_CAP = 4 * 1024 * 1024
-        private const val MAX_BLOCKS = 20
-        private const val MAX_DEPTH = 4
-        private val APPLICATION_TYPES = setOf("SoftwareApplication", "MobileApplication")
-        private val SLUG = Regex("[A-Za-z0-9_-]{1,200}")
-        private val LD_JSON = Regex("""<script\b[^>]{0,200}?\btype\s*=\s*["']application/ld\+json["'][^>]{0,200}>""", RegexOption.IGNORE_CASE)
-        private val HEADING = Regex("""<h1(?:\s[^>]{0,1000})?>(.{0,2000}?)</h1>""", setOf(RegexOption.IGNORE_CASE, RegexOption.DOT_MATCHES_ALL))
-        private val TAG = Regex("<[^>]*>")
-        private val SPACES = Regex("\\s+")
-    }
-}
diff --git a/core/src/main/kotlin/io/github/munzzyy/tern/core/source/store/RuStoreSource.kt b/core/src/main/kotlin/io/github/munzzyy/tern/core/source/store/RuStoreSource.kt
deleted file mode 100644
index 1dae4e1a..00000000
--- a/core/src/main/kotlin/io/github/munzzyy/tern/core/source/store/RuStoreSource.kt
+++ /dev/null
@@ -1,232 +0,0 @@
-package io.github.munzzyy.tern.core.source.store
-
-import io.github.munzzyy.tern.core.apk.BinaryManifest
-import io.github.munzzyy.tern.core.json.Json
-import io.github.munzzyy.tern.core.json.JsonObject
-import io.github.munzzyy.tern.core.model.Asset
-import io.github.munzzyy.tern.core.model.NotesFormat
-import io.github.munzzyy.tern.core.model.Release
-import io.github.munzzyy.tern.core.model.SourceSpec
-import io.github.munzzyy.tern.core.net.HttpRequest
-import io.github.munzzyy.tern.core.net.HttpResponse
-import io.github.munzzyy.tern.core.net.Urls
-import io.github.munzzyy.tern.core.source.CheckContext
-import io.github.munzzyy.tern.core.source.CheckResult
-import io.github.munzzyy.tern.core.source.Hit
-import io.github.munzzyy.tern.core.source.Searchable
-import io.github.munzzyy.tern.core.source.Source
-import io.github.munzzyy.tern.core.source.SourceErrorKind
-import io.github.munzzyy.tern.core.source.SourceException
-import io.github.munzzyy.tern.core.source.SourceListing
-import io.github.munzzyy.tern.core.source.SourceOptions
-import io.github.munzzyy.tern.core.source.SourceTypes
-import io.github.munzzyy.tern.core.source.fdroid.packageOption
-import io.github.munzzyy.tern.core.source.forge.Iso8601
-import io.github.munzzyy.tern.core.source.guarded
-import java.security.SecureRandom
-import java.util.Base64
-import java.util.Random
-import javax.crypto.Mac
-import javax.crypto.spec.SecretKeySpec
-
-/**
- * RuStore. Reads the API RuStore's app uses (backapi.rustore.ru): the app's record, then where its
- * file is. Both want a signed session, a nonce from api.rustore.ru signed with the key in RuStore's
- * app. The session is kept in this object's memory and made again when the store answers 419.
- */
-class RuStoreSource(private val random: Random = SecureRandom()) : Source, Searchable {
-    override val type: String = SourceTypes.RUSTORE
-
-    override val origin: String = "RuStore"
-
-    private class Session(val deviceId: String, val signature: String)
-
-    @Volatile
-    private var session: Session? = null
-
-    override fun match(url: String): SourceSpec? {
-        val uri = Urls.parseHttps(url) ?: return null
-        if (uri.host?.lowercase()?.removePrefix("www.") != "rustore.ru") return null
-        val segments = Urls.segments(uri.toString())
-        if (segments.size < 3 || segments[0] != "catalog" || segments[1] != "app") return null
-        val pkg = segments[2]
-        if (!BinaryManifest.isValidName(pkg)) return null
-        return SourceSpec(type, pageUrl(pkg), mapOf(SourceOptions.PACKAGE to pkg))
-    }
-
-    override fun check(spec: SourceSpec, context: CheckContext): CheckResult = guarded(context) { checkOnce(spec, it) }
-
-    private fun checkOnce(spec: SourceSpec, context: CheckContext): CheckResult {
-        val pkg = packageOption(spec)
-        val info = signed(context) { HttpRequest("$API/applicationData/overallInfo/$pkg", headers = headers(context, it)) }.use { response ->
-            if (response.status == 404) throw SourceException(SourceErrorKind.NOT_FOUND, "RuStore has no app $pkg")
-            if (!response.isSuccess) throw SourceException(SourceErrorKind.NETWORK, "RuStore answered ${response.status} for $pkg")
-            Json.parseObject(response.text(MAX_BODY)).obj("body")
-        } ?: throw SourceException(SourceErrorKind.NOT_FOUND, "RuStore has no app $pkg")
-        if (info.string("packageName")?.let { it != pkg } == true) throw SourceException(SourceErrorKind.PARSE, "Asked for $pkg and was answered for another package")
-        val appId = info.long("appId") ?: throw SourceException(SourceErrorKind.NOT_FOUND, "RuStore has no app $pkg")
-        val version = info.string("versionName")?.takeIf { it.isNotBlank() }
-            ?: throw SourceException(SourceErrorKind.NO_RELEASES, "RuStore named no version of $pkg")
-        val versionCode = info.long("versionCode")?.takeIf { it > 0 }
-        val release = Release(
-            id = versionCode?.toString() ?: version,
-            version = version,
-            versionCode = versionCode,
-            notes = info.string("whatsNew")?.takeIf { it.isNotBlank() },
-            notesFormat = NotesFormat.PLAIN,
-            publishedAtMs = info.string("appVerUpdatedAt")?.let(Iso8601::parseMs),
-            pageUrl = spec.url,
-            // An app RuStore only lists from another store has no file here.
-            assets = listOfNotNull(file(appId, pkg, version, context)),
-        )
-        val listing = SourceListing(
-            releases = listOf(release),
-            name = info.string("appName"),
-            author = info.string("companyName"),
-            packageName = pkg,
-            description = info.string("shortDescription"),
-        )
-        return CheckResult.Listing(listing.withIcons(spec.url, listOf(info.string("iconUrl")?.let(::onPublicHost))))
-    }
-
-    /**
-     * The app's file. RuStore names one file for an app that has one, and a base and its splits for
-     * the device described for an app that is split, each a .zip that holds an APK. One file is
-     * listed as the APK RuStore serves beside its .zip. A base and its splits are listed as one
-     * bundle of the files as named, installed whole or not at all, so one of them that is not on
-     * RuStore's hosts leaves the bundle out.
-     */
-    private fun file(appId: Long, pkg: String, version: String, context: CheckContext): Asset? {
-        val device = context.device
-        val body = Json.write(
-            Json.obj(
-                "appId" to appId,
-                "firstInstall" to true,
-                "withoutSplits" to false,
-                "supportedAbis" to (device?.abis ?: listOf("arm64-v8a")),
-                "sdkVersion" to (device?.sdk ?: DEFAULT_SDK),
-                "screenDensity" to (device?.densityDpi ?: DEFAULT_DENSITY),
-            ),
-        )
-        val answer = signed(context) {
-            HttpRequest.post("$API/v3/showcase/apps/download-link", body, "application/json; charset=utf-8", headers(context, it)).copy(followRedirects = false)
-        }.use { response ->
-            if (!response.isSuccess) throw SourceException(SourceErrorKind.NETWORK, "RuStore answered ${response.status} when asked for the file of app $appId")
-            Json.parseObject(response.text(MAX_BODY))
-        }
-        val files = answer.array("downloadUrls")?.objects().orEmpty()
-            .mapNotNull { file -> file.string("url")?.takeIf { it.isNotBlank() }?.let { it to file.long("size")?.takeIf { size -> size > 0 } } }
-            .distinctBy { it.first }
-        if (files.size <= 1) return files.firstOrNull()?.let { apkAddress(it.first) }?.let { Asset(name = "${pkg}_$version.apk", url = it) }
-        if (files.size > Asset.MAX_PARTS + 1) throw SourceException(SourceErrorKind.PARSE, "RuStore named ${files.size} files for app $appId")
-        val addresses = files.map { onPublicHost(it.first) ?: return null }
-        val sizes = files.mapNotNull { it.second }
-        return Asset(
-            name = "${pkg}_$version.apks",
-            url = addresses.first(),
-            size = sizes.takeIf { it.size == files.size }?.sum(),
-            parts = addresses.drop(1),
-        )
-    }
-
-    /**
-     * RuStore names each file as a .zip that holds the APK, and serves the APK itself beside it
-     * under the same name, which is what is listed.
-     */
-    private fun apkAddress(url: String): String? = onPublicHost(url)?.replace(ZIP_END, ".apk")
-
-    /**
-     * An https address on RuStore's hosts. Its file host static-m.rustore.ru presents a certificate
-     * from the Russian Trusted Root CA, which Android does not trust, while static.rustore.ru serves
-     * the same files with a certificate from a public authority, so files are asked for there.
-     */
-    private fun onPublicHost(url: String): String? {
-        if (!Urls.isHttps(url)) return null
-        val normalized = Urls.normalize(url) ?: return null
-        val host = Urls.host(normalized)
-        if (host != HOME && !host.endsWith(".$HOME")) return null
-        return if (host == "static-m.$HOME") "https://static.$HOME" + normalized.removePrefix("https://static-m.$HOME") else normalized
-    }
-
-    override fun search(query: String, context: CheckContext): List<Hit> = guarded(context) { scoped ->
-        val url = "$API/applicationData/apps?query=${Urls.encodeSegment(query)}&pageNumber=0&pageSize=$MAX_HITS"
-        // The search wants no signature, but a device id.
-        val deviceId = session?.deviceId ?: deviceId()
-        val root = scoped.http.execute(HttpRequest(url, headers = deviceHeaders(scoped, deviceId))).use { response ->
-            if (!response.isSuccess) throw SourceException(SourceErrorKind.NETWORK, "RuStore answered ${response.status} to a search")
-            Json.parseObject(response.text(MAX_BODY))
-        }
-        root.obj("body")?.array("content")?.objects().orEmpty().asSequence().mapNotNull(::hit).take(MAX_HITS).toList()
-    }
-
-    private fun hit(app: JsonObject): Hit? {
-        val pkg = app.string("packageName")?.takeIf { BinaryManifest.isValidName(it) } ?: return null
-        val name = app.string("appName")?.takeIf { it.isNotBlank() } ?: return null
-        return Hit(name = name, owner = null, description = app.string("shortDescription"), url = pageUrl(pkg))
-    }
-
-    /** [request] with the kept session, and once more with a new one when the store answers 419. */
-    private fun signed(context: CheckContext, request: (Session) -> HttpRequest): HttpResponse {
-        val response = context.http.execute(request(session ?: newSession(context)))
-        if (response.status != 419) return response
-        response.close()
-        return context.http.execute(request(newSession(context)))
-    }
-
-    private fun newSession(context: CheckContext): Session {
-        val deviceId = deviceId()
-        val nonce = context.http.execute(HttpRequest(NONCE_URL, method = "POST", headers = deviceHeaders(context, deviceId), body = ByteArray(0))).use { response ->
-            if (!response.isSuccess) throw SourceException(SourceErrorKind.NETWORK, "RuStore answered ${response.status} when asked for a session")
-            Json.parseObject(response.text(64 * 1024)).string("nonce")
-        } ?: throw SourceException(SourceErrorKind.NETWORK, "RuStore gave no session")
-        val mac = Mac.getInstance("HmacSHA256")
-        mac.init(SecretKeySpec(Base64.getDecoder().decode(HMAC_KEY), "HmacSHA256"))
-        val signature = Base64.getEncoder().encodeToString(mac.doFinal(Base64.getDecoder().decode(nonce) + Base64.getDecoder().decode(APP_CERT_SHA256)))
-        return Session(deviceId, signature).also { session = it }
-    }
-
-    private fun headers(context: CheckContext, session: Session): Map<String, String> =
-        deviceHeaders(context, session.deviceId) + ("X-Client-Signature" to session.signature)
-
-    /** What RuStore's app says about the phone it runs on, a Pixel 8 Pro as Obtainium says. */
-    private fun deviceHeaders(context: CheckContext, deviceId: String): Map<String, String> = mapOf(
-        "deviceId" to deviceId,
-        "firmwareVer" to "16",
-        "androidSdkVer" to "36",
-        "deviceManufacturerName" to MANUFACTURER,
-        "deviceModelName" to MODEL,
-        "deviceModel" to "$MANUFACTURER $MODEL",
-        "firmwareLang" to "ru",
-        "ruStoreVerCode" to "1105002",
-        "deviceType" to if (context.device?.television == true) "TV" else "mobile",
-        "User-Agent" to "RuStore/1.105.0.2 (Android 16; SDK 36; arm64-v8a; $MANUFACTURER $MODEL; ru)",
-    )
-
-    /** A random Android id and a number made from the phone's names, as RuStore's app makes its device id. */
-    private fun deviceId(): String {
-        val androidId = ByteArray(8).also(random::nextBytes).joinToString("") { "%02x".format(it) }
-        val suffix = listOf(MANUFACTURER, MODEL, HARDWARE, HARDWARE).fold(0) { hash, name -> hash * 31 + name.hashCode() }
-        return "$androidId-$suffix"
-    }
-
-    private companion object {
-        const val HOME = "rustore.ru"
-        const val API = "https://backapi.rustore.ru"
-        const val NONCE_URL = "https://api.rustore.ru/v1/secure/nonce"
-        const val MAX_BODY = 2 * 1024 * 1024
-        const val MAX_HITS = 20
-        const val DEFAULT_SDK = 36
-        const val DEFAULT_DENSITY = 420
-        const val MANUFACTURER = "Google"
-        const val MODEL = "Pixel 8 Pro"
-        const val HARDWARE = "husky"
-
-        /** The key RuStore's app signs its nonce with, and the SHA-256 of that app's certificate, which is signed along with it. */
-        const val HMAC_KEY = "K+eeiCbnVFnZ71KEVal0g5siHaX6v6drh8upeLgEPoU="
-        const val APP_CERT_SHA256 = "Zh8ggo73gN4LebxZ8mowhkMWNV8w5Pkc+hSiB5GDmRQ="
-
-        val ZIP_END = Regex("\\.zip$")
-
-        fun pageUrl(pkg: String) = "https://www.rustore.ru/catalog/app/$pkg"
-    }
-}
diff --git a/core/src/main/kotlin/io/github/munzzyy/tern/core/source/store/SamsungSource.kt b/core/src/main/kotlin/io/github/munzzyy/tern/core/source/store/SamsungSource.kt
index 8287cf0b..53a4fcdc 100644
--- a/core/src/main/kotlin/io/github/munzzyy/tern/core/source/store/SamsungSource.kt
+++ b/core/src/main/kotlin/io/github/munzzyy/tern/core/source/store/SamsungSource.kt
@@ -24,14 +24,18 @@ import java.time.LocalDateTime
 import java.time.ZoneOffset
 
 /**
- * Galaxy Store. Reads the download stub the store's own app asks (vas.samsungapps.com), which names
- * the newest version for one device model and region and a file address that holds a token for a
- * short while. The file is listed at that address without the token, so it stays the same from one
- * check to the next, and [resolve] asks the stub again for a fresh one.
+ * Galaxy Store. Reads the download stub at vas.samsungapps.com, which names the newest version for
+ * a device model and region and a file address that holds a token for a short while. Tern asks
+ * for the model and region in the companion unless the person set their own on the app's page, and
+ * says nothing else about the device but its Android version and whether it runs 64-bit code. The file is listed at
+ * its address without the token, so it stays the same from one check to the next, and [resolve]
+ * asks the stub again for a fresh one.
  */
 class SamsungSource : Source {
     override val type: String = SourceTypes.SAMSUNG
 
+    override val domains: Set<String> get() = DOMAINS
+
     override fun match(url: String): SourceSpec? {
         val uri = Urls.parseHttps(url) ?: return null
         val host = uri.host?.lowercase()?.removePrefix("www.") ?: return null
@@ -72,15 +76,14 @@ class SamsungSource : Source {
     private class Stub(val versionName: String, val versionCode: Long?, val name: String?, val fileUrl: String?, val size: Long?)
 
     private fun stub(spec: SourceSpec, pkg: String, context: CheckContext): Stub {
-        val model = spec.option(SourceOptions.DEVICE_MODEL) ?: DEFAULT_MODEL
-        val csc = spec.option(SourceOptions.CSC) ?: DEFAULT_CSC
+        val model = spec.option(SourceOptions.DEVICE_MODEL) ?: MODEL
+        val csc = spec.option(SourceOptions.CSC) ?: CSC
         val device = context.device
         val sdk = device?.sdk ?: DEFAULT_SDK
         // The store serves a separate build to phones that run only 32-bit code.
         val abiType = if (device != null && device.abis.none { it in ABIS_64 }) "32" else "64"
         val url = "https://vas.samsungapps.com/stub/stubDownload.as?appId=$pkg" +
-            "&deviceId=${Urls.encodeSegment(model)}&mcc=425&mnc=01&csc=${Urls.encodeSegment(csc)}&sdkVer=$sdk" +
-            "&systemId=1608665720954&abiType=$abiType&extuk=0191d6627f38685f"
+            "&deviceId=${Urls.encodeSegment(model)}&mcc=$MCC&mnc=$MNC&csc=${Urls.encodeSegment(csc)}&sdkVer=$sdk&abiType=$abiType&extuk=0"
         context.http.execute(HttpRequest(url)).use { response ->
             if (response.status == 404) throw SourceException(SourceErrorKind.NOT_FOUND, "The Galaxy Store has no app $pkg")
             if (!response.isSuccess) throw SourceException(SourceErrorKind.NETWORK, "The Galaxy Store answered ${response.status} for $pkg")
@@ -126,13 +129,16 @@ class SamsungSource : Source {
     }
 
     companion object {
-        /** Asked for when the app names no model: the model and region Obtainium asks for too. */
-        const val DEFAULT_MODEL = "SM-S948B"
-        const val DEFAULT_CSC = "DBT"
+        /** The model and region asked for unless the app names its own, the ones Obtainium asks for too. PRIVACY.md names them. */
+        const val MODEL = "SM-S948B"
+        const val CSC = "DBT"
+        const val MCC = "425"
+        const val MNC = "01"
         private const val DEFAULT_SDK = 36
         private const val MAX_BODY = 256 * 1024
 
         private val HOSTS = setOf("galaxystore.samsung.com", "apps.samsung.com", "apps.samsung.cn", "galaxyappstore.com", "apps.galaxyappstore.com")
+        private val DOMAINS = setOf("galaxystore.samsung.com", "apps.samsung.com", "apps.samsung.cn", "galaxyappstore.com", "samsungapps.com")
 
         /** The store's file hosts, such as cflare-dn.gw.samsungapps.com, and the Chinese store's. */
         private val FILE_HOSTS = listOf("samsungapps.com", "galaxyappstore.com")
diff --git a/core/src/main/kotlin/io/github/munzzyy/tern/core/source/store/TencentSource.kt b/core/src/main/kotlin/io/github/munzzyy/tern/core/source/store/TencentSource.kt
index 518e6c9d..8996926e 100644
--- a/core/src/main/kotlin/io/github/munzzyy/tern/core/source/store/TencentSource.kt
+++ b/core/src/main/kotlin/io/github/munzzyy/tern/core/source/store/TencentSource.kt
@@ -22,10 +22,15 @@ import io.github.munzzyy.tern.core.source.guarded
 /**
  * Tencent App Store (sj.qq.com). Reads the app's download page on a.app.qq.com, which carries the
  * store's record of the app as JSON in window.systemData, and lists the file that record names.
+ * The store holds copies that others than the developer upload, so it counts as republishing.
  */
 class TencentSource : Source {
     override val type: String = SourceTypes.TENCENT
 
+    override val republishes: Boolean get() = true
+
+    override val domains: Set<String> get() = setOf("sj.qq.com", "a.app.qq.com") + FILE_HOSTS
+
     override fun match(url: String): SourceSpec? {
         val uri = Urls.parseHttps(url) ?: return null
         val normalized = uri.toString()
diff --git a/core/src/main/kotlin/io/github/munzzyy/tern/core/source/store/UptodownSource.kt b/core/src/main/kotlin/io/github/munzzyy/tern/core/source/store/UptodownSource.kt
deleted file mode 100644
index f401a474..00000000
--- a/core/src/main/kotlin/io/github/munzzyy/tern/core/source/store/UptodownSource.kt
+++ /dev/null
@@ -1,321 +0,0 @@
-package io.github.munzzyy.tern.core.source.store
-
-import io.github.munzzyy.tern.core.json.Json
-import io.github.munzzyy.tern.core.json.JsonException
-import io.github.munzzyy.tern.core.json.JsonObject
-import io.github.munzzyy.tern.core.model.Asset
-import io.github.munzzyy.tern.core.model.Release
-import io.github.munzzyy.tern.core.model.SourceSpec
-import io.github.munzzyy.tern.core.net.HttpRequest
-import io.github.munzzyy.tern.core.net.Urls
-import io.github.munzzyy.tern.core.source.CheckContext
-import io.github.munzzyy.tern.core.source.CheckResult
-import io.github.munzzyy.tern.core.source.Download
-import io.github.munzzyy.tern.core.source.Hit
-import io.github.munzzyy.tern.core.source.Searchable
-import io.github.munzzyy.tern.core.source.Source
-import io.github.munzzyy.tern.core.source.SourceErrorKind
-import io.github.munzzyy.tern.core.source.SourceException
-import io.github.munzzyy.tern.core.source.SourceListing
-import io.github.munzzyy.tern.core.source.SourceTypes
-import io.github.munzzyy.tern.core.source.fdroid.FDroidSource
-import io.github.munzzyy.tern.core.source.guarded
-import io.github.munzzyy.tern.core.xml.XmlScanner
-import java.security.SecureRandom
-import java.time.LocalDate
-import java.time.ZoneOffset
-import java.time.format.DateTimeFormatter
-import java.time.format.DateTimeParseException
-import java.util.Base64
-import java.util.Locale
-import javax.crypto.Mac
-import javax.crypto.spec.SecretKeySpec
-
-/**
- * Uptodown, read from the English download page of an app: the version, the name, the author and
- * the technical details, among them the package, the date and the kind of file. The file is listed
- * at `<page>/<file number>-x`, an address that lasts; Uptodown's own addresses expire, so [resolve]
- * asks the service Uptodown's app uses, with an anonymous session, where the file is right now.
- * Searched through the site's own search.
- *
- * [newIdentifier] names the device to the service when a session is opened; tests fix it.
- */
-class UptodownSource(private val newIdentifier: () -> String = { randomIdentifier() }) : Source, Searchable {
-    override val type: String = SourceTypes.UPTODOWN
-
-    override val republishes: Boolean get() = true
-
-    override val origin: String = "Uptodown"
-
-    private class Session(val token: String, val expiresAtSeconds: Long)
-
-    @Volatile
-    private var session: Session? = null
-
-    override fun match(url: String): SourceSpec? {
-        val uri = Urls.parseHttps(url) ?: return null
-        val host = uri.host?.lowercase() ?: return null
-        if (!host.endsWith(".uptodown.com")) return null
-        val labels = host.removeSuffix(".uptodown.com").split('.')
-        val app = when {
-            labels.size == 2 && LANGUAGE.matches(labels[1]) -> labels[0]
-            // Without a language the page is the Spanish one, as in <app>.uptodown.com/android/descargar.
-            labels.size == 1 && labels[0].length > 2 -> labels[0]
-            else -> return null
-        }
-        if (!NAME.matches(app) || app in NOT_APPS) return null
-        return SourceSpec(type, "https://$app.en.uptodown.com/android/download")
-    }
-
-    override fun check(spec: SourceSpec, context: CheckContext): CheckResult = guarded(context) { checkOnce(spec, it) }
-
-    private fun checkOnce(spec: SourceSpec, context: CheckContext): CheckResult {
-        val html = page(spec.url, context)
-        val version = elementText(html, "version") { tag -> tag.name == "div" && "version" in classes(tag) }
-            ?: throw SourceException(SourceErrorKind.NO_RELEASES, "The page at ${spec.url} names no version")
-        val fileId = fileNumber(html) ?: throw SourceException(SourceErrorKind.NO_RELEASES, "The page at ${spec.url} offers no file")
-        val (details, cells) = technicalDetails(html)
-        val pkg = (details["package name"] ?: cells.lastOrNull())?.takeIf { FDroidSource.isValidPackage(it) }
-        val date = details["date"] ?: cells.getOrNull(cells.size - 5)
-        val extension = (details["file type"] ?: cells.getOrNull(cells.size - 4))?.lowercase()?.takeIf { it in EXTENSIONS } ?: "apk"
-        val asset = Asset(
-            name = "${pkg ?: Urls.host(spec.url).substringBefore('.')}.$extension",
-            url = "${spec.url}/$fileId-x",
-            // The page names the digest of the very file it offers.
-            sha256 = details["sha256"]?.lowercase()?.takeIf { SHA256.matches(it) },
-        )
-        val release = Release(
-            id = fileId,
-            version = version,
-            publishedAtMs = date?.let(::parseDate),
-            pageUrl = spec.url,
-            assets = listOf(asset),
-        )
-        val listing = SourceListing(
-            releases = listOf(release),
-            name = elementText(html, "detail-app-name") { it.attributes["id"] == "detail-app-name" },
-            author = elementText(html, "author-link") { it.attributes["id"] == "author-link" },
-            packageName = pkg,
-        )
-        val icon = tags(html, "og:image").firstOrNull { it.name == "meta" && it.attributes["property"] == "og:image" }?.attributes?.get("content")
-        return CheckResult.Listing(listing.withIcons(spec.url, listOf(icon)))
-    }
-
-    /**
-     * The page of the file names the numbers the app and the file go by, and the service is asked,
-     * with a session, where that file is now, as Uptodown's app does. A refused session is renewed once.
-     */
-    override fun resolve(spec: SourceSpec, asset: Asset, context: CheckContext): Download = guarded(context) {
-        if (!FILE_PAGE.matches(asset.url.removePrefix(spec.url))) {
-            throw SourceException(SourceErrorKind.UNSUPPORTED, "${asset.url} is not a file of ${spec.url}")
-        }
-        val html = page(asset.url, it)
-        val button = tags(html, "detail-download-button").firstOrNull { tag -> tag.attributes["id"] == "detail-download-button" }
-        val heading = tags(html, "detail-app-name").firstOrNull { tag -> tag.attributes["id"] == "detail-app-name" }
-        val appId = (button?.attributes?.get("data-app-id") ?: heading?.attributes?.get("data-code"))?.takeIf { id -> NUMBER.matches(id) }
-        val fileId = fileNumber(html)
-        if (appId == null || fileId == null) throw SourceException(SourceErrorKind.NOT_FOUND, "Uptodown no longer offers the file at ${asset.url}")
-        Download(downloadAddress(appId, fileId, it), mapOf("User-Agent" to USER_AGENT))
-    }
-
-    override fun search(query: String, context: CheckContext): List<Hit> = guarded(context) {
-        val text = query.trim().take(MAX_QUERY)
-        if (text.isEmpty()) return@guarded emptyList()
-        val request = HttpRequest.post(SEARCH, "queryString=${Urls.encodeSegment(text)}", FORM, mapOf("User-Agent" to USER_AGENT))
-        it.http.execute(request).use { response ->
-            if (!response.isSuccess) throw SourceException(SourceErrorKind.NETWORK, "Unexpected status ${response.status} from the Uptodown search")
-            val answer = Json.parseObject(response.text(BODY_CAP))
-            if (answer.long("success") != 1L) throw SourceException(SourceErrorKind.NETWORK, "The Uptodown search failed")
-            answer.obj("data")?.array("apps")?.objects().orEmpty()
-                .mapNotNull(::hit)
-                .distinctBy { hit -> hit.url }
-                .take(MAX_HITS)
-        }
-    }
-
-    private fun hit(app: JsonObject): Hit? {
-        if (app.string("platformURL") != "/android") return null
-        val url = app.string("url")?.let(::match)?.url ?: return null
-        val name = app.string("name")?.let(::plain) ?: return null
-        return Hit(name = name, owner = app.string("author")?.trim()?.takeIf { it.isNotEmpty() }, description = null, url = url)
-    }
-
-    private fun page(url: String, context: CheckContext): String = context.http.execute(HttpRequest(url)).use {
-        if (it.status == 404 || it.status == 410) throw SourceException(SourceErrorKind.NOT_FOUND, "There is no Uptodown page at $url")
-        if (!it.isSuccess) throw SourceException(SourceErrorKind.NETWORK, "Unexpected status ${it.status} for $url")
-        it.text(PAGE_CAP)
-    }
-
-    /** The number of the file the page offers. */
-    private fun fileNumber(html: String): String? {
-        val button = tags(html, "detail-download-button").firstOrNull { it.attributes["id"] == "detail-download-button" }
-        val heading = tags(html, "detail-app-name").firstOrNull { it.attributes["id"] == "detail-app-name" }
-        return (button?.attributes?.get("data-file-id") ?: heading?.attributes?.get("data-file-id"))?.takeIf { NUMBER.matches(it) }
-    }
-
-    private fun downloadAddress(appId: String, fileId: String, context: CheckContext): String {
-        repeat(2) { attempt ->
-            val token = session(context, renew = attempt > 0)
-            val request = HttpRequest("https://$API_HOST/eapi/apps/$appId/file/$fileId/downloadUrl", headers = CLIENT, authorization = "Bearer $token")
-            context.http.execute(request).use {
-                if (it.status == 401) return@repeat
-                if (it.status == 404) throw SourceException(SourceErrorKind.NOT_FOUND, "Uptodown no longer offers file $fileId")
-                if (!it.isSuccess) throw SourceException(SourceErrorKind.NETWORK, "Unexpected status ${it.status} from Uptodown")
-                val answer = Json.parseObject(it.text(BODY_CAP))
-                val address = answer.takeIf { a -> a.long("success") == 1L }?.obj("data")?.string("downloadURL")
-                    ?: throw SourceException(SourceErrorKind.NOT_FOUND, "Uptodown could not say where file $fileId is")
-                val normalized = address.takeIf(Urls::isHttps)?.let(Urls::normalize)
-                if (normalized == null || Urls.host(normalized) !in FILE_HOSTS) {
-                    throw SourceException(SourceErrorKind.PARSE, "Uptodown named a file somewhere other than its download servers")
-                }
-                return normalized
-            }
-        }
-        throw SourceException(SourceErrorKind.AUTH, "Uptodown refused the session twice")
-    }
-
-    /** A token for the service: the one held while it has more than a minute to run, or a new one. */
-    private fun session(context: CheckContext, renew: Boolean): String {
-        val now = context.nowMs() / 1000
-        session?.takeIf { !renew && now < it.expiresAtSeconds - 60 }?.let { return it.token }
-        val identifier = newIdentifier()
-        val body = "identifier=$identifier&id_plataforma=13&lang=en&unixtime=$now&hmac=${signature(now.toString())}"
-        val request = HttpRequest.post("https://$API_HOST$AUTH_PATH?identifier=$identifier", body, FORM, CLIENT)
-        val token = context.http.execute(request).use {
-            if (!it.isSuccess) throw SourceException(SourceErrorKind.NETWORK, "Uptodown opened no session: status ${it.status}")
-            Json.parseObject(it.text(BODY_CAP)).string("token")
-        }
-        val expires = token?.let(::expiry) ?: throw SourceException(SourceErrorKind.PARSE, "Uptodown answered with a session that cannot be read")
-        session = Session(token, expires)
-        return token
-    }
-
-    /** When [token], a JSON web token, runs out, in seconds since 1970; null when it is not one. */
-    private fun expiry(token: String): Long? {
-        val parts = token.split('.')
-        if (parts.size != 3) return null
-        return try {
-            Json.parseObject(String(Base64.getUrlDecoder().decode(parts[1]), Charsets.UTF_8)).long("exp")
-        } catch (_: IllegalArgumentException) {
-            null
-        } catch (_: JsonException) {
-            null
-        }
-    }
-
-    private fun parseDate(text: String): Long? {
-        for (format in DATES) {
-            try {
-                return LocalDate.parse(text.trim(), format).atStartOfDay(ZoneOffset.UTC).toInstant().toEpochMilli()
-            } catch (_: DateTimeParseException) {
-            }
-        }
-        return null
-    }
-
-    private class Tag(val name: String, val attributes: Map<String, String>, val end: Int)
-
-    /** The start tags that hold [hint], in the order of the page. */
-    private fun tags(html: String, hint: String): Sequence<Tag> = START_TAG.findAll(html)
-        .filter { hint in it.value }
-        .map { Tag(it.groupValues[1].lowercase(), attributes(it.groupValues[2]), it.range.last + 1) }
-
-    /** The text of the first element whose start tag holds [hint] and passes [wanted], up to where the first element of its name closes. */
-    private fun elementText(html: String, hint: String, wanted: (Tag) -> Boolean): String? {
-        val tag = tags(html, hint).firstOrNull(wanted) ?: return null
-        val close = html.indexOf("</${tag.name}", tag.end, ignoreCase = true)
-        if (close < 0 || close - tag.end > TEXT_WINDOW) return null
-        return plain(html.substring(tag.end, close))
-    }
-
-    /** Where the element [tag] opens ends: at its own closing tag, with elements of its name inside it counted. */
-    private fun closeOf(html: String, tag: Tag): Int {
-        var depth = 1
-        for (m in Regex("<(/?)${Regex.escape(tag.name)}\\b[^>]*>", RegexOption.IGNORE_CASE).findAll(html, tag.end)) {
-            depth += if (m.groupValues[1] == "/") -1 else 1
-            if (depth == 0) return m.range.first
-        }
-        return html.length
-    }
-
-    /**
-     * The rows of the technical details, which may be spread over several tables, by the label in
-     * their header cell with the text of their last cell; and every cell with text in the order of
-     * the page, for a page whose rows carry no label.
-     */
-    private fun technicalDetails(html: String): Pair<Map<String, String>, List<String>> {
-        val section = tags(html, "technical-information").firstOrNull { it.attributes["id"] == "technical-information" }
-            ?: return emptyMap<String, String>() to emptyList()
-        val region = html.substring(section.end, minOf(closeOf(html, section), section.end + TABLE_WINDOW))
-        val labelled = LinkedHashMap<String, String>()
-        for (row in ROW.findAll(region)) {
-            val label = HEAD.find(row.groupValues[1])?.groupValues?.get(1)?.let(::plain)?.lowercase() ?: continue
-            val value = CELL.findAll(row.groupValues[1]).lastOrNull()?.groupValues?.get(1)?.let(::plain) ?: continue
-            labelled.putIfAbsent(label, value)
-        }
-        return labelled to CELL.findAll(region).mapNotNull { plain(it.groupValues[1]) }.toList()
-    }
-
-    companion object {
-        private const val API_HOST = "www.uptodown.app"
-        private const val AUTH_PATH = "/eapi/auth/token"
-        private const val SEARCH = "https://en.uptodown.com/android/en/s"
-        private const val CLIENT_VERSION = "739"
-        private const val USER_AGENT = "Dalvik/2.1.0 (Linux; U; Android 16; Pixel 8 Pro Build/BP4A.260205.001)"
-
-        /** The key Uptodown's app signs the time with to open an anonymous session. */
-        private const val SESSION_KEY = "MDGMXUMdvHJBG/vjdFgmqX6LUdy7ecfwvYNd0gyfOCs="
-        private const val FORM = "application/x-www-form-urlencoded"
-        private const val PAGE_CAP = 4 * 1024 * 1024
-        private const val BODY_CAP = 1024 * 1024
-        private const val TEXT_WINDOW = 4000
-        private const val TABLE_WINDOW = 64 * 1024
-        private const val MAX_QUERY = 200
-        private const val MAX_HITS = 20
-
-        /** Where the service says Uptodown's files are. */
-        val FILE_HOSTS = setOf("dw.uptodown.com", "dw.uptodown.net")
-
-        private val CLIENT = mapOf("User-Agent" to USER_AGENT, "Identificador" to "Uptodown_Android", "Identificador-Version" to CLIENT_VERSION)
-        private val EXTENSIONS = setOf("apk", "xapk", "apks")
-        private val LANGUAGE = Regex("[a-z]{2,3}")
-        private val NAME = Regex("[a-z0-9][a-z0-9-]{0,62}")
-        private val NOT_APPS = setOf("www", "dw", "img", "blog", "static", "api")
-        private val NUMBER = Regex("[0-9]{1,18}")
-        private val SHA256 = Regex("[0-9a-f]{64}")
-        private val FILE_PAGE = Regex("/[0-9]{1,18}-x")
-        private val DATES = listOf(DateTimeFormatter.ofPattern("MMM d, yyyy", Locale.US), DateTimeFormatter.ofPattern("MMMM d, yyyy", Locale.US))
-        private val START_TAG = Regex("""<([A-Za-z][A-Za-z0-9]*)((?:\s[^<>]*)?)>""")
-        private val ATTRIBUTE = Regex("""([A-Za-z_:][-A-Za-z0-9_:.]*)\s*=\s*(?:"([^"]*)"|'([^']*)'|([^\s"'<>`=]+))""")
-        private val ROW = Regex("<tr\\b[^>]*>(.*?)</tr>", setOf(RegexOption.IGNORE_CASE, RegexOption.DOT_MATCHES_ALL))
-        private val HEAD = Regex("<th\\b[^>]*>(.*?)</th>", setOf(RegexOption.IGNORE_CASE, RegexOption.DOT_MATCHES_ALL))
-        private val CELL = Regex("<td\\b[^>]*>(.*?)</td>", setOf(RegexOption.IGNORE_CASE, RegexOption.DOT_MATCHES_ALL))
-        private val MARKUP = Regex("<[^>]*>")
-        private val SPACE = Regex("\\s+")
-
-        private fun randomIdentifier(): String = hex(ByteArray(8).also(SecureRandom()::nextBytes))
-
-        private fun signature(text: String): String {
-            val mac = Mac.getInstance("HmacSHA256")
-            mac.init(SecretKeySpec(SESSION_KEY.toByteArray(Charsets.UTF_8), "HmacSHA256"))
-            return hex(mac.doFinal(text.toByteArray(Charsets.UTF_8)))
-        }
-
-        private fun hex(bytes: ByteArray): String = bytes.joinToString("") { "%02x".format(it) }
-
-        private fun attributes(text: String): Map<String, String> {
-            val found = LinkedHashMap<String, String>()
-            for (m in ATTRIBUTE.findAll(text)) {
-                val value = m.groups[2]?.value ?: m.groups[3]?.value ?: m.groups[4]?.value ?: ""
-                found.putIfAbsent(m.groupValues[1].lowercase(), XmlScanner.decode(value))
-            }
-            return found
-        }
-
-        private fun classes(tag: Tag): List<String> = tag.attributes["class"]?.split(SPACE).orEmpty()
-
-        /** What a person reads of a piece of markup, or null when that is nothing. */
-        private fun plain(fragment: String): String? =
-            XmlScanner.decode(fragment.replace(MARKUP, " ").replace("&nbsp;", " ")).replace(SPACE, " ").trim().ifEmpty { null }
-    }
-}
diff --git a/core/src/main/kotlin/io/github/munzzyy/tern/core/source/store/VivoSource.kt b/core/src/main/kotlin/io/github/munzzyy/tern/core/source/store/VivoSource.kt
index 85ffe193..4d34ee79 100644
--- a/core/src/main/kotlin/io/github/munzzyy/tern/core/source/store/VivoSource.kt
+++ b/core/src/main/kotlin/io/github/munzzyy/tern/core/source/store/VivoSource.kt
@@ -36,6 +36,8 @@ class VivoSource : Source, Searchable {
 
     override val origin: String = "vivo App Store"
 
+    override val domains: Set<String> get() = setOf(FILE_HOST)
+
     override fun match(url: String): SourceSpec? {
         // The mobile site routes by hash, as in h5.appstore.vivo.com.cn/#/details?appId=123.
         val uri = Urls.parseHttps(url.replaceFirst("/#", "")) ?: return null
diff --git a/core/src/main/kotlin/io/github/munzzyy/tern/core/source/web/HtmlSource.kt b/core/src/main/kotlin/io/github/munzzyy/tern/core/source/web/HtmlSource.kt
index cbd8ca36..37490453 100644
--- a/core/src/main/kotlin/io/github/munzzyy/tern/core/source/web/HtmlSource.kt
+++ b/core/src/main/kotlin/io/github/munzzyy/tern/core/source/web/HtmlSource.kt
@@ -22,6 +22,7 @@ import io.github.munzzyy.tern.core.text.MatchTemplate
 import io.github.munzzyy.tern.core.text.NaturalOrder
 import io.github.munzzyy.tern.core.text.PatternException
 import io.github.munzzyy.tern.core.text.SafePattern
+import io.github.munzzyy.tern.core.version.Version
 
 /**
  * Any web page with links to an app's files, read the way Obtainium's HTML source reads one. On
@@ -98,7 +99,8 @@ class HtmlSource : Source {
         // The link Obtainium takes is the last in order. Here it comes first, and the others follow it.
         val preferred = ordered.asReversed().distinctBy { it.url }.take(MAX_LINKS)
 
-        val reading = reading(spec, context)
+        val highest = spec.flag(SourceOptions.HIGHEST_VERSION)
+        val reading = reading(spec, context, highest)
         val versions = watched("The version pattern") { versionsOf(preferred, html, reading) }
         val versioned = LinkedHashMap<String, MutableList<Link>>()
         val unversioned = ArrayList<Link>()
@@ -107,16 +109,24 @@ class HtmlSource : Source {
             if (version == null) unversioned.add(link) else versioned.getOrPut(version) { ArrayList() }.add(link)
         }
 
-        val releases = versioned.entries.take(MAX_RELEASES).map { (version, links) ->
+        // Tern 0.1.0 listed the highest versions, or with the page's order its first ones, whatever else the page held.
+        val listed = if (!highest) {
+            versioned.entries
+        } else if (choice.pageOrder) {
+            versioned.entries.sortedBy { entry -> entry.value.minOf { link -> ordered.indexOfFirst { it.url == link.url } } }
+        } else {
+            versioned.entries.sortedWith(compareByDescending { Version.parse(it.key) })
+        }
+        val releases = listed.take(MAX_RELEASES).map { (version, links) ->
             Release(id = version, version = version, pageUrl = finalUrl, assets = links.map { Asset(fileName(it.url), it.url) })
         }.toMutableList()
         val taken = unversioned.take(MAX_UNVERSIONED)
         if (taken.isNotEmpty()) {
             val release = followedByContent(taken, finalUrl, pseudo, headers, context)
-            if (versions[preferred.first().url] == null) releases.add(0, release) else releases.add(release)
+            if (versions[preferred.first().url] == null && !highest) releases.add(0, release) else releases.add(release)
         }
         if (unversioned.isEmpty() || pseudo == PseudoVersion.LINK) context.validators.put(key, pageValidator)
-        releases[0] = releases[0].copy(latest = true)
+        if (!highest) releases[0] = releases[0].copy(latest = true)
         return CheckResult.Listing(SourceListing(releases = releases.take(MAX_RELEASES), name = LinkScanner.title(html)))
     }
 
@@ -149,9 +159,10 @@ class HtmlSource : Source {
     /** The part after the last slash, query included, as Obtainium's "last link segment" reads it. */
     private fun lastSegmentOf(url: String): String = url.split('/').lastOrNull { it.isNotEmpty() } ?: url
 
-    private fun reading(spec: SourceSpec, context: CheckContext): Reading {
+    /** With [highest] the pattern is left to the release filters, which run it over the guessed version as 0.1.0 did. */
+    private fun reading(spec: SourceSpec, context: CheckContext, highest: Boolean): Reading {
         val from = spec.option(SourceOptions.VERSION_FROM) ?: "link"
-        val raw = context.app?.releases?.versionExtract?.takeIf { it.isNotBlank() }
+        val raw = context.app?.releases?.versionExtract?.takeIf { it.isNotBlank() && !highest }
         val pattern = try {
             raw?.let { if (from == "page") SafePattern.compileForPages(it) else SafePattern.compile(it) }
         } catch (e: PatternException) {
diff --git a/core/src/main/kotlin/io/github/munzzyy/tern/core/source/web/RequestHeaders.kt b/core/src/main/kotlin/io/github/munzzyy/tern/core/source/web/RequestHeaders.kt
index 8f07c67e..bd506a5c 100644
--- a/core/src/main/kotlin/io/github/munzzyy/tern/core/source/web/RequestHeaders.kt
+++ b/core/src/main/kotlin/io/github/munzzyy/tern/core/source/web/RequestHeaders.kt
@@ -8,11 +8,11 @@ import io.github.munzzyy.tern.core.source.SourceException
 import io.github.munzzyy.tern.core.source.SourceOptions
 
 /**
- * Extra headers a person has a web page or a download address sent with, such as a browser's
- * User-Agent for a site that turns other clients away. They are stored in [SourceOptions.HEADERS]
- * as a JSON object of names to values and go with the page and the file alike. A header that
- * carries credentials or changes what a request means is refused, and so is any character a
- * header cannot carry.
+ * Extra headers a person has a web page or a download address sent with, such as a Referer a
+ * site asks for. They are stored in [SourceOptions.HEADERS] as a JSON object of names to values
+ * and go with the page and the file alike. A header that carries credentials or changes what a
+ * request means is refused, and so is any character a header cannot carry. So is User-Agent:
+ * Tern says who it is to every site, and does not pass for a browser or another app.
  */
 object RequestHeaders {
     const val MAX_HEADERS = 8
@@ -21,10 +21,13 @@ object RequestHeaders {
     const val MAX_LENGTH = 500
 
     private val REFUSED = setOf(
-        "authorization", "proxy-authorization", "cookie", "host", "content-length", "range",
+        "authorization", "proxy-authorization", "cookie", "host", "content-length", "range", "user-agent",
         "connection", "keep-alive", "transfer-encoding", "te", "trailer", "upgrade", "expect", "accept-encoding",
     )
     private val REFUSED_PREFIXES = listOf("if-", "proxy-")
+
+    /** Headers that say how to ask and never who asks. Any other can hold a key. */
+    private val PLAIN = setOf("accept", "accept-language", "referer")
     private const val NAME_MARKS = "!#$%&'*+-.^_`|~"
 
     /** The headers [spec] asks for; a refused one fails the check as an unsupported option. */
@@ -63,6 +66,17 @@ object RequestHeaders {
         }
     }
 
+    /**
+     * [spec] with only the headers of [PLAIN] kept, for everything that leaves the phone: an
+     * export, a shared file, a link. Headers that cannot be read go too.
+     */
+    fun plainOnly(spec: SourceSpec): SourceSpec {
+        val raw = spec.option(SourceOptions.HEADERS) ?: return spec
+        val plain = runCatching { parse(raw) }.getOrDefault(emptyMap()).filterKeys { it.lowercase() in PLAIN }
+        val options = if (plain.isEmpty()) spec.options - SourceOptions.HEADERS else spec.options + (SourceOptions.HEADERS to write(plain))
+        return spec.copy(options = options)
+    }
+
     /** [headers] as the option stores them. */
     fun write(headers: Map<String, String>): String = Json.write(Json.of(headers))
 
diff --git a/core/src/test/kotlin/io/github/munzzyy/tern/core/compress/XzInputStreamTest.kt b/core/src/test/kotlin/io/github/munzzyy/tern/core/compress/XzInputStreamTest.kt
index ac362fdd..f5586341 100644
--- a/core/src/test/kotlin/io/github/munzzyy/tern/core/compress/XzInputStreamTest.kt
+++ b/core/src/test/kotlin/io/github/munzzyy/tern/core/compress/XzInputStreamTest.kt
@@ -11,8 +11,13 @@ import org.junit.Assert.assertTrue
 import org.junit.Test
 
 class XzInputStreamTest {
-    private fun unpack(bytes: ByteArray, maxOutput: Long = Long.MAX_VALUE, maxDictionary: Int = XzInputStream.MAX_DICTIONARY, chunk: Int = 8192): ByteArray =
-        Samples.readAll(XzInputStream(ByteArrayInputStream(bytes), maxOutput, maxDictionary), chunk)
+    private fun unpack(
+        bytes: ByteArray,
+        maxOutput: Long = Long.MAX_VALUE,
+        maxDictionary: Int = XzInputStream.MAX_DICTIONARY,
+        chunk: Int = 8192,
+        firstWindow: Int = XzInputStream.FIRST_WINDOW,
+    ): ByteArray = Samples.readAll(XzInputStream(ByteArrayInputStream(bytes), maxOutput, maxDictionary, firstWindow), chunk)
 
     private fun fixture(name: String) = Fixtures.bytes("compress/$name")
 
@@ -53,6 +58,27 @@ class XzInputStreamTest {
         assertArrayEquals(Samples.text(20_000, 11), unpack(fixture("text-extreme.xz")))
     }
 
+    @Test
+    fun aDictionaryGrowsOnlyAsFarAsTheDataFillsIt() {
+        val window = Window(64 * 1024 * 1024, XzInputStream.FIRST_WINDOW)
+        assertEquals(XzInputStream.FIRST_WINDOW, window.capacity)
+        // Grown many times over from the smallest start, every match still finds what it points back to.
+        for (name in listOf("text-crc64.xz", "text-extreme.xz", "blocks.xz", "noise.xz", "two-streams.xz")) {
+            assertArrayEquals(name, unpack(fixture(name)), unpack(fixture(name), firstWindow = 4096, chunk = 777))
+        }
+        assertArrayEquals(Samples.text(250_000, 7), unpack(fixture("text-crc64.xz"), firstWindow = 4096))
+    }
+
+    @Test
+    fun aDictionaryTheDeviceHasNoMemoryForIsRefusedAndNotACrash() {
+        var asked = 0
+        val stingy = { length: Int -> if (length > 8192) throw OutOfMemoryError("Failed to allocate $length bytes") else ByteArray(length).also { asked++ } }
+        val window = Window(64 * 1024 * 1024, 4096, stingy)
+        val error = assertThrows(CompressedDataException::class.java) { repeat(3) { window.limit(4096); while (window.space()) window.put(1); window.flush(ByteArray(4096), 0) } }
+        assertTrue(error.message!!, error.message!!.contains("64 MiB"))
+        assertEquals(2, asked)
+    }
+
     @Test
     fun aDictionaryLargerThanAllowedIsRefusedBeforeItIsMade() {
         val error = assertThrows(CompressedDataException::class.java) { unpack(fixture("text-crc64.xz"), maxDictionary = 1024 * 1024) }
diff --git a/core/src/test/kotlin/io/github/munzzyy/tern/core/docs/PrivacyHostsTest.kt b/core/src/test/kotlin/io/github/munzzyy/tern/core/docs/PrivacyHostsTest.kt
new file mode 100644
index 00000000..f2e43bf5
--- /dev/null
+++ b/core/src/test/kotlin/io/github/munzzyy/tern/core/docs/PrivacyHostsTest.kt
@@ -0,0 +1,36 @@
+package io.github.munzzyy.tern.core.docs
+
+import io.github.munzzyy.tern.core.icon.IconAddresses
+import io.github.munzzyy.tern.core.source.SourceRegistry
+import io.github.munzzyy.tern.core.source.SourceTypes
+import io.github.munzzyy.tern.core.source.store.ItchIoSource
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertTrue
+import org.junit.Test
+import java.io.File
+
+/** PRIVACY.md names every host a store is read at and every host an icon may come from, so a new one cannot slip in unsaid. */
+class PrivacyHostsTest {
+    private val privacy = File("../PRIVACY.md").readText()
+
+    @Test
+    fun everyDomainOfAStoreIsNamed() {
+        val registry = SourceRegistry.standard()
+        val missing = registry.sources.filter { it.type in SourceTypes.THIRD_PARTY_STORES }.flatMap { source ->
+            assertTrue("${source.type} names its domains", source.domains.isNotEmpty())
+            source.domains.filter { it !in privacy }.map { "${source.type}: $it" }
+        }
+        assertEquals(emptyList<String>(), missing)
+    }
+
+    @Test
+    fun everyHostAnIconMayComeFromIsNamed() {
+        val hosts = IconAddresses.OTHER_HOSTS.values.flatten() + IconAddresses.OTHER_HOSTS_UNDER.values.flatten()
+        assertEquals(emptyList<String>(), hosts.distinct().filter { it !in privacy })
+    }
+
+    @Test
+    fun theFileStoresOfTheDevelopersChannelsAreNamed() {
+        assertEquals(emptyList<String>(), (ItchIoSource.FILE_HOSTS + "telesco.pe" + "search.f-droid.org").filter { it !in privacy })
+    }
+}
diff --git a/core/src/test/kotlin/io/github/munzzyy/tern/core/icon/IconAddressesTest.kt b/core/src/test/kotlin/io/github/munzzyy/tern/core/icon/IconAddressesTest.kt
index cdfcabf6..7e6e1472 100644
--- a/core/src/test/kotlin/io/github/munzzyy/tern/core/icon/IconAddressesTest.kt
+++ b/core/src/test/kotlin/io/github/munzzyy/tern/core/icon/IconAddressesTest.kt
@@ -72,8 +72,6 @@ class IconAddressesTest {
                 "appgallery.huawei.ru" to setOf("appimg-dra.dbankcdn.com", "appimg-drcn.dbankcdn.com"),
                 "detail-browser.vivo.com.cn" to setOf("imgwsdl.vivo.com.cn", "appstoreimg-ipv6.vivo.com.cn"),
                 "sj.qq.com" to setOf("pp.myapp.com"),
-                "www.coolapk.com" to setOf("pp.myapp.com"),
-                "www.rustore.ru" to setOf("static.rustore.ru"),
                 "apkpure.com" to setOf("image.winudf.com"),
                 "apkpure.net" to setOf("image.winudf.com"),
                 "www.apkmirror.com" to setOf("downloadr2.apkmirror.com"),
@@ -81,7 +79,7 @@ class IconAddressesTest {
             IconAddresses.OTHER_HOSTS,
         )
         assertEquals(
-            mapOf("aptoide.com" to setOf("pool.img.aptoide.com"), "uptodown.com" to setOf("img.utdstc.com")),
+            mapOf("aptoide.com" to setOf("pool.img.aptoide.com")),
             IconAddresses.OTHER_HOSTS_UNDER,
         )
     }
diff --git a/core/src/test/kotlin/io/github/munzzyy/tern/core/interop/AppConfigJsonTest.kt b/core/src/test/kotlin/io/github/munzzyy/tern/core/interop/AppConfigJsonTest.kt
index 07b0cbdc..a105d1eb 100644
--- a/core/src/test/kotlin/io/github/munzzyy/tern/core/interop/AppConfigJsonTest.kt
+++ b/core/src/test/kotlin/io/github/munzzyy/tern/core/interop/AppConfigJsonTest.kt
@@ -44,7 +44,7 @@ class AppConfigJsonTest {
     @Test
     fun encodesSchemaField() {
         val json = AppConfigJson.encode(sample())
-        assertEquals(1L, json.long("schema"))
+        assertEquals(2L, json.long("schema"))
     }
 
     @Test
@@ -111,7 +111,7 @@ class AppConfigJsonTest {
         val original = everything()
         assertEquals(original, AppConfigJson.decode(AppConfigJson.encode(original)))
         assertEquals(original, AppConfigJson.decode(Json.parseObject(Json.write(AppConfigJson.encode(original)))))
-        assertEquals(1L, AppConfigJson.encode(original).long("schema"))
+        assertEquals(2L, AppConfigJson.encode(original).long("schema"))
     }
 
     @Test
@@ -130,8 +130,8 @@ class AppConfigJsonTest {
             "assets": {"include": null, "exclude": null, "matchDevice": true},
             "updates": "NOTIFY", "trackOnly": false, "pinnedSigners": [], "categories": [], "favorite": false, "notes": null}"""
         val decoded = AppConfigJson.decode(Json.parseObject(older))
-        // A wait that was stored stays the app's own; only an app without one follows the setting for all apps.
-        assertEquals(ReleasePolicy(minAgeDays = 0), decoded.releases)
+        // Tern 0.1.0 wrote a wait of 0 for every app, which was no choice of the person's, so it follows the setting for all apps.
+        assertEquals(ReleasePolicy(minAgeDays = null), decoded.releases)
         assertEquals(AssetPolicy(), decoded.assets)
         assertNull(decoded.customName)
         assertNull(decoded.customAuthor)
diff --git a/core/src/test/kotlin/io/github/munzzyy/tern/core/interop/ConfigLinkTest.kt b/core/src/test/kotlin/io/github/munzzyy/tern/core/interop/ConfigLinkTest.kt
index 95825f5f..e1c625e5 100644
--- a/core/src/test/kotlin/io/github/munzzyy/tern/core/interop/ConfigLinkTest.kt
+++ b/core/src/test/kotlin/io/github/munzzyy/tern/core/interop/ConfigLinkTest.kt
@@ -76,14 +76,14 @@ class ConfigLinkTest {
 
     @Test
     fun aHeaderThatCouldHoldAKeyNeverGoesIntoALink() {
-        val headers = RequestHeaders.write(mapOf("User-Agent" to "Mozilla/5.0", "X-Api-Key" to "hunter2secret", "PRIVATE-TOKEN" to "glpat-abc"))
+        val headers = RequestHeaders.write(mapOf("Referer" to "https://example.com/", "X-Api-Key" to "hunter2secret", "PRIVATE-TOKEN" to "glpat-abc"))
         val direct = AppConfig("direct", SourceSpec(SourceTypes.DIRECT, "https://example.org/app.apk", mapOf(SourceOptions.HEADERS to headers)), "Direct")
         val link = ConfigLink.web(direct)!!
         assertFalse(link.contains("hunter2secret"))
         assertFalse(link.contains("glpat"))
         assertFalse(link.contains("creds"))
         val back = readBack(link)
-        assertEquals(mapOf("User-Agent" to "Mozilla/5.0"), RequestHeaders.of(back.source))
+        assertEquals(mapOf("Referer" to "https://example.com/"), RequestHeaders.of(back.source))
 
         val onlySecret = direct.copy(source = direct.source.copy(options = mapOf(SourceOptions.HEADERS to RequestHeaders.write(mapOf("X-Api-Key" to "hunter2secret")))))
         assertNull(readBack(ConfigLink.of(onlySecret)!!).source.option(SourceOptions.HEADERS))
@@ -116,11 +116,32 @@ class ConfigLinkTest {
         assertEquals(readBack(ConfigLink.of(app)!!), readBack(web))
     }
 
+    @Test
+    fun ternsOwnLinkKeepsTheSettingsAfterTheHashWhereNoServerSeesThem() {
+        val link = ConfigLink.tern(app)!!
+        assertTrue(link.startsWith("https://tern.munzzyy.dev/add/#app="))
+        assertFalse("nothing before the hash but the page", link.substringBefore('#').contains("github"))
+        assertEquals(readBack(ConfigLink.of(app)!!), readBack(link))
+        assertEquals("the page's tern:// link reads the same", readBack(ConfigLink.of(app)!!), readBack("tern://app/" + link.substringAfter("#app=")))
+    }
+
+    @Test
+    fun ternsLinkForAnAddressKeepsItAfterTheHashAndOlderLinksStillRead() {
+        val address = "https://github.com/example/app?tab=releases"
+        val link = ConfigLink.ternAddress(address)
+        assertEquals("https://tern.munzzyy.dev/add/#url=https%3A%2F%2Fgithub.com%2Fexample%2Fapp%3Ftab%3Dreleases", link)
+        assertEquals(ObtainiumLink.Add(address), ObtainiumLink.parse(link))
+        assertEquals(ObtainiumLink.Add(address), ObtainiumLink.parse("https://tern.munzzyy.dev/add/?url=https%3A%2F%2Fgithub.com%2Fexample%2Fapp%3Ftab%3Dreleases"))
+        assertEquals(ObtainiumLink.Add(address), ObtainiumLink.parse("tern://add?url=https%3A%2F%2Fgithub.com%2Fexample%2Fapp%3Ftab%3Dreleases"))
+        assertNull("the page without an app carries nothing", ObtainiumLink.parse("https://tern.munzzyy.dev/add/"))
+    }
+
     @Test
     fun aSourceObtainiumCannotFollowHasNoLink() {
         val actions = AppConfig("ci", SourceSpec(SourceTypes.GITHUB_ACTIONS, "https://github.com/example/app"), "Nightly")
         assertNull(ConfigLink.of(actions))
         assertNull(ConfigLink.web(actions))
+        assertNull(ConfigLink.tern(actions))
     }
 
     @Test
@@ -128,6 +149,7 @@ class ConfigLinkTest {
         val long = app.copy(releases = ReleasePolicy(titleFilter = "release ".repeat(1_000)))
         assertNull(ConfigLink.of(long))
         assertNull(ConfigLink.web(long))
+        assertNull(ConfigLink.tern(long))
         assertTrue(ConfigLink.web(app)!!.length <= ConfigLink.MAX_LENGTH)
     }
 }
diff --git a/core/src/test/kotlin/io/github/munzzyy/tern/core/interop/ObtainiumExportTest.kt b/core/src/test/kotlin/io/github/munzzyy/tern/core/interop/ObtainiumExportTest.kt
index 7a89f85f..76cd9f49 100644
--- a/core/src/test/kotlin/io/github/munzzyy/tern/core/interop/ObtainiumExportTest.kt
+++ b/core/src/test/kotlin/io/github/munzzyy/tern/core/interop/ObtainiumExportTest.kt
@@ -13,6 +13,7 @@ import io.github.munzzyy.tern.core.source.SourceTypes
 import io.github.munzzyy.tern.core.source.web.PseudoVersion
 import io.github.munzzyy.tern.core.source.web.RequestHeaders
 import org.junit.Assert.assertEquals
+import org.junit.Assert.assertFalse
 import org.junit.Assert.assertNull
 import org.junit.Assert.assertTrue
 import org.junit.Test
@@ -116,6 +117,16 @@ class ObtainiumExportTest {
         assertEquals(plain.releases, ObtainiumImport.read(ObtainiumExport.write(listOf(plain), 0, "0.2.0").text).apps.single().releases)
     }
 
+    @Test
+    fun aHeaderThatCouldHoldAKeyNeverLeavesForObtainium() {
+        val headers = RequestHeaders.write(mapOf("Accept-Language" to "de", "X-Api-Key" to "k123"))
+        val direct = AppConfig("direct", SourceSpec(SourceTypes.DIRECT, "https://example.org/app.apk", mapOf(SourceOptions.HEADERS to headers)), "Direct")
+        val text = ObtainiumExport.write(listOf(direct), 0, "0.2.0").text
+        assertFalse(text, "k123" in text || "X-Api-Key" in text)
+        val back = ObtainiumImport.read(text).apps.single()
+        assertEquals(mapOf("Accept-Language" to "de"), RequestHeaders.parse(back.source.option(SourceOptions.HEADERS)))
+    }
+
     @Test
     fun theFileHasTheShapeObtainiumChecks() {
         val root = Json.parseObject(ObtainiumExport.write(listOf(github), 0, "0.2.0").text)
diff --git a/core/src/test/kotlin/io/github/munzzyy/tern/core/interop/ObtainiumImportTest.kt b/core/src/test/kotlin/io/github/munzzyy/tern/core/interop/ObtainiumImportTest.kt
index 74318d93..e157aca6 100644
--- a/core/src/test/kotlin/io/github/munzzyy/tern/core/interop/ObtainiumImportTest.kt
+++ b/core/src/test/kotlin/io/github/munzzyy/tern/core/interop/ObtainiumImportTest.kt
@@ -5,6 +5,7 @@ import io.github.munzzyy.tern.core.model.AssetPolicy
 import io.github.munzzyy.tern.core.model.ReleaseOrder
 import io.github.munzzyy.tern.core.model.ReleasePolicy
 import io.github.munzzyy.tern.core.model.VersionFrom
+import io.github.munzzyy.tern.core.source.Refusal
 import io.github.munzzyy.tern.core.source.SourceOptions
 import io.github.munzzyy.tern.core.source.SourceTypes
 import io.github.munzzyy.tern.core.source.web.RequestHeaders
@@ -65,10 +66,57 @@ class ObtainiumImportTest {
         val skipped = result().skipped
         assertEquals(2, skipped.size)
         assertTrue(skipped.any { it.name == "Thirteen" && it.reason.contains("APKPure") })
-        assertTrue(skipped.any { it.name == "Fourteen" && it.reason.contains("Uptodown") })
+        assertTrue(skipped.any { it.name == "Fourteen" && it.refusal == Refusal.IMPERSONATION })
         assertEquals(SourceTypes.TELEGRAM, result().apps.first { it.name == "Fifteen" }.source.type)
     }
 
+    @Test
+    fun appsOfSitesTernRefusesAreSkippedWithTheReasonAndTheRestIsImported() {
+        val entries = listOf(
+            "LiteAPKs" to "https://liteapks.com/example.html",
+            "Apk4Free" to "https://apk4free.net/example/",
+            "RockMods" to "https://www.rockmods.net/apps/example",
+            "Farsroid" to "https://www.farsroid.com/example/",
+            "RuStore" to "https://www.rustore.ru/catalog/app/org.example.ru",
+            "Uptodown" to "https://example.en.uptodown.com/android",
+            "CoolApk" to "https://www.coolapk.com/apk/org.example.cool",
+            null to "https://liteapks.com/found-by-address.html",
+            "HTML" to "https://dl.farsroid.com/ap/example.apk",
+        ).mapIndexed { i, (type, url) ->
+            val override = if (type == null) "null" else "\"$type\""
+            """{"id":"org.example.skipped$i","url":"$url","author":"","name":"Skipped $i","overrideSource":$override,"additionalSettings":"{}"}"""
+        }
+        val github = """{"id":"org.example.kept","url":"https://github.com/example/kept","author":"","name":"Kept","overrideSource":"GitHub","additionalSettings":"{}"}"""
+        val result = ObtainiumImport.read("""{"apps":[${(entries + github).joinToString(",")}]}""")
+
+        assertEquals(listOf("Kept"), result.apps.map { it.name })
+        assertEquals(9, result.skipped.size)
+        val modified = result.skipped.filter { it.refusal == Refusal.MODIFIED_APPS }.map { it.name }
+        assertEquals(listOf("Skipped 0", "Skipped 1", "Skipped 2", "Skipped 3", "Skipped 7", "Skipped 8"), modified)
+        assertTrue(result.skipped.filter { it.refusal == Refusal.MODIFIED_APPS }.all { it.reason == "Tern does not read sites that offer modified apps" })
+        val impersonation = result.skipped.filter { it.refusal == Refusal.IMPERSONATION }
+        assertEquals(listOf("Skipped 4", "Skipped 5", "Skipped 6"), impersonation.map { it.name })
+        assertTrue(impersonation.all { it.reason == "Tern cannot read this store without pretending to be its app" })
+    }
+
+    @Test
+    fun obtainiumsDefaultBrowserUserAgentIsNotCarriedOver() {
+        val settings = """{\"requestHeader\": [{\"requestHeader\": \"User-Agent: Mozilla/5.0 (Linux; Android 10; K) Chrome/114.0.0.0\"}, {\"requestHeader\": \"Referer: https://example.com/\"}]}"""
+        val text = """{"apps":[{"id":"org.example.page","url":"https://example.com/app","author":"","name":"Page","overrideSource":"HTML","additionalSettings":"$settings"}]}"""
+        val source = ObtainiumImport.read(text).apps.single().source
+        assertEquals(mapOf("Referer" to "https://example.com/"), RequestHeaders.parse(source.option(SourceOptions.HEADERS)))
+    }
+
+    @Test
+    fun aGalaxyStoreAppKeepsTheModelAndRegionItWasFollowedWith() {
+        val settings = """{\"deviceId\": \"SM-A556B\", \"csc\": \"EUX\"}"""
+        val text = """{"apps":[{"id":"org.example.app","url":"https://galaxystore.samsung.com/detail/org.example.app","author":"","name":"Galaxy","overrideSource":"SamsungGalaxyStore","additionalSettings":"$settings"}]}"""
+        val source = ObtainiumImport.read(text).apps.single().source
+        assertEquals(SourceTypes.SAMSUNG, source.type)
+        assertEquals("SM-A556B", source.option(SourceOptions.DEVICE_MODEL))
+        assertEquals("EUX", source.option(SourceOptions.CSC))
+    }
+
     @Test
     fun onlyValidPackageLikeIdsBecomePackageName() {
         val byName = result().apps.associateBy { it.name }
@@ -195,7 +243,7 @@ class ObtainiumImportTest {
         assertEquals("true", page.option(SourceOptions.LAST_SEGMENT))
         assertEquals("true", page.option(SourceOptions.ANY_TEXT))
         assertEquals("link", page.option(SourceOptions.PSEUDO))
-        assertEquals(mapOf("X-Mirror" to "eu:west", "user-agent" to "Example/2.0"), RequestHeaders.parse(page.option(SourceOptions.HEADERS)))
+        assertEquals(mapOf("X-Mirror" to "eu:west"), RequestHeaders.parse(page.option(SourceOptions.HEADERS)))
         assertEquals(
             Json.parseArray("""[{"filter": "Releases", "text": true}, "/latest/", {"filter": "/builds/", "arch": true}]"""),
             Json.parseArray(page.option(SourceOptions.STEPS)!!),
@@ -218,7 +266,7 @@ class ObtainiumImportTest {
         val direct = options().getValue("Direct").source
         assertEquals(SourceTypes.DIRECT, direct.type)
         assertEquals("etag", direct.option(SourceOptions.PSEUDO))
-        assertTrue(RequestHeaders.parse(direct.option(SourceOptions.HEADERS)).getValue("User-Agent").startsWith("Mozilla/5.0 (Linux; Android 10; K)"))
+        assertNull("Obtainium's browser User-Agent stays behind: Tern says who it is", direct.option(SourceOptions.HEADERS))
         val byAddress = options().getValue("Direct By Address").source
         assertEquals(SourceTypes.DIRECT, byAddress.type)
         assertEquals("hash", byAddress.option(SourceOptions.PSEUDO))
diff --git a/core/src/test/kotlin/io/github/munzzyy/tern/core/interop/TernExportTest.kt b/core/src/test/kotlin/io/github/munzzyy/tern/core/interop/TernExportTest.kt
index 59bd4b93..bcb9e8c4 100644
--- a/core/src/test/kotlin/io/github/munzzyy/tern/core/interop/TernExportTest.kt
+++ b/core/src/test/kotlin/io/github/munzzyy/tern/core/interop/TernExportTest.kt
@@ -1,8 +1,15 @@
 package io.github.munzzyy.tern.core.interop
 
+import io.github.munzzyy.tern.core.json.Json
 import io.github.munzzyy.tern.core.model.AppConfig
 import io.github.munzzyy.tern.core.model.SourceSpec
+import io.github.munzzyy.tern.core.source.Refusal
+import io.github.munzzyy.tern.core.source.SourceOptions
+import io.github.munzzyy.tern.core.source.SourceTypes
+import io.github.munzzyy.tern.core.source.web.RequestHeaders
 import org.junit.Assert.assertEquals
+import org.junit.Assert.assertFalse
+import org.junit.Assert.assertNull
 import org.junit.Assert.assertTrue
 import org.junit.Test
 
@@ -34,6 +41,17 @@ class TernExportTest {
         assertTrue(!text.contains("secret", ignoreCase = true))
     }
 
+    @Test
+    fun aHeaderThatCouldHoldAKeyNeverLeavesInAnExport() {
+        val headers = RequestHeaders.write(mapOf("Accept-Language" to "de", "X-Api-Key" to "k123", "X-Mirror" to "eu"))
+        val app = AppConfig("web", SourceSpec(SourceTypes.DIRECT, "https://example.org/app.apk", mapOf(SourceOptions.HEADERS to headers)), "Web")
+        val text = TernExport.write(listOf(app), exportedAtMs = 1, appVersion = "1")
+        assertFalse(text, "k123" in text || "X-Api-Key" in text || "X-Mirror" in text)
+        assertEquals(mapOf("Accept-Language" to "de"), RequestHeaders.parse(TernExport.read(text).single().source.option(SourceOptions.HEADERS)))
+        val onlySecret = app.copy(source = app.source.copy(options = mapOf(SourceOptions.HEADERS to RequestHeaders.write(mapOf("X-Api-Key" to "k123")))))
+        assertNull(TernExport.read(TernExport.write(listOf(onlySecret), 1, "1")).single().source.option(SourceOptions.HEADERS))
+    }
+
     @Test(expected = TernExportException::class)
     fun rejectsWrongFormatTag() {
         TernExport.read("""{"format":"something-else","schema":1,"apps":[]}""")
@@ -53,4 +71,16 @@ class TernExportTest {
     fun rejectsMissingAppsArray() {
         TernExport.read("""{"format":"tern-export","schema":1}""")
     }
+
+    @Test
+    fun anAppOfASiteTernNoLongerReadsIsSkippedAndTheRestIsRead() {
+        val kept = AppConfigJson.encode(apps()[0])
+        val text = """{"format":"tern-export","schema":1,"apps":[
+            {"id":"ru","name":"Store App","source":{"type":"rustore","url":"https://www.rustore.ru/catalog/app/org.example"}},
+            {"id":"mod","name":"Page","customName":"Modded","source":{"type":"html","url":"https://liteapks.com/example.html"}},
+            ${Json.write(kept)}]}"""
+        val file = TernExport.readFile(text)
+        assertEquals(listOf(apps()[0]), file.apps)
+        assertEquals(listOf("Store App" to Refusal.IMPERSONATION, "Modded" to Refusal.MODIFIED_APPS), file.skipped.map { it.name to it.refusal })
+    }
 }
diff --git a/core/src/test/kotlin/io/github/munzzyy/tern/core/interop/V010ConfigTest.kt b/core/src/test/kotlin/io/github/munzzyy/tern/core/interop/V010ConfigTest.kt
new file mode 100644
index 00000000..2ab225a7
--- /dev/null
+++ b/core/src/test/kotlin/io/github/munzzyy/tern/core/interop/V010ConfigTest.kt
@@ -0,0 +1,91 @@
+package io.github.munzzyy.tern.core.interop
+
+import io.github.munzzyy.tern.core.engine.ReleaseSelector
+import io.github.munzzyy.tern.core.json.Json
+import io.github.munzzyy.tern.core.model.AppConfig
+import io.github.munzzyy.tern.core.model.ReleaseOrder
+import io.github.munzzyy.tern.core.net.InMemoryValidatorStore
+import io.github.munzzyy.tern.core.source.CheckContext
+import io.github.munzzyy.tern.core.source.CheckResult
+import io.github.munzzyy.tern.core.source.SourceOptions
+import io.github.munzzyy.tern.core.source.web.HtmlSource
+import io.github.munzzyy.tern.core.source.web.HtmlStep
+import io.github.munzzyy.tern.core.testing.FakeHttp
+import io.github.munzzyy.tern.core.testing.Fixtures
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertFalse
+import org.junit.Assert.assertNull
+import org.junit.Assert.assertTrue
+import org.junit.Test
+
+/** Apps Tern 0.1.0 saved or exported mean after the update what they meant before it. */
+class V010ConfigTest {
+    private val export = Fixtures.text("interop/tern-0.1.0-export.json")
+    private fun rows() = Json.parseObject(export).array("apps")!!.objects()
+    private fun web(): AppConfig = AppConfigJson.decode(rows()[0])
+    private fun github(): AppConfig = AppConfigJson.decode(rows()[1])
+
+    @Test
+    fun aStepOfAWebPageAppStillTakesTheFirstMatchInThePagesOrder() {
+        val steps = HtmlStep.parse(web().source.option(SourceOptions.STEPS))!!
+        assertEquals(listOf(HtmlStep("/v/", pageOrder = true, firstLink = true)), steps)
+        assertTrue(web().source.flag(SourceOptions.HIGHEST_VERSION))
+        assertEquals("\\.apk$", web().source.option(SourceOptions.LINK_FILTER))
+    }
+
+    @Test
+    fun theWaitOf0DaysV010AlwaysWroteFollowsTheSetting() {
+        assertNull(web().releases.minAgeDays)
+        assertNull(github().releases.minAgeDays)
+        assertEquals(ReleaseOrder.VERSION, web().releases.order)
+    }
+
+    @Test
+    fun otherSourcesAndEverythingElseComeThroughAsTheyWere() {
+        val app = github()
+        assertEquals(emptyMap<String, String>(), app.source.options)
+        assertTrue(app.favorite)
+        assertEquals(listOf("Tools"), app.categories)
+        assertEquals(listOf("a894d99944e6d3a5f69bbdfc6f8c4a0a8bb0b85c1e0d0a8c5c1d2e3f4a5b6c7d"), web().pinnedSigners)
+        assertEquals("^(\\d+\\.\\d+)", web().releases.versionExtract)
+    }
+
+    @Test
+    fun aV010ExportIsReadTheSameWay() {
+        val apps = TernExport.read(export)
+        assertEquals(web().source, apps[0].source)
+        assertNull(apps[1].releases.minAgeDays)
+    }
+
+    @Test
+    fun whatIsSavedAgainIsReadAgainTheSame() {
+        for (app in listOf(web(), github())) {
+            val saved = AppConfigJson.encode(app)
+            assertEquals(2L, saved.long("schema"))
+            assertEquals(app, AppConfigJson.decode(Json.parseObject(Json.write(saved))))
+        }
+    }
+
+    @Test
+    fun aRowWrittenAfterV010IsNotChanged() {
+        val later = AppConfigJson.encode(AppConfigJson.decode(rows()[1]).copy(releases = github().releases.copy(minAgeDays = 0)))
+        val asSchema1 = Json.parseObject(Json.write(later).replace("\"schema\":2", "\"schema\":1"))
+        assertEquals(0, AppConfigJson.decode(asSchema1).releases.minAgeDays)
+    }
+
+    @Test
+    fun theV010WebPageAppFollows19OnThePage191101AndOffersTheHighestVersion() {
+        val start = "https://example.com/project"
+        val http = FakeHttp()
+            .text(start, """<a href="/v/1.9/">1.9</a><a href="/v/1.10/">1.10</a><a href="/v/1.2/">1.2</a>""")
+            .text("https://example.com/v/1.9/", """<a href="/beta/app-1.9.3.apk">beta</a><a href="/stable/app-1.9.1.apk">stable</a>""")
+        val app = web()
+        val listing = (HtmlSource().check(app.source, CheckContext(http, InMemoryValidatorStore(), app = app)) as CheckResult.Listing).listing
+        assertEquals(setOf("1.9.3", "1.9.1"), listing.releases.map { it.version }.toSet())
+        assertFalse(listing.releases.any { it.latest })
+        // v0.1.0 took the highest version and read it with the app's pattern; natural order of the addresses would take /stable/.
+        val chosen = ReleaseSelector.select(listing.releases, app.releases, 0L) { true }.candidate!!
+        assertTrue(chosen.assets.single().url.endsWith("/beta/app-1.9.3.apk"))
+        assertEquals("1.9", chosen.version)
+    }
+}
diff --git a/core/src/test/kotlin/io/github/munzzyy/tern/core/live/JvmHttp.kt b/core/src/test/kotlin/io/github/munzzyy/tern/core/live/JvmHttp.kt
index e075d3a5..48168878 100644
--- a/core/src/test/kotlin/io/github/munzzyy/tern/core/live/JvmHttp.kt
+++ b/core/src/test/kotlin/io/github/munzzyy/tern/core/live/JvmHttp.kt
@@ -12,9 +12,9 @@ import java.net.URI
 import java.util.zip.GZIPInputStream
 
 /**
- * Plain HTTPS for the live tests: redirects followed by hand, credentials dropped when the host
- * changes, gzip negotiated the way Android's own client does it. [bytesReceived] counts what
- * crossed the wire, before decompression.
+ * Plain HTTPS for the live tests: redirects followed by hand unless the request says not to,
+ * credentials dropped when the host changes, a request body sent, gzip negotiated the way
+ * Android's own client does it. [bytesReceived] counts what crossed the wire, before decompression.
  */
 class JvmHttp : HttpClient {
     val requests = ArrayList<HttpRequest>()
@@ -37,8 +37,13 @@ class JvmHttp : HttpClient {
             val negotiate = request.headers.keys.none { it.equals("Accept-Encoding", ignoreCase = true) }
             if (negotiate) connection.setRequestProperty("Accept-Encoding", "gzip")
             authorization?.let { connection.setRequestProperty("Authorization", it) }
+            request.body?.let { body ->
+                connection.doOutput = true
+                connection.setFixedLengthStreamingMode(body.size)
+                connection.outputStream.use { it.write(body) }
+            }
             val status = connection.responseCode
-            if (status in 300..399 && status != 304) {
+            if (status in 300..399 && status != 304 && request.followRedirects) {
                 val location = connection.getHeaderField("Location") ?: error("Redirect without a Location")
                 connection.disconnect()
                 url = URI(url).resolve(location).toString()
diff --git a/core/src/test/kotlin/io/github/munzzyy/tern/core/live/StoresLiveTest.kt b/core/src/test/kotlin/io/github/munzzyy/tern/core/live/StoresLiveTest.kt
new file mode 100644
index 00000000..4cf5b4bd
--- /dev/null
+++ b/core/src/test/kotlin/io/github/munzzyy/tern/core/live/StoresLiveTest.kt
@@ -0,0 +1,160 @@
+package io.github.munzzyy.tern.core.live
+
+import io.github.munzzyy.tern.core.apk.ApkInspector
+import io.github.munzzyy.tern.core.model.AssetKind
+import io.github.munzzyy.tern.core.model.AssetPolicy
+import io.github.munzzyy.tern.core.model.DeviceProfile
+import io.github.munzzyy.tern.core.model.SourceSpec
+import io.github.munzzyy.tern.core.net.HttpRequest
+import io.github.munzzyy.tern.core.net.InMemoryValidatorStore
+import io.github.munzzyy.tern.core.net.PoliteHttp
+import io.github.munzzyy.tern.core.net.RateLimiter
+import io.github.munzzyy.tern.core.net.Urls
+import io.github.munzzyy.tern.core.select.AssetPicker
+import io.github.munzzyy.tern.core.source.CheckContext
+import io.github.munzzyy.tern.core.source.CheckResult
+import io.github.munzzyy.tern.core.source.Searchable
+import io.github.munzzyy.tern.core.source.SourceListing
+import io.github.munzzyy.tern.core.source.SourceRegistry
+import io.github.munzzyy.tern.core.source.SourceTypes
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertTrue
+import org.junit.Assume.assumeTrue
+import org.junit.Before
+import org.junit.Test
+
+/**
+ * Every store and developer channel Tern still reads, asked for a real app over the network the
+ * way the app asks: with the User-Agent Tern sends and nothing borrowed from another client. Each
+ * one is followed to the first bytes of its file, and every host it asked is one PRIVACY.md names
+ * for it. Off unless asked for: ./gradlew :core:test -Dtern.live=true --tests '*StoresLiveTest'
+ */
+class StoresLiveTest {
+    private val raw = JvmHttp()
+    private val agent = "Tern/0.1.0"
+    private val http = PoliteHttp(raw, RateLimiter(), agent)
+    private val registry = SourceRegistry.standard()
+    private val phone = DeviceProfile.ARM64_PHONE
+
+    @Before
+    fun onlyWhenAsked() {
+        assumeTrue("live tests are off", System.getProperty("tern.live") == "true")
+    }
+
+    private fun context() = CheckContext(http, InMemoryValidatorStore(), device = phone)
+
+    /** Reads [address] as [type], and the first bytes of the file it offers unless it offers none; returns what the source listed. */
+    private fun follow(address: String, type: String, packageName: String? = null): SourceListing {
+        val spec = registry.match(address) ?: error("no source takes $address")
+        assertEquals(type, spec.type)
+        val listing = (registry.check(spec, context()) as CheckResult.Listing).listing
+        val newest = listing.releases.first()
+        println("$type: ${listing.name} by ${listing.author}, ${listing.releases.size} releases, newest ${newest.version} (${newest.versionCode}), files ${newest.assets.map { it.name }}")
+        packageName?.let { assertEquals(it, listing.packageName) }
+        if (spec.type !in SourceTypes.TRACK_ONLY) fetchStart(spec, listing)
+        identityAndHosts(spec)
+        return listing
+    }
+
+    private fun fetchStart(spec: SourceSpec, listing: SourceListing) {
+        val release = listing.releases.first { it.assets.isNotEmpty() }
+        val pick = AssetPicker.rank(release.assets, phone, AssetPolicy()).first().asset
+        val download = registry.resolve(spec, pick, context())
+        http.execute(HttpRequest(download.url, headers = download.headers + mapOf("Range" to "bytes=0-3", "Accept-Encoding" to "identity"))).use {
+            assertTrue("${spec.type}: ${it.status} for ${download.url.take(120)}", it.isSuccess)
+            val head = it.body.readNBytes(4)
+            assertEquals("${spec.type}: the file is a zip", "PK\u0003\u0004", String(head, Charsets.ISO_8859_1))
+            println("${spec.type}: ${pick.name} starts as a zip at ${Urls.host(it.url)}")
+        }
+        if (pick.kind == AssetKind.APK) {
+            val info = ApkInspector.inspectRemote(http, download.url)
+            println("${spec.type}: the file is ${info.manifest.packageName} ${info.manifest.versionName}")
+            listing.packageName?.let { assertEquals(it, info.manifest.packageName) }
+        }
+    }
+
+    /** Every request carried Tern's own User-Agent and no header that says it is someone else, and went to a host of the source. */
+    private fun identityAndHosts(spec: SourceSpec) {
+        val domains = registry.get(spec.type)!!.domains
+        for (request in raw.requests) {
+            assertEquals(request.url, agent, request.headers["User-Agent"])
+            assertTrue(request.url, request.headers.keys.none { it.startsWith("X-App", ignoreCase = true) || it.startsWith("Ual-", ignoreCase = true) })
+            val host = Urls.host(request.url)
+            if (domains.isNotEmpty()) assertTrue("${spec.type} asked $host", domains.any { host == it || host.endsWith(".$it") })
+        }
+        println("${spec.type}: ${raw.requests.size} requests to ${raw.requests.map { Urls.host(it.url) }.distinct()}")
+    }
+
+    private fun search(type: String, query: String) {
+        val store = registry.get(type) as Searchable
+        val hits = store.search(query, context())
+        println("$type search for $query: ${hits.take(3).map { it.name to it.url }}")
+        assertTrue(hits.isNotEmpty())
+        identityAndHosts(SourceSpec(type, hits.first().url))
+    }
+
+    @Test
+    fun apkPure() {
+        follow("https://apkpure.com/vlc-for-android/org.videolan.vlc", SourceTypes.APKPURE, "org.videolan.vlc")
+    }
+
+    @Test
+    fun aptoide() {
+        follow("https://videolabs-vlc.en.aptoide.com/app", SourceTypes.APTOIDE, "org.videolan.vlc")
+    }
+
+    @Test
+    fun aptoideSearch() = search(SourceTypes.APTOIDE, "vlc")
+
+    @Test
+    fun apkCombo() {
+        follow("https://apkcombo.com/vlc/org.videolan.vlc", SourceTypes.APKCOMBO, "org.videolan.vlc")
+    }
+
+    @Test
+    fun apkMirrorIsFollowedWithoutAFile() {
+        val listing = follow("https://www.apkmirror.com/apk/mozilla/firefox/", SourceTypes.APKMIRROR)
+        assertTrue(listing.releases.first().notes != null || listing.releases.first().fileSize != null)
+    }
+
+    @Test
+    fun huaweiAppGallery() {
+        follow("https://appgallery.huawei.com/app/C100336075", SourceTypes.HUAWEI, "com.lifeplus.diveplus")
+    }
+
+    @Test
+    fun huaweiSearch() = search(SourceTypes.HUAWEI, "wechat")
+
+    @Test
+    fun galaxyStore() {
+        follow("https://galaxystore.samsung.com/detail/com.sec.android.app.sbrowser", SourceTypes.SAMSUNG, "com.sec.android.app.sbrowser")
+    }
+
+    @Test
+    fun vivo() {
+        follow("https://h5.appstore.vivo.com.cn/#/details?appId=40413", SourceTypes.VIVO, "com.tencent.mm")
+    }
+
+    @Test
+    fun vivoSearch() = search(SourceTypes.VIVO, "wechat")
+
+    @Test
+    fun tencent() {
+        follow("https://sj.qq.com/appdetail/com.tencent.mm", SourceTypes.TENCENT, "com.tencent.mm")
+    }
+
+    @Test
+    fun itchIo() {
+        follow("https://xlaucifer.itch.io/remember", SourceTypes.ITCHIO)
+    }
+
+    @Test
+    fun telegram() {
+        follow("https://telegram.org/android", SourceTypes.TELEGRAM)
+    }
+
+    @Test
+    fun neutronCode() {
+        follow("https://neutroncode.com/downloads/file/2-neutronmpapkarm64", SourceTypes.NEUTRONCODE)
+    }
+}
diff --git a/core/src/test/kotlin/io/github/munzzyy/tern/core/select/FileOriginTest.kt b/core/src/test/kotlin/io/github/munzzyy/tern/core/select/FileOriginTest.kt
index 8f4a7776..a92285c4 100644
--- a/core/src/test/kotlin/io/github/munzzyy/tern/core/select/FileOriginTest.kt
+++ b/core/src/test/kotlin/io/github/munzzyy/tern/core/select/FileOriginTest.kt
@@ -15,7 +15,7 @@ class FileOriginTest {
         assertNull(foreign(SourceTypes.GITHUB, "https://github.com/example/app", "https://github.com/example/app/releases/download/v1/app.apk"))
         assertNull(foreign(SourceTypes.FDROID, "https://apt.izzysoft.de/fdroid/index/apk/org.example", "https://apt.izzysoft.de/fdroid/repo/org.example_1.apk"))
         assertNull(foreign(SourceTypes.HTML, "https://www.example.org/download", "https://downloads.example.org/app.apk"))
-        assertNull(foreign(SourceTypes.RUSTORE, "https://www.rustore.ru/catalog/app/org.example", "https://static.rustore.ru/a.apk"))
+        assertNull(foreign(SourceTypes.APTOIDE, "https://example.en.aptoide.com/app", "https://pool.apk.aptoide.com/a.apk"))
     }
 
     @Test
diff --git a/core/src/test/kotlin/io/github/munzzyy/tern/core/source/HonestIdentityTest.kt b/core/src/test/kotlin/io/github/munzzyy/tern/core/source/HonestIdentityTest.kt
new file mode 100644
index 00000000..4a1772af
--- /dev/null
+++ b/core/src/test/kotlin/io/github/munzzyy/tern/core/source/HonestIdentityTest.kt
@@ -0,0 +1,36 @@
+package io.github.munzzyy.tern.core.source
+
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertTrue
+import org.junit.Test
+import java.io.File
+
+/**
+ * Tern asks every source as itself: with the User-Agent PoliteHttp gives every request, never
+ * another app's, and never with a key or a signature lifted from another app. The sources are read
+ * as text, so that a new one that borrows another client's name fails here before anyone reviews it.
+ */
+class HonestIdentityTest {
+    private val sources = File("src/main/kotlin/io/github/munzzyy/tern/core/source")
+
+    private val forbidden = listOf(
+        Regex("\"User-Agent\"", RegexOption.IGNORE_CASE) to "sets its own User-Agent",
+        Regex("""Mac\.getInstance|HmacSHA|Signature\.getInstance""") to "signs requests",
+        Regex("""com\.huawei\.appmarket|com\.coolapk|ru\.vk\.store|com\.uptodown|com\.apkpure|Ual-Access""") to "names a store's own app",
+        Regex("""Pixel \d|SM-[A-Z]\d{3}""") to "names a device",
+    )
+
+    /** The fixed model the Galaxy Store is asked for, which PRIVACY.md names, and the list that refuses a User-Agent header. */
+    private val allowed = setOf("store/SamsungSource.kt" to "names a device", "web/RequestHeaders.kt" to "sets its own User-Agent")
+
+    @Test
+    fun noSourceBorrowsAnotherClientsIdentity() {
+        assertTrue("run from the core module", sources.isDirectory)
+        val found = sources.walkTopDown().filter { it.isFile && it.extension == "kt" }.flatMap { file ->
+            val name = file.relativeTo(sources).path
+            val text = file.readText()
+            forbidden.filter { (pattern, why) -> pattern.containsMatchIn(text) && (name to why) !in allowed }.map { "$name ${it.second}" }
+        }.toList()
+        assertEquals(emptyList<String>(), found)
+    }
+}
diff --git a/core/src/test/kotlin/io/github/munzzyy/tern/core/source/ReadAsTest.kt b/core/src/test/kotlin/io/github/munzzyy/tern/core/source/ReadAsTest.kt
index b39ed89e..67965b52 100644
--- a/core/src/test/kotlin/io/github/munzzyy/tern/core/source/ReadAsTest.kt
+++ b/core/src/test/kotlin/io/github/munzzyy/tern/core/source/ReadAsTest.kt
@@ -42,7 +42,7 @@ class ReadAsTest {
         assertNull(registry.readAs("https://example.org", SourceTypes.GITHUB, context()))
         assertNull(registry.readAs("https://github.com/settings/profile", SourceTypes.GITHUB, context()))
         assertNull(registry.readAs("https://example.org/owner/app", SourceTypes.VIVO, context()))
-        assertNull(registry.readAs("https://example.org/owner/app", SourceTypes.COOLAPK, context()))
+        assertNull(registry.readAs("https://example.org/owner/app", "coolapk", context()))
         assertNull(registry.readAs("https://example.org/owner/app", "nonsense", context()))
     }
 
diff --git a/core/src/test/kotlin/io/github/munzzyy/tern/core/source/SourceRegistryTest.kt b/core/src/test/kotlin/io/github/munzzyy/tern/core/source/SourceRegistryTest.kt
index 6e3c4e2f..d0b8c362 100644
--- a/core/src/test/kotlin/io/github/munzzyy/tern/core/source/SourceRegistryTest.kt
+++ b/core/src/test/kotlin/io/github/munzzyy/tern/core/source/SourceRegistryTest.kt
@@ -1,5 +1,7 @@
 package io.github.munzzyy.tern.core.source
 
+import io.github.munzzyy.tern.core.model.Asset
+import io.github.munzzyy.tern.core.model.SourceSpec
 import io.github.munzzyy.tern.core.net.Headers
 import io.github.munzzyy.tern.core.net.HttpResponse
 import io.github.munzzyy.tern.core.net.InMemoryValidatorStore
@@ -10,9 +12,11 @@ import io.github.munzzyy.tern.core.source.forge.GitLabSource
 import io.github.munzzyy.tern.core.testing.FakeHttp
 import io.github.munzzyy.tern.core.testing.Fixtures
 import org.junit.Assert.assertEquals
+import org.junit.Assert.assertFalse
 import org.junit.Assert.assertNull
 import org.junit.Assert.assertSame
 import org.junit.Assert.assertTrue
+import org.junit.Assert.fail
 import org.junit.Test
 
 class SourceRegistryTest {
@@ -41,7 +45,8 @@ class SourceRegistryTest {
     fun theSourcesThatRepublishAreTheOnesTheListNames() {
         val registry = SourceRegistry.standard()
         assertEquals(SourceTypes.REPUBLISHING, registry.sources.filter { it.republishes }.map { it.type }.toSet())
-        assertTrue(SourceTypes.REPUBLISHING.containsAll(SourceTypes.MODIFIED))
+        assertTrue(SourceTypes.TENCENT in SourceTypes.REPUBLISHING)
+        assertTrue(SourceTypes.THIRD_PARTY_STORES.containsAll(SourceTypes.REPUBLISHING))
         assertEquals(SourceTypes.TRACK_ONLY, registry.sources.filter { it.trackOnly }.map { it.type }.toSet())
     }
 
@@ -113,4 +118,100 @@ class SourceRegistryTest {
         val spec = reordered.match("github.com/example/app")
         assertEquals(SourceTypes.GITHUB, spec?.type)
     }
+
+    private fun refusedCheck(registry: SourceRegistry, spec: SourceSpec): SourceException {
+        try {
+            registry.check(spec, context(FakeHttp()))
+        } catch (e: SourceException) {
+            return e
+        }
+        fail("expected a refusal")
+        throw AssertionError()
+    }
+
+    @Test
+    fun sitesThatOfferModifiedAppsAreRefusedAndNeverReadAsPages() {
+        val registry = SourceRegistry.standard()
+        val http = FakeHttp()
+        for (url in listOf("https://liteapks.com/x.html", "https://apk4free.net/x/", "https://www.rockmods.net/apps/x", "https://www.farsroid.com/x/", "https://dl.farsroid.com/ap/x.apk")) {
+            assertEquals(url, SourceRegistry.Closed.Refused(Refusal.MODIFIED_APPS), registry.closed(url))
+            assertNull(url, registry.match(url))
+            assertNull(url, registry.detect(url, context(http)))
+            assertNull(url, registry.readAs(url, SourceTypes.HTML, context(http)))
+        }
+        assertEquals(emptyList<Any>(), http.requests)
+        val e = refusedCheck(registry, SourceSpec(SourceTypes.HTML, "https://liteapks.com/x.html"))
+        assertEquals(SourceErrorKind.UNSUPPORTED, e.kind)
+        assertEquals("Tern does not read sites that offer modified apps", e.message)
+    }
+
+    @Test
+    fun storesThatAnswerOnlyTheirOwnAppAreRefused() {
+        val registry = SourceRegistry.standard()
+        for (url in listOf("https://www.rustore.ru/catalog/app/org.example", "https://example.en.uptodown.com/android", "https://www.coolapk.com/apk/org.example")) {
+            assertEquals(url, SourceRegistry.Closed.Refused(Refusal.IMPERSONATION), registry.closed(url))
+            assertNull(url, registry.detect(url, context(FakeHttp())))
+        }
+        assertEquals("Tern cannot read this store without pretending to be its app", refusedCheck(registry, SourceSpec("rustore", "https://www.rustore.ru/catalog/app/org.example")).message)
+        assertTrue("no type Tern reads is one it refuses", SourceTypes.ALL.none { Refusal.ofType(it) != null })
+    }
+
+    @Test
+    fun withStoresOffAStoreAddressIsClosedAndNotReadAsAPage() {
+        val registry = SourceRegistry.standard(storesAllowed = { false })
+        val http = FakeHttp()
+        val page = "https://apkpure.com/example-app/org.example.app"
+        assertEquals(SourceRegistry.Closed.StoresOff(SourceTypes.APKPURE), registry.closed(page))
+        assertNull(registry.match(page))
+        assertNull(registry.detect(page, context(http)))
+        assertNull(registry.readAs(page, SourceTypes.HTML, context(http)))
+        assertNull(registry.readAs("https://example.org/app", SourceTypes.APKPURE, context(http)))
+        assertEquals(SourceRegistry.Closed.StoresOff(SourceTypes.APKPURE), registry.closed("https://d.apkpure.com/b/APK/org.example.app"))
+        assertEquals(SourceRegistry.Closed.StoresOff(SourceTypes.HUAWEI), registry.closed("appgallery.huawei.com/#/app/C100000000"))
+        assertEquals(emptyList<Any>(), http.requests)
+
+        assertNull("the developers' own channels stay open", registry.closed("https://examplelabs.itch.io/example-quest"))
+        assertEquals(SourceTypes.ITCHIO, registry.match("https://examplelabs.itch.io/example-quest")?.type)
+        assertEquals(SourceTypes.GITHUB, registry.match("https://github.com/owner/repo")?.type)
+    }
+
+    @Test
+    fun withStoresOffAStoreAppIsPausedAndAsksForNothing() {
+        var allowed = false
+        val registry = SourceRegistry.standard(storesAllowed = { allowed })
+        val spec = SourceSpec(SourceTypes.APKPURE, "https://apkpure.com/example-app/org.example.app", mapOf(SourceOptions.PACKAGE to "org.example.app"))
+        val asPage = SourceSpec(SourceTypes.HTML, "https://apkpure.com/example-app/org.example.app")
+        assertTrue(registry.paused(spec))
+        assertTrue(registry.paused(asPage))
+        assertFalse(registry.paused(SourceSpec(SourceTypes.GITHUB, "https://github.com/owner/repo")))
+        val http = FakeHttp()
+        for (paused in listOf(spec, asPage)) {
+            try {
+                registry.check(paused, context(http))
+                fail("expected a refusal")
+            } catch (e: SourceException) {
+                assertEquals(SourceErrorKind.UNSUPPORTED, e.kind)
+            }
+            try {
+                registry.resolve(paused, Asset("a.apk", "https://d.apkpure.com/b/APK/org.example.app?versionCode=1"), context(http))
+                fail("expected a refusal")
+            } catch (e: SourceException) {
+                assertEquals(SourceErrorKind.UNSUPPORTED, e.kind)
+            }
+        }
+        assertEquals(emptyList<Any>(), http.requests)
+
+        allowed = true
+        assertFalse(registry.paused(spec))
+        assertEquals(SourceTypes.APKPURE, registry.match(spec.url)?.type)
+    }
+
+    @Test
+    fun withStoresOffSearchLeavesThemOut() {
+        var allowed = false
+        val registry = SourceRegistry.standard(storesAllowed = { allowed })
+        assertTrue(registry.searchable.none { (it as Source).type in SourceTypes.THIRD_PARTY_STORES })
+        allowed = true
+        assertTrue(registry.searchable.any { (it as Source).type in SourceTypes.THIRD_PARTY_STORES })
+    }
 }
diff --git a/core/src/test/kotlin/io/github/munzzyy/tern/core/source/store/Apk4FreeSourceTest.kt b/core/src/test/kotlin/io/github/munzzyy/tern/core/source/store/Apk4FreeSourceTest.kt
deleted file mode 100644
index d6b5c0b2..00000000
--- a/core/src/test/kotlin/io/github/munzzyy/tern/core/source/store/Apk4FreeSourceTest.kt
+++ /dev/null
@@ -1,134 +0,0 @@
-package io.github.munzzyy.tern.core.source.store
-
-import io.github.munzzyy.tern.core.model.Asset
-import io.github.munzzyy.tern.core.model.SourceSpec
-import io.github.munzzyy.tern.core.net.InMemoryValidatorStore
-import io.github.munzzyy.tern.core.source.CheckContext
-import io.github.munzzyy.tern.core.source.CheckResult
-import io.github.munzzyy.tern.core.source.SourceErrorKind
-import io.github.munzzyy.tern.core.source.SourceException
-import io.github.munzzyy.tern.core.source.SourceListing
-import io.github.munzzyy.tern.core.testing.FakeHttp
-import io.github.munzzyy.tern.core.testing.Fixtures
-import org.junit.Assert.assertEquals
-import org.junit.Assert.assertFalse
-import org.junit.Assert.assertNull
-import org.junit.Assert.assertTrue
-import org.junit.Assert.fail
-import org.junit.Test
-
-class Apk4FreeSourceTest {
-    private val source = Apk4FreeSource()
-    private val page = "https://apk4free.net/example-notes/"
-    private val downloads = "https://apk4free.net/example-notes/download/"
-    private val spec = SourceSpec(source.type, page)
-    private val files = "https://apps.apk4free.net/example-notes"
-
-    private fun site(
-        app: String = Fixtures.text("store/apk4free_app.html"),
-        download: String = Fixtures.text("store/apk4free_download.html"),
-    ): FakeHttp = FakeHttp().text(page, app).text(downloads, download)
-
-    private fun listing(http: FakeHttp): SourceListing =
-        (source.check(spec, CheckContext(http, InMemoryValidatorStore())) as CheckResult.Listing).listing
-
-    private fun failure(http: FakeHttp): SourceException {
-        try {
-            source.check(spec, CheckContext(http, InMemoryValidatorStore()))
-        } catch (e: SourceException) {
-            return e
-        }
-        fail("expected a SourceException")
-        throw AssertionError()
-    }
-
-    @Test
-    fun matchesAnAppPageInItsCanonicalForm() {
-        for (url in listOf(page, "https://www.apk4free.net/example-notes", "http://apk4free.net/example-notes/download/", "apk4free.net/example-notes/?ref=1")) {
-            assertEquals(url, spec, source.match(url))
-        }
-    }
-
-    @Test
-    fun leavesOtherPagesAndHostsAlone() {
-        for (url in listOf(
-            "https://apk4free.net/",
-            "https://apk4free.net/apps/productivity/",
-            "https://apk4free.net/editors-choice/",
-            "https://apps.apk4free.net/example-notes/Example-Notes-v2.5.1-Mod.apk",
-            "https://apk4free.net.example.org/example-notes/",
-            "https://example.org/example-notes/",
-        )) {
-            assertNull(url, source.match(url))
-        }
-    }
-
-    @Test
-    fun groupsTheFilesOfTheDownloadPageByVersion() {
-        val http = site()
-        val listing = listing(http)
-        assertEquals("Example Notes", listing.name)
-        assertNull(listing.author)
-        assertEquals(listOf("2.6.0-beta2", "2.5.1", "2.4.9"), listing.releases.map { it.version })
-
-        val beta = listing.releases[0]
-        assertTrue(beta.prerelease)
-        assertEquals(listOf(Asset("Example-Notes-v2.6.0-beta2.apk", "$files/Example-Notes-v2.6.0-beta2.apk")), beta.assets)
-
-        val current = listing.releases[1]
-        assertEquals("2.5.1", current.id)
-        assertFalse(current.prerelease)
-        assertEquals("Example Notes v2.5.1 Premium APK", current.title)
-        assertEquals(1773150072000L, current.publishedAtMs)
-        assertEquals(page, current.pageUrl)
-        assertEquals(
-            listOf(
-                Asset("Example-Notes-v2.5.1-Mod.apk", "$files/Example-Notes-v2.5.1-Mod.apk"),
-                Asset("Example-Notes-v2.5.1-Mod-arm64-v8a.apk", "$files/Example-Notes-v2.5.1-Mod-arm64-v8a.apk"),
-                Asset("Example-Notes-Final.apk", "https://apk4free.net/example-notes/Example-Notes-Final.apk"),
-            ),
-            current.assets,
-        )
-
-        val older = listing.releases[2]
-        assertNull(older.publishedAtMs)
-        assertEquals(listOf("$files/Example-Notes-v2.4.9-Mod.apk"), older.assets.map { it.url })
-        assertEquals(listOf(page, downloads), http.requests.map { it.url })
-    }
-
-    @Test
-    fun aFileOnAnotherHostIsLeftOut() {
-        val urls = listing(site()).releases.flatMap { release -> release.assets.map { it.url } }
-        assertTrue(urls.none { it.contains("example.org") })
-        assertEquals(5, urls.size)
-    }
-
-    @Test
-    fun withoutButtonsAnyLinkToAnAppCounts() {
-        val plain = Fixtures.text("store/apk4free_download.html").replace("buttond downloadAPK dapk_b", "plain")
-        val versions = listing(site(download = plain)).releases.map { it.version }
-        assertEquals(listOf("2.6.0-beta2", "2.5.1", "2.4.9"), versions)
-    }
-
-    @Test
-    fun theVersionComesFromTheTitleWhenThePageNamesNoneApart() {
-        val app = Fixtures.text("store/apk4free_app.html").replace("<div class=\"version\">2.5.1</div>", "")
-        val download = """<a class="buttond downloadAPK" href="https://apps.apk4free.net/example-notes/Example-Notes-Final.apk">Example Notes Premium APK</a>"""
-        val release = listing(site(app, download)).releases.single()
-        assertEquals("2.5.1", release.version)
-    }
-
-    @Test
-    fun aPageWithoutDownloadsHasNoRelease() {
-        val app = Fixtures.text("store/apk4free_app.html").replace("https://apk4free.net/example-notes/download/", "https://apk4free.net/example-notes/#comments")
-        assertEquals(SourceErrorKind.NO_RELEASES, failure(FakeHttp().text(page, app)).kind)
-        val elsewhere = """<a class="buttond downloadAPK" href="https://files.example.org/Example-Notes-v2.5.1.apk">Mirror</a>"""
-        assertEquals(SourceErrorKind.NO_RELEASES, failure(site(download = elsewhere)).kind)
-    }
-
-    @Test
-    fun aMissingPageIsNotFoundAndAFailingOneIsANetworkProblem() {
-        assertEquals(SourceErrorKind.NOT_FOUND, failure(FakeHttp().text(page, "", status = 404)).kind)
-        assertEquals(SourceErrorKind.NETWORK, failure(FakeHttp().text(page, "", status = 500)).kind)
-    }
-}
diff --git a/core/src/test/kotlin/io/github/munzzyy/tern/core/source/store/ApkComboSourceTest.kt b/core/src/test/kotlin/io/github/munzzyy/tern/core/source/store/ApkComboSourceTest.kt
index 908a55aa..9258612d 100644
--- a/core/src/test/kotlin/io/github/munzzyy/tern/core/source/store/ApkComboSourceTest.kt
+++ b/core/src/test/kotlin/io/github/munzzyy/tern/core/source/store/ApkComboSourceTest.kt
@@ -81,7 +81,7 @@ class ApkComboSourceTest {
         assertEquals(listOf(AssetKind.APK, AssetKind.BUNDLE), release.assets.map { it.kind })
 
         assertEquals(listOf(page, downloads), http.requests.map { it.url })
-        assertTrue(http.requests.all { it.headers["User-Agent"] == "curl/8.0.1" && it.headers["Accept"] == "*/*" })
+        assertTrue("asked as Tern, which PoliteHttp names", http.requests.all { it.headers == mapOf("Accept" to "*/*") })
     }
 
     @Test
diff --git a/core/src/test/kotlin/io/github/munzzyy/tern/core/source/store/ApkMirrorSourceTest.kt b/core/src/test/kotlin/io/github/munzzyy/tern/core/source/store/ApkMirrorSourceTest.kt
index 29f59d65..72b89607 100644
--- a/core/src/test/kotlin/io/github/munzzyy/tern/core/source/store/ApkMirrorSourceTest.kt
+++ b/core/src/test/kotlin/io/github/munzzyy/tern/core/source/store/ApkMirrorSourceTest.kt
@@ -89,7 +89,7 @@ class ApkMirrorSourceTest {
         // The pages of the two releases that may be offered are asked for what they say; they cannot be read here.
         assertEquals(listOf(feed, betaPage, stablePage, page), http.requests.map { it.url })
         assertTrue(listing.releases.all { it.notes == null && it.fileSize == null })
-        assertTrue(http.requests.all { it.headers["User-Agent"] == "APKUpdater-v3.5.9 Tern" })
+        assertTrue("asked as Tern, which PoliteHttp names", http.requests.all { request -> request.headers.keys.none { it.equals("User-Agent", ignoreCase = true) } })
     }
 
     @Test
diff --git a/core/src/test/kotlin/io/github/munzzyy/tern/core/source/store/ApkPureSourceTest.kt b/core/src/test/kotlin/io/github/munzzyy/tern/core/source/store/ApkPureSourceTest.kt
index 4fd6aa1f..aec179a4 100644
--- a/core/src/test/kotlin/io/github/munzzyy/tern/core/source/store/ApkPureSourceTest.kt
+++ b/core/src/test/kotlin/io/github/munzzyy/tern/core/source/store/ApkPureSourceTest.kt
@@ -1,9 +1,7 @@
 package io.github.munzzyy.tern.core.source.store
 
-import io.github.munzzyy.tern.core.model.Asset
 import io.github.munzzyy.tern.core.model.AssetKind
 import io.github.munzzyy.tern.core.model.DeviceProfile
-import io.github.munzzyy.tern.core.model.NotesFormat
 import io.github.munzzyy.tern.core.model.SourceSpec
 import io.github.munzzyy.tern.core.net.InMemoryValidatorStore
 import io.github.munzzyy.tern.core.source.CheckContext
@@ -25,10 +23,13 @@ import java.time.Instant
 class ApkPureSourceTest {
     private val source = ApkPureSource()
     private val page = "https://apkpure.com/example-app/org.example.app"
-    private val history = "https://tapi.pureapk.com/v3/get_app_his_version?package_name=org.example.app&hl=en"
+    private val versions = "$page/versions"
+    private val download = "$page/download/2.1.0"
 
     private fun spec() = source.match(page)!!
 
+    private fun site() = FakeHttp().resource(versions, "store/apkpure_versions.html").resource(download, "store/apkpure_download.html")
+
     private fun check(http: FakeHttp, device: DeviceProfile? = null): SourceListing =
         (source.check(spec(), CheckContext(http, InMemoryValidatorStore(), device = device)) as CheckResult.Listing).listing
 
@@ -46,7 +47,7 @@ class ApkPureSourceTest {
         assertEquals(page, source.match("apkpure.com/example-app/org.example.app/download")?.url)
         assertEquals(page, source.match("https://m.apkpure.com/de/example-app/org.example.app/versions")?.url)
         assertEquals(page, source.match("https://www.apkpure.com/example-app/org.example.app")?.url)
-        assertEquals("https://apkpure.net/example-app/org.example.app", source.match("https://apkpure.net/example-app/org.example.app")?.url)
+        assertEquals(page, source.match("https://apkpure.net/example-app/org.example.app")?.url)
         assertEquals("https://apkpure.com/xy/org.example.app", source.match("https://apkpure.com/xy/org.example.app/download")?.url)
     }
 
@@ -61,118 +62,84 @@ class ApkPureSourceTest {
     }
 
     @Test
-    fun readsEachVersionWithItsVariants() {
-        val http = FakeHttp().resource(history, "store/apkpure_history.json")
-        val listing = check(http)
+    fun readsEachVersionWithItsBuildsFromTheSite() {
+        val listing = check(site())
 
         assertEquals("Example App", listing.name)
         assertEquals("Example Labs", listing.author)
         assertEquals("org.example.app", listing.packageName)
-        assertEquals("An invented app for tests.", listing.description)
-        assertEquals(listOf("2.1.0", "2.0.0", "1.9.0", "1.8.0"), listing.releases.map { it.version })
+        assertEquals("An invented app for tests & nothing else.", listing.description)
+        assertEquals("https://image.winudf.com/v2/image1/ZXhhbXBsZQ/icon.png?w=160&fakeurl=1", listing.iconUrl)
+        assertEquals(listOf("2.1.0", "2.0.0", "1.9.0", "1.4.0"), listing.releases.map { it.version })
 
         val newest = listing.releases[0]
         assertEquals("2.1.0", newest.id)
         assertEquals(210L, newest.versionCode)
-        assertEquals("• Faster start.<br>• Fewer crashes.", newest.notes)
-        assertEquals(NotesFormat.HTML, newest.notesFormat)
-        assertEquals(Instant.parse("2026-09-28T05:00:31Z").toEpochMilli(), newest.publishedAtMs)
+        assertEquals(Instant.parse("2026-09-28T00:00:00Z").toEpochMilli(), newest.publishedAtMs)
         assertEquals(page, newest.pageUrl)
-        assertEquals(
-            listOf("org.example.app-210-arm64-v8a.xapk", "org.example.app-210-arm64-v8a,armeabi-v7a,x86,x86_64.apk"),
-            newest.assets.map { it.name },
-        )
-        val bundle = newest.assets[0]
-        assertEquals("https://data.winudf.com/XAPK/b3JnLmV4YW1wbGUuYXBwXzIxMF9hYQ", bundle.url)
-        assertEquals(AssetKind.BUNDLE, bundle.kind)
-        assertEquals(51200000L, bundle.size)
-        assertEquals("abcdef01".repeat(8), bundle.sha256)
-        assertEquals(AssetKind.APK, newest.assets[1].kind)
-
-        val headers = http.requestsTo(history).single().headers
-        assertEquals("projecta", headers["Ual-Access-Businessid"])
-        assertEquals("""{"device_info":{"os_ver":"35"}}""", headers["Ual-Access-ProjectA"])
-    }
+        assertEquals(listOf("org.example.app-211-arm64-v8a.xapk", "org.example.app-210-armeabi-v7a.xapk"), newest.assets.map { it.name })
+        assertEquals("https://d.apkpure.com/b/XAPK/org.example.app?versionCode=211", newest.assets[0].url)
+        assertEquals(AssetKind.BUNDLE, newest.assets[0].kind)
+        assertNull("one size is given for several builds, so none is taken", newest.assets[0].size)
 
-    @Test
-    fun aVersionWhoseVariantsCarryDifferentCodesTakesTheLowest() {
-        val listing = check(FakeHttp().resource(history, "store/apkpure_history.json"))
-        val older = listing.releases.first { it.version == "2.0.0" }
-        assertEquals(200L, older.versionCode)
-        assertEquals("First release with sync.", older.notes)
-        assertEquals(2, older.assets.size)
+        val older = listing.releases[1]
+        assertEquals(listOf("org.example.app-200.apk"), older.assets.map { it.name })
+        assertEquals("https://d.apkpure.com/b/APK/org.example.app?versionCode=200", older.assets[0].url)
+        assertEquals(AssetKind.APK, older.assets[0].kind)
+        assertEquals(50000000L, older.assets[0].size)
     }
 
     @Test
-    fun onAKnownDeviceVariantsForOtherProcessorsAreLeftOut() {
-        val http = FakeHttp().resource(history, "store/apkpure_history.json")
-        val listing = check(http, DeviceProfile(listOf("arm64-v8a"), sdk = 34, densityDpi = 420))
-
-        assertEquals(listOf("2.1.0", "2.0.0", "1.8.0"), listing.releases.map { it.version })
-        val older = listing.releases[1]
-        assertEquals(listOf("org.example.app-201-arm64-v8a.xapk"), older.assets.map { it.name })
-        assertEquals(201L, older.versionCode)
-        assertEquals(listOf("org.example.app-180-universal.apk"), listing.releases[2].assets.map { it.name })
-        assertEquals("""{"device_info":{"os_ver":"34"}}""", http.requestsTo(history).single().headers["Ual-Access-ProjectA"])
+    fun aBuildOfAnotherPackageOrWithoutAnIdIsLeftOut() {
+        val listing = check(site())
+        assertTrue(listing.releases.none { it.version == "1.8.0" || it.version == "1.7.0" })
+        assertTrue(listing.releases.flatMap { it.assets }.all { it.url.startsWith("https://d.apkpure.com/b/") && "org.example.app?" in it.url })
     }
 
     @Test
-    fun aFileOnAnotherHostIsLeftOut() {
-        val listing = check(FakeHttp().resource(history, "store/apkpure_history.json"))
-        val addresses = listing.releases.flatMap { release -> release.assets.map { it.url } }
-        assertTrue(addresses.all { it.startsWith("https://data.winudf.com/") })
-        assertTrue(listing.releases[0].assets.none { it.name.contains("210-armeabi-v7a") })
+    fun onAKnownDeviceBuildsForOtherProcessorsAreLeftOut() {
+        val listing = check(site(), DeviceProfile(listOf("arm64-v8a"), sdk = 34, densityDpi = 420))
+        val newest = listing.releases[0]
+        assertEquals(listOf("org.example.app-211-arm64-v8a.xapk"), newest.assets.map { it.name })
+        assertEquals(211L, newest.versionCode)
     }
 
     @Test
-    fun anAppTheStoreDoesNotHaveIsNotFound() {
-        assertEquals(SourceErrorKind.NOT_FOUND, failure(FakeHttp().text(history, """{"retcode":0,"errmsg":"success","version_list":[]}""")))
-        assertEquals(SourceErrorKind.NOT_FOUND, failure(FakeHttp().text(history, "", status = 404)))
+    fun asksAsItselfAndOnlyForPages() {
+        val http = site()
+        check(http)
+        assertEquals(listOf(versions, download), http.requests.map { it.url })
+        assertTrue(http.requests.all { it.headers.isEmpty() && it.method == "GET" })
     }
 
     @Test
-    fun failuresOfTheStoreAreReported() {
-        assertEquals(SourceErrorKind.NETWORK, failure(FakeHttp().text(history, "", status = 503)))
-        assertEquals(SourceErrorKind.NETWORK, failure(FakeHttp().text(history, """{"retcode":403,"errmsg":"denied"}""")))
-        assertEquals(SourceErrorKind.PARSE, failure(FakeHttp().text(history, "<html>")))
+    fun theDownloadPageIsReadOnlyWhenTheNewestVersionHasSeveralBuilds() {
+        val single = """<div class="ver_download_link" data-dt-version="3.0.0" data-dt-apkid="b/APK/b3JnLmV4YW1wbGUuYXBwXzMwMF8wMGFi" data-dt-filesize="7"></div>"""
+        val http = FakeHttp().text(versions, single)
+        val listing = check(http)
+        assertEquals(listOf(versions), http.requests.map { it.url })
+        assertEquals(300L, listing.releases.single().versionCode)
+        assertEquals(7L, listing.releases.single().assets.single().size)
     }
 
     @Test
-    fun noVersionWithAFileForTheDeviceIsNoRelease() {
-        val body = """{"retcode":0,"version_list":[{"package_name":"org.example.app","version_code":"5","version_name":"0.5",
-            "native_code":["x86"],"asset":{"type":"APK","url":"https://data.winudf.com/APK/eA?token=1"}}]}"""
-        val http = FakeHttp().text(history, body)
-        try {
-            source.check(spec(), CheckContext(http, InMemoryValidatorStore(), device = DeviceProfile.ARM64_PHONE))
-            fail("expected SourceException")
-        } catch (e: SourceException) {
-            assertEquals(SourceErrorKind.NO_RELEASES, e.kind)
-        }
+    fun anAppTheStoreDoesNotHaveIsNotFound() {
+        assertEquals(SourceErrorKind.NOT_FOUND, failure(FakeHttp().text(versions, "", status = 404)))
+        assertEquals(SourceErrorKind.NOT_FOUND, failure(FakeHttp().text(versions, "<html><body>Nothing here</body></html>")))
     }
 
     @Test
-    fun aDownloadIsResolvedToTheAddressTheStoreHandsOutNow() {
-        val http = FakeHttp().resource(history, "store/apkpure_history.json")
-        val context = CheckContext(http, InMemoryValidatorStore())
-        val asset = check(http).releases[0].assets[0]
-
-        val download = SourceRegistry(listOf(source)).resolve(spec(), asset, context)
-        assertEquals(
-            "https://data.winudf.com/XAPK/b3JnLmV4YW1wbGUuYXBwXzIxMF9hYQ?filename=Example.xapk&k=0a1b&package_name=org.example.app&token=1790729950-aa-0-bb",
-            download.url,
-        )
-        assertTrue(download.headers.isEmpty())
+    fun failuresOfTheStoreAreReported() {
+        assertEquals(SourceErrorKind.NETWORK, failure(FakeHttp().text(versions, "", status = 503)))
+        assertEquals(SourceErrorKind.NETWORK, failure(FakeHttp().text(versions, "", status = 403)))
     }
 
     @Test
-    fun aFileTheStoreNoLongerOffersCannotBeResolved() {
-        val http = FakeHttp().resource(history, "store/apkpure_history.json")
-        val gone = Asset("org.example.app-100.apk", "https://data.winudf.com/APK/b3JnLmV4YW1wbGUuYXBwXzEwMA")
-        try {
-            source.resolve(spec(), gone, CheckContext(http, InMemoryValidatorStore()))
-            fail("expected SourceException")
-        } catch (e: SourceException) {
-            assertEquals(SourceErrorKind.NOT_FOUND, e.kind)
-        }
+    fun aDownloadIsFetchedFromTheAddressItIsListedAt() {
+        val http = site()
+        val asset = check(http).releases[0].assets[0]
+        val resolved = SourceRegistry(listOf(source)).resolve(spec(), asset, CheckContext(http, InMemoryValidatorStore()))
+        assertEquals(asset.url, resolved.url)
+        assertTrue(resolved.headers.isEmpty())
     }
 }
diff --git a/core/src/test/kotlin/io/github/munzzyy/tern/core/source/store/CoolApkSourceTest.kt b/core/src/test/kotlin/io/github/munzzyy/tern/core/source/store/CoolApkSourceTest.kt
deleted file mode 100644
index 4d96aba5..00000000
--- a/core/src/test/kotlin/io/github/munzzyy/tern/core/source/store/CoolApkSourceTest.kt
+++ /dev/null
@@ -1,159 +0,0 @@
-package io.github.munzzyy.tern.core.source.store
-
-import io.github.munzzyy.tern.core.model.Asset
-import io.github.munzzyy.tern.core.model.NotesFormat
-import io.github.munzzyy.tern.core.net.Headers
-import io.github.munzzyy.tern.core.net.HttpResponse
-import io.github.munzzyy.tern.core.net.InMemoryValidatorStore
-import io.github.munzzyy.tern.core.source.CheckContext
-import io.github.munzzyy.tern.core.source.CheckResult
-import io.github.munzzyy.tern.core.source.SourceErrorKind
-import io.github.munzzyy.tern.core.source.SourceException
-import io.github.munzzyy.tern.core.source.SourceListing
-import io.github.munzzyy.tern.core.source.SourceOptions
-import io.github.munzzyy.tern.core.testing.FakeHttp
-import io.github.munzzyy.tern.core.testing.Fixtures
-import org.junit.Assert.assertEquals
-import org.junit.Assert.assertFalse
-import org.junit.Assert.assertNull
-import org.junit.Assert.assertTrue
-import org.junit.Assert.fail
-import org.junit.Test
-
-class CoolApkSourceTest {
-    private val source = CoolApkSource()
-    private val canonical = "https://www.coolapk.com/apk/org.example.app"
-    private val detailUrl = "https://api2.coolapk.com/v6/apk/detail?id=org.example.app"
-    private val fileUrl = "https://api2.coolapk.com/v6/apk/download?pn=org.example.app&aid=4242&vc=20001"
-    private val now = 1790730000123L
-
-    private fun context(http: FakeHttp) = CheckContext(http, InMemoryValidatorStore(), nowMs = { now })
-
-    private fun listing(http: FakeHttp): SourceListing = (source.check(source.match(canonical)!!, context(http)) as CheckResult.Listing).listing
-
-    @Test
-    fun bcryptMatchesTheReferenceHashes() {
-        val vectors = listOf(
-            Triple("", "\$2a\$06\$DCq7YPn5Rq63x1Lad4cll.", "\$2a\$06\$DCq7YPn5Rq63x1Lad4cll.TV4S6ytwfsfvkgY8jIucDrjc8deX1s."),
-            Triple("a", "\$2a\$06\$m0CrhHm10qJ3lXRY.5zDGO", "\$2a\$06\$m0CrhHm10qJ3lXRY.5zDGO3rS2KdeeWLuGmsfGlMfOxih58VYVfxe"),
-            Triple("abc", "\$2a\$06\$If6bvum7DFjUnE9p2uDeDu", "\$2a\$06\$If6bvum7DFjUnE9p2uDeDu0YHzrHM6tf.iqN8.yx.jNN1ILEf7h0i"),
-            Triple("abcdefghijklmnopqrstuvwxyz", "\$2a\$06\$.rCVZVOThsIa97pEDOxvGu", "\$2a\$06\$.rCVZVOThsIa97pEDOxvGuRRgzG64bvtJ0938xuqzv18d3ZpQhstC"),
-            Triple("~!@#\$%^&*()      ~!@#\$%^&*()PNBFRD", "\$2a\$06\$fPIsBO8qRqkjj273rfaOI.", "\$2a\$06\$fPIsBO8qRqkjj273rfaOI.HtSV9jLDpTbZn782DC6/t7qT67P6FfO"),
-            Triple("0123456789abcdef0123456789abcdef", "\$2a\$04\$MTc5MDczMDAwMA/abcdefu", "\$2a\$04\$MTc5MDczMDAwMA/abcdefubVmFYtUjLn5uGxj3pI5U2Vf/2L9CcLK"),
-        )
-        for ((password, salt, expected) in vectors) assertEquals(password, expected, Bcrypt.hash(password, salt))
-    }
-
-    @Test
-    fun theTokenIsMadeAsCoolApksAppMakesIt() {
-        val device = CoolApkToken.deviceCode(ByteArray(16) { (0x10 + it).toByte() }, byteArrayOf(0x0a, 0x1b, 0x2c, 0x3d, 0x4e, 0x5f))
-        assertEquals(
-            "MTAxMTEyMTMxNDE1MTYxNzE4MTkxQTFCMUMxRDFFMUY7IDsgOyAwYToxYjoyYzozZDo0ZTo1ZjsgR29vZ2xlOyBHb29nbGU7IFBpeGVsIDVhOyBTUTFELjIyMDEwNS4wMDc=",
-            device,
-        )
-        assertEquals(
-            "v2JDJ5JDEwJE1UYzVNRGN6TURBd01BL2ZjNGQ4ZHVWeXhqOHBGMW5jY1ZRR0ZRZUFTeGh6TWhObC42czJ1",
-            CoolApkToken.token(1790730000, device),
-        )
-    }
-
-    @Test
-    fun matchesTheAppPage() {
-        for (url in listOf(canonical, "https://coolapk.com/apk/org.example.app", "http://www.coolapk.com/apk/org.example.app?from=share")) {
-            val spec = source.match(url)
-            assertEquals(url, canonical, spec?.url)
-            assertEquals(url, "org.example.app", spec?.option(SourceOptions.PACKAGE))
-        }
-    }
-
-    @Test
-    fun leavesOtherAddressesAlone() {
-        assertNull(source.match("https://www.coolapk.com/feed/12345"))
-        assertNull(source.match("https://www.coolapk.com/apk/"))
-        assertNull(source.match("https://www.coolapk.com/apk/4242"))
-        assertNull(source.match("https://coolapk.com.example.org/apk/org.example.app"))
-        assertNull(source.match("https://example.com/apk/org.example.app"))
-    }
-
-    @Test
-    fun readsTheRecordWithTheAppsHeaders() {
-        val http = FakeHttp().resource(detailUrl, "store/coolapk-detail.json")
-        val listing = listing(http)
-        val headers = http.requestsTo(detailUrl).single().headers
-        assertEquals("com.coolapk.market", headers["X-App-Id"])
-        assertTrue(headers["User-Agent"]!!.endsWith("+CoolMarket/12.4.2-2208241-universal"))
-        assertTrue(headers["X-App-Token"]!!.startsWith("v2"))
-        assertTrue(headers["X-App-Device"]!!.isNotEmpty())
-        assertEquals("Example App", listing.name)
-        assertEquals("Example Labs", listing.author)
-        assertEquals("org.example.app", listing.packageName)
-        assertEquals("An app for trying things out", listing.description)
-        val release = listing.releases.single()
-        assertEquals("2.0.1", release.version)
-        assertEquals(20001L, release.versionCode)
-        assertEquals("20001", release.id)
-        assertEquals(1790675588000L, release.publishedAtMs)
-        assertEquals("Fixed a crash when opening the settings\r\nStarts faster", release.notes)
-        assertEquals(NotesFormat.PLAIN, release.notesFormat)
-        assertEquals(canonical, release.pageUrl)
-        val asset = release.assets.single()
-        assertEquals("org.example.app_2.0.1.apk", asset.name)
-        assertEquals(fileUrl, asset.url)
-        assertEquals(5452595L, asset.size)
-    }
-
-    @Test
-    fun anAppCoolApkDoesNotKnowIsNotFound() {
-        val http = FakeHttp().text(detailUrl, """{"status":-2,"error":-2,"message":"not found","messageStatus":-2}""")
-        assertFailure(SourceErrorKind.NOT_FOUND) { listing(http) }
-    }
-
-    @Test
-    fun aRefusalIsANetworkProblem() {
-        assertFailure(SourceErrorKind.NETWORK) { listing(FakeHttp().text(detailUrl, """{"status":-1,"message":"refused"}""")) }
-        assertFailure(SourceErrorKind.NETWORK) { listing(FakeHttp().text(detailUrl, "<html></html>", status = 567)) }
-    }
-
-    @Test
-    fun anAnswerForAnotherPackageIsRefused() {
-        val json = Fixtures.text("store/coolapk-detail.json").replace("\"org.example.app\"", "\"org.example.other\"")
-        assertFailure(SourceErrorKind.PARSE) { listing(FakeHttp().text(detailUrl, json)) }
-    }
-
-    @Test
-    fun resolveReadsWhereTheDownloadAddressPoints() {
-        val location = "https://dl.coolapk.com/down?pn=org.example.app&id=4242&v=NDI0Mg&type=apk&from=market-v12&vc=20001&nd=0&h=0123abcd"
-        val http = FakeHttp().on(fileUrl) { HttpResponse.of(302, "", Headers.of("Location" to location), fileUrl) }
-        val download = source.resolve(source.match(canonical)!!, Asset("org.example.app_2.0.1.apk", fileUrl), context(http))
-        assertEquals(location, download.url)
-        val request = http.requestsTo(fileUrl).single()
-        assertFalse(request.followRedirects)
-        assertTrue(request.headers["X-App-Token"]!!.startsWith("v2"))
-        assertTrue(download.headers.isEmpty())
-    }
-
-    @Test
-    fun resolveRefusesAFileOnAnotherHost() {
-        val http = FakeHttp().on(fileUrl) { HttpResponse.of(302, "", Headers.of("Location" to "https://files.example.org/example.apk"), fileUrl) }
-        assertFailure(SourceErrorKind.PARSE) { source.resolve(source.match(canonical)!!, Asset("org.example.app_2.0.1.apk", fileUrl), context(http)) }
-        val plain = FakeHttp().on(fileUrl) { HttpResponse.of(302, "", Headers.of("Location" to "http://dl.coolapk.com/down?pn=org.example.app"), fileUrl) }
-        assertFailure(SourceErrorKind.PARSE) { source.resolve(source.match(canonical)!!, Asset("org.example.app_2.0.1.apk", fileUrl), context(plain)) }
-    }
-
-    @Test
-    fun resolveOnlyAsksTheStoresOwnAddress() {
-        val http = FakeHttp()
-        val foreign = Asset("example.apk", "https://api2.coolapk.com/v6/apk/download?pn=org.example.other&aid=4242")
-        assertFailure(SourceErrorKind.PARSE) { source.resolve(source.match(canonical)!!, foreign, context(http)) }
-        assertEquals(emptyList<String>(), http.requests.map { it.url })
-    }
-
-    private fun assertFailure(kind: SourceErrorKind, block: () -> Unit) {
-        try {
-            block()
-            fail("expected a SourceException of kind $kind")
-        } catch (e: SourceException) {
-            assertEquals(e.message, kind, e.kind)
-        }
-    }
-}
diff --git a/core/src/test/kotlin/io/github/munzzyy/tern/core/source/store/FarsroidSourceTest.kt b/core/src/test/kotlin/io/github/munzzyy/tern/core/source/store/FarsroidSourceTest.kt
deleted file mode 100644
index 5fd5cdce..00000000
--- a/core/src/test/kotlin/io/github/munzzyy/tern/core/source/store/FarsroidSourceTest.kt
+++ /dev/null
@@ -1,108 +0,0 @@
-package io.github.munzzyy.tern.core.source.store
-
-import io.github.munzzyy.tern.core.model.SourceSpec
-import io.github.munzzyy.tern.core.net.InMemoryValidatorStore
-import io.github.munzzyy.tern.core.source.CheckContext
-import io.github.munzzyy.tern.core.source.CheckResult
-import io.github.munzzyy.tern.core.source.SourceErrorKind
-import io.github.munzzyy.tern.core.source.SourceException
-import io.github.munzzyy.tern.core.source.SourceListing
-import io.github.munzzyy.tern.core.source.SourceTypes
-import io.github.munzzyy.tern.core.testing.FakeHttp
-import io.github.munzzyy.tern.core.testing.Fixtures
-import org.junit.Assert.assertEquals
-import org.junit.Assert.assertNull
-import org.junit.Assert.fail
-import org.junit.Test
-
-class FarsroidSourceTest {
-    private val source = FarsroidSource()
-    private val page = "https://www.farsroid.com/example-app"
-    private val box = "https://www.farsroid.com/api/download-box/?post_id=4242&post_version=2.1.0"
-
-    private fun spec() = SourceSpec(SourceTypes.FARSROID, page)
-
-    private fun context(http: FakeHttp) = CheckContext(http, InMemoryValidatorStore())
-
-    private fun check(http: FakeHttp): SourceListing = (source.check(spec(), context(http)) as CheckResult.Listing).listing
-
-    private fun failure(http: FakeHttp): SourceErrorKind = try {
-        source.check(spec(), context(http))
-        fail("expected SourceException")
-        error("unreachable")
-    } catch (e: SourceException) {
-        e.kind
-    }
-
-    @Test
-    fun matchesAnAppPost() {
-        assertEquals(SourceSpec(SourceTypes.FARSROID, page), source.match("https://www.farsroid.com/example-app/"))
-        assertEquals(page, source.match("http://farsroid.com/example-app/#download")?.url)
-        assertEquals("https://www.farsroid.com/%D9%86%D9%85%D9%88%D9%86%D9%87", source.match("https://www.farsroid.com/%D9%86%D9%85%D9%88%D9%86%D9%87/")?.url)
-    }
-
-    @Test
-    fun leavesOtherAddressesAlone() {
-        assertNull(source.match("https://www.farsroid.com/"))
-        assertNull(source.match("https://www.farsroid.com/api/download-box/?post_id=4242"))
-        assertNull(source.match("https://www.farsroid.com/category/games/"))
-        assertNull(source.match("https://dl2.farsroid.com/app/Example-App.apk"))
-        assertNull(source.match("https://www.farsroid.com/app/Example-App.apk"))
-        assertNull(source.match("https://example.org/example-app"))
-        assertNull(source.match("https://www.farsroid.com.example.org/example-app"))
-    }
-
-    @Test
-    fun readsTheFilesOfTheDownloadBox() {
-        val http = FakeHttp().resource(page, "store/farsroid_page.html").resource(box, "store/farsroid_box.json")
-        val release = check(http).releases.single()
-
-        assertEquals("2.1.0", release.id)
-        assertEquals("2.1.0", release.version)
-        assertEquals(page, release.pageUrl)
-        assertEquals(
-            listOf(
-                "https://dl2.farsroid.com/app/Example-App-2.1.0-arm64-v8a(www.farsroid.com).apk",
-                "https://dl2.farsroid.com/app/Example-App-2.1.0-armeabi-v7a(www.farsroid.com).apk",
-                "https://www.farsroid.com/app/Example%20App%202.1.0%20(Mod).apk",
-            ),
-            release.assets.map { it.url },
-        )
-        assertEquals(
-            listOf("Example-App-2.1.0-arm64-v8a(www.farsroid.com).apk", "Example-App-2.1.0-armeabi-v7a(www.farsroid.com).apk", "Example App 2.1.0 (Mod).apk"),
-            release.assets.map { it.name },
-        )
-        assertEquals(listOf(page, box), http.requests.map { it.url })
-    }
-
-    @Test
-    fun aFileOnAnotherHostIsLeftOut() {
-        val http = FakeHttp().resource(page, "store/farsroid_page.html").resource(box, "store/farsroid_box.json")
-        val addresses = check(http).releases.single().assets.map { it.url }
-        assertEquals(emptyList<String>(), addresses.filter { "example.org" in it || it.startsWith("http:") || it.endsWith(".zip") })
-    }
-
-    @Test
-    fun theVersionIsSentAsPartOfTheAddress() {
-        val html = Fixtures.text("store/farsroid_page.html").replace("data-post-version=\"2.1.0\"", "data-post-version=\"2.1.0 beta&amp;1\"")
-        val encoded = "https://www.farsroid.com/api/download-box/?post_id=4242&post_version=2.1.0%20beta%261"
-        val http = FakeHttp().text(page, html).resource(encoded, "store/farsroid_box.json")
-        assertEquals("2.1.0 beta&1", check(http).releases.single().version)
-    }
-
-    @Test
-    fun aPageWithoutADownloadBoxHasNoRelease() {
-        assertEquals(SourceErrorKind.NO_RELEASES, failure(FakeHttp().text(page, "<html><body>Example App</body></html>")))
-        assertEquals(SourceErrorKind.NO_RELEASES, failure(FakeHttp().text(page, """<ul class="download-links" data-post-id="4242"></ul>""")))
-        assertEquals(SourceErrorKind.NO_RELEASES, failure(FakeHttp().text(page, """<ul class="download-links" data-post-id="../1" data-post-version="2.1.0"></ul>""")))
-        val empty = FakeHttp().resource(page, "store/farsroid_page.html").text(box, """{"data":{"content":""}}""")
-        assertEquals(SourceErrorKind.NO_RELEASES, failure(empty))
-    }
-
-    @Test
-    fun failuresAreReported() {
-        assertEquals(SourceErrorKind.NOT_FOUND, failure(FakeHttp().text(page, "", status = 404)))
-        assertEquals(SourceErrorKind.NETWORK, failure(FakeHttp().resource(page, "store/farsroid_page.html").text(box, "", status = 500)))
-        assertEquals(SourceErrorKind.PARSE, failure(FakeHttp().resource(page, "store/farsroid_page.html").text(box, "<html>")))
-    }
-}
diff --git a/core/src/test/kotlin/io/github/munzzyy/tern/core/source/store/HuaweiSourceTest.kt b/core/src/test/kotlin/io/github/munzzyy/tern/core/source/store/HuaweiSourceTest.kt
index 5f81e8e5..ab827cd5 100644
--- a/core/src/test/kotlin/io/github/munzzyy/tern/core/source/store/HuaweiSourceTest.kt
+++ b/core/src/test/kotlin/io/github/munzzyy/tern/core/source/store/HuaweiSourceTest.kt
@@ -104,13 +104,13 @@ class HuaweiSourceTest {
     }
 
     @Test
-    fun sendsASortedFormAsTheAppGalleryAppDoes() {
+    fun sendsASortedFormAsTern() {
         val http = serve(FakeHttp(), europe, detailStore())
         listing(HuaweiSource(), http)
         val detail = http.requests.single { method(it) == "client.appDetailById" }
         assertEquals("POST", detail.method)
         assertEquals("application/x-www-form-urlencoded", detail.headers["Content-Type"])
-        assertEquals("HiSpace##16.5.1.301##google##Pixel 8 Pro", detail.headers["User-Agent"])
+        assertEquals(setOf("Content-Type", "Accept"), detail.headers.keys)
         val fields = form(detail)
         assertEquals(fields.map { it.first }.sorted(), fields.map { it.first })
         val values = fields.toMap()
@@ -121,6 +121,18 @@ class HuaweiSourceTest {
         assertEquals(values["deviceId"], form(http.requests.first()).toMap()["deviceId"])
     }
 
+    @Test
+    fun saysNothingAboutTheDeviceAndDoesNotPassForTheAppGalleryApp() {
+        val http = serve(FakeHttp(), europe, detailStore())
+        listing(HuaweiSource(), http)
+        val allowed = setOf("ver", "locale", "serviceType", "ts", "deviceId", "deviceIdType", "method", "needServiceZone", "sign", "id")
+        for (request in http.requests) {
+            val fields = form(request).toMap()
+            assertEquals(emptySet<String>(), fields.keys - allowed)
+            assertTrue(request.headers.keys.none { it.equals("User-Agent", ignoreCase = true) })
+        }
+    }
+
     @Test
     fun keepsTheHandshakeForADay() {
         val source = HuaweiSource()
diff --git a/core/src/test/kotlin/io/github/munzzyy/tern/core/source/store/ItchIoSourceTest.kt b/core/src/test/kotlin/io/github/munzzyy/tern/core/source/store/ItchIoSourceTest.kt
index ce037a36..31848b77 100644
--- a/core/src/test/kotlin/io/github/munzzyy/tern/core/source/store/ItchIoSourceTest.kt
+++ b/core/src/test/kotlin/io/github/munzzyy/tern/core/source/store/ItchIoSourceTest.kt
@@ -1,6 +1,7 @@
 package io.github.munzzyy.tern.core.source.store
 
 import io.github.munzzyy.tern.core.model.Asset
+import io.github.munzzyy.tern.core.model.AssetKind
 import io.github.munzzyy.tern.core.model.SourceSpec
 import io.github.munzzyy.tern.core.net.Headers
 import io.github.munzzyy.tern.core.net.HttpRequest
@@ -108,23 +109,29 @@ class ItchIoSourceTest {
         assertEquals(base, release.pageUrl)
         assertEquals(
             listOf(
-                Asset("ExampleQuest-2.3.0.apk", "$base/download/1002", size = 12345678L),
+                Asset("Example Quest for Android", "$base/download/1002", kind = AssetKind.APK),
+                Asset("Example Quest (mirror)", "$base/download/1003", kind = AssetKind.APK),
                 Asset("example-quest-arm64.apk", "$base/download/1004"),
             ),
             release.assets,
         )
 
-        val posts = http.requests.filter { it.method == "POST" }
-        assertEquals(listOf("$base/download_url", fileEndpoint(1002), fileEndpoint(1003), fileEndpoint(1004)), posts.map { it.url })
-        for (post in posts) {
-            assertEquals("""{"csrf_token":"$token"}""", String(post.body!!, Charsets.UTF_8))
-            assertEquals("application/json", post.headers["Content-Type"])
-            assertEquals("XMLHttpRequest", post.headers["X-Requested-With"])
-        }
-        assertEquals("$base/download/1002", posts[1].headers["Referer"])
+        val post = http.requests.single { it.method == "POST" }
+        assertEquals("$base/download_url", post.url)
+        assertEquals("""{"csrf_token":"$token"}""", String(post.body!!, Charsets.UTF_8))
+        assertEquals("application/json", post.headers["Content-Type"])
+        assertEquals("XMLHttpRequest", post.headers["X-Requested-With"])
         assertTrue("no cookie is ever sent", http.requests.none { request -> request.headers.keys.any { it.equals("Cookie", ignoreCase = true) } })
     }
 
+    @Test
+    fun aCheckAsksForNoFile() {
+        val http = game()
+        listing(http)
+        assertEquals(listOf("GET $base", "POST $base/download_url", "GET $downloadPage"), http.requests.map { "${it.method} ${it.url}" })
+        assertTrue(http.requests.none { "/file/" in it.url || it.url.startsWith(fileStore) })
+    }
+
     @Test
     fun aFreeGameIsReadFromItsOwnPage() {
         val page = """
@@ -166,20 +173,6 @@ class ItchIoSourceTest {
         assertEquals(SourceErrorKind.NO_RELEASES, failure(FakeHttp().text(base, page)).kind)
     }
 
-    @Test
-    fun anAndroidFileKeptOnAnotherSiteIsLeftOut() {
-        val page = """
-            <html><head><meta name="csrf_token" value="$token"/></head><body><div class="page_widget">
-            <div class="upload"><a class="download_btn" data-upload_id="1003">Download</a>
-            <strong class="name" title="Example Quest (mirror)">Example Quest (mirror)</strong>
-            <span class="download_platforms"><span class="icon icon-android"></span></span></div></div></body></html>
-        """.trimIndent()
-        val http = FakeHttp().text(base, page)
-            .on(fileEndpoint(1003), json(fileEndpoint(1003), """{"external":true,"url":"https://files.example.org/ExampleQuest.apk"}"""))
-        assertEquals(SourceErrorKind.NO_RELEASES, failure(http).kind)
-        assertTrue(http.requests.none { it.url.startsWith("https://files.example.org") })
-    }
-
     @Test
     fun aMissingGameIsNotFoundAndAFailingPageIsANetworkProblem() {
         assertEquals(SourceErrorKind.NOT_FOUND, failure(FakeHttp().text(base, "", status = 404)).kind)
diff --git a/core/src/test/kotlin/io/github/munzzyy/tern/core/source/store/LiteApksSourceTest.kt b/core/src/test/kotlin/io/github/munzzyy/tern/core/source/store/LiteApksSourceTest.kt
deleted file mode 100644
index 9c74697a..00000000
--- a/core/src/test/kotlin/io/github/munzzyy/tern/core/source/store/LiteApksSourceTest.kt
+++ /dev/null
@@ -1,120 +0,0 @@
-package io.github.munzzyy.tern.core.source.store
-
-import io.github.munzzyy.tern.core.model.Asset
-import io.github.munzzyy.tern.core.model.SourceSpec
-import io.github.munzzyy.tern.core.net.InMemoryValidatorStore
-import io.github.munzzyy.tern.core.source.CheckContext
-import io.github.munzzyy.tern.core.source.CheckResult
-import io.github.munzzyy.tern.core.source.SourceErrorKind
-import io.github.munzzyy.tern.core.source.SourceException
-import io.github.munzzyy.tern.core.source.SourceListing
-import io.github.munzzyy.tern.core.source.SourceRegistry
-import io.github.munzzyy.tern.core.testing.FakeHttp
-import io.github.munzzyy.tern.core.testing.Fixtures
-import org.junit.Assert.assertEquals
-import org.junit.Assert.assertNull
-import org.junit.Assert.assertTrue
-import org.junit.Assert.fail
-import org.junit.Test
-
-class LiteApksSourceTest {
-    private val source = LiteApksSource()
-    private val page = "https://liteapks.com/example-app.html"
-    private val spec = SourceSpec(source.type, page)
-    private val search = "https://liteapks.com/wp-json/wp/v2/posts?slug=example-app"
-    private val record = "https://liteapks.com/wp-json/v2/posts/4321"
-
-    private fun site(post: String = Fixtures.text("store/liteapks_post.json")): FakeHttp =
-        FakeHttp().resource(search, "store/liteapks_posts.json").text(record, post)
-
-    private fun listing(http: FakeHttp): SourceListing =
-        (source.check(spec, CheckContext(http, InMemoryValidatorStore())) as CheckResult.Listing).listing
-
-    private fun failure(http: FakeHttp): SourceException {
-        try {
-            source.check(spec, CheckContext(http, InMemoryValidatorStore()))
-        } catch (e: SourceException) {
-            return e
-        }
-        fail("expected a SourceException")
-        throw AssertionError()
-    }
-
-    @Test
-    fun matchesAnAppPageInItsCanonicalForm() {
-        for (url in listOf(page, "https://www.liteapks.com/example-app.html", "liteapks.com/example-app", "http://liteapks.com/example-app.html/amp?x=1")) {
-            assertEquals(url, spec, source.match(url))
-        }
-    }
-
-    @Test
-    fun leavesOtherPagesAndHostsAlone() {
-        for (url in listOf(
-            "https://liteapks.com/",
-            "https://liteapks.com/category/apps",
-            "https://liteapks.com/download/example-app-4321",
-            "https://liteapks.com/example%20app.html",
-            "https://liteapks.com.example.org/example-app.html",
-            "https://example.org/example-app.html",
-        )) {
-            assertNull(url, source.match(url))
-        }
-    }
-
-    @Test
-    fun readsTheNewestVersionAndItsDownloadsThroughTheApi() {
-        val http = site()
-        val listing = listing(http)
-        assertEquals("Example App & Friends", listing.name)
-        assertEquals("Example Labs", listing.author)
-        val release = listing.releases.single()
-        assertEquals("5.6.1", release.version)
-        assertEquals("5.6.1", release.id)
-        assertEquals(page, release.pageUrl)
-        assertEquals(listOf(Asset("Example App-5.6.1-mod.apk", "https://dl.liteapks.com/files/Example%20App-5.6.1-mod.apk")), release.assets)
-        assertEquals(listOf(search, record), http.requests.map { it.url })
-        assertTrue("each request names itself as where it comes from", http.requests.all { it.headers["Referer"] == it.url })
-    }
-
-    @Test
-    fun aSlugTheSiteDoesNotKnowIsNotFound() {
-        val http = FakeHttp().text(search, "[]")
-        assertEquals(SourceErrorKind.NOT_FOUND, failure(http).kind)
-    }
-
-    @Test
-    fun answersThatCannotBeReadAreSaidSo() {
-        assertEquals(SourceErrorKind.NOT_FOUND, failure(FakeHttp().text(search, "", status = 404)).kind)
-        assertEquals(SourceErrorKind.NETWORK, failure(FakeHttp().text(search, "<html>Just a moment...</html>", status = 403)).kind)
-        assertEquals(SourceErrorKind.PARSE, failure(FakeHttp().text(search, "<html>not json</html>")).kind)
-        assertEquals(SourceErrorKind.PARSE, failure(site("""{"data":{"title":"Example App","versions":[]}}""")).kind)
-    }
-
-    @Test
-    fun aVersionWithoutAFileOnTheSiteHasNoRelease() {
-        val post = """{"data":{"title":"Example App","versions":[{"version":"5.6.1","version_downloads":[{"version_download_link":"https://files.example.org/Example.apk"}]}]}}"""
-        assertEquals(SourceErrorKind.NO_RELEASES, failure(site(post)).kind)
-    }
-
-    @Test
-    fun resolveAddsTheTokenAndThePage() {
-        val context = CheckContext(FakeHttp(), InMemoryValidatorStore(), nowMs = { 1_700_000_000_000L })
-        val asset = Asset("Example App-5.6.1-mod.apk", "https://dl.liteapks.com/files/Example%20App-5.6.1-mod.apk")
-        val download = SourceRegistry(listOf(source)).resolve(spec, asset, context)
-        assertEquals("https://dl.liteapks.com/files/Example%20App-5.6.1-mod.apk?token=TVRjd01EQXhNRGd3TUE9PQ%3D%3D", download.url)
-        assertEquals(mapOf("Referer" to page), download.headers)
-
-        val queried = source.resolve(spec, Asset("x.apk", "https://dl.liteapks.com/get?id=7"), context)
-        assertEquals("https://dl.liteapks.com/get?id=7&token=TVRjd01EQXhNRGd3TUE9PQ%3D%3D", queried.url)
-    }
-
-    @Test
-    fun resolveRefusesAFileElsewhere() {
-        try {
-            source.resolve(spec, Asset("x.apk", "https://files.example.org/x.apk"), CheckContext(FakeHttp(), InMemoryValidatorStore()))
-            fail("resolved a file on another host")
-        } catch (e: SourceException) {
-            assertEquals(SourceErrorKind.PARSE, e.kind)
-        }
-    }
-}
diff --git a/core/src/test/kotlin/io/github/munzzyy/tern/core/source/store/RockModsSourceTest.kt b/core/src/test/kotlin/io/github/munzzyy/tern/core/source/store/RockModsSourceTest.kt
deleted file mode 100644
index e7cfa595..00000000
--- a/core/src/test/kotlin/io/github/munzzyy/tern/core/source/store/RockModsSourceTest.kt
+++ /dev/null
@@ -1,108 +0,0 @@
-package io.github.munzzyy.tern.core.source.store
-
-import io.github.munzzyy.tern.core.model.SourceSpec
-import io.github.munzzyy.tern.core.net.InMemoryValidatorStore
-import io.github.munzzyy.tern.core.source.CheckContext
-import io.github.munzzyy.tern.core.source.CheckResult
-import io.github.munzzyy.tern.core.source.SourceErrorKind
-import io.github.munzzyy.tern.core.source.SourceException
-import io.github.munzzyy.tern.core.source.SourceListing
-import io.github.munzzyy.tern.core.testing.FakeHttp
-import io.github.munzzyy.tern.core.testing.Fixtures
-import org.junit.Assert.assertEquals
-import org.junit.Assert.assertNull
-import org.junit.Assert.assertTrue
-import org.junit.Assert.fail
-import org.junit.Test
-
-class RockModsSourceTest {
-    private val source = RockModsSource()
-    private val page = "https://www.rockmods.net/apps/example-player-mod-apk"
-    private val spec = SourceSpec(source.type, page)
-    private val fixture = Fixtures.text("store/rockmods_app.html")
-
-    private fun listing(html: String = fixture): SourceListing =
-        (source.check(spec, CheckContext(FakeHttp().text(page, html), InMemoryValidatorStore())) as CheckResult.Listing).listing
-
-    private fun failure(http: FakeHttp): SourceException {
-        try {
-            source.check(spec, CheckContext(http, InMemoryValidatorStore()))
-        } catch (e: SourceException) {
-            return e
-        }
-        fail("expected a SourceException")
-        throw AssertionError()
-    }
-
-    @Test
-    fun isFollowedWithoutFiles() {
-        assertTrue(source.trackOnly)
-        assertTrue(source.republishes)
-    }
-
-    @Test
-    fun matchesAnAppPageInItsCanonicalForm() {
-        for (url in listOf(page, "https://rockmods.net/apps/example-player-mod-apk", "http://rockmods.net/Apps/example-player-mod-apk/download?x=1")) {
-            assertEquals(url, spec, source.match(url))
-        }
-    }
-
-    @Test
-    fun leavesOtherPagesAndHostsAlone() {
-        for (url in listOf(
-            "https://www.rockmods.net/",
-            "https://www.rockmods.net/apps",
-            "https://www.rockmods.net/categories/video-players-editors",
-            "https://rockmods.net.example.org/apps/example-player-mod-apk",
-            "https://example.org/apps/example-player-mod-apk",
-        )) {
-            assertNull(url, source.match(url))
-        }
-    }
-
-    @Test
-    fun readsTheSoftwareApplicationOfThePage() {
-        val listing = listing()
-        assertEquals("Example Player (Pro)(Mod)", listing.name)
-        assertEquals("Example Labs", listing.author)
-        assertEquals("A video player with subtitles & more", listing.description)
-        val release = listing.releases.single()
-        assertEquals("3.2.4", release.version)
-        assertEquals("3.2.4", release.id)
-        assertEquals(page, release.pageUrl)
-        assertEquals(emptyList<Any>(), release.assets)
-        assertNull("an icon on another host is not taken", listing.iconUrl)
-    }
-
-    @Test
-    fun theHeadingStandsInForAMissingName() {
-        val html = fixture.replace("\"name\":\"Example Player (Pro)(Mod)\",", "")
-        assertEquals("Example Player (Pro)(Mod)", listing(html).name)
-    }
-
-    @Test
-    fun findsTheApplicationInsideAGraph() {
-        val graph = """<script type="application/ld+json">{"@graph":[{"@type":"WebPage"},{"@type":["SoftwareApplication","MobileApplication"],"name":"Example Player","softwareVersion":3.3}]}</script>"""
-        val listing = listing("<html><head>$graph</head><body></body></html>")
-        assertEquals("3.3", listing.releases.single().version)
-        assertEquals("Example Player", listing.name)
-    }
-
-    @Test
-    fun aBrokenBlockIsPassedOver() {
-        val broken = """<script type="application/ld+json">{"@type": "SoftwareApplication", oops</script>"""
-        assertEquals("3.2.4", listing(fixture.replace("<head>", "<head>$broken")).releases.single().version)
-    }
-
-    @Test
-    fun aPageWithoutAVersionCannotBeRead() {
-        assertEquals(SourceErrorKind.PARSE, failure(FakeHttp().text(page, fixture.replace("\"softwareVersion\":\"3.2.4\",", ""))).kind)
-        assertEquals(SourceErrorKind.PARSE, failure(FakeHttp().text(page, "<html><h1>Example Player</h1></html>")).kind)
-    }
-
-    @Test
-    fun aMissingPageIsNotFoundAndAFailingOneIsANetworkProblem() {
-        assertEquals(SourceErrorKind.NOT_FOUND, failure(FakeHttp().text(page, "", status = 404)).kind)
-        assertEquals(SourceErrorKind.NETWORK, failure(FakeHttp().text(page, "", status = 520)).kind)
-    }
-}
diff --git a/core/src/test/kotlin/io/github/munzzyy/tern/core/source/store/RuStoreSourceTest.kt b/core/src/test/kotlin/io/github/munzzyy/tern/core/source/store/RuStoreSourceTest.kt
deleted file mode 100644
index cbf9f0e6..00000000
--- a/core/src/test/kotlin/io/github/munzzyy/tern/core/source/store/RuStoreSourceTest.kt
+++ /dev/null
@@ -1,249 +0,0 @@
-package io.github.munzzyy.tern.core.source.store
-
-import io.github.munzzyy.tern.core.json.Json
-import io.github.munzzyy.tern.core.model.AssetKind
-import io.github.munzzyy.tern.core.model.DeviceProfile
-import io.github.munzzyy.tern.core.model.NotesFormat
-import io.github.munzzyy.tern.core.net.HttpResponse
-import io.github.munzzyy.tern.core.net.InMemoryValidatorStore
-import io.github.munzzyy.tern.core.source.CheckContext
-import io.github.munzzyy.tern.core.source.CheckResult
-import io.github.munzzyy.tern.core.source.SourceErrorKind
-import io.github.munzzyy.tern.core.source.SourceException
-import io.github.munzzyy.tern.core.source.SourceListing
-import io.github.munzzyy.tern.core.source.SourceOptions
-import io.github.munzzyy.tern.core.testing.FakeHttp
-import io.github.munzzyy.tern.core.testing.Fixtures
-import org.junit.Assert.assertEquals
-import org.junit.Assert.assertFalse
-import org.junit.Assert.assertNull
-import org.junit.Assert.assertTrue
-import org.junit.Assert.fail
-import org.junit.Test
-
-class RuStoreSourceTest {
-    private val canonical = "https://www.rustore.ru/catalog/app/org.example.app"
-    private val nonceUrl = "https://api.rustore.ru/v1/secure/nonce"
-    private val infoUrl = "https://backapi.rustore.ru/applicationData/overallInfo/org.example.app"
-    private val linkUrl = "https://backapi.rustore.ru/v3/showcase/apps/download-link"
-
-    /** The nonce the fake store hands out and the signature RuStore's key makes of it. */
-    private val nonce = "AAECAwQFBgcICQoLDA0ODxAREhMUFRYXGBkaGxwdHh8="
-    private val signature = "3jbz8yY9IApY/AYDk2YYucg5FcCMEZu9HOGLhiOSmqA="
-
-    private fun store(
-        info: String = Fixtures.text("store/rustore-info.json"),
-        link: String = Fixtures.text("store/rustore-download-link.json"),
-        nonces: MutableList<String> = mutableListOf(),
-    ): FakeHttp = FakeHttp()
-        .on(nonceUrl) { HttpResponse.of(200, """{"nonce":"${nonces.removeFirstOrNull() ?: nonce}"}""", url = nonceUrl) }
-        .on(infoUrl) { request -> if (request.headers["X-Client-Signature"] == signature) HttpResponse.of(200, info, url = infoUrl) else HttpResponse.of(419, "", url = infoUrl) }
-        .on(linkUrl) { request -> if (request.headers["X-Client-Signature"] == signature) HttpResponse.of(200, link, url = linkUrl) else HttpResponse.of(419, "", url = linkUrl) }
-
-    private fun context(http: FakeHttp, device: DeviceProfile? = DeviceProfile.ARM64_PHONE) = CheckContext(http, InMemoryValidatorStore(), device = device)
-
-    private fun listing(http: FakeHttp, source: RuStoreSource = RuStoreSource(), device: DeviceProfile? = DeviceProfile.ARM64_PHONE): SourceListing =
-        (source.check(source.match(canonical)!!, context(http, device)) as CheckResult.Listing).listing
-
-    @Test
-    fun matchesTheAppPage() {
-        val source = RuStoreSource()
-        for (url in listOf(canonical, "https://rustore.ru/catalog/app/org.example.app", "http://www.rustore.ru/catalog/app//org.example.app?utm_source=share")) {
-            val spec = source.match(url)
-            assertEquals(url, canonical, spec?.url)
-            assertEquals(url, "org.example.app", spec?.option(SourceOptions.PACKAGE))
-        }
-    }
-
-    @Test
-    fun leavesOtherAddressesAlone() {
-        val source = RuStoreSource()
-        assertNull(source.match("https://www.rustore.ru/catalog/app/"))
-        assertNull(source.match("https://www.rustore.ru/catalog/org.example.app"))
-        assertNull(source.match("https://www.rustore.ru/help/app/org.example.app"))
-        assertNull(source.match("https://www.rustore.ru/catalog/app/not-a-package"))
-        assertNull(source.match("https://example.com/catalog/app/org.example.app"))
-    }
-
-    @Test
-    fun readsTheAppWithASignedSession() {
-        val http = store()
-        val listing = listing(http)
-        assertEquals("Example App", listing.name)
-        assertEquals("Example Labs", listing.author)
-        assertEquals("org.example.app", listing.packageName)
-        assertEquals("An app for trying things out", listing.description)
-        val release = listing.releases.single()
-        assertEquals("26.34.0", release.version)
-        assertEquals(6850L, release.versionCode)
-        assertEquals("6850", release.id)
-        assertEquals(1790175857000L, release.publishedAtMs)
-        assertEquals("Fixed a crash when opening the settings\nStarts faster", release.notes)
-        assertEquals(NotesFormat.PLAIN, release.notesFormat)
-        assertEquals(canonical, release.pageUrl)
-        val asset = release.assets.single()
-        assertEquals("org.example.app_26.34.0.apk", asset.name)
-        // The APK beside the .zip, on the host whose certificate Android trusts.
-        assertEquals("https://static.rustore.ru/2026/9/29/2d/185fd5c7-0000-4000-8000-000000000001.apk", asset.url)
-        assertNull(asset.size)
-    }
-
-    @Test
-    fun asksAsRuStoresAppDoes() {
-        val http = store()
-        listing(http)
-        val nonceRequest = http.requestsTo(nonceUrl).single()
-        assertEquals("POST", nonceRequest.method)
-        assertEquals(0, nonceRequest.body?.size)
-        val deviceId = nonceRequest.headers["deviceId"]!!
-        assertTrue(deviceId, deviceId.matches(Regex("[0-9a-f]{16}--1057450190")))
-        assertNull(nonceRequest.headers["X-Client-Signature"])
-        val info = http.requestsTo(infoUrl).single()
-        assertEquals(signature, info.headers["X-Client-Signature"])
-        assertEquals(deviceId, info.headers["deviceId"])
-        assertEquals("mobile", info.headers["deviceType"])
-        assertTrue(info.headers["User-Agent"]!!.startsWith("RuStore/"))
-        val link = http.requestsTo(linkUrl).single()
-        assertEquals("POST", link.method)
-        assertFalse(link.followRedirects)
-        assertEquals("application/json; charset=utf-8", link.headers["Content-Type"])
-        val body = Json.parseObject(String(link.body!!, Charsets.UTF_8))
-        assertEquals(2063000001L, body.long("appId"))
-        assertEquals(true, body.bool("firstInstall"))
-        assertEquals(false, body.bool("withoutSplits"))
-        assertEquals(listOf("arm64-v8a", "armeabi-v7a", "armeabi"), body.array("supportedAbis")?.strings())
-        assertEquals(36L, body.long("sdkVersion"))
-        assertEquals(420L, body.long("screenDensity"))
-    }
-
-    @Test
-    fun aTelevisionSaysSo() {
-        val http = store()
-        listing(http, device = DeviceProfile(listOf("armeabi-v7a"), sdk = 30, densityDpi = 320, television = true))
-        assertEquals("TV", http.requestsTo(infoUrl).single().headers["deviceType"])
-        assertEquals(30L, Json.parseObject(String(http.requestsTo(linkUrl).single().body!!, Charsets.UTF_8)).long("sdkVersion"))
-    }
-
-    @Test
-    fun keepsTheSession() {
-        val source = RuStoreSource()
-        val http = store()
-        listing(http, source)
-        listing(http, source)
-        assertEquals(1, http.requestsTo(nonceUrl).size)
-    }
-
-    @Test
-    fun aRefusedSessionIsMadeAgain() {
-        val http = store(nonces = mutableListOf("AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA="))
-        assertEquals("26.34.0", listing(http).releases.single().version)
-        assertEquals(2, http.requestsTo(nonceUrl).size)
-        assertEquals(listOf(419, 200), http.requestsTo(infoUrl).map { if (it.headers["X-Client-Signature"] == signature) 200 else 419 })
-    }
-
-    @Test
-    fun aStoreThatKeepsRefusingIsANetworkProblem() {
-        val bad = "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA="
-        assertFailure(SourceErrorKind.NETWORK) { listing(store(nonces = mutableListOf(bad, bad))) }
-    }
-
-    @Test
-    fun aBaseAndItsSplitsAreListedAsOneBundle() {
-        val link = """{"appId":2063000001,"downloadUrls":[
-            {"url":"https://static-m.rustore.ru/2026/9/16/ab/base.zip","size":3},
-            {"url":"https://static-m.rustore.ru/2026/9/16/ab/config.arm64_v8a.zip","size":2},
-            {"url":"https://static-m.rustore.ru/2026/9/16/ab/config.xxhdpi.zip","size":1}]}"""
-        val asset = listing(store(link = link)).releases.single().assets.single()
-        assertEquals("org.example.app_26.34.0.apks", asset.name)
-        assertEquals(AssetKind.BUNDLE, asset.kind)
-        // Each file as RuStore names it, a .zip that holds the APK, on the host whose certificate Android trusts.
-        assertEquals("https://static.rustore.ru/2026/9/16/ab/base.zip", asset.url)
-        assertEquals(
-            listOf("https://static.rustore.ru/2026/9/16/ab/config.arm64_v8a.zip", "https://static.rustore.ru/2026/9/16/ab/config.xxhdpi.zip"),
-            asset.parts,
-        )
-        assertEquals(6L, asset.size)
-    }
-
-    @Test
-    fun aBundleWithAFileOfUnknownSizeHasNoSize() {
-        val link = """{"appId":2063000001,"downloadUrls":[
-            {"url":"https://static.rustore.ru/2026/9/16/ab/base.zip","size":3},
-            {"url":"https://static.rustore.ru/2026/9/16/ab/config.xxhdpi.zip"}]}"""
-        val asset = listing(store(link = link)).releases.single().assets.single()
-        assertEquals(1, asset.parts.size)
-        assertNull(asset.size)
-    }
-
-    @Test
-    fun aFileNamedTwiceIsFetchedOnce() {
-        val link = """{"appId":2063000001,"downloadUrls":[
-            {"url":"https://static.rustore.ru/2026/9/16/ab/base.zip","size":3},
-            {"url":"https://static.rustore.ru/2026/9/16/ab/base.zip","size":3}]}"""
-        val asset = listing(store(link = link)).releases.single().assets.single()
-        // One file left is an app that is not split.
-        assertEquals("https://static.rustore.ru/2026/9/16/ab/base.apk", asset.url)
-        assertTrue(asset.parts.isEmpty())
-    }
-
-    @Test
-    fun aBundleWithASplitOnAnotherHostIsLeftOut() {
-        val link = """{"appId":2063000001,"downloadUrls":[
-            {"url":"https://static.rustore.ru/2026/9/16/ab/base.zip","size":3},
-            {"url":"https://files.example.org/config.xxhdpi.zip","size":1}]}"""
-        assertTrue(listing(store(link = link)).releases.single().assets.isEmpty())
-    }
-
-    @Test
-    fun anAppWithoutAFileHereIsStillListed() {
-        val release = listing(store(link = """{"appId":2063000001,"downloadUrls":[]}""")).releases.single()
-        assertEquals("26.34.0", release.version)
-        assertTrue(release.assets.isEmpty())
-    }
-
-    @Test
-    fun aFileOnAnotherHostIsLeftOut() {
-        for (address in listOf("https://files.example.org/base.zip", "http://static.rustore.ru/2026/base.zip", "https://rustore.ru.example.org/base.zip")) {
-            val link = """{"appId":2063000001,"downloadUrls":[{"url":"$address","size":3}]}"""
-            assertTrue(address, listing(store(link = link)).releases.single().assets.isEmpty())
-        }
-    }
-
-    @Test
-    fun anAppRuStoreDoesNotKnowIsNotFound() {
-        val http = FakeHttp()
-            .on(nonceUrl) { HttpResponse.of(200, """{"nonce":"$nonce"}""", url = nonceUrl) }
-            .on(infoUrl) { HttpResponse.of(404, """{"code":"ERROR","message":"Couldn't find required data","body":null}""", url = infoUrl) }
-        assertFailure(SourceErrorKind.NOT_FOUND) { listing(http) }
-    }
-
-    @Test
-    fun anAnswerForAnotherPackageIsRefused() {
-        val info = Fixtures.text("store/rustore-info.json").replace("\"packageName\": \"org.example.app\"", "\"packageName\": \"org.example.other\"")
-        assertFailure(SourceErrorKind.PARSE) { listing(store(info = info)) }
-    }
-
-    @Test
-    fun searchListsTheAppsFound() {
-        val url = "https://backapi.rustore.ru/applicationData/apps?query=example%20app&pageNumber=0&pageSize=20"
-        val http = FakeHttp().resource(url, "store/rustore-search.json")
-        val source = RuStoreSource()
-        val hits = source.search("example app", context(http))
-        assertEquals(listOf("Example App", "Example Notes"), hits.map { it.name })
-        assertEquals(canonical, hits[0].url)
-        assertEquals("An app for trying things out", hits[0].description)
-        assertEquals(canonical, source.match(hits[0].url)?.url)
-        val request = http.requestsTo(url).single()
-        assertTrue(request.headers["deviceId"]!!.isNotEmpty())
-        assertNull(request.headers["X-Client-Signature"])
-    }
-
-    private fun assertFailure(kind: SourceErrorKind, block: () -> Unit) {
-        try {
-            block()
-            fail("expected a SourceException of kind $kind")
-        } catch (e: SourceException) {
-            assertEquals(e.message, kind, e.kind)
-        }
-    }
-}
diff --git a/core/src/test/kotlin/io/github/munzzyy/tern/core/source/store/SamsungSourceTest.kt b/core/src/test/kotlin/io/github/munzzyy/tern/core/source/store/SamsungSourceTest.kt
index 856d00fc..733d3c9f 100644
--- a/core/src/test/kotlin/io/github/munzzyy/tern/core/source/store/SamsungSourceTest.kt
+++ b/core/src/test/kotlin/io/github/munzzyy/tern/core/source/store/SamsungSourceTest.kt
@@ -22,8 +22,7 @@ class SamsungSourceTest {
     private val canonical = "https://apps.galaxyappstore.com/detail/org.example.app"
 
     private fun stubUrl(pkg: String = "org.example.app", model: String = "SM-S948B", csc: String = "DBT", sdk: Int = 36, abiType: String = "64") =
-        "https://vas.samsungapps.com/stub/stubDownload.as?appId=$pkg&deviceId=$model&mcc=425&mnc=01&csc=$csc&sdkVer=$sdk" +
-            "&systemId=1608665720954&abiType=$abiType&extuk=0191d6627f38685f"
+        "https://vas.samsungapps.com/stub/stubDownload.as?appId=$pkg&deviceId=$model&mcc=425&mnc=01&csc=$csc&sdkVer=$sdk&abiType=$abiType&extuk=0"
 
     private fun context(http: FakeHttp, device: DeviceProfile? = DeviceProfile.ARM64_PHONE) = CheckContext(http, InMemoryValidatorStore(), device = device)
 
@@ -75,12 +74,20 @@ class SamsungSourceTest {
     }
 
     @Test
-    fun asksForTheModelRegionAndDeviceOfTheApp() {
-        val spec = SourceSpec(source.type, canonical, mapOf(SourceOptions.PACKAGE to "org.example.app", SourceOptions.DEVICE_MODEL to "SM-A556B", SourceOptions.CSC to "EUX"))
+    fun withoutAModelOfItsOwnEveryCopyAsksForTheSameOneAndSaysOnlyTheAndroidVersionAndBitness() {
+        val spec = SourceSpec(source.type, canonical, mapOf(SourceOptions.PACKAGE to "org.example.app"))
         val phone32 = DeviceProfile(listOf("armeabi-v7a", "armeabi"), sdk = 30, densityDpi = 320)
-        val http = FakeHttp().resource(stubUrl(model = "SM-A556B", csc = "EUX", sdk = 30, abiType = "32"), "store/samsung-stub.xml")
+        val http = FakeHttp().resource(stubUrl(sdk = 30, abiType = "32"), "store/samsung-stub.xml")
         val result = source.check(spec, context(http, phone32)) as CheckResult.Listing
         assertEquals("2.4.1", result.listing.releases.single().version)
+        assertTrue(http.requests.single().headers.isEmpty())
+    }
+
+    @Test
+    fun asksForTheModelAndRegionThePersonSetForTheApp() {
+        val spec = SourceSpec(source.type, canonical, mapOf(SourceOptions.PACKAGE to "org.example.app", SourceOptions.DEVICE_MODEL to "SM-A556B", SourceOptions.CSC to "EUX"))
+        val http = FakeHttp().resource(stubUrl(model = "SM-A556B", csc = "EUX"), "store/samsung-stub.xml")
+        assertEquals("2.4.1", listing(http, spec).releases.single().version)
     }
 
     @Test
diff --git a/core/src/test/kotlin/io/github/munzzyy/tern/core/source/store/UptodownSourceTest.kt b/core/src/test/kotlin/io/github/munzzyy/tern/core/source/store/UptodownSourceTest.kt
deleted file mode 100644
index 4db1817b..00000000
--- a/core/src/test/kotlin/io/github/munzzyy/tern/core/source/store/UptodownSourceTest.kt
+++ /dev/null
@@ -1,271 +0,0 @@
-package io.github.munzzyy.tern.core.source.store
-
-import io.github.munzzyy.tern.core.model.Asset
-import io.github.munzzyy.tern.core.model.AssetKind
-import io.github.munzzyy.tern.core.model.SourceSpec
-import io.github.munzzyy.tern.core.net.HttpRequest
-import io.github.munzzyy.tern.core.net.HttpResponse
-import io.github.munzzyy.tern.core.net.InMemoryValidatorStore
-import io.github.munzzyy.tern.core.source.CheckContext
-import io.github.munzzyy.tern.core.source.CheckResult
-import io.github.munzzyy.tern.core.source.Download
-import io.github.munzzyy.tern.core.source.Hit
-import io.github.munzzyy.tern.core.source.SourceErrorKind
-import io.github.munzzyy.tern.core.source.SourceException
-import io.github.munzzyy.tern.core.source.SourceListing
-import io.github.munzzyy.tern.core.source.SourceRegistry
-import io.github.munzzyy.tern.core.source.SourceTypes
-import io.github.munzzyy.tern.core.testing.FakeHttp
-import io.github.munzzyy.tern.core.testing.Fixtures
-import org.junit.Assert.assertEquals
-import org.junit.Assert.assertNull
-import org.junit.Assert.assertTrue
-import org.junit.Assert.fail
-import org.junit.Test
-import java.time.Instant
-
-class UptodownSourceTest {
-    private val source = UptodownSource { "0123456789abcdef" }
-    private val page = "https://example-app.en.uptodown.com/android/download"
-    private val filePage = "$page/7654321-x"
-    private val auth = "https://www.uptodown.app/eapi/auth/token?identifier=0123456789abcdef"
-    private val downloadUrl = "https://www.uptodown.app/eapi/apps/1234567/file/7654321/downloadUrl"
-    private val search = "https://en.uptodown.com/android/en/s"
-    private val file = "https://dw.uptodown.net/dwn/0a1b2c3d/example-app-2-1-0.xapk"
-
-    /** A session token whose claims say it runs until [expires], in seconds. */
-    private fun token(expires: Long): String {
-        val encoder = java.util.Base64.getUrlEncoder().withoutPadding()
-        val header = encoder.encodeToString("""{"typ":"JWT","alg":"HS256"}""".toByteArray())
-        val claims = encoder.encodeToString("""{"iat":${expires - 1800},"exp":$expires}""".toByteArray())
-        return "$header.$claims.c2lnbmF0dXJl"
-    }
-
-    private val now = 1_790_730_000_000L
-
-    private fun context(http: FakeHttp, nowMs: Long = now) = CheckContext(http, InMemoryValidatorStore(), nowMs = { nowMs })
-
-    private fun spec() = source.match(page)!!
-
-    private fun check(http: FakeHttp): SourceListing = (source.check(spec(), context(http)) as CheckResult.Listing).listing
-
-    private fun failure(http: FakeHttp): SourceErrorKind = try {
-        source.check(spec(), context(http))
-        fail("expected SourceException")
-        error("unreachable")
-    } catch (e: SourceException) {
-        e.kind
-    }
-
-    private fun session(http: FakeHttp, expires: Long = 1_790_731_800L): FakeHttp = http.text(auth, """{"token":"${token(expires)}"}""")
-
-    private fun asset() = Asset("org.example.app.xapk", filePage)
-
-    @Test
-    fun matchesAppPagesInAnyLanguageAndReadsTheEnglishDownloadPage() {
-        assertEquals(SourceSpec(SourceTypes.UPTODOWN, page), source.match("https://example-app.en.uptodown.com/android"))
-        assertEquals(page, source.match("https://example-app.br.uptodown.com/android/download")?.url)
-        assertEquals(page, source.match("https://example-app.uptodown.com/android/descargar/")?.url)
-        assertEquals(page, source.match("http://example-app.en.uptodown.com")?.url)
-        assertEquals(page, source.match("$page/7654321-x")?.url)
-    }
-
-    @Test
-    fun leavesOtherAddressesAlone() {
-        assertNull(source.match("https://en.uptodown.com/android"))
-        assertNull(source.match("https://www.uptodown.com/"))
-        assertNull(source.match("https://uptodown.com/app/fourteen"))
-        assertNull(source.match("https://dw.uptodown.com/dwn/0a1b2c3d"))
-        assertNull(source.match("https://a.b.c.uptodown.com/android"))
-        assertNull(source.match("https://example-app.en.uptodown.com.example.org/android"))
-        assertNull(source.match("https://example.org/android"))
-    }
-
-    @Test
-    fun readsTheDownloadPage() {
-        val http = FakeHttp().resource(page, "store/uptodown_download.html")
-        val listing = check(http)
-
-        assertEquals("Example App", listing.name)
-        assertEquals("Example Labs & Friends", listing.author)
-        assertEquals("org.example.app", listing.packageName)
-        val release = listing.releases.single()
-        assertEquals("7654321", release.id)
-        assertEquals("2.1.0", release.version)
-        assertNull(release.versionCode)
-        assertEquals(Instant.parse("2026-09-25T00:00:00Z").toEpochMilli(), release.publishedAtMs)
-        assertEquals(page, release.pageUrl)
-        val asset = release.assets.single()
-        assertEquals("org.example.app.xapk", asset.name)
-        assertEquals(filePage, asset.url)
-        assertEquals(AssetKind.BUNDLE, asset.kind)
-        assertEquals("0a1b2c3d4e5f60718293a4b5c6d7e8f90a1b2c3d4e5f60718293a4b5c6d7e8f9", asset.sha256)
-        assertNull(asset.size)
-        assertEquals(listOf(page), http.requests.map { it.url })
-    }
-
-    @Test
-    fun detailsInBlocksInsideTheSameElementAreAllRead() {
-        val html = Fixtures.text("store/uptodown_download.html")
-            .replace("<section class=\"info\" id=\"technical-information\">", "<div class=\"info\" id=\"technical-information\">")
-            .replace("</div>\n</section>\n<section id=\"versions\">", "</div>\n</div>\n<section id=\"versions\">")
-        val listing = check(FakeHttp().text(page, html))
-        assertEquals("org.example.app", listing.packageName)
-        assertEquals("org.example.app.xapk", listing.releases.single().assets.single().name)
-    }
-
-    @Test
-    fun rowsWithoutALabelAreReadByTheirPlace() {
-        val html = """
-            <h1 id="detail-app-name" data-code="1234567" data-file-id="7654321">Example App</h1>
-            <div class="version">2.1.0</div>
-            <div id="technical-information"><table>
-            <tr><th></th><td>Free</td></tr><tr><th></th><td>Android</td></tr>
-            <tr><th></th><td>September 25, 2026</td></tr><tr><th></th><td>APK</td></tr>
-            <tr><th></th><td>50.12 MB</td></tr><tr><th></th><td>English</td></tr>
-            <tr><th></th><td>org.example.app</td></tr>
-            </table></div>
-        """.trimIndent()
-        val release = check(FakeHttp().text(page, html)).releases.single()
-        assertEquals("org.example.app.apk", release.assets.single().name)
-        assertEquals(Instant.parse("2026-09-25T00:00:00Z").toEpochMilli(), release.publishedAtMs)
-    }
-
-    @Test
-    fun aPageWithoutAVersionOrAFileHasNoRelease() {
-        assertEquals(SourceErrorKind.NO_RELEASES, failure(FakeHttp().text(page, """<h1 id="detail-app-name" data-file-id="7654321">Example App</h1>""")))
-        assertEquals(SourceErrorKind.NO_RELEASES, failure(FakeHttp().text(page, """<div class="version">2.1.0</div>""")))
-        assertEquals(SourceErrorKind.NO_RELEASES, failure(FakeHttp().text(page, """<div class="version">2.1.0</div><button id="detail-download-button" data-file-id="../x">""")))
-    }
-
-    @Test
-    fun aMissingPageIsNotFoundAndOtherFailuresAreReported() {
-        assertEquals(SourceErrorKind.NOT_FOUND, failure(FakeHttp().text(page, "<html><body>404 Not Found</body></html>", status = 404)))
-        assertEquals(SourceErrorKind.NOT_FOUND, failure(FakeHttp().text(page, "", status = 410)))
-        assertEquals(SourceErrorKind.NETWORK, failure(FakeHttp().text(page, "", status = 503)))
-    }
-
-    @Test
-    fun aDownloadIsResolvedThroughAnAnonymousSession() {
-        val http = session(FakeHttp().resource(filePage, "store/uptodown_download.html"))
-            .text(downloadUrl, """{"success":1,"data":{"downloadURL":"$file"}}""")
-
-        val download = SourceRegistry(listOf(source)).resolve(spec(), asset(), context(http))
-        assertEquals(Download(file, mapOf("User-Agent" to "Dalvik/2.1.0 (Linux; U; Android 16; Pixel 8 Pro Build/BP4A.260205.001)")), download)
-
-        val opened = http.requestsTo(auth).single()
-        assertEquals("POST", opened.method)
-        assertEquals("application/x-www-form-urlencoded", opened.headers["Content-Type"])
-        assertEquals("Uptodown_Android", opened.headers["Identificador"])
-        assertEquals("739", opened.headers["Identificador-Version"])
-        assertEquals(
-            "identifier=0123456789abcdef&id_plataforma=13&lang=en&unixtime=1790730000" +
-                "&hmac=09e69ce82645d4dda65f30b4fb39462f864159e14e280c55df2b016db465dc53",
-            String(opened.body!!, Charsets.UTF_8),
-        )
-        val asked = http.requestsTo(downloadUrl).single()
-        assertEquals("Bearer ${token(1_790_731_800L)}", asked.authorization)
-        assertTrue(asked.headers.keys.none { it.equals("Authorization", ignoreCase = true) })
-        assertEquals("Uptodown_Android", asked.headers["Identificador"])
-    }
-
-    @Test
-    fun theSessionIsKeptUntilItIsAboutToRunOut() {
-        val http = session(FakeHttp().resource(filePage, "store/uptodown_download.html"))
-            .text(downloadUrl, """{"success":1,"data":{"downloadURL":"$file"}}""")
-        source.resolve(spec(), asset(), context(http))
-        source.resolve(spec(), asset(), context(http, nowMs = now + 1_000_000L))
-        assertEquals(1, http.requestsTo(auth).size)
-        source.resolve(spec(), asset(), context(http, nowMs = now + 1_750_000L))
-        assertEquals(2, http.requestsTo(auth).size)
-    }
-
-    @Test
-    fun aRefusedSessionIsRenewedOnce() {
-        var asked = 0
-        val http = session(FakeHttp().resource(filePage, "store/uptodown_download.html"))
-            .on(downloadUrl) {
-                asked++
-                if (asked == 1) HttpResponse.of(401, "", url = downloadUrl) else HttpResponse.of(200, """{"success":1,"data":{"downloadURL":"$file"}}""", url = downloadUrl)
-            }
-        assertEquals(file, source.resolve(spec(), asset(), context(http)).url)
-        assertEquals(2, http.requestsTo(auth).size)
-
-        val refused = session(FakeHttp().resource(filePage, "store/uptodown_download.html")).text(downloadUrl, "", status = 401)
-        try {
-            UptodownSource { "0123456789abcdef" }.resolve(spec(), asset(), context(refused))
-            fail("expected SourceException")
-        } catch (e: SourceException) {
-            assertEquals(SourceErrorKind.AUTH, e.kind)
-        }
-        assertEquals(2, refused.requestsTo(downloadUrl).size)
-    }
-
-    @Test
-    fun aFileOnAnotherHostIsRefused() {
-        val http = session(FakeHttp().resource(filePage, "store/uptodown_download.html"))
-            .text(downloadUrl, """{"success":1,"data":{"downloadURL":"https://files.example.org/example-app.xapk"}}""")
-        try {
-            source.resolve(spec(), asset(), context(http))
-            fail("expected SourceException")
-        } catch (e: SourceException) {
-            assertEquals(SourceErrorKind.PARSE, e.kind)
-        }
-    }
-
-    @Test
-    fun onlyAFileOfThisAppIsResolved() {
-        val http = FakeHttp()
-        for (address in listOf("https://files.example.org/7654321-x", "$page/../../7654321-x", "https://other-app.en.uptodown.com/android/download/7654321-x")) {
-            try {
-                source.resolve(spec(), Asset("org.example.app.apk", address), context(http))
-                fail("resolved $address")
-            } catch (e: SourceException) {
-                assertEquals(SourceErrorKind.UNSUPPORTED, e.kind)
-            }
-        }
-        assertTrue(http.requests.isEmpty())
-    }
-
-    @Test
-    fun aSessionThatCannotBeReadIsRefused() {
-        val http = FakeHttp().resource(filePage, "store/uptodown_download.html").text(auth, """{"token":"not-a-token"}""")
-        try {
-            source.resolve(spec(), asset(), context(http))
-            fail("expected SourceException")
-        } catch (e: SourceException) {
-            assertEquals(SourceErrorKind.PARSE, e.kind)
-        }
-    }
-
-    @Test
-    fun searchKeepsAndroidAppsTheSourceAccepts() {
-        val http = FakeHttp().resource(search, "store/uptodown_search.json")
-        val hits = source.search("example app", context(http))
-
-        assertEquals(
-            listOf(
-                Hit("Example App", "Example Labs", null, page),
-                Hit("Example Tools", null, null, "https://example-tools.en.uptodown.com/android/download"),
-            ),
-            hits,
-        )
-        val request: HttpRequest = http.requestsTo(search).single()
-        assertEquals("POST", request.method)
-        assertEquals("queryString=example%20app", String(request.body!!, Charsets.UTF_8))
-        assertEquals("application/x-www-form-urlencoded", request.headers["Content-Type"])
-        assertEquals("Uptodown", source.origin)
-    }
-
-    @Test
-    fun aFailedSearchIsReported() {
-        for (http in listOf(FakeHttp().text(search, "", status = 500), FakeHttp().text(search, """{"success":0}"""))) {
-            try {
-                source.search("example", context(http))
-                fail("expected SourceException")
-            } catch (e: SourceException) {
-                assertEquals(SourceErrorKind.NETWORK, e.kind)
-            }
-        }
-    }
-}
diff --git a/core/src/test/kotlin/io/github/munzzyy/tern/core/source/web/DirectSourceTest.kt b/core/src/test/kotlin/io/github/munzzyy/tern/core/source/web/DirectSourceTest.kt
index ee70a56f..65f8aa82 100644
--- a/core/src/test/kotlin/io/github/munzzyy/tern/core/source/web/DirectSourceTest.kt
+++ b/core/src/test/kotlin/io/github/munzzyy/tern/core/source/web/DirectSourceTest.kt
@@ -164,15 +164,15 @@ class DirectSourceTest {
 
     @Test
     fun theHeadersGoWithEveryQuestionAndWithTheDownload() {
-        val headers = SourceOptions.HEADERS to """{"User-Agent": "Example/1.0"}"""
+        val headers = SourceOptions.HEADERS to """{"Referer": "https://example.com/"}"""
         val http = FakeHttp().on(file) { request ->
             if (request.method == "HEAD") HttpResponse.of(405, "", Headers.EMPTY, file) else HttpResponse.of(206, "x", Headers.of("ETag" to "\"v1\""), file)
         }
         release(http, headers)
         assertEquals(listOf("HEAD", "GET"), http.requests.map { it.method })
-        assertTrue(http.requests.all { it.headers["User-Agent"] == "Example/1.0" })
+        assertTrue(http.requests.all { it.headers["Referer"] == "https://example.com/" })
         val spec = SourceSpec(source.type, file, mapOf(headers))
-        assertEquals(Download(file, mapOf("User-Agent" to "Example/1.0")), source.resolve(spec, Asset("app.apk", file), context(http)))
+        assertEquals(Download(file, mapOf("Referer" to "https://example.com/")), source.resolve(spec, Asset("app.apk", file), context(http)))
         assertEquals(Download(file), source.resolve(SourceSpec(source.type, file), Asset("app.apk", file), context(http)))
     }
 
diff --git a/core/src/test/kotlin/io/github/munzzyy/tern/core/source/web/HtmlSourceTest.kt b/core/src/test/kotlin/io/github/munzzyy/tern/core/source/web/HtmlSourceTest.kt
index 1c0042d8..b94fe0d7 100644
--- a/core/src/test/kotlin/io/github/munzzyy/tern/core/source/web/HtmlSourceTest.kt
+++ b/core/src/test/kotlin/io/github/munzzyy/tern/core/source/web/HtmlSourceTest.kt
@@ -289,7 +289,7 @@ class HtmlSourceTest {
             .text(start, """<a href="/download">downloads</a>""")
             .text(page, """<a href="/dl/latest.apk">get</a>""")
             .on(file) { HttpResponse.of(200, "", Headers.of("ETag" to "\"e1\""), file) }
-        val headers = mapOf("User-Agent" to "Mozilla/5.0 Example", "X-Mirror" to "eu")
+        val headers = mapOf("Referer" to "https://example.com/project", "X-Mirror" to "eu")
         val spec = SourceSpec(source.type, start, mapOf(SourceOptions.HEADERS to RequestHeaders.write(headers), SourceOptions.STEPS to "[\"download\"]"))
         listing(http, spec)
         assertEquals(listOf(start, page, file), http.requests.map { it.url })
diff --git a/core/src/test/kotlin/io/github/munzzyy/tern/core/source/web/RequestHeadersTest.kt b/core/src/test/kotlin/io/github/munzzyy/tern/core/source/web/RequestHeadersTest.kt
index 83213f7a..baed9f25 100644
--- a/core/src/test/kotlin/io/github/munzzyy/tern/core/source/web/RequestHeadersTest.kt
+++ b/core/src/test/kotlin/io/github/munzzyy/tern/core/source/web/RequestHeadersTest.kt
@@ -11,7 +11,7 @@ import org.junit.Test
 class RequestHeadersTest {
     @Test
     fun readsAnObjectOfNamesAndValues() {
-        assertEquals(mapOf("User-Agent" to "Mozilla/5.0", "X-A" to "b"), RequestHeaders.parse("""{"User-Agent": " Mozilla/5.0 ", "X-A": "b"}"""))
+        assertEquals(mapOf("Referer" to "https://example.com/", "X-A" to "b"), RequestHeaders.parse("""{"Referer": " https://example.com/ ", "X-A": "b"}"""))
         assertEquals(emptyMap<String, String>(), RequestHeaders.parse(null))
         assertEquals(emptyMap<String, String>(), RequestHeaders.parse(" "))
     }
@@ -21,7 +21,9 @@ class RequestHeadersTest {
         for (name in listOf("Authorization", "proxy-authorization", "Proxy-Connection", "Cookie", "Host", "Content-Length", "Range", "If-None-Match", "if-modified-since", "Transfer-Encoding", "Accept-Encoding")) {
             assertNotNull(name, RequestHeaders.problem(name, "x"))
         }
-        assertNull(RequestHeaders.problem("User-Agent", "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Mobile Safari/537.36"))
+        assertNull(RequestHeaders.problem("Referer", "https://downloads.example.org/app/latest"))
+        assertEquals("The header User-Agent may not be set", RequestHeaders.problem("User-Agent", "Mozilla/5.0 (Linux; Android 10; K) Chrome/114.0.0.0 Mobile Safari/537.36"))
+        assertEquals("The header user-agent may not be set", RequestHeaders.problem("user-agent", "Example/1.0"))
         assertNull(RequestHeaders.problem("Referer", "https://example.com/"))
     }
 
@@ -55,7 +57,7 @@ class RequestHeadersTest {
 
     @Test
     fun readsWhatItWrites() {
-        val headers = mapOf("User-Agent" to "Example \"quoted\" \\ agent", "X-A" to "b")
+        val headers = mapOf("X-Note" to "Example \"quoted\" \\ note", "X-A" to "b")
         assertEquals(headers, RequestHeaders.parse(RequestHeaders.write(headers)))
     }
 }
diff --git a/core/src/test/resources/fixtures/interop/tern-0.1.0-export.json b/core/src/test/resources/fixtures/interop/tern-0.1.0-export.json
new file mode 100644
index 00000000..1d5859de
--- /dev/null
+++ b/core/src/test/resources/fixtures/interop/tern-0.1.0-export.json
@@ -0,0 +1,81 @@
+{
+  "format": "tern-export",
+  "schema": 1,
+  "exportedAt": 1759200000000,
+  "appVersion": "0.1.0",
+  "apps": [
+    {
+      "schema": 1,
+      "id": "3f2a9b8c7d6e5f40",
+      "source": {
+        "type": "html",
+        "url": "https://example.com/project",
+        "options": {
+          "steps": "[\"/v/\"]",
+          "linkFilter": "\\.apk$"
+        }
+      },
+      "name": "Example Web",
+      "author": null,
+      "packageName": "org.example.web",
+      "releases": {
+        "includePrereleases": false,
+        "tagFilter": null,
+        "titleFilter": null,
+        "notesFilter": null,
+        "versionExtract": "^(\\d+\\.\\d+)",
+        "minAgeDays": 0,
+        "skippedReleaseId": null,
+        "fallbackToOlder": true
+      },
+      "assets": {
+        "include": null,
+        "exclude": null,
+        "matchDevice": true
+      },
+      "updates": "NOTIFY",
+      "trackOnly": false,
+      "pinnedSigners": [
+        "a894d99944e6d3a5f69bbdfc6f8c4a0a8bb0b85c1e0d0a8c5c1d2e3f4a5b6c7d"
+      ],
+      "categories": [],
+      "favorite": false,
+      "notes": null
+    },
+    {
+      "schema": 1,
+      "id": "9c8b7a6f5e4d3c21",
+      "source": {
+        "type": "github",
+        "url": "https://github.com/example/app",
+        "options": {}
+      },
+      "name": "Example",
+      "author": "example",
+      "packageName": "org.example.app",
+      "releases": {
+        "includePrereleases": false,
+        "tagFilter": null,
+        "titleFilter": null,
+        "notesFilter": null,
+        "versionExtract": null,
+        "minAgeDays": 0,
+        "skippedReleaseId": null,
+        "fallbackToOlder": true
+      },
+      "assets": {
+        "include": null,
+        "exclude": null,
+        "matchDevice": true
+      },
+      "updates": "AUTO",
+      "trackOnly": false,
+      "pinnedSigners": [],
+      "categories": [
+        "Tools"
+      ],
+      "favorite": true,
+      "notes": null
+    }
+  ]
+}
diff --git a/core/src/test/resources/fixtures/store/apk4free_app.html b/core/src/test/resources/fixtures/store/apk4free_app.html
deleted file mode 100644
index 114bd560..00000000
--- a/core/src/test/resources/fixtures/store/apk4free_app.html
+++ /dev/null
@@ -1,28 +0,0 @@
-<!DOCTYPE html>
-<html lang="en-US">
-<head>
-<meta charset="UTF-8">
-<title>Example Notes v2.5.1 MOD APK (Premium Unlocked) - APK4Free</title>
-<script type="application/ld+json">{"@context":"https://schema.org","@type":"SoftwareApplication","name":"Example Notes","url":"https://apk4free.net/example-notes/","datePublished":"2026-03-01T09:00:00+07:00","dateModified":"2026-03-10T20:41:12+07:00","softwareVersion":"2.5.1","fileSize":"12.40 MB"}</script>
-</head>
-<body>
-<div class="container">
-<div class="app-s">
-<div class="box"><div class="app-spe s2">
-<ol id="breadcrumbs">
-<li><a href="https://apk4free.net" title="APK4Free">Home</a>  /  </li>
-<li><a href="https://apk4free.net/apps/productivity/">Productivity</a> </li></ol><div></div>
-<h1 class="main-box-title">Example Notes v2.5.1 MOD APK [Premium] (Unlocked)</h1><div class="version">2.5.1</div>    <div class="clear"></div>
-<div class="meta-cats"><ul class="post-categories">
-<li><a href="https://apk4free.net/apps/productivity/" rel="category tag">Productivity</a></li></ul></div>
-</div></div>
-<div class="box"><div class="bx-download">
-<a href="https://apk4free.net/example-notes/download/" class="buttond downloadAPK" rel="nofollow" title="Download APK"><i class="fa fa-download"></i> Download APK</a>
-</div></div>
-<div class="box"><h2 class="box-title">Related</h2>
-<a href="https://apk4free.net/other-notes/"><div class="bloque-app"><span class="title">Other Notes</span><div class="version">9.9.9</div></div></a>
-</div>
-</div>
-</div>
-</body>
-</html>
diff --git a/core/src/test/resources/fixtures/store/apk4free_download.html b/core/src/test/resources/fixtures/store/apk4free_download.html
deleted file mode 100644
index a01bd90f..00000000
--- a/core/src/test/resources/fixtures/store/apk4free_download.html
+++ /dev/null
@@ -1,31 +0,0 @@
-<!DOCTYPE html>
-<html lang="en-US">
-<head>
-<meta charset="UTF-8">
-<title>Download Example Notes - APK4Free</title>
-</head>
-<body>
-<main>
-<div class="app-s">
-<a href="https://apk4free.net/example-notes/" class="buttond" title="Go back">Go back</a>
-<h3>Example Notes <i class="fa fa-check-circle"></i></h3>
-<table class="table"><tbody>
-<tr><td><b>Version</b></td><td>2.5.1</td></tr>
-<tr><td><b>Size</b></td><td>12.40 MB</td></tr>
-</tbody></table>
-<div class="pxtdld">
-<div class="bxt ldl-d">Download links</div><div class="show_download_links" data-timer="5" style="display:none;"><ul id="list-downloadlinks" class=" ldl-d">
-<li><a href="https://apps.apk4free.net/example-notes/Example-Notes-v2.5.1-Mod.apk" target="_blank" rel="nofollow" class="buttond downloadAPK dapk_b"><i class="fa fa-download"></i> Example Notes v2.5.1 Premium APK</a></li>
-<li><a href="https://apps.apk4free.net/example-notes/Example-Notes-v2.5.1-Mod-arm64-v8a.apk" target="_blank" rel="nofollow" class="buttond downloadAPK dapk_b"><i class="fa fa-download"></i> Example Notes v2.5.1 Premium APK (arm64)</a></li>
-<li><a href="https://apps.apk4free.net/example-notes/Example-Notes-v2.6.0-beta2.apk" target="_blank" rel="nofollow" class="buttond downloadAPK dapk_b"><i class="fa fa-download"></i> Example Notes v2.6.0 [Beta] APK</a></li>
-<li><a href="https://apps.apk4free.net/example-notes/Example-Notes-v2.4.9-Mod.apk" target="_blank" rel="nofollow" class="buttond downloadAPK dapk_b"><i class="fa fa-download"></i> Example Notes v2.4.9 Premium APK</a></li>
-<li><a href="https://files.example.org/Example-Notes-v2.7.0-Mod.apk" target="_blank" rel="nofollow" class="buttond downloadAPK dapk_b"><i class="fa fa-download"></i> Example Notes v2.7.0 Mirror</a></li>
-<li><a href="https://apps.apk4free.net.example.org/Example-Notes-v2.8.0.apk" target="_blank" rel="nofollow" class="buttond downloadAPK dapk_b"><i class="fa fa-download"></i> Example Notes v2.8.0</a></li>
-<li><a href="/example-notes/Example-Notes-Final.apk" target="_blank" rel="nofollow" class="buttond downloadAPK dapk_b"><i class="fa fa-download"></i> Example Notes Premium APK</a></li>
-</ul></div>
-<div class="bx-info-install entry"><p><strong>How to install Example Notes APK?</strong></p></div>
-</div>
-</div>
-</main>
-</body>
-</html>
diff --git a/core/src/test/resources/fixtures/store/apkpure_download.html b/core/src/test/resources/fixtures/store/apkpure_download.html
new file mode 100644
index 00000000..6702d735
--- /dev/null
+++ b/core/src/test/resources/fixtures/store/apkpure_download.html
@@ -0,0 +1,8 @@
+<!DOCTYPE html><html><body data-dt-version="2.1.0">
+<div class="show-more-content">
+<div class="group-title">armeabi-v7a</div>
+<div class="fancybox-custom-dialog-2 variants-desc-dialog align-center" id="variant-1" style="display: none;"><div class="title"><strong class="one-line">Example App 2.1.0 </strong><span class="additional-info one-line">(210)</span></div><div class="content-wrap"><div class="content"><p><span class="label">Architecture</span><span class="value">armeabi-v7a</span></p><p><span class="label">Requires Android</span><span class="value">Android 10.0+ (Q, API 29)</span></p></div></div></div>
+<div class="split-line"></div>
+<div class="group-title">arm64-v8a</div>
+<div class="fancybox-custom-dialog-2 variants-desc-dialog align-center" id="variant-2" style="display: none;"><div class="title"><strong class="one-line">Example App 2.1.0 </strong><span class="additional-info one-line">(211)</span></div><div class="content-wrap"><div class="content"><p><span class="label">Architecture</span><span class="value">arm64-v8a</span></p></div></div></div>
+</div></body></html>
diff --git a/core/src/test/resources/fixtures/store/apkpure_history.json b/core/src/test/resources/fixtures/store/apkpure_history.json
deleted file mode 100644
index 26897b06..00000000
--- a/core/src/test/resources/fixtures/store/apkpure_history.json
+++ /dev/null
@@ -1,117 +0,0 @@
-{
-  "retcode": 0,
-  "errmsg": "",
-  "version_list": [
-    {
-      "title": "Example App",
-      "label": "Example App",
-      "package_name": "org.example.app",
-      "version_code": "210",
-      "version_name": "2.1.0",
-      "description_short": "An invented app for tests.",
-      "whatsnew": "• Faster start.<br>• Fewer crashes.",
-      "developer": "Example Labs",
-      "native_code": ["arm64-v8a"],
-      "update_date": "2026-09-28T12:00:31+07:00",
-      "is_beta": false,
-      "icon": {
-        "thumbnail": {"url": "https://image.winudf.com/v2/image1/ZXhhbXBsZV9pY29u/icon.png?w=100&fakeurl=1"},
-        "original": {"url": "https://image.winudf.com/v2/image1/ZXhhbXBsZV9pY29u/icon.png?fakeurl=1"}
-      },
-      "asset": {
-        "type": "XAPK",
-        "size": "51200000",
-        "sha1": "0123456789abcdef0123456789abcdef01234567",
-        "file_sha256": "ABCDEF01ABCDEF01ABCDEF01ABCDEF01ABCDEF01ABCDEF01ABCDEF01ABCDEF01",
-        "url": "https://data.winudf.com/XAPK/b3JnLmV4YW1wbGUuYXBwXzIxMF9hYQ?filename=Example.xapk&k=0a1b&package_name=org.example.app&token=1790729950-aa-0-bb"
-      }
-    },
-    {
-      "title": "Example App",
-      "package_name": "org.example.app",
-      "version_code": "210",
-      "version_name": "2.1.0",
-      "whatsnew": "",
-      "developer": "Example Labs",
-      "native_code": ["arm64-v8a", "armeabi-v7a", "x86", "x86_64"],
-      "update_date": "2026-09-27T09:00:00+07:00",
-      "asset": {
-        "type": "APK",
-        "size": "104857600",
-        "file_sha256": "1212121212121212121212121212121212121212121212121212121212121212",
-        "url": "https://data.winudf.com/APK/b3JnLmV4YW1wbGUuYXBwXzIxMF9iYg?filename=Example.apk&k=0a1c&package_name=org.example.app&token=1790729950-cc-0-dd"
-      }
-    },
-    {
-      "title": "Example App",
-      "package_name": "org.example.app",
-      "version_code": "210",
-      "version_name": "2.1.0",
-      "developer": "Example Labs",
-      "native_code": ["armeabi-v7a"],
-      "update_date": "2026-09-27T08:00:00+07:00",
-      "asset": {
-        "type": "XAPK",
-        "size": "1000",
-        "url": "https://files.example.org/XAPK/b3JnLmV4YW1wbGUuYXBwXzIxMF9jYw?token=1"
-      }
-    },
-    {
-      "title": "Example App",
-      "package_name": "org.example.app",
-      "version_code": "201",
-      "version_name": "2.0.0",
-      "whatsnew": "First release with sync.",
-      "developer": "Example Labs",
-      "native_code": ["arm64-v8a"],
-      "update_date": "2026-08-21T20:00:49+07:00",
-      "asset": {
-        "type": "XAPK",
-        "size": "50331648",
-        "url": "https://data.winudf.com/XAPK/b3JnLmV4YW1wbGUuYXBwXzIwMV9kZA?filename=Example.xapk&token=1790729950-ee-0-ff"
-      }
-    },
-    {
-      "title": "Example App",
-      "package_name": "org.example.app",
-      "version_code": "200",
-      "version_name": "2.0.0",
-      "developer": "Example Labs",
-      "native_code": ["armeabi-v7a"],
-      "update_date": "2026-08-20T20:00:49+07:00",
-      "asset": {
-        "type": "XAPK",
-        "size": "41943040",
-        "url": "https://data.winudf.com/XAPK/b3JnLmV4YW1wbGUuYXBwXzIwMF9lZQ?filename=Example.xapk&token=1790729950-gg-0-hh"
-      }
-    },
-    {
-      "title": "Example App",
-      "package_name": "org.example.app",
-      "version_code": "190",
-      "version_name": "1.9.0",
-      "developer": "Example Labs",
-      "native_code": ["x86_64"],
-      "update_date": "2026-07-01T10:00:00+07:00",
-      "asset": {
-        "type": "APK",
-        "size": "40000000",
-        "url": "https://data.winudf.com/APK/b3JnLmV4YW1wbGUuYXBwXzE5MF9mZg?filename=Example.apk&token=1790729950-ii-0-jj"
-      }
-    },
-    {
-      "title": "Example App",
-      "package_name": "org.example.app",
-      "version_code": "180",
-      "version_name": "1.8.0",
-      "developer": "Example Labs",
-      "native_code": ["universal"],
-      "update_date": "2026-06-01T10:00:00+07:00",
-      "asset": {
-        "type": "APK",
-        "size": "30000000",
-        "url": "https://data.winudf.com/APK/b3JnLmV4YW1wbGUuYXBwXzE4MF9nZw?filename=Example.apk&token=1790729950-kk-0-ll"
-      }
-    }
-  ]
-}
diff --git a/core/src/test/resources/fixtures/store/apkpure_versions.html b/core/src/test/resources/fixtures/store/apkpure_versions.html
new file mode 100644
index 00000000..14fd49a4
--- /dev/null
+++ b/core/src/test/resources/fixtures/store/apkpure_versions.html
@@ -0,0 +1,169 @@
+<!DOCTYPE html>
+<html lang="en"><head><meta charset="utf-8">
+<title>Example App Old Versions APK Download</title>
+<meta property="og:title" content="Example App Old Versions APK Download" />
+</head><body>
+<div class="ver-top">
+  <div class="ver-left-box">
+    <a class="ver-top-l" href="https://apkpure.com/example-app/org.example.app" title="Example App">
+      <img title="Example App icon" alt="Example App icon" src="https://image.winudf.com/v2/image1/ZXhhbXBsZQ/icon.png?w=160&amp;fakeurl=1">
+    </a>
+    <div class="ver-top-r">
+      <a class="ver_title" href="https://apkpure.com/example-app/org.example.app" title="Example App">
+        <h1>Example App</h1>
+      </a>
+      <p class="ver_dev">
+        <a title="Get more from Example Labs" href="https://apkpure.com/developer/Example%20Labs">
+          Example Labs
+        </a>
+      </p>
+      <p class="ver-des">An invented app for tests &amp; nothing else.</p>
+    </div>
+  </div>
+  <div class="ver-top-down" data-dt-apkid="b/XAPK/b3JnLmV4YW1wbGUuYXBwXzIxMV8wMGFi" data-dt-filesize="51200000" data-dt-version="2.1.0" data-dt-versioncode="211"></div>
+</div>
+<ul class="ver-wrap">
+
+<li class="">
+    <div
+      class="ver_download_link dt-old-versions-item-new"
+      data-dt-version="2.1.0"
+      data-dt-versioncode="211"
+      data-dt-apkid="b/XAPK/b3JnLmV4YW1wbGUuYXBwXzIxMV8wMGFi"
+      data-dt-filesize="51200000"
+      data-dt-variant="true"
+      data-dt-apklist="b/XAPK/b3JnLmV4YW1wbGUuYXBwXzIxMV8wMGFi,b/XAPK/b3JnLmV4YW1wbGUuYXBwXzIxMF8wMWFi">
+        <div class="ver-item">
+          <div class="version-info-first-line">
+            <a class="ver-item-n dt-version-name-link" title="Download Example App v2.1.0 for android"
+              href="https://apkpure.com/example-app/org.example.app/download/2.1.0">
+                Example App
+                2.1.0
+            </a>
+          </div>
+            <div class="ver-item-info">
+                <div class="apk-type-tag-list">
+                    <span class="apk-type-tag" data-tag="XAPK">XAPK</span>
+                </div>
+                <span class="ver-item-s">48.8 MB</span>
+                <span class="update-on one-line">Sep 28, 2026</span>
+            </div>
+        </div>
+  </div>
+</li>
+
+<li class="hot">
+    <div
+      class="ver_download_link dt-old-versions-item-new"
+      data-dt-version="1.4.0"
+      data-dt-versioncode="140"
+      data-dt-apkid="b/APK/b3JnLmV4YW1wbGUuYXBwXzE0MF8wMGFi"
+      data-dt-filesize="30000000"
+      data-dt-variant="false"
+      data-dt-apklist="b/APK/b3JnLmV4YW1wbGUuYXBwXzE0MF8wMGFi">
+        <div class="ver-item">
+          <div class="version-info-first-line">
+            <a class="ver-item-n dt-version-name-link" title="Download Example App v1.4.0 for android"
+              href="https://apkpure.com/example-app/org.example.app/download/1.4.0">
+                Example App
+                1.4.0
+            </a>
+          </div>
+            <div class="ver-item-info">
+                <div class="apk-type-tag-list">
+                    <span class="apk-type-tag" data-tag="APK">APK</span>
+                </div>
+                <span class="ver-item-s">48.8 MB</span>
+                <span class="update-on one-line">Jan 3, 2025</span>
+            </div>
+        </div>
+  </div>
+</li>
+
+<li class="">
+    <div
+      class="ver_download_link dt-old-versions-item-new"
+      data-dt-version="2.0.0"
+      data-dt-versioncode="200"
+      data-dt-apkid="b/APK/b3JnLmV4YW1wbGUuYXBwXzIwMF8wMGFi"
+      data-dt-filesize="50000000"
+      data-dt-variant="false"
+      data-dt-apklist="b/APK/b3JnLmV4YW1wbGUuYXBwXzIwMF8wMGFi">
+        <div class="ver-item">
+          <div class="version-info-first-line">
+            <a class="ver-item-n dt-version-name-link" title="Download Example App v2.0.0 for android"
+              href="https://apkpure.com/example-app/org.example.app/download/2.0.0">
+                Example App
+                2.0.0
+            </a>
+          </div>
+            <div class="ver-item-info">
+                <div class="apk-type-tag-list">
+                    <span class="apk-type-tag" data-tag="APK">APK</span>
+                </div>
+                <span class="ver-item-s">48.8 MB</span>
+                <span class="update-on one-line">Aug 30, 2026</span>
+            </div>
+        </div>
+  </div>
+</li>
+
+<li class="">
+    <div
+      class="ver_download_link dt-old-versions-item-new"
+      data-dt-version="2.0.0"
+      data-dt-versioncode="200"
+      data-dt-apkid="b/APK/b3JnLmV4YW1wbGUuYXBwXzIwMF8wMGFi"
+      data-dt-filesize="50000000"
+      data-dt-variant="false"
+      data-dt-apklist="b/APK/b3JnLmV4YW1wbGUuYXBwXzIwMF8wMGFi">
+        <div class="ver-item">
+          <div class="version-info-first-line">
+            <a class="ver-item-n dt-version-name-link" title="Download Example App v2.0.0 for android"
+              href="https://apkpure.com/example-app/org.example.app/download/2.0.0">
+                Example App
+                2.0.0
+            </a>
+          </div>
+            <div class="ver-item-info">
+                <div class="apk-type-tag-list">
+                    <span class="apk-type-tag" data-tag="APK">APK</span>
+                </div>
+                <span class="ver-item-s">48.8 MB</span>
+                <span class="update-on one-line">Aug 30, 2026</span>
+            </div>
+        </div>
+  </div>
+</li>
+
+<li class="">
+    <div
+      class="ver_download_link dt-old-versions-item-new"
+      data-dt-version="1.9.0"
+      data-dt-versioncode="190"
+      data-dt-apkid="b/APK/b3JnLmV4YW1wbGUuYXBwXzE5MF8wMGFi"
+      data-dt-filesize="49000000"
+      data-dt-variant="false"
+      data-dt-apklist="b/APK/b3JnLmV4YW1wbGUuYXBwXzE5MF8wMGFi">
+        <div class="ver-item">
+          <div class="version-info-first-line">
+            <a class="ver-item-n dt-version-name-link" title="Download Example App v1.9.0 for android"
+              href="https://apkpure.com/example-app/org.example.app/download/1.9.0">
+                Example App
+                1.9.0
+            </a>
+          </div>
+            <div class="ver-item-info">
+                <div class="apk-type-tag-list">
+                    <span class="apk-type-tag" data-tag="APK">APK</span>
+                </div>
+                <span class="ver-item-s">48.8 MB</span>
+                <span class="update-on one-line">Jul 1, 2026</span>
+            </div>
+        </div>
+  </div>
+</li>
+<li><div class="ver_download_link" data-dt-version="1.8.0" data-dt-apkid="b/APK/b3JnLm90aGVyLmFwcF8xODBfMDBhYg" data-dt-filesize="1"></div></li>
+<li><div class="ver_download_link" data-dt-version="1.7.0" data-dt-apkid="https://elsewhere.example/app.apk" data-dt-filesize="1"></div></li>
+</ul>
+</body></html>
diff --git a/core/src/test/resources/fixtures/store/coolapk-detail.json b/core/src/test/resources/fixtures/store/coolapk-detail.json
deleted file mode 100644
index f7c7b9e0..00000000
--- a/core/src/test/resources/fixtures/store/coolapk-detail.json
+++ /dev/null
@@ -1,33 +0,0 @@
-{
-  "data": {
-    "id": 4242,
-    "apktype": 1,
-    "catid": 7,
-    "title": "Example App",
-    "subtitle": "An app for trying things out",
-    "version": "2.0.1",
-    "apkname": "org.example.app",
-    "apkmd5": "0123456789abcdef0123456789abcdef",
-    "apkversionname": "2.0.1",
-    "apkversioncode": 20001,
-    "apksize": "5.2M",
-    "apklength": 5452595,
-    "sdkversion": 24,
-    "logo": "http://pp.myapp.com/ma_icon/0/icon_4242_1611306222/256",
-    "url": "/apk/org.example.app",
-    "description": "",
-    "developername": "Example Labs",
-    "pubdate": 1326901827,
-    "lastupdate": 1790675588,
-    "status": 1,
-    "entityType": "apk",
-    "entityId": 4242,
-    "packageName": "org.example.app",
-    "apkfile": "/apk_file/2026/0929/Example-2.0.1-20001.apk",
-    "changehistory": "2026-09-29: 2.0.1\n2026-09-01: 2.0.0",
-    "introduce": "<p>An app for trying things out.</p>",
-    "changelog": "Fixed a crash when opening the settings\r\nStarts faster",
-    "relatedRows": [],
-    "tabList": []
-  }
-}
diff --git a/core/src/test/resources/fixtures/store/farsroid_box.json b/core/src/test/resources/fixtures/store/farsroid_box.json
deleted file mode 100644
index 19aee877..00000000
--- a/core/src/test/resources/fixtures/store/farsroid_box.json
+++ /dev/null
@@ -1,6 +0,0 @@
-{
-  "success": true,
-  "data": {
-    "content": "<ul class=\"download-links\">\n<li class=\"download-link\"><a class=\"download-btn\" href=\"https:\/\/dl2.farsroid.com\/app\/Example-App-2.1.0-arm64-v8a(www.farsroid.com).apk\"><span class=\"txt\">Download arm64-v8a<\/span><\/a><\/li>\n<li class=\"download-link\"><a class=\"download-btn\" href=\"https:\/\/dl2.farsroid.com\/app\/Example-App-2.1.0-armeabi-v7a(www.farsroid.com).apk\"><span class=\"txt\">Download armeabi-v7a<\/span><\/a><\/li>\n<li class=\"download-link\"><a href=\"\/app\/Example%20App%202.1.0%20(Mod).apk\">Mod<\/a><\/li>\n<li class=\"download-link\"><a href=\"https:\/\/dl2.farsroid.com\/app\/Example-App-Data(www.farsroid.com).zip\">Data<\/a><\/li>\n<li class=\"download-link\"><a href=\"https:\/\/files.example.org\/Example-App-2.1.0.apk\">Mirror<\/a><\/li>\n<li class=\"download-link\"><a href=\"http:\/\/dl2.farsroid.com\/app\/Example-App-2.1.0-x86(www.farsroid.com).apk\">x86<\/a><\/li>\n<li class=\"download-link\"><a href=\"https:\/\/dl2.farsroid.com\/app\/Example-App-2.1.0-arm64-v8a(www.farsroid.com).apk\">Again<\/a><\/li>\n<\/ul>"
-  }
-}
diff --git a/core/src/test/resources/fixtures/store/farsroid_page.html b/core/src/test/resources/fixtures/store/farsroid_page.html
deleted file mode 100644
index 629629c8..00000000
--- a/core/src/test/resources/fixtures/store/farsroid_page.html
+++ /dev/null
@@ -1,18 +0,0 @@
-<!DOCTYPE html>
-<html dir="rtl" lang="fa-IR">
-<head>
-<meta charset="UTF-8">
-<title>Example App 2.1.0 - Farsroid</title>
-</head>
-<body>
-<article class="post">
-  <h1 class="title">Example App 2.1.0</h1>
-  <div class="post-content"><p>An invented app for tests.</p></div>
-  <section class="download-box">
-    <ul class="download-links" data-post-id="4242" data-post-version="2.1.0">
-      <li class="loading">...</li>
-    </ul>
-  </section>
-</article>
-</body>
-</html>
diff --git a/core/src/test/resources/fixtures/store/liteapks_post.json b/core/src/test/resources/fixtures/store/liteapks_post.json
deleted file mode 100644
index 4f71d172..00000000
--- a/core/src/test/resources/fixtures/store/liteapks_post.json
+++ /dev/null
@@ -1,26 +0,0 @@
-{
-  "success": true,
-  "data": {
-    "id": 4321,
-    "title": "Example App &amp; Friends",
-    "publisher": "Example Labs",
-    "versions": [
-      {
-        "version": "5.6.1",
-        "version_downloads": [
-          {"version_download_name": "MOD APK", "version_download_link": "https://dl.liteapks.com/files/Example%20App-5.6.1-mod.apk"},
-          {"version_download_name": "Mirror", "version_download_link": "https://files.example.org/Example-5.6.1.apk"},
-          {"version_download_name": "Look-alike", "version_download_link": "https://liteapks.com.example.org/Example-5.6.1.apk"},
-          {"version_download_name": "Plain", "version_download_link": "http://dl.liteapks.com/files/Example-5.6.1-plain.apk"},
-          {"version_download_name": "Empty", "version_download_link": ""}
-        ]
-      },
-      {
-        "version": "5.6.0",
-        "version_downloads": [
-          {"version_download_name": "MOD APK", "version_download_link": "https://dl.liteapks.com/files/Example-5.6.0-mod.apk"}
-        ]
-      }
-    ]
-  }
-}
diff --git a/core/src/test/resources/fixtures/store/liteapks_posts.json b/core/src/test/resources/fixtures/store/liteapks_posts.json
deleted file mode 100644
index 6c8e3889..00000000
--- a/core/src/test/resources/fixtures/store/liteapks_posts.json
+++ /dev/null
@@ -1,11 +0,0 @@
-[
-  {
-    "id": 4321,
-    "date": "2026-03-02T10:15:00",
-    "slug": "example-app",
-    "status": "publish",
-    "type": "post",
-    "link": "https://liteapks.com/example-app.html",
-    "title": {"rendered": "Example App v5.6.1 MOD APK (Premium Unlocked)"}
-  }
-]
diff --git a/core/src/test/resources/fixtures/store/rockmods_app.html b/core/src/test/resources/fixtures/store/rockmods_app.html
deleted file mode 100644
index 7ca04347..00000000
--- a/core/src/test/resources/fixtures/store/rockmods_app.html
+++ /dev/null
@@ -1,16 +0,0 @@
-<!DOCTYPE html>
-<html lang="en">
-<head>
-<meta charset="utf-8"/>
-<title>Example Player (Pro)(Mod) APK - RockMods</title>
-<script type="application/ld+json">{"@context":"https://schema.org","@type":"WebSite","name":"RockMods","url":"https://www.rockmods.net"}</script>
-<script type="application/ld+json">{"@context":"https://schema.org","@type":"SoftwareApplication","name":"Example Player (Pro)(Mod)","applicationCategory":"MultimediaApplication","operatingSystem":"Android","softwareVersion":"3.2.4","description":"A video player with subtitles & more","image":"https://play-lh.googleusercontent.com/example-icon","url":"https://www.rockmods.net/apps/example-player-mod-apk","author":{"@type":"Organization","name":"Example Labs"},"aggregateRating":{"@type":"AggregateRating","ratingValue":4.2,"reviewCount":1}}</script>
-<script type="application/ld+json">{"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://www.rockmods.net/"}]}</script>
-</head>
-<body>
-<main>
-<h1 class="text-3xl font-bold mb-3">Example Player (Pro)(Mod)</h1>
-<p>Version 3.2.4</p>
-</main>
-</body>
-</html>
diff --git a/core/src/test/resources/fixtures/store/rustore-download-link.json b/core/src/test/resources/fixtures/store/rustore-download-link.json
deleted file mode 100644
index e5bd7a8a..00000000
--- a/core/src/test/resources/fixtures/store/rustore-download-link.json
+++ /dev/null
@@ -1,17 +0,0 @@
-{
-  "appId": 2063000001,
-  "versionCode": 6850,
-  "versionId": 2064000002,
-  "downloadUrls": [
-    {
-      "url": "https://static-m.rustore.ru/2026/9/29/2d/185fd5c7-0000-4000-8000-000000000001.zip",
-      "size": 76695293,
-      "hash": "e2db97d670d5637d"
-    }
-  ],
-  "preApproveInfo": {
-    "label": "Example App",
-    "locale": "ru-RU"
-  },
-  "detailsCode": null
-}
diff --git a/core/src/test/resources/fixtures/store/rustore-info.json b/core/src/test/resources/fixtures/store/rustore-info.json
deleted file mode 100644
index 8af6d6a2..00000000
--- a/core/src/test/resources/fixtures/store/rustore-info.json
+++ /dev/null
@@ -1,32 +0,0 @@
-{
-  "code": "OK",
-  "message": null,
-  "body": {
-    "appId": 2063000001,
-    "packageName": "org.example.app",
-    "appName": "Example App",
-    "categories": ["tools"],
-    "companyName": "Example Labs",
-    "shortDescription": "An app for trying things out",
-    "fullDescription": "An app for trying things out.\n\nIt does very little.",
-    "fileSize": 32063707,
-    "versionName": "26.34.0",
-    "appType": "MAIN",
-    "downloads": 1000,
-    "price": 0,
-    "appVerUpdatedAt": "2026-09-23T15:04:17.130+00:00",
-    "aggregatorInfo": null,
-    "labelIds": [],
-    "versionCode": 6850,
-    "minSdkVersion": 26,
-    "targetSdkVersion": 36,
-    "whatsNew": "Fixed a crash when opening the settings\nStarts faster",
-    "iconUrl": "https://static-m.rustore.ru/2026/5/14/fb/apk/2063000001/content/ICON/0a1b2c3d-0000-4000-8000-000000000001.png",
-    "signatures": ["0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"],
-    "versionId": 2064000002,
-    "versionType": "REGULAR",
-    "firstPublishedAt": "2025-03-26T14:18:22.037+00:00",
-    "deviceTypes": ["MOBILE"]
-  },
-  "timestamp": "2026-09-30T01:08:03.730Z"
-}
diff --git a/core/src/test/resources/fixtures/store/rustore-search.json b/core/src/test/resources/fixtures/store/rustore-search.json
deleted file mode 100644
index e3bf73d1..00000000
--- a/core/src/test/resources/fixtures/store/rustore-search.json
+++ /dev/null
@@ -1,35 +0,0 @@
-{
-  "code": "OK",
-  "message": null,
-  "body": {
-    "content": [
-      {
-        "appId": 2063000001,
-        "packageName": "org.example.app",
-        "minSdkVersion": 26,
-        "appName": "Example App",
-        "shortDescription": "An app for trying things out",
-        "iconUrl": "https://static-m.rustore.ru/2026/5/14/fb/apk/2063000001/content/ICON/0a1b2c3d-0000-4000-8000-000000000001.png",
-        "appType": "MAIN",
-        "versionCode": 6850,
-        "price": 0
-      },
-      {
-        "appId": 2063000002,
-        "packageName": "org.example.notes",
-        "appName": "Example Notes",
-        "shortDescription": "Notes, for trying things out"
-      },
-      {
-        "appId": 2063000003,
-        "packageName": "not a package",
-        "appName": "Broken card"
-      }
-    ],
-    "pageNumber": 0,
-    "pageSize": 20,
-    "totalElements": 3,
-    "totalPages": 1
-  },
-  "timestamp": "2026-09-30T01:08:03.730Z"
-}
diff --git a/core/src/test/resources/fixtures/store/uptodown_download.html b/core/src/test/resources/fixtures/store/uptodown_download.html
deleted file mode 100644
index f5ac0295..00000000
--- a/core/src/test/resources/fixtures/store/uptodown_download.html
+++ /dev/null
@@ -1,104 +0,0 @@
-<!DOCTYPE html>
-<html lang="en">
-<head>
-<meta charset="utf-8">
-<title>Download Example App 2.1.0 for Android | Uptodown.com</title>
-<meta property="og:image" content="https://img.utdstc.com/icon/0a1/b2c/0a1b2c3d4e5f.png">
-</head>
-<body>
-<div id="main">
-<div class="detail">
-<div class="icon"><img src="https://img.utdstc.com/icon/0a1/b2c/0a1b2c3d4e5f.png:100" alt="Example App icon"></div>
-<div class="info">
-<a href="https://example-app.en.uptodown.com/android">
-<h1 id="detail-app-name" data-code="1234567" data-file-id="7654321">
-Example App </h1>
-</a>
-<div class="version">2.1.0</div>
-<div class="autor">
-<button id="author-link"
-onclick="addEventAnalytics('authorLink', {'event_category': 'author'});"
-data-organization-slug="example-labs"
->
-Example&nbsp;Labs &amp; Friends</button>
-</div>
-</div>
-</div>
-<div id="button-group-download" class="button-group download">
-<button id="detail-download-button" class="button download "
-data-app-id="1234567" data-file-id="7654321" data-only-xapk="0" data-download-version="7654321" title="download example app free"
-rel="nofollow"><strong>Download</strong><span class="size">50.12 MB</span></button>
-</div>
-<section class="info" id="technical-information">
-<div class="title-row"><h2 class="title">Information about Example App 2.1.0</h2></div>
-<div class="info-block" id="">
-<div class="title-row"><h3 class="title">Basic information</h3></div>
-<table class="content">
-<tr>
-<td><img alt="" src="https://stc.utdstc.com/img/icons-info.svg#icon-40-author" width="40" height="40"></td>
-<th scope="row">Developer</th>
-<td>
-<a href="https://example.org/">Example Labs</a> </td>
-</tr>
-<tr>
-<td><img alt="" src="https://stc.utdstc.com/img/icons-info.svg#icon-40-category" width="40" height="40"></td>
-<th scope="row"><a href="https://example.org/source">Source code</a></th>
-<td>
-</td>
-</tr>
-</table>
-</div><div class="info-block" id="">
-<div class="title-row"><h3 class="title">Download info</h3></div>
-<table class="content">
-<tr>
-<td><img alt="" src="https://stc.utdstc.com/img/icons-info.svg#icon-40-downloads" width="40" height="40"></td>
-<th>Downloads</th>
-<td>1,234</td>
-</tr>
-<tr>
-<td><img alt="" src="https://stc.utdstc.com/img/icons-info.svg#icon-40-date" width="40" height="40"></td>
-<th>Date</th>
-<td>Sep 25, 2026</td>
-</tr>
-<tr>
-<td><img alt="" src="https://stc.utdstc.com/img/icons-info.svg#icon-40-file" width="40" height="40"></td>
-<th scope="row">File type</th>
-<td>XAPK</td>
-</tr>
-<tr>
-<td><img alt="" src="https://stc.utdstc.com/img/icons-info.svg#icon-40-size" width="40" height="40"></td>
-<th>Size</th>
-<td>50.12 MB</td>
-</tr>
-<tr>
-<td><img alt="" src="https://stc.utdstc.com/img/icons-info.svg#icon-40-sha" width="40" height="40"></td>
-<th scope="row">SHA256</th>
-<td>
-<div id="sha256-copy" class="copy-sha256">0A1B2C3D4E5F60718293A4B5C6D7E8F90A1B2C3D4E5F60718293A4B5C6D7E8F9</div> </td>
-</tr>
-</table>
-</div><div class="info-block" id="">
-<div class="title-row"><h3 class="title">Technical details</h3></div>
-<table class="content">
-<tr class="full">
-<td>
-<img alt="" src="https://stc.utdstc.com/img/icons-info.svg#icon-40-package" width="40" height="40">
-</td>
-<th>Package Name</th>
-<td>org.example.app</td>
-</tr>
-</table>
-</div>
-</section>
-<section id="versions">
-<div id="versions-items-list" class="content">
-<div data-url="https://example-app.en.uptodown.com/android" data-version-id="7654000" data-extra-url="download">
-<span class="type apk" title="apk">apk</span>
-<span class="version">1.9.0</span>
-<span class="date">Jul 1, 2026</span>
-</div>
-</div>
-</section>
-</div>
-</body>
-</html>
diff --git a/core/src/test/resources/fixtures/store/uptodown_search.json b/core/src/test/resources/fixtures/store/uptodown_search.json
deleted file mode 100644
index ae4ac104..00000000
--- a/core/src/test/resources/fixtures/store/uptodown_search.json
+++ /dev/null
@@ -1,32 +0,0 @@
-{
-  "success": 1,
-  "data": {
-    "apps": [
-      {
-        "name": "<b>Example<\/b> App",
-        "url": "https:\/\/example-app.en.uptodown.com\/android",
-        "platformURL": "\/android",
-        "icon": "https:\/\/img.utdstc.com\/icon\/0a1\/b2c\/0a1b2c3d4e5f",
-        "author": "Example Labs"
-      },
-      {
-        "name": "<b>Example<\/b> App for Windows",
-        "url": "https:\/\/example-app.en.uptodown.com\/windows",
-        "platformURL": "\/windows",
-        "author": "Example Labs"
-      },
-      {
-        "name": "<b>Example<\/b> Tools",
-        "url": "https:\/\/example-tools.en.uptodown.com\/android",
-        "platformURL": "\/android",
-        "author": ""
-      },
-      {
-        "name": "Elsewhere",
-        "url": "https:\/\/apps.example.org\/android",
-        "platformURL": "\/android",
-        "author": "Somebody"
-      }
-    ]
-  }
-}
diff --git a/docs/COMPARISON.md b/docs/COMPARISON.md
index 97ab1951..434cf6ea 100644
--- a/docs/COMPARISON.md
+++ b/docs/COMPARISON.md
@@ -102,7 +102,7 @@ Not yet observed: behaviour in Doze over many hours, and after a reboot.
 | GitHub Actions builds | 102 | Yes, with a token |
 | Share a link into the app | 109 | Yes |
 | Work out the source from the link | 1108 | Yes |
-| XAPK and split APKs | 682, 1056 | Yes, installed as one session, RuStore's base and splits too, every part held to the base's signer |
+| XAPK and split APKs | 682, 1056 | Yes, installed as one session, every part held to the base's signer |
 | Keep the file when an install fails | 1978 | Yes |
 | Older versions | 2934 | The version history installs any listed release. Going back needs the app removed first, which Android requires, unless the Let Me Downgrade module is installed; then a setting lets an older version go in over a newer one, as in Obtainium |
 | Update ownership | 2078 | A setting, off by default. Not yet tested |
@@ -120,14 +120,20 @@ run against answers recorded from the real services.
 | Obtainium | Tern |
 |---|---|
 | GitHub, GitLab, Codeberg and Forgejo, F-Droid, IzzyOnDroid, third-party F-Droid repositories, SourceHut, SourceForge, Jenkins, a direct link, any web page | All of them, and GitHub Actions artifacts |
-| APKPure, Aptoide, Uptodown, APKCombo, APKMirror (tracking only), Farsroid | All of them. The Add screen says the store offers again what developers publish elsewhere, and every file is still held to the developer's certificate once Tern knows it |
-| Huawei AppGallery, Samsung Galaxy Store (device model and CSC), vivo, Tencent, RuStore, CoolApk, itch.io | All of them |
-| Telegram, NeutronCode | Both |
-| LiteAPKs, Apk4Free, RockMods (tracking only) | All three, with a warning on the Add screen that they offer apps changed by someone else |
-| Search in GitHub, GitLab, Codeberg or another Forgejo, F-Droid, a third-party F-Droid repository, Uptodown, AppGallery, vivo and RuStore, with a picker of where to look, a fewest-stars limit and a filter over the results | All of them, and Aptoide. The picker is kept between searches, each place that fails is named with its reason, and a repository is searched by words |
+| APKPure, Aptoide, APKCombo, APKMirror (tracking only), Huawei AppGallery, Samsung Galaxy Store, vivo, Tencent | All of them behind one setting that starts off. The Add screen and the app page and an import say where the files come from and what the first install decides. The Galaxy Store is asked for one fixed model and region that is the same for everyone |
+| Uptodown, RuStore, CoolApk | Not read. Each answers only its own app. Reading it means sending a key taken from that app and signing requests as that app. Tern asks every place as itself |
+| LiteAPKs, Apk4Free, RockMods, Farsroid | Not read. They offer unlocked and modified builds signed by whoever changed them. Farsroid mixes them with the originals under names that do not always say which is which |
+| itch.io, Telegram, Neutron Code | All three, always on: they are the developers' own channels |
+| Search in GitHub, GitLab, Codeberg or another Forgejo, F-Droid, a third-party F-Droid repository, Uptodown, AppGallery, vivo and RuStore, with a picker of where to look, a fewest-stars limit and a filter over the results | All of them but Uptodown and RuStore. Aptoide too. The stores only once they are on. The picker is kept between searches, each place that fails is named with its reason, and a repository is searched by words |
 | Override source, for self-hosted instances | "Read as" on the Add screen, for every source Obtainium lets be overridden and GitHub Actions; GitHub on another host uses the API that kind of GitHub documents. Self-hosted GitLab, Forgejo and Gitea are also recognised by asking them, and an F-Droid repository by its site's address |
 | F-Droid's author and changelog, APKMirror's changes and file size, a SourceForge folder or `/p/` address | All of them |
 | Tags for a project without releases | For apps that are only tracked, on GitHub, GitLab and Forgejo |
+
+Obtainium reads every one of those stores and sites. That is its call to make.
+Tern leaves some out because it wants to say two things about every request:
+it comes from Tern, and it fetches the app the person asked for. An export from
+Obtainium that names a place Tern does not read still comes in. Those apps are
+listed as skipped with the reason.
 | Private repositories | With a token, GitHub's files come through its API, and a refused token is tried once without |
 
 ### Per-app options
@@ -145,7 +151,7 @@ run against answers recorded from the real services.
 | Google Play as the installer (Shizuku or root) | For one app or for all |
 | Skip update notifications | Muted apps |
 | Refresh before download | Yes |
-| Headers, steps through intermediate pages and other options of the HTML source | All of them: links in natural order and the last one taken, by address, text or last segment, up to ten steps with their own options, and the version read from the link, its text or the whole page. Set on the app's page or before adding; a header that carries credentials is refused |
+| Headers, steps through intermediate pages and other options of the HTML source | All of them: links in natural order and the last one taken, by address, text or last segment, up to ten steps with their own options, and the version read from the link, its text or the whole page. Set on the app's page or before adding; a header that carries credentials is refused, and so is User-Agent, because Tern says who it is |
 
 ### Settings
 
@@ -153,7 +159,7 @@ run against answers recorded from the real services.
 |---|---|
 | Background checks from 15 minutes to 30 days on a slider, Wi-Fi and charging only, retries of failed checks | All of them, through Android's job scheduler rather than a task that decides by itself whether it is due. As in Obtainium, Wi-Fi and charging hold back installs, not checks, and a rate limit is waited out |
 | Check on start, check on opening an app, only installed and tracked apps, remove apps uninstalled elsewhere, a global APK filter | All of them |
-| Installers: system, Shizuku, Dhizuku, root, another app picked from a list with icons and its way in | All five. Every file is checked before any of them sees it, and the signer of what was installed is compared with the checked file afterwards, whichever installed it. Dhizuku is reached through its own owner and eight named classes, never all of Android's hidden interfaces |
+| Installers: system, Shizuku, Dhizuku, root, another app picked from a list with icons and its way in | All five. Every file is checked before any of them sees it, and the signer of what was installed is compared with the checked file afterwards, whichever installed it. Dhizuku is reached through its own owner and eight named classes, never all of Android's hidden interfaces. Shizuku and Dhizuku were tried on an Android 13 emulator; root has not been tried on a device |
 | New apps shown to Verified Apps first, and its About link | Yes, on at first as in Obtainium, for an install started with Tern on the screen. The installer still gets the checked file |
 | OBB files of an XAPK put in `Android/obb`, through Android's folder picker | Through Shizuku or root, under the package the checks verified and with plain file names only. With another installer they stay in the release's file, and the log says where |
 | Parallel downloads, retries of a failed download, Obtainium installed last | All three: one download at a time if wanted, three more tries resuming where the server allows, and Tern's own update last |
@@ -175,7 +181,7 @@ run against answers recorded from the real services.
 
 | Obtainium | Tern |
 |---|---|
-| `obtainium://add`, `app`, `apps`, `refresh` links, sharing an app's settings as a link | All of it, and `tern://` links of the same kinds; a link made by Tern opens in Obtainium too |
+| `obtainium://add`, `app`, `apps`, `refresh` links, sharing an app's settings as a link | All of it, and `tern://` links of the same kinds. Tern's own share links keep the address or the settings after `#` on tern.munzzyy.dev, so no server sees them; "Share as an Obtainium link" makes one Obtainium opens |
 | On each app: release date, changes, a dimmed icon when not installed, Mark updated for tracked apps, a moved repository first | All of them |
 | Install, categorize and share many apps at once, a determinate check | All of them; categories can be set, cleared or left for each |
 | Cancel a download from its tile or notification | Both, with how much has come |
diff --git a/docs/RELEASING.md b/docs/RELEASING.md
index b939a2e8..958888dd 100644
--- a/docs/RELEASING.md
+++ b/docs/RELEASING.md
@@ -32,6 +32,17 @@ secret-tool store --label "Tern upload keystore" service tern-keystore key uploa
 5. Install `dist/tern-<version>.apk` on an emulator over the previous
    release and walk through adding, installing and updating an app.
 6. Tag, push, and create the release with both APK files and both checksum files.
+7. Until fdroiddata merge request
+   [!50599](https://gitlab.com/fdroid/fdroiddata/-/merge_requests/50599) is
+   merged, bring it up to the release. In `metadata/io.github.munzzyy.tern.yml`
+   on its branch, add a build for the new `versionName` and `versionCode`
+   whose `commit:` is the full 40-character hash of the tagged commit
+   (`git rev-parse <tag>^{commit}`), not the tag and not a short hash. Set
+   `CurrentVersion` and `CurrentVersionCode` to the same two values. Run
+   `fdroid rewritemeta io.github.munzzyy.tern` and `fdroid lint
+   io.github.munzzyy.tern`, push the branch, and wait for the pipeline of the
+   merge request to pass. F-Droid's build has to reproduce the APK signed in
+   step 4, so this commit and that file must match.
 
 apksigner comes from build-tools 34.0.0 on purpose. F-Droid copies the
 developer's signature onto its own reproducible build, and its tool rejects
diff --git a/docs/SECURITY-MODEL.md b/docs/SECURITY-MODEL.md
index 9d6b7d2e..9ef9fa1c 100644
--- a/docs/SECURITY-MODEL.md
+++ b/docs/SECURITY-MODEL.md
@@ -29,6 +29,15 @@ the same one as the developer's own file. `docs/SUGGESTIONS.md` has the list,
 the second place for each, and the ten entries for which none was found. A pin
 that arrives with a link or an import does not take the place of a carried one.
 
+A carried certificate is found by the app's address, and for an app from a
+third-party store, a web page or a direct link also by its package: Aegis added
+from APKPure is held to the developer's certificate at its first install, as it
+is from GitHub. A package can ship from several channels, so it is held to every
+certificate the list carries for it. The package is taken from the listing, or
+from the file once a check reads it. Forges are matched by address only,
+because a fork may keep the package, and so are F-Droid repositories, whose
+signed index names the signer.
+
 ## Every install after that
 
 The checks run in this order, and the first one that fails ends it.
@@ -106,11 +115,26 @@ passes on what it claims.
 The log shows a file as verified after every file that goes to the installer
 has been verified by Android or by Tern.
 
+When "Remove apps uninstalled elsewhere" takes an app out of the list, Tern
+keeps the certificates it was pinned to and its repository's key. Added again
+from the same source, the app is held to them again, so uninstalling and
+reinstalling does not let the next file served become the pin. An app Android
+15 archived is not taken out at all. Removing an app in Tern by hand forgets
+what was kept, which is how a person lets an app change its signer.
+
 ### Package, version and kind
 
 A file for another package is refused. So is an older version code, a test-only
 build, and a build for a newer Android than the device runs.
 
+With Let Me Downgrade installed and "Allow older versions" on, an older version
+code can go in, but only for a release the person picked from an app's history.
+A background install, Update all and a plain install of the latest release
+never go back. Even a picked release is refused when the file's version code is
+lower than the one its source named, since then the source said it was newer.
+A store that lies about version codes cannot roll an app back to a version with
+known holes that way.
+
 ### Android
 
 The system installer runs its own checks after all of that. Tern treats an
@@ -151,6 +175,12 @@ only once Dhizuku is chosen. No hidden install flag is set. Where one of these
 calls is missing on some version of Android, Settings and the install say that
 Tern cannot install through Dhizuku there.
 
+Sui, the Magisk module that serves Shizuku's interface, is found the same way:
+its library reads `ServiceManager` and sends a call of its own to the activity
+service. Shizuku's library would do that at every start of Tern. Tern turns it
+off before anything starts and asks Sui only once Shizuku is the chosen
+installer. With Android's installer chosen, neither is asked anything.
+
 OBB files are the one exception, and a narrow one. After Android has installed
 an app that passed the gate, Shizuku or root writes the OBB files of its
 archive to `Android/obb/<the package the gate verified>/`, each with `dd` and
@@ -173,16 +203,39 @@ counted.
 Before the first install of an app, when the setting asks for it and Verified
 Apps or AppVerifier is on the phone, a read-only copy of the checked file goes
 to that app alone, for a second look by code that shares nothing with Tern's.
+The setting is off at first. Tern knows the certificate each of these apps is
+signed with, as its makers publish it, and sends nothing, neither this file nor
+the package and certificate the "Check with" button hands over, to an app that
+has the name but not the certificate.
 This happens only for an install the person started while Tern is on the
 screen. The installer then gets the file the gate passed, never the copy.
 
 ## Stores and mirrors
 
-Some sources are stores that offer again what developers published elsewhere,
-and three are sites that offer apps someone else changed. The Add screen says so
-before an app from one is stored. Their files are held to the same pin as any
-other, so once the developer's certificate is known a file signed by someone
-else is refused as an update.
+Eight sources are third-party stores: APKPure, Aptoide, APKCombo, APKMirror and
+Tencent, which offer again what others published, and Huawei AppGallery, the
+Galaxy Store and vivo, where developers upload their own. They are off until
+the person turns on Settings, Network, Third-party stores, and no file or link
+can turn that on. While it is off, no host of theirs is asked, an address on
+one is not read even as a web page, and an app from one that arrived with an
+import stays in the list, paused.
+
+Tern asks each store as itself, with its own User-Agent, and borrows nothing
+from the store's own app: no package name, no key, no signature, no made-up
+phone. Only the Galaxy Store needs a device model, and every copy of Tern asks
+for the same one. `HonestIdentityTest` fails when a source sets its own
+User-Agent, signs a request or names a store's app, and a person cannot set a
+User-Agent header either. Stores that answer only their own app, as RuStore,
+Uptodown and CoolApk do, are not read at all, and neither are sites that offer
+modified apps, such as LiteAPKs, Apk4Free, RockMods and Farsroid. An import
+that names them keeps the rest and says why these were left out.
+
+The Add screen, an app's page and the summary of an import say where a store's
+files come from. Until an app is pinned, the certificate of the first file
+installed from a store is the one its updates must carry, unless Tern carries
+the developer's for that package. A checksum a store gives is called the
+store's, and matching it says the file arrived as the store has it, not that
+the developer made it.
 
 Some stores hand out a link that expires, or a file only to a request with the
 right headers. Such a link is asked for right before the download, has to be an
@@ -193,9 +246,9 @@ or `If-Range`. A token still goes only to the host it was given for.
 
 ## Parts named one by one
 
-A store that serves an app as a base and its splits at separate addresses, as
-RuStore does, gets each part downloaded from its own address, with the rule for
-tokens applied to each. The parts are packed into one zip in the staging folder
+A source that serves an app as a base and its splits at separate addresses gets
+each part downloaded from its own address, with the rule for tokens applied to
+each. No source Tern reads today does this. The parts are packed into one zip in the staging folder
 and go through exactly the checks of a bundle: every part held to the base's
 signer, one install session. Every part must be an HTTPS address on the store's
 own hosts, or the bundle is left out.
@@ -271,6 +324,17 @@ request Tern makes to GitHub. It is never sent a token or a cookie, and while
 one is set Tern holds back the tokens of GitHub's hosts altogether, so private
 projects and GitHub Actions cannot be followed through it.
 
+It can also change every answer. The release list, the digest GitHub gives
+for a file and the file itself all come from the hubproxy. Tern hands them on
+as if GitHub sent them. So the hubproxy decides what GitHub appears to publish.
+An app already installed stays held to its certificate and a built-in pin
+still holds. A changed file cannot replace it. The first install of a GitHub
+app through a hubproxy trusts the hubproxy as much as GitHub, since the
+certificate Tern pins is whatever the hubproxy served. Certificate pinning
+does not reach the hubproxy either, because the connection goes to its host.
+While one is set, a digest from GitHub is shown as passed on by that host. The
+setting says all of this where it is turned on.
+
 With a SOCKS proxy set, host names are resolved by the proxy. This was checked
 with a logging proxy and a packet capture, and with a real Orbot on an emulator:
 Tor Project's own check answered `{"IsTor":true}` for a request Tern sent.
@@ -280,7 +344,12 @@ also when the proxy does not answer and when the setting names no proxy at
 all. One file opens connections, `net/UrlConnectionHttp.kt`, and
 `tools/check-network-doors.sh` fails in CI when a second one appears, when
 anything outside the handoff makes a socket, or when a name is resolved on the
-device. Device tests send a check, a download and an icon through a proxy that
+device. It also fails on everything else that can fetch by itself:
+`java.net.URL` or a URLConnection outside that file, Android's DownloadManager,
+HttpEngine or Cronet, a web view, DnsResolver, and HTTP libraries such as OkHttp
+or Ktor. `tools/tests/network-doors` keeps a small file for each of these ways,
+and CI proves that each one makes the check fail and that the tree passes.
+Device tests send a check, a download and an icon through a proxy that
 is not there and count the requests that arrive: none. When a request through a
 proxy on the device fails, Tern asks the proxy whether it is there at all. If
 not, the failure says "The proxy did not answer, so nothing was sent" instead of
@@ -304,10 +373,14 @@ app that holds Orbot's package name.
 
 ### Which certificates are trusted
 
-Android's own trust store decides, with certificate transparency asked for on
-Android 16. Certificates a user or an administrator added are not trusted.
+Android's own trust store decides, for every host, with certificate
+transparency asked for on Android 16 and never turned off. Certificates a user
+or an administrator added are not trusted, and Tern ships no certificate of its
+own. `NetworkSecurityConfigTest` parses both network security configs and fails
+on any other trust anchor, on a host with rules of its own, on transparency
+turned off and on a certificate file anywhere in the app's resources.
 
-Two exceptions, both narrow:
+One exception, and it only adds a condition:
 
 - Pinning, off by default as in Obtainium. With it on, a connection to
   `github.com`, GitHub's two hosts for release files, `gitlab.com` or
@@ -318,15 +391,6 @@ Two exceptions, both narrow:
   lifts one. The keys are in `net/Pinning.kt`, and `PinsTest` checks each one
   against the root certificate it names. A forge that moves to another
   authority fails there until the setting is off or Tern is updated.
-- RuStore serves part of its addresses with a certificate of the Russian
-  Trusted Root CA, which Android does not trust. That root is trusted for
-  `rustore.ru` and its subdomains and for nothing else, as Obtainium does; its
-  SHA-256 fingerprint is
-  `D2:6D:2D:02:31:B7:C3:9F:92:CC:73:85:12:BA:54:10:35:19:E4:40:5D:68:B5:BD:70:3E:97:88:CA:8E:CF:31`.
-  Certificates under it are in no transparency log, so Android 16 does not ask
-  for one there. Whoever holds that root could read and change Tern's requests
-  to RuStore, and only those. A file from RuStore still has to pass every
-  check, including the certificate of the app itself.
 
 ## Notifications
 
@@ -342,6 +406,14 @@ same install as the buttons in Tern, through every check above. So do the
 widget's Update all button and the launcher shortcut of that name. The tile and
 the widget's Check button only check.
 
+Only Tern can start these. The widget's buttons go to a receiver that is not
+exported. The launcher shortcuts go to an activity alias that is not exported
+either. Tern's window has to be exported for the launcher, but an intent that
+reaches it any other way cannot run Update all, Add or a check. A
+`tern://refresh` or `obtainium://refresh` link from a web page or another app
+asks the person before it checks anything. One such link a minute at most gets
+that far, and it never installs.
+
 A notification about problems gives each app's reason only in the version that
 names apps. A tap on it carries the ids of the apps and nothing else, and the
 screen it opens shows what Tern holds now, so another app cannot make Tern show
@@ -376,11 +448,15 @@ pins, a package name it already knew, its repository's signing key and a
 release the person skipped, and it never starts installing by itself. Taking a
 file's settings never makes new apps install by themselves either.
 
-A link that carries an app's settings is Obtainium's `obtainium://app/` form,
-or the same link behind Obtainium's web page for opening it from a browser.
-Tern makes such links without a token, which an app's settings never hold,
-and with no request header but User-Agent, Accept, Accept-Language and
-Referer, since any other could hold a key. Whoever opens the web form in a
+A link that carries an app's settings is Tern's own page on tern.munzzyy.dev
+with the settings after `#app=`, a part of the address browsers never send, so
+no server sees them. "Share as an Obtainium link" makes Obtainium's
+`obtainium://app/` form instead. Either way the link carries no token, which an
+app's settings never hold, and no request header but Accept, Accept-Language
+and Referer, since any other could hold a key. The same rule holds for every
+config that leaves the phone: an export in either format, the kept export and
+a file shared with another app. A header such as X-Api-Key stays on the device
+and has to be set again after an import. Whoever opens the web form in a
 browser shows the settings in it to Obtainium's page; Tern reads that form on
 the device and never asks the page. A link of a kind Tern does not know is
 named on the Add screen and goes no further.
@@ -579,14 +655,23 @@ import it.
   is the one to compare.
 - Tern's verifier has been tested on a computer, against files signed by
   apksigner and against files changed after signing. On a device it uses the
-  cryptography and the JAR reader of that device. The tests for that have not
-  been run yet.
+  cryptography and the JAR reader of that device. The tests for that have run
+  on Android 10 and 16 phone emulators and an Android TV 14 emulator.
 - It has been tested on emulators. Vendor builds of Android can behave
   differently.
 - Installing through Dhizuku has been checked against Android's sources for
-  versions 10 to 16 and tested on a computer, not yet on a device with Dhizuku
-  as its owner.
+  versions 10 to 16 and tested on a computer. On an Android 13 emulator with
+  Dhizuku 2.12 as its device owner, a first install and an update went in
+  without a prompt, with Dhizuku named as the installer. No other version has
+  been tried with it.
+- Keeping an app that Android 15 archived has not been tried on a device. No
+  installer on Android's emulator images can archive an app.
+- Installing through Shizuku has been tried on an Android 13 emulator only.
+  Installing as root has not been tried on a device: the su of Android's
+  emulator images answers only adb.
 - The handoff has been tested with real connections on a computer, and its
-  page in Chromium on a computer. No phone has loaded the page yet. How the
-  handoff finds the device's address and how it closes when Tern leaves the
-  screen has tests for a device that have not been run yet.
+  page in Chromium on a computer. No phone has loaded the page yet. Its tests
+  for a device, where it listens and how it closes when Tern leaves the
+  screen, have run on Android 10, 14 and 16 emulators. A link and an export
+  file sent from a computer to an Android TV 14 emulator arrived sealed and
+  were shown, and what was changed on the way was refused.
diff --git a/docs/TELEVISION.md b/docs/TELEVISION.md
index 27a32690..5c5ec734 100644
--- a/docs/TELEVISION.md
+++ b/docs/TELEVISION.md
@@ -11,10 +11,29 @@ Tern writes the export into `Download/Tern/` on the shared storage and names it
 Tokens are never in it. Android lets an app put a file of its own there without any permission, so
 Tern asks for none.
 
+Export for Obtainium works the same way and writes a file Obtainium can import, named as Obtainium
+names its own: `obtainium-export-2026-09-29.json`, then `obtainium-export-2026-09-29-2.json`.
+What Obtainium has no setting for stays behind.
+
+### Keep an export up to date
+
+With Keep an export up to date on, Tern writes the export again a moment after anything in the
+list changes. Without a file picker there is no folder to choose, so it goes into `Download/Tern/`
+as well. It is always the same file, written over each time: `tern-apps.json`, or
+`obtainium-export.json` in Obtainium's format, or the name you type under File name. Tern takes out
+what a file name cannot hold and adds `.json` where it is missing.
+
+### Save files
+
+Save to Downloads on an app's page, and Save files to Downloads for several picked apps, put a copy
+of a release's file into `Download/Tern/` as it came, under its own name. Nothing is checked or
+installed.
+
 ## Import from a file
 
-Tern lists the exports it wrote itself, and every `.json` file in its own folder on the shared
-storage, newest first, at most 50. A file of more than 2 MiB is refused. Android does not let
+Tern lists every `.json` file it wrote itself into `Download/Tern/`, and every `.json` file in its
+own folder on the shared storage, newest first, at most 50. That takes in its exports in either
+format and the export it keeps up to date. A file of more than 2 MiB is refused. Android does not let
 Tern see a file in `Download/` that another app or an earlier installation of Tern wrote, so a
 file that comes from elsewhere has to go into Tern's own folder.
 
diff --git a/fastlane/metadata/android/en-US/changelogs/200.txt b/fastlane/metadata/android/en-US/changelogs/200.txt
new file mode 100644
index 00000000..28c7dabe
--- /dev/null
+++ b/fastlane/metadata/android/en-US/changelogs/200.txt
@@ -0,0 +1 @@
+Reads itch.io, Telegram and Neutron Code, and third-party stores behind a setting that starts off. Every source is asked as Tern, and sites that offer modified apps are refused. Installs through Shizuku, Dhizuku, root or another installer. Every per-app option Obtainium has, separate Wi-Fi and charging switches for checks and installs, a widget, a tile and shortcuts. Well known apps say when they are already on the phone.
diff --git a/fastlane/metadata/android/en-US/full_description.txt b/fastlane/metadata/android/en-US/full_description.txt
index 53fbbd1f..97043693 100644
--- a/fastlane/metadata/android/en-US/full_description.txt
+++ b/fastlane/metadata/android/en-US/full_description.txt
@@ -10,7 +10,7 @@ The file has to be the app you asked for, and not an older version of it.
 
 Tern reads the version and the signer out of a file while it is still on the server, a few kilobytes of it, so an update is only offered when there really is one.
 
-On Android 12 and newer, updates go in without asking once Tern has installed the app. With Shizuku or root they go in without asking on any version, first installs too. If Android does want a confirmation, you get a notification you can update from. Background checks use Android's own scheduler, as often as every 15 minutes, and you choose whether they run on mobile data or only while charging.
+On Android 12 and newer, updates go in without asking once Tern has installed the app. With Shizuku or Dhizuku they go in without asking, first installs too. If Android does want a confirmation, you get a notification you can update from. Background checks use Android's own scheduler, as often as every 15 minutes, and you choose whether they run on mobile data or only while charging.
 
 No account. Nothing is reported to anyone. HTTPS only.
 
@@ -26,4 +26,8 @@ Obtainium user? Import your export file and your apps come along, with every opt
 
 Sort, group and filter your list, give categories colours, and see what is waiting on a home-screen widget or a Quick Settings tile.
 
-Reads: GitHub releases and Actions builds, GitLab, Forgejo, Gitea, Codeberg, F-Droid, IzzyOnDroid, any F-Droid format repository (signature checked), web pages, direct links, Jenkins, SourceHut, SourceForge, APKPure, Aptoide, Uptodown, APKCombo, APKMirror (tracking only), Farsroid, Huawei AppGallery, Samsung Galaxy Store, vivo, Tencent, CoolApk, RuStore, itch.io, Telegram, NeutronCode, LiteAPKs, Apk4Free and RockMods (tracking only).
+Reads: GitHub releases and Actions builds, GitLab, Forgejo, Gitea, Codeberg, F-Droid, IzzyOnDroid, any F-Droid format repository (signature checked), web pages, direct links, Jenkins, SourceHut, SourceForge, itch.io, Telegram and Neutron Code.
+
+Off until you turn them on in Settings: the third-party stores APKPure, Aptoide, APKCombo, APKMirror (tracking only), Tencent, Huawei AppGallery, Samsung Galaxy Store and vivo. A store serves its own copies of apps, not files from the developer's own site, and Tern says so. The first install from a store decides which certificate later updates must carry, unless Tern already knows the developer's. Tern does not read sites that offer modified apps, or stores that answer only their own app.
+
+Who Tern talks to: the forges, repositories, instances and sites of the apps you add; for an F-Droid app also F-Droid's data on gitlab.com and the changelog it names; the icon hosts of those sources, such as raw.githubusercontent.com; a third-party store's own hosts only when stores are on and you add an app from it; and the places you tick when you search, which are GitHub, Codeberg, GitLab and search.f-droid.org at first. Every request says it comes from Tern. PRIVACY.md lists every host.
diff --git a/fastlane/metadata/android/en-US/short_description.txt b/fastlane/metadata/android/en-US/short_description.txt
index 098ef1bf..17a83c89 100644
--- a/fastlane/metadata/android/en-US/short_description.txt
+++ b/fastlane/metadata/android/en-US/short_description.txt
@@ -1 +1 @@
-Apps straight from their developers, checked before they install
+Follow app releases where they are published and check them before they install
diff --git a/site/add/index.html b/site/add/index.html
index 97eb1792..6e7259f9 100644
--- a/site/add/index.html
+++ b/site/add/index.html
@@ -17,7 +17,7 @@
   <h1>Add an app to Tern</h1>
 </header>
 
-<noscript><p class="card">This page needs JavaScript to read the app's address. The address is in this page's own link, after <code>?url=</code>.</p></noscript>
+<noscript><p class="card">This page needs JavaScript to read the app's address. The address is in this page's own link, after <code>#url=</code>. Your browser keeps that part to itself, so this site never sees which app it is.</p></noscript>
 
 <div id="good" hidden>
   <div class="card">
@@ -28,6 +28,7 @@ <h1>Add an app to Tern</h1>
     <a class="button" id="open" href="../">Open in Tern</a>
     <button class="button second" id="copy" type="button">Copy the address</button>
   </div>
+  <p id="with-settings" hidden>The link also holds the settings someone chose for this app. Tern shows them to you with the app.</p>
   <p>Tern shows you the app first. Nothing is added until you press Add there.</p>
   <p class="card" id="elsewhere" hidden>Open this page on the Android phone or tablet where Tern is installed. On a TV, open Tern, choose Send from a phone, and send this address from your phone.</p>
   <p class="quiet">No Tern yet? <a href="../">Download Tern</a>, open it once, and come back to this page.</p>
diff --git a/site/index.html b/site/index.html
index 53912dcd..cc2e6cb1 100644
--- a/site/index.html
+++ b/site/index.html
@@ -29,7 +29,7 @@ <h1>Tern</h1>
 
 <h2>What it does</h2>
 <ul>
-  <li>Follows the releases of apps on GitHub, GitLab, Codeberg and other Forgejo servers, SourceHut, SourceForge, Jenkins, F-Droid repositories and plain download links, and in the stores Obtainium reads, from APKPure to the Galaxy Store.</li>
+  <li>Follows the releases of apps on GitHub, GitLab, Codeberg and other Forgejo servers, SourceHut, SourceForge, Jenkins, F-Droid repositories and plain download links, and, once you turn them on, in third-party stores from APKPure to the Galaxy Store.</li>
   <li>Checks who signed each file, holds every update to the certificate of the first install, and compares the checksum the publisher gave. A file that fails is not installed.</li>
   <li>Says what it found in plain words, and keeps a log of every download, check and install.</li>
   <li>Installs without asking through Shizuku or root if you like, and shows what is waiting on a widget, a Quick Settings tile and in notifications you can update from.</li>
diff --git a/site/tern.js b/site/tern.js
index b312dfa3..0962a593 100644
--- a/site/tern.js
+++ b/site/tern.js
@@ -4,10 +4,22 @@ var TERN_PACKAGE = 'io.github.munzzyy.tern';
 var HOME = 'https://tern.munzzyy.dev/';
 var BADGE = HOME + 'badge.png';
 
-/** The app address in a page's query, when it is one Tern will take: https, no login, no spaces. */
-function appAddress(search) {
-  var raw = new URLSearchParams(search).get('url');
-  if (!raw || raw.length > 2000 || /[\s\u0000-\u001f\u007f]/.test(raw)) return null;
+/**
+ * What the page was given, read from after '#', which a browser never sends to any server, and
+ * from after '?' in the links made before Tern used '#'.
+ */
+function given(search, hash) {
+  var fromHash = new URLSearchParams(hash && hash.charAt(0) === '#' ? hash.slice(1) : '');
+  var fromQuery = new URLSearchParams(search || '');
+  return {
+    url: fromHash.get('url') || fromQuery.get('url'),
+    app: fromHash.get('app')
+  };
+}
+
+/** [raw] as an app address Tern will take: https, no login, no spaces. */
+function httpsAddress(raw) {
+  if (typeof raw !== 'string' || !raw || raw.length > 2000 || /[\s\u0000-\u001f\u007f]/.test(raw)) return null;
   var url;
   try {
     url = new URL(raw);
@@ -18,23 +30,61 @@ function appAddress(search) {
   return url;
 }
 
-/** What the add page offers for [url]: the words to show and the two ways to hand it to Tern. */
-function addTarget(url) {
-  var address = url.href;
-  var path = url.pathname === '/' ? '' : url.pathname.replace(/\/+$/, '');
+/** The app address the page was given, when it is one Tern will take. */
+function appAddress(search, hash) {
+  return httpsAddress(given(search, hash).url);
+}
+
+/**
+ * The settings of an app the page was given after '#app=', as Tern and Obtainium write them: the
+ * JSON, the app's address and its name. Null when there are none, or they are not an app.
+ */
+function appSettings(hash) {
+  var raw = given('', hash).app;
+  if (!raw || raw.length > 8000) return null;
+  var app;
+  try {
+    app = JSON.parse(raw);
+  } catch (e) {
+    return null;
+  }
+  if (!app || typeof app !== 'object' || Array.isArray(app)) return null;
+  var url = httpsAddress(app.url);
+  if (!url) return null;
+  var name = typeof app.name === 'string' ? app.name.replace(/[\u0000-\u001f\u007f\u200e\u200f\u202a-\u202e\u2066-\u2069]/g, '').slice(0, 200) : '';
+  return { json: raw, url: url, name: name };
+}
+
+/** How the page hands [path] to Tern: tern:// anywhere, and on Android an intent that falls back to the home page. */
+function handOff(path) {
   return {
-    address: address,
-    shown: url.host + path,
-    intent: 'intent://add?url=' + encodeURIComponent(address) +
-      '#Intent;scheme=tern;package=' + TERN_PACKAGE +
+    intent: 'intent://' + path + '#Intent;scheme=tern;package=' + TERN_PACKAGE +
       ';S.browser_fallback_url=' + encodeURIComponent(HOME + '?from=add') + ';end',
-    link: 'tern://add?url=' + encodeURIComponent(address)
+    link: 'tern://' + path
   };
 }
 
+function shownAddress(url) {
+  var path = url.pathname === '/' ? '' : url.pathname.replace(/\/+$/, '');
+  return url.host + path;
+}
+
+/** What the add page offers for [url]: the words to show and the two ways to hand it to Tern. */
+function addTarget(url) {
+  var address = url.href;
+  var hand = handOff('add?url=' + encodeURIComponent(address));
+  return { address: address, shown: shownAddress(url), intent: hand.intent, link: hand.link };
+}
+
+/** The same for an app that comes with its settings: Tern shows them before anything is added. */
+function settingsTarget(settings) {
+  var hand = handOff('app/' + encodeURIComponent(settings.json));
+  return { address: settings.url.href, shown: shownAddress(settings.url), name: settings.name, intent: hand.intent, link: hand.link };
+}
+
 /** The Markdown for a README: the badge, linked to the add page for [url]. */
 function badgeMarkdown(url) {
-  return '[<img src="' + BADGE + '" alt="Get it with Tern" height="80">](' + HOME + 'add/?url=' + encodeURIComponent(url.href) + ')';
+  return '[<img src="' + BADGE + '" alt="Get it with Tern" height="80">](' + HOME + 'add/#url=' + encodeURIComponent(url.href) + ')';
 }
 
 if (typeof document !== 'undefined') {
@@ -42,13 +92,15 @@ if (typeof document !== 'undefined') {
   var show = function (id, on) { document.getElementById(id).hidden = !on; };
 
   if (page === 'add') {
-    var url = appAddress(location.search);
-    show('good', !!url);
-    show('bad', !url);
-    if (url) {
-      var target = addTarget(url);
+    var settings = appSettings(location.hash);
+    var url = settings ? null : appAddress(location.search, location.hash);
+    var target = settings ? settingsTarget(settings) : url ? addTarget(url) : null;
+    show('good', !!target);
+    show('bad', !target);
+    show('with-settings', !!settings);
+    if (target) {
       var android = /Android/i.test(navigator.userAgent);
-      document.getElementById('address').textContent = target.shown;
+      document.getElementById('address').textContent = target.name ? target.name + ', ' + target.shown : target.shown;
       document.getElementById('open').href = android ? target.intent : target.link;
       show('elsewhere', !android);
       var copy = document.getElementById('copy');
@@ -77,4 +129,4 @@ if (typeof document !== 'undefined') {
   }
 }
 
-if (typeof module !== 'undefined') module.exports = { appAddress: appAddress, addTarget: addTarget, badgeMarkdown: badgeMarkdown };
+if (typeof module !== 'undefined') module.exports = { appAddress: appAddress, appSettings: appSettings, addTarget: addTarget, settingsTarget: settingsTarget, badgeMarkdown: badgeMarkdown };
diff --git a/tools/check-apk.sh b/tools/check-apk.sh
index c6362ec6..9960ab31 100755
--- a/tools/check-apk.sh
+++ b/tools/check-apk.sh
@@ -76,6 +76,19 @@ else
   fi
 fi
 
+# The launcher shortcuts run Update all and a check without asking, so no other app may start their alias.
+shortcuts=$(echo "$manifest" | awk '
+  /E: / { if (alias && shortcuts) print record; alias = ($0 ~ /E: activity-alias/); shortcuts = 0; record = "" }
+  alias { record = record $0 "\n"; if ($0 ~ /android:name.*\.Shortcuts"/) shortcuts = 1 }
+  END { if (alias && shortcuts) print record }')
+if [ -z "$shortcuts" ]; then
+  echo "FAIL the shortcuts alias is missing from the manifest"; fail=1
+elif echo "$shortcuts" | grep -q 'android:exported.*=false'; then
+  echo "ok   the shortcuts alias is not exported"
+else
+  echo "FAIL the shortcuts alias is exported, so any app could start Update all"; fail=1
+fi
+
 badging=$("$AAPT" dump badging "$APK")
 television=""
 echo "$badging" | grep -q "^leanback-launchable-activity: name='[^']" || television="$television no-launcher-entry"
@@ -109,6 +122,14 @@ else
   echo "ok   apk is $size bytes (budget $MAX_BYTES)"
 fi
 
+# R8 renames Tern's classes but not the platform's, so a use of these shows by its type.
+doors=$(unzip -p "$APK" 'classes*.dex' | strings | grep -oE 'Landroid/app/DownloadManager\$Request;|Landroid/webkit/WebView;|Landroid/net/http/HttpEngine;|Landroid/net/DnsResolver;|Lorg/chromium/net/[A-Za-z]+;|Lokhttp3/[A-Za-z]+;' | sort -u || true)
+if [ -n "$doors" ]; then
+  echo "FAIL the apk reaches the network round the one door:"; echo "$doors"; fail=1
+else
+  echo "ok   no DownloadManager request, web view, HttpEngine, Cronet, OkHttp or DnsResolver in the apk"
+fi
+
 # Text, not class names: R8 renames classes, so a class name is absent even when the class is there.
 leftovers=$(unzip -p "$APK" 'classes*.dex' | strings | grep -E 'tern-stand-in-engine|forge\.test' | head -3 || true)
 if [ -n "$leftovers" ]; then
diff --git a/tools/check-network-doors.sh b/tools/check-network-doors.sh
index 4c4583a2..85bb7983 100755
--- a/tools/check-network-doors.sh
+++ b/tools/check-network-doors.sh
@@ -5,7 +5,10 @@
 # proxy the user chose and hands the name of the host to that proxy unresolved. A second place that
 # opens a connection, makes a socket or resolves a name would go round the proxy, and nothing else
 # would notice. The handoff in core/handoff listens on the local network, and net/ProxyProbe.kt asks
-# the proxy on this device whether it is there. No other place makes a socket.
+# the proxy on this device whether it is there. No other place makes a socket, and nothing else that
+# fetches by itself is used: java.net.URL outside the door, DownloadManager, HttpEngine or Cronet,
+# a web view, DnsResolver or an HTTP library. tools/tests/network-doors holds a file for each way,
+# and tools/tests/network-doors/run.sh proves each one fails this script.
 #
 #   tools/check-network-doors.sh [root of the source tree]
 set -euo pipefail
@@ -68,6 +71,15 @@ if [ -f "$PROBE" ]; then
   fi
 fi
 check "a name resolved on this device" 'getByName\(|getAllByName\(' "-"
+check "java.net.URL or a URLConnection outside $DOOR, which opens a connection round the proxy" \
+  '(^|[^A-Za-z0-9_.])java\.net\.(URL|URLConnection|HttpURLConnection)([^A-Za-z0-9_]|$)|javax\.net\.ssl\.HttpsURLConnection|(^|[^A-Za-z0-9_])(Https?)?URLConnection([^A-Za-z0-9_]|$)|import java\.net\.\*' "$DOOR:"
+check "a URL made from a URI outside $DOOR" '\.toURL\(' "$DOOR:"
+check "what an address holds read straight from it" '\.getContent\(|URL\([^)]*\)\.(content|readText|readBytes)' "-"
+check "Android's download service, which fetches outside Tern" 'DownloadManager\.(Request|Query)|\.enqueue\(' "-"
+check "a second HTTP stack: HttpEngine, Cronet, java.net.http, OkHttp, Ktor or Retrofit" \
+  'HttpEngine|org\.chromium\.net|(^|[^A-Za-z0-9_])UrlRequest|BidirectionalStream|java\.net\.http\.|okhttp3|io\.ktor|retrofit2' "-"
+check "a web view, which loads what a page asks for by itself" 'android\.webkit\.|(^|[^A-Za-z0-9_])WebView|loadUrl\(' "-"
+check "Android's name resolver" 'DnsResolver' "-"
 
 [ "$fail" -eq 0 ] && echo "ok   the network has one door"
 exit "$fail"
diff --git a/tools/check-site.js b/tools/check-site.js
index 6801dbf5..73dafda5 100644
--- a/tools/check-site.js
+++ b/tools/check-site.js
@@ -26,5 +26,30 @@ ok(tricky.intent.split('#Intent;').length === 2, 'the address cannot add a secon
 const angle = t.addTarget(t.appAddress('?url=' + encodeURIComponent('https://example.org/"><script>x</script>')));
 ok(!angle.intent.includes('<') && !angle.intent.includes('"'), 'markup in the address is encoded in the intent');
 
-eq(t.badgeMarkdown(good), '[<img src="https://tern.munzzyy.dev/badge.png" alt="Get it with Tern" height="80">](https://tern.munzzyy.dev/add/?url=https%3A%2F%2Fgithub.com%2Fmunzzyy%2Fstarling)', 'the badge Markdown links the add page with the address encoded');
+eq(t.badgeMarkdown(good), '[<img src="https://tern.munzzyy.dev/badge.png" alt="Get it with Tern" height="80">](https://tern.munzzyy.dev/add/#url=https%3A%2F%2Fgithub.com%2Fmunzzyy%2Fstarling)', 'the badge Markdown links the add page with the address after the hash');
+
+// The address after '#', which no server sees, as Tern shares it now; '?url=' still works for links already out there.
+const starling = encodeURIComponent('https://github.com/munzzyy/starling');
+eq(t.appAddress('', '#url=' + starling).href, 'https://github.com/munzzyy/starling', 'the address after the hash is taken');
+eq(t.appAddress('?url=' + encodeURIComponent('https://github.com/old/link'), '#url=' + starling).href, 'https://github.com/munzzyy/starling', 'the hash wins over the query');
+eq(t.appAddress('?url=' + starling, '').href, 'https://github.com/munzzyy/starling', 'an older link with the query still works');
+eq(t.appAddress('?url=' + starling, '#top').href, 'https://github.com/munzzyy/starling', 'a hash without an address leaves the query in charge');
+for (const bad of ['http://github.com/a/b', 'javascript:alert(1)', 'https://user:pw@github.com/a/b', 'intent://x#Intent;end']) {
+  eq(t.appAddress('', '#url=' + encodeURIComponent(bad)), null, 'refused after the hash: ' + JSON.stringify(bad));
+}
+
+// An app with its settings after '#app=', as Tern shares them, handed to Tern as a tern://app/ link.
+const app = JSON.stringify({ id: 'org.example.app', url: 'https://github.com/example/app', name: 'Example\u202e App', additionalSettings: '{"includePrereleases":true}' });
+const settings = t.appSettings('#app=' + encodeURIComponent(app));
+ok(settings, 'the settings after the hash are taken');
+eq(settings.url.href, 'https://github.com/example/app', 'the app address comes from the settings');
+eq(settings.name, 'Example App', 'a character that turns text around is taken out of the name');
+const withSettings = t.settingsTarget(settings);
+eq(withSettings.link, 'tern://app/' + encodeURIComponent(app), 'the tern link carries the settings encoded');
+ok(withSettings.intent.startsWith('intent://app/' + encodeURIComponent(app) + '#Intent;scheme=tern;package=io.github.munzzyy.tern;'), 'the intent carries them to Tern');
+ok(withSettings.intent.split('#Intent;').length === 2, 'the settings cannot add a second intent part');
+for (const bad of ['', 'not json', '[1]', '{"url":"http://example.org/a"}', '{"name":"x"}', JSON.stringify({ url: 'https://example.org/' + 'a'.repeat(9000) })]) {
+  eq(t.appSettings('#app=' + encodeURIComponent(bad)), null, 'refused settings: ' + JSON.stringify(bad.slice(0, 30)));
+}
+eq(t.appSettings('?app=' + encodeURIComponent(app)), null, 'settings are only read after the hash');
 console.log(`ok   ${n} checks of the site's script`);
diff --git a/tools/tests/network-doors/cronet.kt b/tools/tests/network-doors/cronet.kt
new file mode 100644
index 00000000..133c16e0
--- /dev/null
+++ b/tools/tests/network-doors/cronet.kt
@@ -0,0 +1,4 @@
+// expect: a second HTTP stack
+package fixture
+
+import org.chromium.net.CronetEngine
diff --git a/tools/tests/network-doors/dns-resolver.kt b/tools/tests/network-doors/dns-resolver.kt
new file mode 100644
index 00000000..7fe445dd
--- /dev/null
+++ b/tools/tests/network-doors/dns-resolver.kt
@@ -0,0 +1,4 @@
+// expect: Android's name resolver
+package fixture
+
+fun resolver() = android.net.DnsResolver.getInstance()
diff --git a/tools/tests/network-doors/door-without-proxy.kt b/tools/tests/network-doors/door-without-proxy.kt
new file mode 100644
index 00000000..d3851d63
--- /dev/null
+++ b/tools/tests/network-doors/door-without-proxy.kt
@@ -0,0 +1,7 @@
+// expect: the door opens a connection without the proxy
+// replaces: app/src/main/kotlin/io/github/munzzyy/tern/net/UrlConnectionHttp.kt
+package io.github.munzzyy.tern.net
+
+import java.net.URL
+
+fun open(url: URL) = url.openConnection()
diff --git a/tools/tests/network-doors/download-manager.kt b/tools/tests/network-doors/download-manager.kt
new file mode 100644
index 00000000..2a3fc3fc
--- /dev/null
+++ b/tools/tests/network-doors/download-manager.kt
@@ -0,0 +1,7 @@
+// expect: Android's download service
+package fixture
+
+import android.app.DownloadManager
+import android.net.Uri
+
+fun download(dm: DownloadManager) = dm.enqueue(DownloadManager.Request(Uri.parse("https://example.org/a.apk")))
diff --git a/tools/tests/network-doors/get-by-name.kt b/tools/tests/network-doors/get-by-name.kt
new file mode 100644
index 00000000..f8486062
--- /dev/null
+++ b/tools/tests/network-doors/get-by-name.kt
@@ -0,0 +1,4 @@
+// expect: a name resolved on this device
+package fixture
+
+fun resolve() = java.net.InetAddress.getByName("example.org")
diff --git a/tools/tests/network-doors/get-content.kt b/tools/tests/network-doors/get-content.kt
new file mode 100644
index 00000000..6c7ce911
--- /dev/null
+++ b/tools/tests/network-doors/get-content.kt
@@ -0,0 +1,4 @@
+// expect: what an address holds read straight from it
+package fixture
+
+fun fetch(address: Any) = (address as Holder).getContent()
diff --git a/tools/tests/network-doors/http-engine.kt b/tools/tests/network-doors/http-engine.kt
new file mode 100644
index 00000000..464aed01
--- /dev/null
+++ b/tools/tests/network-doors/http-engine.kt
@@ -0,0 +1,6 @@
+// expect: a second HTTP stack
+package fixture
+
+import android.content.Context
+
+fun engine(context: Context) = android.net.http.HttpEngine.Builder(context).build()
diff --git a/tools/tests/network-doors/java-net-http.kt b/tools/tests/network-doors/java-net-http.kt
new file mode 100644
index 00000000..f4edafb2
--- /dev/null
+++ b/tools/tests/network-doors/java-net-http.kt
@@ -0,0 +1,4 @@
+// expect: a second HTTP stack
+package fixture
+
+fun client() = java.net.http.HttpClient.newHttpClient()
diff --git a/tools/tests/network-doors/ktor.kt b/tools/tests/network-doors/ktor.kt
new file mode 100644
index 00000000..0585249f
--- /dev/null
+++ b/tools/tests/network-doors/ktor.kt
@@ -0,0 +1,4 @@
+// expect: a second HTTP stack
+package fixture
+
+import io.ktor.client.HttpClient
diff --git a/tools/tests/network-doors/okhttp.kt b/tools/tests/network-doors/okhttp.kt
new file mode 100644
index 00000000..5a325bae
--- /dev/null
+++ b/tools/tests/network-doors/okhttp.kt
@@ -0,0 +1,6 @@
+// expect: a second HTTP stack
+package fixture
+
+import okhttp3.OkHttpClient
+
+fun client() = OkHttpClient()
diff --git a/tools/tests/network-doors/open-connection.kt b/tools/tests/network-doors/open-connection.kt
new file mode 100644
index 00000000..a01d24d5
--- /dev/null
+++ b/tools/tests/network-doors/open-connection.kt
@@ -0,0 +1,4 @@
+// expect: a connection opened outside
+package fixture
+
+fun open(address: java.net.URI) = address.openConnection()
diff --git a/tools/tests/network-doors/open-stream.kt b/tools/tests/network-doors/open-stream.kt
new file mode 100644
index 00000000..1a7b309d
--- /dev/null
+++ b/tools/tests/network-doors/open-stream.kt
@@ -0,0 +1,4 @@
+// expect: a connection opened outside
+package fixture
+
+fun read(address: Any) = (address as Opener).openStream().readBytes()
diff --git a/tools/tests/network-doors/probe-elsewhere.kt b/tools/tests/network-doors/probe-elsewhere.kt
new file mode 100644
index 00000000..8a66fb2d
--- /dev/null
+++ b/tools/tests/network-doors/probe-elsewhere.kt
@@ -0,0 +1,11 @@
+// expect: the probe connects to something other than 127.0.0.1
+// replaces: app/src/main/kotlin/io/github/munzzyy/tern/net/ProxyProbe.kt
+package io.github.munzzyy.tern.net
+
+import java.net.InetAddress
+import java.net.InetSocketAddress
+import java.net.Socket
+
+private val THIS_DEVICE = byteArrayOf(127, 0, 0, 1)
+
+fun probe(port: Int) = Socket().connect(InetSocketAddress(InetAddress.getByAddress(byteArrayOf(10, 0, 0, 1)), port))
diff --git a/tools/tests/network-doors/run.sh b/tools/tests/network-doors/run.sh
new file mode 100755
index 00000000..14297c93
--- /dev/null
+++ b/tools/tests/network-doors/run.sh
@@ -0,0 +1,60 @@
+#!/bin/bash
+# Proves tools/check-network-doors.sh: the tree as it is passes, and each file here, put into a
+# copy of the tree, makes it fail with the line its first comment expects. A file that names a path
+# after "replaces:" takes that file's place; any other goes in as a file of its own.
+#
+#   tools/tests/network-doors/run.sh
+set -euo pipefail
+HERE="$(cd "$(dirname "$0")" && pwd)"
+ROOT="$(cd "$HERE/../../.." && pwd)"
+CHECK="$ROOT/tools/check-network-doors.sh"
+work=$(mktemp -d)
+trap 'rm -rf "$work"' EXIT
+
+for tree in app/src/main/kotlin app/src/release/kotlin core/src/main/kotlin; do
+  if [ -d "$ROOT/$tree" ]; then
+    mkdir -p "$work/$tree"
+    cp -r "$ROOT/$tree/." "$work/$tree/"
+  fi
+done
+
+fail=0
+if out=$(bash "$CHECK" "$work" 2>&1); then
+  echo "ok   the tree as it is passes"
+else
+  echo "FAIL the tree as it is does not pass:"
+  printf '%s\n' "$out" | grep '^FAIL' | sed 's/^/       /'
+  fail=1
+fi
+
+count=0
+for fixture in "$HERE"/*.kt; do
+  name=$(basename "$fixture" .kt)
+  expect=$(sed -n 's|^// expect: ||p' "$fixture" | head -1)
+  replaces=$(sed -n 's|^// replaces: ||p' "$fixture" | head -1)
+  if [ -z "$expect" ]; then
+    echo "FAIL $name says nothing about what it should fail with"
+    fail=1
+    continue
+  fi
+  if [ -n "$replaces" ]; then
+    target="$work/$replaces"
+    cp "$target" "$work/kept"
+  else
+    target="$work/app/src/main/kotlin/fixture/$name.kt"
+    mkdir -p "$(dirname "$target")"
+  fi
+  cp "$fixture" "$target"
+  status=0
+  out=$(bash "$CHECK" "$work" 2>&1) || status=$?
+  if [ -n "$replaces" ]; then mv "$work/kept" "$target"; else rm -f "$target"; fi
+  if [ "$status" -eq 1 ] && printf '%s\n' "$out" | grep -qF "FAIL $expect"; then
+    count=$((count + 1))
+  else
+    echo "FAIL $name went through (exit $status); expected a line starting FAIL $expect"
+    fail=1
+  fi
+done
+
+[ "$fail" -eq 0 ] && echo "ok   each of the $count ways to the network fails the check"
+exit "$fail"
diff --git a/tools/tests/network-doors/socket-address.kt b/tools/tests/network-doors/socket-address.kt
new file mode 100644
index 00000000..5483a58b
--- /dev/null
+++ b/tools/tests/network-doors/socket-address.kt
@@ -0,0 +1,4 @@
+// expect: an address made from a name outside
+package fixture
+
+fun where() = java.net.InetSocketAddress("example.org", 443)
diff --git a/tools/tests/network-doors/socket.kt b/tools/tests/network-doors/socket.kt
new file mode 100644
index 00000000..e204437f
--- /dev/null
+++ b/tools/tests/network-doors/socket.kt
@@ -0,0 +1,6 @@
+// expect: a socket made outside
+package fixture
+
+import java.net.Socket
+
+fun connect() = Socket("example.org", 443)
diff --git a/tools/tests/network-doors/to-url.kt b/tools/tests/network-doors/to-url.kt
new file mode 100644
index 00000000..e200b379
--- /dev/null
+++ b/tools/tests/network-doors/to-url.kt
@@ -0,0 +1,4 @@
+// expect: a URL made from a URI outside
+package fixture
+
+fun fetch(): ByteArray = java.net.URI("https://example.org/x").toURL().readBytes()
diff --git a/tools/tests/network-doors/url-aliased.kt b/tools/tests/network-doors/url-aliased.kt
new file mode 100644
index 00000000..e34eef04
--- /dev/null
+++ b/tools/tests/network-doors/url-aliased.kt
@@ -0,0 +1,6 @@
+// expect: java.net.URL or a URLConnection outside
+package fixture
+
+import java.net.URL as Address
+
+fun fetch(): ByteArray = Address("https://example.org/x").readBytes()
diff --git a/tools/tests/network-doors/url-connection.kt b/tools/tests/network-doors/url-connection.kt
new file mode 100644
index 00000000..f053903e
--- /dev/null
+++ b/tools/tests/network-doors/url-connection.kt
@@ -0,0 +1,4 @@
+// expect: java.net.URL or a URLConnection outside
+package fixture
+
+fun status(connection: Any) = (connection as javax.net.ssl.HttpsURLConnection).responseCode
diff --git a/tools/tests/network-doors/url-read-text.kt b/tools/tests/network-doors/url-read-text.kt
new file mode 100644
index 00000000..15161f05
--- /dev/null
+++ b/tools/tests/network-doors/url-read-text.kt
@@ -0,0 +1,6 @@
+// expect: java.net.URL or a URLConnection outside
+package fixture
+
+import java.net.URL
+
+fun fetch(): String = URL("https://example.org/x").readText()
diff --git a/tools/tests/network-doors/url-wildcard.kt b/tools/tests/network-doors/url-wildcard.kt
new file mode 100644
index 00000000..4a96570c
--- /dev/null
+++ b/tools/tests/network-doors/url-wildcard.kt
@@ -0,0 +1,6 @@
+// expect: java.net.URL or a URLConnection outside
+package fixture
+
+import java.net.*
+
+fun fetch(): Any = URL("https://example.org/x").content
diff --git a/tools/tests/network-doors/webview.kt b/tools/tests/network-doors/webview.kt
new file mode 100644
index 00000000..33246f12
--- /dev/null
+++ b/tools/tests/network-doors/webview.kt
@@ -0,0 +1,6 @@
+// expect: a web view
+package fixture
+
+import android.content.Context
+
+fun show(context: Context) = android.webkit.WebView(context).loadUrl("https://example.org")