From 21dcf5d947e958d4b74e064d4ea5810889818f36 Mon Sep 17 00:00:00 2001
From: william arzt <bill@tlon.io>
Date: Sat, 18 Jul 2026 18:52:35 -0400
Subject: [PATCH 01/19] feat: add buckets channel prototype

---
 PRODUCT.md                                    |  33 +
 .../app/fixtures/BucketsChannel.fixture.tsx   | 517 +++++++++++++
 .../BucketFileViewer.native.tsx               | 144 ++++
 .../BucketFileViewer.shared.test.ts           |  15 +
 .../BucketsChannel/BucketFileViewer.shared.ts |  40 +
 .../BucketsChannel/BucketFileViewer.tsx       | 131 ++++
 .../BucketsChannel/BucketsChannel.tsx         | 722 ++++++++++++++++++
 .../app/ui/components/BucketsChannel/index.ts |   3 +
 .../ui/components/Channel/ChannelHeader.tsx   |  16 +-
 packages/app/ui/components/SearchBar.tsx      |   4 +-
 packages/app/ui/index.tsx                     |   1 +
 11 files changed, 1623 insertions(+), 3 deletions(-)
 create mode 100644 PRODUCT.md
 create mode 100644 packages/app/fixtures/BucketsChannel.fixture.tsx
 create mode 100644 packages/app/ui/components/BucketsChannel/BucketFileViewer.native.tsx
 create mode 100644 packages/app/ui/components/BucketsChannel/BucketFileViewer.shared.test.ts
 create mode 100644 packages/app/ui/components/BucketsChannel/BucketFileViewer.shared.ts
 create mode 100644 packages/app/ui/components/BucketsChannel/BucketFileViewer.tsx
 create mode 100644 packages/app/ui/components/BucketsChannel/BucketsChannel.tsx
 create mode 100644 packages/app/ui/components/BucketsChannel/index.ts

diff --git a/PRODUCT.md b/PRODUCT.md
new file mode 100644
index 0000000000..d0a287be49
--- /dev/null
+++ b/PRODUCT.md
@@ -0,0 +1,33 @@
+# Product
+
+## Register
+
+product
+
+## Users
+
+Tlon Messenger group members, group administrators, and Tlonbots collaborating inside an existing group. People may arrive to quickly retrieve a file, organize an active project, or review what another member or agent changed. Tlonbots participate through their own ship identities and permissions rather than inheriting their human owner's authority.
+
+## Product Purpose
+
+Tlon Messenger is a group communication and collaboration product built on Urbit. Buckets extends a group with durable, group-owned file storage: a shared Drive or Dropbox that members and authorized Tlonbots can browse and change. Success means a member can understand where a file lives, who or what changed it, and what actions are available without needing to understand object storage, while files remain with the group when an uploader leaves.
+
+## Brand Personality
+
+Familiar, calm, communal. The interface should feel like a native part of Tlon Messenger and earn trust through predictable file-management patterns, concise language, and visible authorship. Agents are ordinary collaborators with a subtle bot marker, not a separate novelty layer.
+
+## Anti-references
+
+Do not resemble an S3 administration console, a second social gallery or feed, or a heavyweight enterprise document-management suite. Avoid storage jargon, dashboard decoration, card-grid sprawl, agent theater, and controls that imply per-file capabilities the backend cannot yet enforce.
+
+## Design Principles
+
+1. Make group ownership unmistakable: files belong to the shared space, not their uploader.
+2. Use earned familiarity: folders, breadcrumbs, list and grid views, selection, and direct manipulation should behave like trusted file tools.
+3. Treat humans and agents as accountable peers: authorize and attribute every action to the acting ship.
+4. Reveal complexity progressively: keep retrieval and upload immediate while placing metadata, activity, and administration one layer deeper.
+5. Preserve continuity with Messenger: reuse its channel shell, identity treatment, media previews, upload feedback, and responsive navigation.
+
+## Accessibility & Inclusion
+
+Target WCAG 2.2 AA. All file operations must work with keyboard and screen readers, have visible focus, use color-independent state cues, maintain touch targets of at least 44 by 44 points on mobile, respect reduced motion, and handle long user-generated names without hiding essential actions.
diff --git a/packages/app/fixtures/BucketsChannel.fixture.tsx b/packages/app/fixtures/BucketsChannel.fixture.tsx
new file mode 100644
index 0000000000..3d16d6434d
--- /dev/null
+++ b/packages/app/fixtures/BucketsChannel.fixture.tsx
@@ -0,0 +1,517 @@
+import * as db from '@tloncorp/shared/db';
+import { useEffect, useMemo, useState } from 'react';
+import { Linking, useWindowDimensions } from 'react-native';
+
+import {
+  BucketFileViewer,
+  BucketItem,
+  BucketSearchResult,
+  BucketsHeaderActions,
+  BucketsNewSheet,
+  BucketsPane,
+  BucketsPaneState,
+  BucketsSearchScreen,
+  ChannelHeader,
+  ChannelHeaderItemsProvider,
+  ScreenHeader,
+  XStack,
+  YStack,
+  useIsWindowNarrow,
+  useRegisterChannelHeaderItem,
+} from '../ui';
+import { FixtureWrapper } from './FixtureWrapper';
+
+const rootFolders: BucketItem[] = [
+  folder('launch', 'Launch', 6),
+  folder('brand', 'Brand', 12),
+  folder('research', 'Research', 8),
+  folder('archive', 'Archive', 24),
+];
+
+const searchRevealFolder = folder('field-notes', 'Field notes', 48);
+const searchRevealFiles = Array.from({ length: 48 }, (_, index) =>
+  file(
+    `field-record-${index}`,
+    index === 24 ? 'meadow-survey.pdf' : `site-record-${index + 1}.pdf`,
+    index === 24 ? '~marzod' : '~zod',
+    index === 24 ? 'Yesterday' : 'Last week',
+    index === 24 ? '4.2 MB' : '1.8 MB',
+    'application/pdf'
+  )
+);
+
+const initialFiles: Record<string, BucketItem[]> = {
+  root: [],
+  launch: [
+    file(
+      'launch-brief',
+      'launch-brief.pdf',
+      '~zod',
+      '12 min ago',
+      '2.4 MB',
+      'application/pdf',
+      false,
+      'https://www.w3.org/WAI/ER/tests/xhtml/testfiles/resources/pdf/dummy.pdf'
+    ),
+    file(
+      'homepage-final',
+      'homepage-final.fig',
+      '~marzod',
+      'Today',
+      '18.1 MB',
+      'application/x-figma'
+    ),
+    file(
+      'demo-cut',
+      'demo-cut.mp4',
+      'Scout',
+      'Today',
+      '84.6 MB',
+      'video/mp4',
+      true,
+      'https://d23dyxeqlo5psv.cloudfront.net/big_buck_bunny.mp4'
+    ),
+    {
+      ...file(
+        'assets-pack',
+        'assets-pack.zip',
+        '~zod',
+        'Uploading',
+        '146 MB',
+        'application/zip'
+      ),
+      uploadProgress: 42,
+    },
+  ],
+  brand: [
+    file(
+      'brand-system',
+      'brand-system.pdf',
+      '~marzod',
+      'Yesterday',
+      '6.8 MB',
+      'application/pdf'
+    ),
+    file(
+      'wordmark',
+      'wordmark.svg',
+      '~zod',
+      'Monday',
+      '38 KB',
+      'image/svg+xml',
+      false,
+      'https://d2w9rnfcy7mm78.cloudfront.net/25296321/original_81eb3ac8a95ce36dc8d64b1038234ec8.jpg'
+    ),
+  ],
+  research: [
+    file(
+      'member-notes',
+      'member-interviews.md',
+      'Scout',
+      'Yesterday',
+      '24 KB',
+      'text/markdown',
+      true,
+      'data:text/plain,',
+      '# Field interviews\n\nScout collected these notes during the first research pass.\n\n- Members want one shared place for project files.\n- Bots should use the same permissions as people.\n- Large uploads need visible progress and retry.'
+    ),
+  ],
+  archive: [],
+};
+
+const fakeChannel = {
+  id: 'buckets/~zod/project-files',
+  type: 'gallery',
+  title: 'Project Files',
+  description: '',
+} as db.Channel;
+
+type FixtureState = BucketsPaneState | 'read-only';
+type SearchOrigin = {
+  activeFolderId: string | null;
+  selectedItemId: string | null;
+};
+
+function folder(id: string, name: string, itemCount: number): BucketItem {
+  return {
+    id,
+    kind: 'folder',
+    name,
+    author: '',
+    modifiedLabel: '',
+    itemCount,
+  };
+}
+
+function file(
+  id: string,
+  name: string,
+  author: string,
+  modifiedLabel: string,
+  sizeLabel: string,
+  mimeType: string,
+  isBot = false,
+  previewUri?: string,
+  textContent?: string
+): BucketItem {
+  return {
+    id,
+    kind: 'file',
+    name,
+    author,
+    isBot,
+    mimeType,
+    modifiedLabel,
+    previewUri,
+    sizeLabel,
+    textContent,
+  };
+}
+
+function BucketsFixture({
+  initialFolderId,
+  includeSearchRevealFolder = false,
+  initialSearchQuery = '',
+  newSheetInitiallyOpen = false,
+  searchInitiallyOpen = false,
+  state = 'populated',
+  viewport,
+}: {
+  initialFolderId?: string | null;
+  includeSearchRevealFolder?: boolean;
+  initialSearchQuery?: string;
+  newSheetInitiallyOpen?: boolean;
+  searchInitiallyOpen?: boolean;
+  state?: FixtureState;
+  viewport: 'mobile' | 'desktop' | 'responsive';
+}) {
+  const { height: windowHeight } = useWindowDimensions();
+  const folders = useMemo(
+    () =>
+      includeSearchRevealFolder
+        ? [...rootFolders, searchRevealFolder]
+        : rootFolders,
+    [includeSearchRevealFolder]
+  );
+  const isWindowNarrow = useIsWindowNarrow();
+  const isMobileLayout =
+    viewport === 'mobile' || (viewport === 'responsive' && isWindowNarrow);
+  const [activeFolderId, setActiveFolderId] = useState<string | null>(
+    initialFolderId === undefined
+      ? isMobileLayout
+        ? null
+        : 'launch'
+      : initialFolderId
+  );
+  const [selectedItemId, setSelectedItemId] = useState<string | null>(
+    activeFolderId === 'launch' ? 'launch-brief' : null
+  );
+  const [newSheetOpen, setNewSheetOpen] = useState(newSheetInitiallyOpen);
+  const [searchOpen, setSearchOpen] = useState(searchInitiallyOpen);
+  const [searchOrigin, setSearchOrigin] = useState<SearchOrigin | null>(null);
+  const [query, setQuery] = useState(initialSearchQuery);
+  const [previewItem, setPreviewItem] = useState<BucketItem | null>(null);
+  const [localFiles, setLocalFiles] = useState(() =>
+    includeSearchRevealFolder
+      ? { ...initialFiles, 'field-notes': searchRevealFiles }
+      : initialFiles
+  );
+  const canEdit = state !== 'read-only';
+  const paneState: BucketsPaneState =
+    state === 'read-only' ? 'populated' : state;
+  const activeFolder = folders.find((item) => item.id === activeFolderId);
+  const currentKey = activeFolderId ?? 'root';
+  const rootItems = [...folders, ...(localFiles.root ?? [])];
+  const visibleItems = activeFolderId
+    ? localFiles[currentKey] ?? []
+    : rootItems;
+  const allSearchResults = useMemo<BucketSearchResult[]>(() => {
+    const results: BucketSearchResult[] = folders.map((item) => ({
+      ...item,
+      parentFolderId: null,
+      pathLabel: 'Project Files',
+    }));
+
+    Object.entries(localFiles).forEach(([folderId, items]) => {
+      const parentFolder = folders.find((item) => item.id === folderId);
+      const pathLabel = parentFolder
+        ? `Project Files / ${parentFolder.name}`
+        : 'Project Files';
+
+      items.forEach((item) => {
+        results.push({
+          ...item,
+          parentFolderId: parentFolder?.id ?? null,
+          pathLabel,
+        });
+      });
+    });
+
+    return results;
+  }, [folders, localFiles]);
+  const normalizedQuery = query.trim().toLowerCase();
+  const searchResults = normalizedQuery
+    ? allSearchResults.filter((item) =>
+        [item.name, item.pathLabel, item.author, item.mimeType]
+          .filter(Boolean)
+          .join(' ')
+          .toLowerCase()
+          .includes(normalizedQuery)
+      )
+    : [];
+
+  useEffect(() => {
+    if (!isMobileLayout && activeFolderId === null) {
+      setActiveFolderId('launch');
+    }
+  }, [activeFolderId, isMobileLayout]);
+
+  const openItem = (item: BucketItem) => {
+    if (item.kind === 'folder') {
+      setActiveFolderId(item.id);
+      setSelectedItemId(null);
+      setQuery('');
+      return;
+    }
+    setSelectedItemId(item.id);
+    if (item.previewUri) {
+      setPreviewItem(item);
+    }
+  };
+
+  const addFolder = () => {
+    const item = folder(`new-folder-${Date.now()}`, 'New folder', 0);
+    setLocalFiles((current) => ({
+      ...current,
+      [currentKey]: [item, ...(current[currentKey] ?? [])],
+    }));
+  };
+
+  const addUpload = () => {
+    const item = {
+      ...file(
+        `field-photo-${Date.now()}`,
+        'field-photo.jpg',
+        '~zod',
+        'Uploading',
+        '4.8 MB',
+        'image/jpeg'
+      ),
+      uploadProgress: 18,
+    };
+    setLocalFiles((current) => ({
+      ...current,
+      [currentKey]: [item, ...(current[currentKey] ?? [])],
+    }));
+  };
+
+  const openSearch = () => {
+    setSearchOrigin({ activeFolderId, selectedItemId });
+    setSearchOpen(true);
+    setQuery('');
+  };
+
+  const closeSearch = () => {
+    if (searchOrigin) {
+      setActiveFolderId(searchOrigin.activeFolderId);
+      setSelectedItemId(searchOrigin.selectedItemId);
+    }
+    setSearchOrigin(null);
+    setSearchOpen(false);
+    setQuery('');
+  };
+
+  const openSearchResult = (result: BucketSearchResult) => {
+    setSearchOrigin((current) => current ?? { activeFolderId, selectedItemId });
+    if (result.kind === 'folder') {
+      setActiveFolderId(result.id);
+      setSelectedItemId(null);
+    } else {
+      setActiveFolderId(result.parentFolderId);
+      setSelectedItemId(result.id);
+    }
+    setSearchOpen(false);
+  };
+
+  const paneProps = {
+    canEdit,
+    currentFolder: isMobileLayout ? undefined : activeFolder?.name,
+    items: paneState === 'empty' ? [] : visibleItems,
+    selectedItemId,
+    state: paneState,
+    onOpenItem: openItem,
+    onDeleteItem: (item: BucketItem) =>
+      setLocalFiles((current) => ({
+        ...current,
+        [currentKey]: (current[currentKey] ?? []).filter(
+          (candidate) => candidate.id !== item.id
+        ),
+      })),
+    onDownloadItem: (item: BucketItem) => setSelectedItemId(item.id),
+    onMoveItem: (item: BucketItem) => setSelectedItemId(item.id),
+    onRenameItem: (item: BucketItem) => setSelectedItemId(item.id),
+  };
+
+  return (
+    <FixtureWrapper fillWidth fillHeight backgroundColor="$secondaryBackground">
+      <YStack width="100%" height={windowHeight}>
+        <ChannelHeaderItemsProvider>
+          {previewItem?.previewUri ? (
+            <BucketFileViewer
+              item={{
+                name: previewItem.name,
+                mimeType: previewItem.mimeType,
+                sizeLabel: previewItem.sizeLabel,
+                textContent: previewItem.textContent,
+                uri: previewItem.previewUri,
+              }}
+              onClose={() => setPreviewItem(null)}
+              onOpenExternally={() => Linking.openURL(previewItem.previewUri!)}
+            />
+          ) : searchOpen ? (
+            <BucketsSearchScreen
+              query={query}
+              results={searchResults}
+              onChangeQuery={setQuery}
+              onClose={closeSearch}
+              onOpenResult={openSearchResult}
+            />
+          ) : isMobileLayout ? (
+            <YStack
+              flex={1}
+              width="100%"
+              height="100%"
+              backgroundColor="$background"
+            >
+              <RegisteredHeaderActions
+                canEdit={canEdit}
+                onNew={() => setNewSheetOpen(true)}
+                onSearch={openSearch}
+              />
+              <ChannelHeader
+                channel={fakeChannel}
+                description=""
+                goToSearch={openSearch}
+                goBack={() => {
+                  if (searchOrigin) {
+                    setSearchOpen(true);
+                    return;
+                  }
+                  if (activeFolderId) {
+                    setActiveFolderId(null);
+                    setSelectedItemId(null);
+                  }
+                }}
+                hideIdentity
+                preferProvidedTitle
+                showSearchButton
+                title={activeFolder?.name ?? 'Project Files'}
+              />
+              <BucketsPane {...paneProps} layout="stack" />
+              <BucketsNewSheet
+                open={newSheetOpen}
+                onNewFolder={addFolder}
+                onOpenChange={setNewSheetOpen}
+                onUploadFiles={addUpload}
+              />
+            </YStack>
+          ) : (
+            <XStack flex={1} width="100%" height="100%">
+              <YStack
+                width={325}
+                height="100%"
+                backgroundColor="$background"
+                borderRightColor="$border"
+                borderRightWidth={1}
+              >
+                <ScreenHeader
+                  backAction={
+                    searchOrigin ? () => setSearchOpen(true) : undefined
+                  }
+                  borderBottom
+                  title="Project Files"
+                />
+                <BucketsPane
+                  canEdit={canEdit}
+                  items={folders}
+                  layout="takeover"
+                  selectedItemId={activeFolderId}
+                  state="populated"
+                  onOpenItem={openItem}
+                />
+              </YStack>
+              <YStack flex={1} minWidth={0} backgroundColor="$background">
+                <ScreenHeader
+                  borderBottom
+                  rightControls={
+                    <BucketsHeaderActions
+                      canEdit={canEdit}
+                      onNew={() => setNewSheetOpen(true)}
+                      onSearch={openSearch}
+                    />
+                  }
+                  showSubtitle
+                  subtitle="Bucket"
+                  title="Project Files"
+                  useHorizontalTitleLayout
+                />
+                <BucketsPane {...paneProps} layout="stack" />
+                <BucketsNewSheet
+                  open={newSheetOpen}
+                  onNewFolder={addFolder}
+                  onOpenChange={setNewSheetOpen}
+                  onUploadFiles={addUpload}
+                />
+              </YStack>
+            </XStack>
+          )}
+        </ChannelHeaderItemsProvider>
+      </YStack>
+    </FixtureWrapper>
+  );
+}
+
+function RegisteredHeaderActions({
+  canEdit,
+  onNew,
+  onSearch,
+}: {
+  canEdit: boolean;
+  onNew: () => void;
+  onSearch: () => void;
+}) {
+  const actions = useMemo(
+    () => (
+      <BucketsHeaderActions
+        canEdit={canEdit}
+        onNew={onNew}
+        onSearch={onSearch}
+        showSearch={false}
+      />
+    ),
+    [canEdit, onNew, onSearch]
+  );
+  useRegisterChannelHeaderItem(actions);
+  return null;
+}
+
+export default {
+  Mobile: <BucketsFixture viewport="mobile" />,
+  'Mobile folder': (
+    <BucketsFixture viewport="mobile" initialFolderId="launch" />
+  ),
+  Desktop: <BucketsFixture viewport="responsive" />,
+  Search: <BucketsFixture viewport="responsive" searchInitiallyOpen />,
+  'Search reveal': (
+    <BucketsFixture
+      viewport="responsive"
+      searchInitiallyOpen
+      includeSearchRevealFolder
+      initialSearchQuery="meadow"
+    />
+  ),
+  'New action': <BucketsFixture viewport="mobile" newSheetInitiallyOpen />,
+  Empty: <BucketsFixture viewport="mobile" state="empty" />,
+  Loading: <BucketsFixture viewport="mobile" state="loading" />,
+  'Read only': <BucketsFixture viewport="responsive" state="read-only" />,
+};
diff --git a/packages/app/ui/components/BucketsChannel/BucketFileViewer.native.tsx b/packages/app/ui/components/BucketsChannel/BucketFileViewer.native.tsx
new file mode 100644
index 0000000000..f55bbf02dd
--- /dev/null
+++ b/packages/app/ui/components/BucketsChannel/BucketFileViewer.native.tsx
@@ -0,0 +1,144 @@
+import { FilePreview, Image, Pressable, Text } from '@tloncorp/ui';
+import { VideoView, useVideoPlayer } from 'expo-video';
+import { Platform } from 'react-native';
+import { WebView } from 'react-native-webview';
+import { ScrollView, View, YStack } from 'tamagui';
+
+import { useWebView } from '../../../hooks/useWebview';
+import { ScreenHeader } from '../ScreenHeader';
+import {
+  BucketFileViewerItem,
+  getBucketPreviewKind,
+} from './BucketFileViewer.shared';
+
+export function BucketFileViewer({
+  item,
+  onClose,
+  onOpenExternally,
+}: {
+  item: BucketFileViewerItem;
+  onClose: () => void;
+  onOpenExternally: () => void;
+}) {
+  const previewKind = getBucketPreviewKind(item);
+  const webview = useWebView();
+
+  return (
+    <YStack flex={1} minHeight={0} backgroundColor="$background">
+      <ScreenHeader
+        backAction={onClose}
+        borderBottom
+        rightControls={
+          <ScreenHeader.TextButton onPress={onOpenExternally}>
+            Open
+          </ScreenHeader.TextButton>
+        }
+        showSubtitle
+        subtitle={item.sizeLabel ?? 'File'}
+        title={item.name}
+      />
+      <View flex={1} minHeight={0} backgroundColor="$secondaryBackground">
+        {previewKind === 'image' ? (
+          <Image
+            source={{ uri: item.uri }}
+            width="100%"
+            height="100%"
+            contentFit="contain"
+            alt={item.name}
+          />
+        ) : previewKind === 'video' ? (
+          <NativeVideoPreview uri={item.uri} />
+        ) : previewKind === 'pdf' && Platform.OS === 'ios' && webview ? (
+          <WebView webview={webview} source={{ uri: item.uri }} />
+        ) : previewKind === 'text' && item.textContent ? (
+          <ScrollView flex={1}>
+            <Text
+              color="$primaryText"
+              fontFamily="$mono"
+              lineHeight={24}
+              padding="$2xl"
+              selectable
+              size="$body"
+            >
+              {item.textContent}
+            </Text>
+          </ScrollView>
+        ) : (
+          <UnsupportedPreview
+            item={item}
+            isAndroidPdf={previewKind === 'pdf' && Platform.OS === 'android'}
+            onOpen={onOpenExternally}
+          />
+        )}
+      </View>
+    </YStack>
+  );
+}
+
+function NativeVideoPreview({ uri }: { uri: string }) {
+  const player = useVideoPlayer({ uri }, (videoPlayer) => {
+    videoPlayer.play();
+  });
+
+  return (
+    <View flex={1} alignItems="center" justifyContent="center" padding="$l">
+      <VideoView
+        player={player}
+        nativeControls
+        contentFit="contain"
+        style={{ aspectRatio: 16 / 9, width: '100%' }}
+      />
+    </View>
+  );
+}
+
+function UnsupportedPreview({
+  isAndroidPdf,
+  item,
+  onOpen,
+}: {
+  isAndroidPdf: boolean;
+  item: BucketFileViewerItem;
+  onOpen: () => void;
+}) {
+  return (
+    <YStack
+      flex={1}
+      alignItems="center"
+      justifyContent="center"
+      gap="$l"
+      padding="$2xl"
+    >
+      <FilePreview
+        fileExtensionLabel={
+          FilePreview.fileExtensionFrom({
+            filename: item.name,
+            mimeType: item.mimeType,
+          }) ?? undefined
+        }
+        size="m"
+      />
+      <YStack alignItems="center" gap="$xs">
+        <Text color="$primaryText" size="$label/l">
+          {isAndroidPdf ? 'Open PDF to view' : 'Preview unavailable'}
+        </Text>
+        <Text color="$tertiaryText" size="$label/m" textAlign="center">
+          {isAndroidPdf
+            ? 'PDFs open in your device viewer.'
+            : 'Open this file in another app to view it.'}
+        </Text>
+      </YStack>
+      <Pressable
+        backgroundColor="$primaryText"
+        borderRadius="$xl"
+        onPress={onOpen}
+        paddingHorizontal="$xl"
+        paddingVertical="$m"
+      >
+        <Text color="$background" size="$label/l">
+          Open file
+        </Text>
+      </Pressable>
+    </YStack>
+  );
+}
diff --git a/packages/app/ui/components/BucketsChannel/BucketFileViewer.shared.test.ts b/packages/app/ui/components/BucketsChannel/BucketFileViewer.shared.test.ts
new file mode 100644
index 0000000000..11ae85cbe4
--- /dev/null
+++ b/packages/app/ui/components/BucketsChannel/BucketFileViewer.shared.test.ts
@@ -0,0 +1,15 @@
+import { describe, expect, it } from 'vitest';
+
+import { getBucketPreviewKind } from './BucketFileViewer.shared';
+
+describe('getBucketPreviewKind', () => {
+  it.each([
+    ['photo.jpg', 'image/jpeg', 'image'],
+    ['demo.mp4', 'video/mp4', 'video'],
+    ['notes.md', undefined, 'text'],
+    ['report.pdf', undefined, 'pdf'],
+    ['archive.zip', 'application/zip', 'unsupported'],
+  ] as const)('classifies %s as %s', (name, mimeType, expected) => {
+    expect(getBucketPreviewKind({ name, mimeType })).toBe(expected);
+  });
+});
diff --git a/packages/app/ui/components/BucketsChannel/BucketFileViewer.shared.ts b/packages/app/ui/components/BucketsChannel/BucketFileViewer.shared.ts
new file mode 100644
index 0000000000..9f5ed91d5e
--- /dev/null
+++ b/packages/app/ui/components/BucketsChannel/BucketFileViewer.shared.ts
@@ -0,0 +1,40 @@
+export type BucketPreviewKind =
+  | 'image'
+  | 'video'
+  | 'text'
+  | 'pdf'
+  | 'unsupported';
+
+export type BucketFileViewerItem = {
+  name: string;
+  mimeType?: string;
+  sizeLabel?: string;
+  uri: string;
+  textContent?: string;
+};
+
+export function getBucketPreviewKind({
+  mimeType,
+  name,
+}: Pick<BucketFileViewerItem, 'mimeType' | 'name'>): BucketPreviewKind {
+  const normalizedMimeType = mimeType?.toLowerCase() ?? '';
+  const extension = name.split('.').pop()?.toLowerCase();
+
+  if (normalizedMimeType.startsWith('image/')) {
+    return 'image';
+  }
+  if (normalizedMimeType.startsWith('video/')) {
+    return 'video';
+  }
+  if (
+    normalizedMimeType.startsWith('text/') ||
+    ['md', 'markdown', 'txt', 'json', 'csv'].includes(extension ?? '')
+  ) {
+    return 'text';
+  }
+  if (normalizedMimeType === 'application/pdf' || extension === 'pdf') {
+    return 'pdf';
+  }
+
+  return 'unsupported';
+}
diff --git a/packages/app/ui/components/BucketsChannel/BucketFileViewer.tsx b/packages/app/ui/components/BucketsChannel/BucketFileViewer.tsx
new file mode 100644
index 0000000000..7d6d44107b
--- /dev/null
+++ b/packages/app/ui/components/BucketsChannel/BucketFileViewer.tsx
@@ -0,0 +1,131 @@
+import { FilePreview, Image, Pressable, Text } from '@tloncorp/ui';
+import { ScrollView, View, YStack } from 'tamagui';
+
+import { ScreenHeader } from '../ScreenHeader';
+import {
+  BucketFileViewerItem,
+  getBucketPreviewKind,
+} from './BucketFileViewer.shared';
+
+export function BucketFileViewer({
+  item,
+  onClose,
+  onOpenExternally,
+}: {
+  item: BucketFileViewerItem;
+  onClose: () => void;
+  onOpenExternally: () => void;
+}) {
+  const previewKind = getBucketPreviewKind(item);
+
+  return (
+    <YStack flex={1} minHeight={0} backgroundColor="$background">
+      <ScreenHeader
+        backAction={onClose}
+        borderBottom
+        rightControls={
+          <ScreenHeader.TextButton onPress={onOpenExternally}>
+            Open
+          </ScreenHeader.TextButton>
+        }
+        showSubtitle
+        subtitle={item.sizeLabel ?? 'File'}
+        title={item.name}
+        useHorizontalTitleLayout
+      />
+      <View flex={1} minHeight={0} backgroundColor="$secondaryBackground">
+        {previewKind === 'image' ? (
+          <Image
+            source={{ uri: item.uri }}
+            width="100%"
+            height="100%"
+            contentFit="contain"
+            alt={item.name}
+          />
+        ) : previewKind === 'video' ? (
+          <View
+            flex={1}
+            alignItems="center"
+            justifyContent="center"
+            padding="$l"
+          >
+            <video
+              src={item.uri}
+              controls
+              preload="metadata"
+              style={{ display: 'block', maxHeight: '100%', maxWidth: '100%' }}
+            />
+          </View>
+        ) : previewKind === 'pdf' ? (
+          <iframe
+            src={item.uri}
+            title={item.name}
+            style={{ border: 0, height: '100%', width: '100%' }}
+          />
+        ) : previewKind === 'text' && item.textContent ? (
+          <ScrollView flex={1}>
+            <Text
+              color="$primaryText"
+              fontFamily="$mono"
+              lineHeight={24}
+              padding="$2xl"
+              selectable
+              size="$body"
+            >
+              {item.textContent}
+            </Text>
+          </ScrollView>
+        ) : (
+          <UnsupportedPreview item={item} onOpen={onOpenExternally} />
+        )}
+      </View>
+    </YStack>
+  );
+}
+
+function UnsupportedPreview({
+  item,
+  onOpen,
+}: {
+  item: BucketFileViewerItem;
+  onOpen: () => void;
+}) {
+  return (
+    <YStack
+      flex={1}
+      alignItems="center"
+      justifyContent="center"
+      gap="$l"
+      padding="$2xl"
+    >
+      <FilePreview
+        fileExtensionLabel={
+          FilePreview.fileExtensionFrom({
+            filename: item.name,
+            mimeType: item.mimeType,
+          }) ?? undefined
+        }
+        size="m"
+      />
+      <YStack alignItems="center" gap="$xs">
+        <Text color="$primaryText" size="$label/l">
+          Preview unavailable
+        </Text>
+        <Text color="$tertiaryText" size="$label/m" textAlign="center">
+          Open this file in another app to view it.
+        </Text>
+      </YStack>
+      <Pressable
+        backgroundColor="$primaryText"
+        borderRadius="$xl"
+        onPress={onOpen}
+        paddingHorizontal="$xl"
+        paddingVertical="$m"
+      >
+        <Text color="$background" size="$label/l">
+          Open file
+        </Text>
+      </Pressable>
+    </YStack>
+  );
+}
diff --git a/packages/app/ui/components/BucketsChannel/BucketsChannel.tsx b/packages/app/ui/components/BucketsChannel/BucketsChannel.tsx
new file mode 100644
index 0000000000..488f87773e
--- /dev/null
+++ b/packages/app/ui/components/BucketsChannel/BucketsChannel.tsx
@@ -0,0 +1,722 @@
+import {
+  FilePreview,
+  Icon,
+  Pressable,
+  Text,
+  useIsWindowNarrow,
+} from '@tloncorp/ui';
+import { useEffect, useRef, useState } from 'react';
+import { Platform } from 'react-native';
+import { ScrollView, View, XStack, YStack } from 'tamagui';
+
+import { ActionSheet, createActionGroups } from '../ActionSheet';
+import { Badge } from '../Badge';
+import { ListItem } from '../ListItem';
+import { NotesActionMenu } from '../NotesChannel/NotesActions';
+import { OverflowTriggerButton } from '../OverflowMenuButton';
+import { ScreenHeader } from '../ScreenHeader';
+import { SearchBar } from '../SearchBar';
+
+export type BucketItem = {
+  id: string;
+  kind: 'file' | 'folder';
+  name: string;
+  author: string;
+  isBot?: boolean;
+  modifiedLabel: string;
+  sizeLabel?: string;
+  itemCount?: number;
+  mimeType?: string;
+  previewUri?: string;
+  textContent?: string;
+  uploadProgress?: number;
+};
+
+export type BucketsPaneState = 'empty' | 'loading' | 'populated';
+
+export type BucketSearchResult = BucketItem & {
+  parentFolderId: string | null;
+  pathLabel: string;
+};
+
+const bucketRowHeight = 72;
+const bucketRowGap = 4;
+
+export function BucketsHeaderActions({
+  canEdit,
+  onNew,
+  onSearch,
+  primaryActionVariant = 'text',
+  showSearch = true,
+}: {
+  canEdit: boolean;
+  onNew: () => void;
+  onSearch: () => void;
+  primaryActionVariant?: 'icon' | 'text';
+  showSearch?: boolean;
+}) {
+  return (
+    <>
+      {showSearch ? (
+        <ScreenHeader.IconButton
+          accessibilityLabel="Search files"
+          alignItems="center"
+          aria-label="Search files"
+          onPress={onSearch}
+          testID="BucketsSearchHeaderAction"
+          type="Search"
+        />
+      ) : null}
+      {canEdit && primaryActionVariant === 'icon' ? (
+        <ScreenHeader.IconButton
+          aria-label="New"
+          onPress={onNew}
+          testID="BucketsNewHeaderAction"
+          type="Add"
+        />
+      ) : canEdit ? (
+        <ScreenHeader.TextButton
+          onPress={onNew}
+          testID="BucketsNewHeaderAction"
+        >
+          New
+        </ScreenHeader.TextButton>
+      ) : null}
+    </>
+  );
+}
+
+export function BucketsSearchScreen({
+  bucketTitle = 'Project Files',
+  query,
+  results,
+  onChangeQuery,
+  onClose,
+  onOpenResult,
+}: {
+  bucketTitle?: string;
+  query: string;
+  results: BucketSearchResult[];
+  onChangeQuery: (query: string) => void;
+  onClose: () => void;
+  onOpenResult: (result: BucketSearchResult) => void;
+}) {
+  const isWindowNarrow = useIsWindowNarrow();
+  const hasQuery = query.trim().length > 0;
+
+  return (
+    <YStack
+      flex={1}
+      minWidth={0}
+      width="100%"
+      height="100%"
+      backgroundColor="$background"
+    >
+      <ScreenHeader
+        backAction={onClose}
+        borderBottom
+        title={`Search ${bucketTitle}`}
+        useHorizontalTitleLayout={!isWindowNarrow}
+      />
+      <YStack
+        flex={1}
+        minHeight={0}
+        width="100%"
+        maxWidth={760}
+        marginHorizontal="auto"
+        paddingHorizontal="$l"
+        paddingTop="$2xl"
+      >
+        <XStack flexShrink={0} width="100%">
+          <SearchBar
+            autoFocus
+            initialValue={query}
+            onChangeQuery={onChangeQuery}
+            onPressCancel={onClose}
+            placeholder={`Search ${bucketTitle}`}
+          />
+        </XStack>
+
+        {!hasQuery ? (
+          <YStack alignItems="center" gap="$s" paddingTop="$3xl">
+            <Text color="$secondaryText" size="$label/l" textAlign="center">
+              Enter a search term to get started
+            </Text>
+            <Text color="$tertiaryText" size="$label/m" textAlign="center">
+              Search filenames, folders, and members across this Bucket.
+            </Text>
+          </YStack>
+        ) : results.length === 0 ? (
+          <YStack alignItems="center" gap="$s" paddingTop="$3xl">
+            <Text color="$secondaryText" size="$label/l" textAlign="center">
+              No results found
+            </Text>
+            <Text color="$tertiaryText" size="$label/m" textAlign="center">
+              Searched the entire Bucket.
+            </Text>
+          </YStack>
+        ) : (
+          <YStack flex={1} minHeight={0} paddingTop="$2xl">
+            <XStack
+              alignItems="center"
+              justifyContent="space-between"
+              gap="$l"
+              paddingHorizontal="$s"
+              paddingBottom="$m"
+            >
+              <Text color="$secondaryText" numberOfLines={1} size="$label/m">
+                {results.length === 1
+                  ? '1 result'
+                  : `${results.length} results`}
+              </Text>
+              <Text color="$tertiaryText" numberOfLines={1} size="$label/m">
+                Entire Bucket
+              </Text>
+            </XStack>
+            <ScrollView flex={1}>
+              <YStack gap="$xs" paddingBottom="$2xl">
+                {results.map((result) => (
+                  <BucketSearchRow
+                    key={`${result.parentFolderId ?? 'root'}-${result.id}`}
+                    result={result}
+                    onOpenResult={onOpenResult}
+                  />
+                ))}
+              </YStack>
+            </ScrollView>
+          </YStack>
+        )}
+      </YStack>
+    </YStack>
+  );
+}
+
+export function BucketsPane({
+  canEdit,
+  currentFolder,
+  items,
+  layout = 'stack',
+  rootLabel = 'Project Files',
+  selectedItemId,
+  state = 'populated',
+  onDeleteItem,
+  onDownloadItem,
+  onMoveItem,
+  onOpenItem,
+  onRenameItem,
+}: {
+  canEdit: boolean;
+  currentFolder?: string | null;
+  items: BucketItem[];
+  layout?: 'stack' | 'takeover';
+  rootLabel?: string;
+  selectedItemId?: string | null;
+  state?: BucketsPaneState;
+  onDeleteItem?: (item: BucketItem) => void;
+  onDownloadItem?: (item: BucketItem) => void;
+  onMoveItem?: (item: BucketItem) => void;
+  onOpenItem: (item: BucketItem) => void;
+  onRenameItem?: (item: BucketItem) => void;
+}) {
+  const scrollViewRef = useRef<ScrollView>(null);
+  const [viewportHeight, setViewportHeight] = useState(0);
+  const selectedIndex = selectedItemId
+    ? items.findIndex((item) => item.id === selectedItemId)
+    : -1;
+
+  useEffect(() => {
+    if (selectedIndex < 0 || !viewportHeight) {
+      return;
+    }
+
+    const itemOffset = selectedIndex * (bucketRowHeight + bucketRowGap);
+    const targetY = Math.max(
+      0,
+      itemOffset - (viewportHeight - bucketRowHeight) / 2
+    );
+    const timer = setTimeout(() => {
+      scrollViewRef.current?.scrollTo({ animated: true, y: targetY });
+    }, 0);
+
+    return () => clearTimeout(timer);
+  }, [selectedIndex, viewportHeight]);
+
+  const list =
+    state === 'loading' ? (
+      <BucketsLoadingRows />
+    ) : state === 'empty' || items.length === 0 ? (
+      <BucketsEmptyState canEdit={canEdit} />
+    ) : (
+      <YStack gap="$xs">
+        {items.map((item) => (
+          <BucketRow
+            key={item.id}
+            canEdit={canEdit}
+            item={item}
+            selected={selectedItemId === item.id}
+            onDeleteItem={onDeleteItem}
+            onDownloadItem={onDownloadItem}
+            onMoveItem={onMoveItem}
+            onOpenItem={onOpenItem}
+            onRenameItem={onRenameItem}
+          />
+        ))}
+      </YStack>
+    );
+
+  return (
+    <YStack flex={1} minHeight={0} backgroundColor="$background">
+      {currentFolder ? (
+        <BucketBreadcrumb rootLabel={rootLabel} folderLabel={currentFolder} />
+      ) : null}
+      <ScrollView
+        ref={scrollViewRef}
+        flex={1}
+        onLayout={(event) => setViewportHeight(event.nativeEvent.layout.height)}
+      >
+        <YStack
+          width="100%"
+          maxWidth={layout === 'takeover' ? 'unset' : 760}
+          marginHorizontal="auto"
+          paddingHorizontal="$l"
+          paddingTop={currentFolder ? '$xs' : '$m'}
+          paddingBottom="$2xl"
+        >
+          {list}
+        </YStack>
+      </ScrollView>
+    </YStack>
+  );
+}
+
+function BucketRow({
+  canEdit,
+  item,
+  selected,
+  onDeleteItem,
+  onDownloadItem,
+  onMoveItem,
+  onOpenItem,
+  onRenameItem,
+}: {
+  canEdit: boolean;
+  item: BucketItem;
+  selected: boolean;
+  onDeleteItem?: (item: BucketItem) => void;
+  onDownloadItem?: (item: BucketItem) => void;
+  onMoveItem?: (item: BucketItem) => void;
+  onOpenItem: (item: BucketItem) => void;
+  onRenameItem?: (item: BucketItem) => void;
+}) {
+  const [isHovered, setIsHovered] = useState(false);
+  const [open, setOpen] = useState(false);
+  const isWindowNarrow = useIsWindowNarrow();
+  const showOverflow =
+    Platform.OS !== 'web' || isWindowNarrow || isHovered || open;
+  const groups = createActionGroups(
+    [
+      'neutral',
+      {
+        title: item.kind === 'folder' ? 'Open folder' : 'Open',
+        startIcon: item.kind === 'folder' ? 'Folder' : 'EyeOpen',
+        action: () => onOpenItem(item),
+      },
+      item.kind === 'file' && {
+        title: 'Download',
+        startIcon: 'ArrowDown',
+        action: () => onDownloadItem?.(item),
+      },
+    ],
+    canEdit && [
+      'neutral',
+      {
+        title: `Rename ${item.kind}`,
+        startIcon: 'EditList',
+        action: () => onRenameItem?.(item),
+      },
+      {
+        title: `Move ${item.kind}`,
+        startIcon: 'Folder',
+        action: () => onMoveItem?.(item),
+      },
+    ],
+    canEdit && [
+      'negative',
+      {
+        title: `Delete ${item.kind}`,
+        startIcon: 'Trash',
+        action: () => onDeleteItem?.(item),
+      },
+    ]
+  );
+  const trigger = showOverflow ? (
+    <OverflowTriggerButton
+      aria-label={`Actions for ${item.name}`}
+      onPress={(event) => {
+        event.stopPropagation();
+        if (isWindowNarrow) {
+          setOpen((currentOpen) => !currentOpen);
+        }
+      }}
+      paddingHorizontal="$xs"
+      paddingVertical="$xs"
+      testID={`BucketsItemActions-${item.id}`}
+    />
+  ) : null;
+
+  return (
+    <Pressable
+      aria-label={`${item.kind === 'folder' ? 'Folder' : 'File'} ${item.name}`}
+      onLongPress={() => setOpen(true)}
+      onMouseEnter={() => setIsHovered(true)}
+      onMouseLeave={() => setIsHovered(false)}
+      onPress={() => onOpenItem(item)}
+      testID={`BucketsItem-${item.id}`}
+    >
+      <ListItem
+        alignItems="stretch"
+        backgroundColor={selected ? '$shadow' : '$transparent'}
+        borderRadius="$xl"
+        gap="$l"
+        hoverStyle={{ backgroundColor: '$secondaryBackground' }}
+        minHeight={bucketRowHeight}
+        padding="$l"
+      >
+        <BucketItemIcon item={item} />
+        <ListItem.MainContent minWidth={0}>
+          <ListItem.Title
+            color="$primaryText"
+            fontWeight="400"
+            letterSpacing={0}
+            size="$body"
+          >
+            {item.name}
+          </ListItem.Title>
+          <BucketItemMetadata item={item} />
+        </ListItem.MainContent>
+        <ListItem.EndContent minWidth="$3xl">
+          {showOverflow ? (
+            <NotesActionMenu
+              groups={groups}
+              header={{
+                icon: item.kind === 'folder' ? 'Folder' : 'Attachment',
+                subtitle: metadataLabel(item),
+                title: item.name,
+              }}
+              open={open}
+              onOpenChange={setOpen}
+              trigger={trigger}
+            />
+          ) : item.kind === 'folder' ? (
+            <Icon color="$tertiaryText" size="$m" type="ChevronRight" />
+          ) : null}
+        </ListItem.EndContent>
+      </ListItem>
+    </Pressable>
+  );
+}
+
+function BucketSearchRow({
+  result,
+  onOpenResult,
+}: {
+  result: BucketSearchResult;
+  onOpenResult: (result: BucketSearchResult) => void;
+}) {
+  return (
+    <Pressable
+      aria-label={`Open ${result.name} in ${result.pathLabel}`}
+      onPress={() => onOpenResult(result)}
+      testID={`BucketsSearchResult-${result.id}`}
+    >
+      <ListItem
+        alignItems="stretch"
+        borderRadius="$xl"
+        gap="$l"
+        hoverStyle={{ backgroundColor: '$secondaryBackground' }}
+        padding="$l"
+      >
+        <BucketItemIcon item={result} />
+        <ListItem.MainContent minWidth={0}>
+          <ListItem.Title
+            color="$primaryText"
+            fontWeight="400"
+            letterSpacing={0}
+            numberOfLines={1}
+            size="$body"
+          >
+            {result.name}
+          </ListItem.Title>
+          <XStack alignItems="center" gap="$xs" minWidth={0}>
+            <Text
+              color="$tertiaryText"
+              flexShrink={1}
+              numberOfLines={1}
+              size="$label/m"
+            >
+              {result.pathLabel}
+              {result.kind === 'file' && result.author
+                ? ` · ${result.author}`
+                : ''}
+            </Text>
+            {result.isBot ? (
+              <Badge type="neutral" size="micro" text="Bot" />
+            ) : null}
+          </XStack>
+        </ListItem.MainContent>
+        <ListItem.EndContent minWidth="$xl">
+          <Icon color="$tertiaryText" size="$m" type="ChevronRight" />
+        </ListItem.EndContent>
+      </ListItem>
+    </Pressable>
+  );
+}
+
+export function BucketsNewSheet({
+  open,
+  onNewFolder,
+  onOpenChange,
+  onUploadFiles,
+}: {
+  open: boolean;
+  onNewFolder: () => void;
+  onOpenChange: (open: boolean) => void;
+  onUploadFiles: () => void;
+}) {
+  return (
+    <ActionSheet
+      open={open}
+      onOpenChange={onOpenChange}
+      modal
+      snapPointsMode="fit"
+      unmountOnClose
+    >
+      <ActionSheet.SimpleHeader
+        title="New"
+        subtitle="Add something to this folder"
+      />
+      <ActionSheet.Content>
+        <ActionSheet.ActionGroup accent="neutral">
+          <ActionSheet.Action
+            action={{
+              title: 'Upload files',
+              startIcon: 'Attachment',
+              action: () => {
+                onOpenChange(false);
+                onUploadFiles();
+              },
+            }}
+            testID="BucketsUploadFilesAction"
+          />
+          <ActionSheet.Action
+            action={{
+              title: 'New folder',
+              startIcon: 'Folder',
+              action: () => {
+                onOpenChange(false);
+                onNewFolder();
+              },
+            }}
+            testID="BucketsNewFolderAction"
+          />
+        </ActionSheet.ActionGroup>
+      </ActionSheet.Content>
+    </ActionSheet>
+  );
+}
+
+function BucketItemIcon({ item }: { item: BucketItem }) {
+  if (item.kind === 'folder') {
+    return <ListItem.SystemIcon icon="Folder" />;
+  }
+
+  return (
+    <YStack
+      width="$4xl"
+      height="$4xl"
+      alignItems="center"
+      justifyContent="center"
+      borderRadius="$s"
+      backgroundColor="$secondaryBackground"
+      overflow="hidden"
+    >
+      <FilePreview
+        fileExtensionLabel={
+          FilePreview.fileExtensionFrom({
+            filename: item.name,
+            mimeType: item.mimeType,
+          }) ?? undefined
+        }
+        size="s"
+      />
+    </YStack>
+  );
+}
+
+function BucketItemMetadata({ item }: { item: BucketItem }) {
+  if (item.kind === 'folder') {
+    return (
+      <ListItem.Subtitle>
+        {item.itemCount === 1 ? '1 item' : `${item.itemCount ?? 0} items`}
+      </ListItem.Subtitle>
+    );
+  }
+
+  if (item.uploadProgress !== undefined) {
+    return (
+      <XStack alignItems="center" gap="$s" minWidth={0}>
+        <XStack alignItems="center" gap="$xs" flex={1} minWidth={0}>
+          <Text color="$tertiaryText" numberOfLines={1} size="$label/m">
+            {item.author}
+          </Text>
+          {item.isBot ? <Badge type="neutral" size="micro" text="Bot" /> : null}
+          <Text
+            color="$tertiaryText"
+            flexShrink={1}
+            numberOfLines={1}
+            size="$label/m"
+          >
+            · Uploading
+          </Text>
+        </XStack>
+        <UploadProgress progress={item.uploadProgress} />
+      </XStack>
+    );
+  }
+
+  return (
+    <XStack alignItems="center" gap="$xs" minWidth={0}>
+      <Text color="$tertiaryText" numberOfLines={1} size="$label/m">
+        {item.author}
+      </Text>
+      {item.isBot ? <Badge type="neutral" size="micro" text="Bot" /> : null}
+      <Text
+        color="$tertiaryText"
+        flexShrink={1}
+        numberOfLines={1}
+        size="$label/m"
+      >
+        · {item.modifiedLabel}
+        {item.sizeLabel ? ` · ${item.sizeLabel}` : ''}
+      </Text>
+    </XStack>
+  );
+}
+
+function BucketBreadcrumb({
+  folderLabel,
+  rootLabel,
+}: {
+  folderLabel: string;
+  rootLabel: string;
+}) {
+  return (
+    <XStack
+      alignItems="center"
+      gap="$m"
+      maxWidth={760}
+      width="100%"
+      marginHorizontal="auto"
+      paddingHorizontal="$xl"
+      paddingTop="$l"
+      paddingBottom="$s"
+    >
+      <Text color="$secondaryText" size="$label/l">
+        {rootLabel}
+      </Text>
+      <Text color="$tertiaryText" size="$label/l">
+        /
+      </Text>
+      <Text color="$primaryText" numberOfLines={1} size="$label/l">
+        {folderLabel}
+      </Text>
+    </XStack>
+  );
+}
+
+function UploadProgress({ progress }: { progress: number }) {
+  const normalizedProgress = Math.max(0, Math.min(100, progress));
+  return (
+    <XStack alignItems="center" gap="$s" flexShrink={0}>
+      <View
+        width={54}
+        height={2}
+        backgroundColor="$border"
+        borderRadius="$xl"
+        overflow="hidden"
+      >
+        <View
+          height="100%"
+          width={`${normalizedProgress}%`}
+          backgroundColor="$positiveActionText"
+        />
+      </View>
+      <Text color="$positiveActionText" size="$label/m">
+        {normalizedProgress}%
+      </Text>
+    </XStack>
+  );
+}
+
+function BucketsLoadingRows() {
+  return (
+    <YStack gap="$xs" accessibilityLabel="Loading files">
+      {[0, 1, 2, 3].map((index) => (
+        <ListItem key={index} padding="$l" gap="$l">
+          <View
+            width="$4xl"
+            height="$4xl"
+            borderRadius="$s"
+            backgroundColor="$secondaryBackground"
+          />
+          <ListItem.MainContent gap="$m">
+            <View
+              width={index % 2 === 0 ? '55%' : '72%'}
+              height="$m"
+              borderRadius="$xl"
+              backgroundColor="$secondaryBackground"
+            />
+            <View
+              width={index % 2 === 0 ? '72%' : '48%'}
+              height="$s"
+              borderRadius="$xl"
+              backgroundColor="$secondaryBackground"
+            />
+          </ListItem.MainContent>
+        </ListItem>
+      ))}
+    </YStack>
+  );
+}
+
+function BucketsEmptyState({ canEdit }: { canEdit: boolean }) {
+  return (
+    <YStack
+      alignItems="center"
+      justifyContent="center"
+      gap="$s"
+      minHeight={260}
+      padding="$2xl"
+    >
+      <ListItem.SystemIcon icon="Folder" />
+      <Text color="$secondaryText" size="$label/l" textAlign="center">
+        This folder is empty
+      </Text>
+      {canEdit ? (
+        <Text color="$tertiaryText" size="$label/m" textAlign="center">
+          Use New to upload files or create a folder.
+        </Text>
+      ) : null}
+    </YStack>
+  );
+}
+
+function metadataLabel(item: BucketItem) {
+  if (item.kind === 'folder') {
+    return item.itemCount === 1 ? '1 item' : `${item.itemCount ?? 0} items`;
+  }
+
+  return [item.author, item.modifiedLabel, item.sizeLabel]
+    .filter(Boolean)
+    .join(' · ');
+}
diff --git a/packages/app/ui/components/BucketsChannel/index.ts b/packages/app/ui/components/BucketsChannel/index.ts
new file mode 100644
index 0000000000..86a6886a31
--- /dev/null
+++ b/packages/app/ui/components/BucketsChannel/index.ts
@@ -0,0 +1,3 @@
+export * from './BucketFileViewer';
+export * from './BucketFileViewer.shared';
+export * from './BucketsChannel';
diff --git a/packages/app/ui/components/Channel/ChannelHeader.tsx b/packages/app/ui/components/Channel/ChannelHeader.tsx
index 8e4ea3644f..879a5b2059 100644
--- a/packages/app/ui/components/Channel/ChannelHeader.tsx
+++ b/packages/app/ui/components/Channel/ChannelHeader.tsx
@@ -1,7 +1,7 @@
 import { useConnectionStatus, useDebouncedValue } from '@tloncorp/shared';
 import * as db from '@tloncorp/shared/db';
 import { useContact, useNotesDeskAvailable } from '@tloncorp/shared/store';
-import { useIsWindowNarrow } from '@tloncorp/ui';
+import { Pressable as TlonPressable, useIsWindowNarrow } from '@tloncorp/ui';
 import {
   Fragment,
   ReactElement,
@@ -396,7 +396,19 @@ export function ChannelHeader({
       rightControls={
         <>
           {showSearchButton && (
-            <ScreenHeader.IconButton type="Search" onPress={goToSearch} />
+            <TlonPressable
+              accessibilityLabel="Search"
+              accessibilityRole="button"
+              alignItems="center"
+              height="$4xl"
+              justifyContent="center"
+              onPress={goToSearch}
+              pressStyle={{ opacity: 0.5 }}
+              testID="ChannelHeaderSearchButton"
+              width="$4xl"
+            >
+              <ScreenHeader.IconButton pointerEvents="none" type="Search" />
+            </TlonPressable>
           )}
           {/* this fragment/map is necessary to be able to provide a key to the items */}
           {contextItems.map((item, index) => (
diff --git a/packages/app/ui/components/SearchBar.tsx b/packages/app/ui/components/SearchBar.tsx
index b6f36fed17..47de5f26b0 100644
--- a/packages/app/ui/components/SearchBar.tsx
+++ b/packages/app/ui/components/SearchBar.tsx
@@ -14,6 +14,7 @@ import { TextInput } from './Form';
 
 export function SearchBar({
   autoFocus = false,
+  initialValue = '',
   placeholder,
   onChangeQuery,
   onChangeValue,
@@ -23,6 +24,7 @@ export function SearchBar({
   ...rest
 }: {
   autoFocus?: boolean;
+  initialValue?: string;
   placeholder?: string;
   onChangeQuery: (query: string) => void;
   // Receives the input's raw value immediately, before onChangeQuery's
@@ -33,7 +35,7 @@ export function SearchBar({
   onPressCancel?: () => void;
   inputProps?: ComponentProps<typeof TextInput>;
 } & ComponentProps<typeof Input>) {
-  const [value, setValue] = useState('');
+  const [value, setValue] = useState(initialValue);
   const debouncedOnChangeQuery = useMemo(
     () =>
       debounce(onChangeQuery, debounceTime, {
diff --git a/packages/app/ui/index.tsx b/packages/app/ui/index.tsx
index 9dfb15bd4d..2e42dc05b8 100644
--- a/packages/app/ui/index.tsx
+++ b/packages/app/ui/index.tsx
@@ -8,6 +8,7 @@ export { GroupAvatar } from './components/GroupAvatar';
 export type { GroupImageShim } from './components/Avatar';
 export * from './components/BigInput';
 export * from './components/BlockedContactsWidget';
+export * from './components/BucketsChannel';
 export * from './components/BotSettingsScreenView';
 export * from './components/Channel';
 export * from './components/Channel/ChannelDivider';

From 9aa1a4796e1b05d4096c4e9d36a57b7e4bd3fddd Mon Sep 17 00:00:00 2001
From: william arzt <bill@tlon.io>
Date: Thu, 6 Aug 2026 16:40:33 -0400
Subject: [PATCH 02/19] feat: add group buckets prototype

---
 backend/click                                 |  15 +-
 desk/app/buckets.hoon                         | 635 ++++++++++++++++++
 desk/desk.bill                                |   1 +
 desk/lib/buckets/json.hoon                    | 274 ++++++++
 desk/mar/buckets-action-1.hoon                |  16 +
 desk/mar/buckets-command-1.hoon               |  14 +
 desk/mar/buckets-response-1.hoon              |  16 +
 desk/mar/buckets-snapshots-1.hoon             |  16 +
 desk/sur/buckets.hoon                         | 147 ++++
 desk/tests/app/buckets.hoon                   | 111 +++
 docs/backend/desk/app/buckets.md              |  79 +++
 .../app/fixtures/BucketsChannel.fixture.tsx   | 165 ++++-
 .../BucketsChannel/BucketsChannel.tsx         | 404 +++++++++--
 .../BucketsDropTarget.native.tsx              |  10 +
 .../BucketsChannel/BucketsDropTarget.tsx      | 104 +++
 .../BucketsChannel/BucketsDropTarget.types.ts |  16 +
 .../app/ui/components/BucketsChannel/index.ts |   1 +
 17 files changed, 1944 insertions(+), 80 deletions(-)
 create mode 100644 desk/app/buckets.hoon
 create mode 100644 desk/lib/buckets/json.hoon
 create mode 100644 desk/mar/buckets-action-1.hoon
 create mode 100644 desk/mar/buckets-command-1.hoon
 create mode 100644 desk/mar/buckets-response-1.hoon
 create mode 100644 desk/mar/buckets-snapshots-1.hoon
 create mode 100644 desk/sur/buckets.hoon
 create mode 100644 desk/tests/app/buckets.hoon
 create mode 100644 docs/backend/desk/app/buckets.md
 create mode 100644 packages/app/ui/components/BucketsChannel/BucketsDropTarget.native.tsx
 create mode 100644 packages/app/ui/components/BucketsChannel/BucketsDropTarget.tsx
 create mode 100644 packages/app/ui/components/BucketsChannel/BucketsDropTarget.types.ts

diff --git a/backend/click b/backend/click
index 38c2514e57..fa20e7d525 100755
--- a/backend/click
+++ b/backend/click
@@ -21,6 +21,7 @@
 SCRIPT_DIR=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )
 SCRIPT_NAME=$(basename "$0")
 CLICK_CMD="$SCRIPT_DIR/click-format"
+CLICK_OPTS=()
 
 # ==========================================================
 # PLATFORM DETECTION
@@ -90,7 +91,7 @@ EOF
 }
 
 full() {
-  $CLICK_CMD "$HOON" $DEPS |
+  "$CLICK_CMD" "${CLICK_OPTS[@]}" "$HOON" $DEPS |
   $EVAL_CMD eval --jam $JAM_OPTS |
   # 30m total inactivity timeout
   socat -T 1800 -t $TIMEOUT -,ignoreeof UNIX-CONNECT:"$PIER/.urb/conn.sock" |
@@ -102,7 +103,7 @@ jam() {
         JAM_OPTS=""
     fi
 
-    $CLICK_CMD "$HOON" $DEPS | $EVAL_CMD eval --jam $JAM_OPTS
+    "$CLICK_CMD" "${CLICK_OPTS[@]}" "$HOON" $DEPS | $EVAL_CMD eval --jam $JAM_OPTS
 }
 
 execute() {
@@ -232,9 +233,11 @@ if [[ -n $INPUT ]]; then
     shift
 
     if [[ $EXECUTE -eq 0 ]]; then
-        # read from file, escape 's, replace newlines w/ gaps
-        # Use paste for portable line joining (works on both GNU and BSD systems)
-        HOON="$(cat $INPUT | sed "s;';\\\\';g" | paste -sd'  ' -)"
+        # Read from file, escape 's, and replace newlines with Hoon gaps.
+        # BSD paste treats the two spaces in -d as an alternating delimiter
+        # list and emits only one of them. Hoon needs a two-space gap, so join
+        # explicitly instead.
+        HOON="$(cat "$INPUT" | sed "s;';\\\\';g" | awk 'NR == 1 { printf "%s", $0; next } { printf "  %s", $0 } END { print "" }')"
     fi
 else
     PIER=$1
@@ -245,7 +248,7 @@ DEPS=$*
 
 # setup shared variables
 if [[ $KHAN_TED -ne 0 ]]; then
-    CLICK_CMD="$CLICK_CMD -k"
+    CLICK_OPTS=(-k)
 elif [[ $CARD -ne 0 ]]; then
     CLICK_CMD="echo"
     DEPS=""
diff --git a/desk/app/buckets.hoon b/desk/app/buckets.hoon
new file mode 100644
index 0000000000..40a6e1ece6
--- /dev/null
+++ b/desk/app/buckets.hoon
@@ -0,0 +1,635 @@
+::  buckets: group-owned shared file manifest and upload coordinator
+::
+::  This agent is a third-party %groups channel host. It stores metadata and
+::  upload lifecycle only; file bytes move directly between clients and object
+::  storage.
+::
+/-  b=buckets
+/+  default-agent, dbug, verb
+|%
++$  card  card:agent:gall
++$  current-state  state-0:b
+--
+=|  current-state
+=*  state  -
+%-  agent:dbug
+%^  verb  |  %warn
+^-  agent:gall
+=<
+  |_  =bowl:gall
+  +*  this  .
+      def   ~(. (default-agent this %|) bowl)
+      cor   ~(. +> [bowl ~])
+  ++  on-init
+    ^-  (quip card _this)
+    =^  cards  state  abet:init:cor
+    [cards this]
+  ++  on-save  !>(state)
+  ++  on-load
+    |=  old=vase
+    ^-  (quip card _this)
+    =^  cards  state  abet:(load:cor old)
+    [cards this]
+  ++  on-poke
+    |=  [=mark =vase]
+    ^-  (quip card _this)
+    =^  cards  state  abet:(poke:cor mark vase)
+    [cards this]
+  ++  on-watch
+    |=  =path
+    ^-  (quip card _this)
+    =^  cards  state  abet:(watch:cor `(pole knot)`path)
+    [cards this]
+  ++  on-peek
+    |=  =path
+    ^-  (unit (unit cage))
+    ?>  =(src our):bowl
+    (peek:cor `(pole knot)`path)
+  ++  on-agent
+    |=  [=wire =sign:agent:gall]
+    ^-  (quip card _this)
+    =^  cards  state  abet:(agent:cor `(pole knot)`wire sign)
+    [cards this]
+  ++  on-arvo   on-arvo:def
+  ++  on-leave  on-leave:def
+  ++  on-fail
+    |=  [=term =tang]
+    ^-  (quip card _this)
+    %-  (slog 'buckets: on-fail' >term< tang)
+    [~ this]
+  --
+::
+|_  [=bowl:gall cards=(list card)]
+++  cor   .
+++  abet  [(flop cards) state]
+++  emit  |=(=card cor(cards [card cards]))
+++  emil  |=(caz=(list card) cor(cards (welp (flop caz) cards)))
+++  give  |=(=gift:agent:gall (emit %give gift))
+::
+++  init
+  ^+  cor
+  (emit [%pass /groups %agent [our.bowl %groups] %watch /v1/groups])
+::
+::  Greenfield version 0. Future state versions must migrate explicitly here.
+::
+++  load
+  |=  old=vase
+  ^+  cor
+  =+  !<(loaded=state-0:b old)
+  ?>  =(%0 -.loaded)
+  =.  state  loaded
+  =?  cor  !(~(has by wex.bowl) [/groups our.bowl %groups])
+    (emit [%pass /groups %agent [our.bowl %groups] %watch /v1/groups])
+  cor
+::
+++  poke
+  |=  [=mark =vase]
+  ^+  cor
+  ?+  mark  ~|(bad-buckets-mark+mark !!)
+      %buckets-action-1
+    ?>  =(src.bowl our.bowl)
+    (dispatch-local !<(action:b vase))
+  ::
+      %buckets-command-1
+    =+  cmd=!<(command:b vase)
+    =/  act=action:b  action.cmd
+    ?>  !=(%create -.act)
+    =/  =flag:b  (action-flag act)
+    ?>  =(ship.flag our.bowl)
+    =/  st=bucket-state:b  (need-state flag)
+    ?>  (group-can-read group.st flag src.bowl)
+    (apply-action act)
+  ::
+      %group-channel-join
+    ?>  =(src.bowl our.bowl)
+    =+  join=!<(channel-join:b vase)
+    ?>  =(%buckets kind.nest.join)
+    =/  =flag:b  [host.nest.join name.nest.join]
+    ?:  =(our.bowl ship.flag)  cor
+    (start-sub flag group.join)
+  ::
+      %group-channel-leave
+    ?>  =(src.bowl our.bowl)
+    =+  leave=!<(channel-leave:b vase)
+    ?>  =(%buckets kind.nest.leave)
+    =/  =flag:b  [host.nest.leave name.nest.leave]
+    ?:  =(our.bowl ship.flag)  cor
+    (stop-sub flag)
+  ==
+::
+++  dispatch-local
+  |=  act=action:b
+  ^+  cor
+  ?+  -.act  (dispatch-existing act)
+    %create
+  (create-bucket name.act title.act group.act readers.act)
+  ==
+::
+++  dispatch-existing
+  |=  act=action:b
+  ^+  cor
+  =/  =flag:b  (action-flag act)
+  =/  sp=space:b  (need-space flag)
+  ?:  =(%pub net.sp)
+    (apply-action act)
+  (forward-action flag act)
+::
+++  action-flag
+  |=  act=action:b
+  ^-  flag:b
+  ?-  -.act
+    %create          ~|(%create-has-no-flag !!)
+    %delete-bucket   flag.act
+    %create-folder   flag.act
+    %begin-upload    flag.act
+    %finish-upload   flag.act
+    %fail-upload     flag.act
+    %rename-entry    flag.act
+    %move-entry      flag.act
+    %delete-entry    flag.act
+  ==
+::
+++  need-space
+  |=  =flag:b
+  ^-  space:b
+  (~(got by spaces) flag)
+::
+++  need-state
+  |=  =flag:b
+  ^-  bucket-state:b
+  =/  sp=space:b  (need-space flag)
+  ?>  ?=(^ state.sp)
+  u.state.sp
+::
+++  put-state
+  |=  [=flag:b st=bucket-state:b]
+  ^+  cor
+  =/  sp=space:b  (need-space flag)
+  =.  spaces  (~(put by spaces) flag [net.sp `st `group.st])
+  cor
+::
+++  create-bucket
+  |=  [name=@tas title=@t group=flag:b readers=(set @tas)]
+  ^+  cor
+  ?>  =(ship.group our.bowl)
+  =/  =flag:b  [our.bowl name]
+  ?>  !(~(has by spaces) flag)
+  =/  id=@ud  +(next-id)
+  =.  next-id  id
+  =/  buc=bucket:b  [id title our.bowl now.bowl our.bowl now.bowl]
+  =/  st=bucket-state:b  [buc group readers ~ ~ 0]
+  =.  spaces  (~(put by spaces) flag [%pub `st `group])
+  =/  channel=group-channel:b
+    [[title '' '' ''] now.bowl %default readers |]
+  =/  add=group-create:b
+    [%group group %channel [%buckets flag] %add channel]
+  =.  cor
+    %-  emit
+    :*  %pass  /buckets/(scot %p ship.flag)/[name.flag]/create
+        %agent  [our.bowl %groups]
+        %poke  group-action-4+!>(add)
+    ==
+  (give [%fact ~[/v1] buckets-response-1+!>(`response:b`[%snapshot flag st])])
+::
+++  apply-action
+  |=  act=action:b
+  ^+  cor
+  ?-  -.act
+    %create          ~|(%cannot-forward-create !!)
+    %delete-bucket   (delete-bucket flag.act)
+    %create-folder   (create-folder flag.act parent.act name.act)
+    %begin-upload    (begin-upload flag.act parent.act name.act mime.act size.act checksum.act)
+    %finish-upload   (finish-upload flag.act session.act object-url.act)
+    %fail-upload     (fail-upload flag.act session.act reason.act)
+    %rename-entry    (rename-entry flag.act id.act name.act)
+    %move-entry      (move-entry flag.act id.act parent.act)
+    %delete-entry    (delete-entry flag.act id.act recursive.act)
+  ==
+::
+++  forward-action
+  |=  [=flag:b act=action:b]
+  ^+  cor
+  %-  emit
+  :*  %pass  /buckets/cmd/(scot %p ship.flag)/[name.flag]
+      %agent  [ship.flag %buckets]
+      %poke  buckets-command-1+!>(`command:b`[act])
+  ==
+::
+++  delete-bucket
+  |=  =flag:b
+  ^+  cor
+  ?>  =(src.bowl our.bowl)
+  =/  st=bucket-state:b  (need-state flag)
+  =/  del=group-channel-del:b
+    [%group group.st %channel [%buckets flag] %del ~]
+  =.  cor
+    %-  emit
+    :*  %pass  /buckets/(scot %p ship.flag)/[name.flag]/delete
+        %agent  [our.bowl %groups]
+        %poke  group-action-4+!>(del)
+    ==
+  =/  res=response:b
+    [%update flag +(revision.st) src.bowl [%bucket-deleted ~]]
+  =.  cor  (give [%fact ~[/v1 (updates-path flag)] buckets-response-1+!>(res)])
+  =.  spaces  (~(del by spaces) flag)
+  cor
+::
+++  create-folder
+  |=  [=flag:b parent=(unit @ud) name=@t]
+  ^+  cor
+  =/  st=bucket-state:b  (need-state flag)
+  ?>  (valid-parent st parent)
+  =/  id=@ud  +(next-id)
+  =.  next-id  id
+  =/  ent=entry:b
+    [id parent name src.bowl now.bowl src.bowl now.bowl [%folder ~]]
+  =.  entries.st  (~(put by entries.st) id ent)
+  (commit-update flag st [%folder-created ent])
+::
+++  begin-upload
+  |=  $:  =flag:b
+          parent=(unit @ud)
+          name=@t
+          mime=@t
+          size=@ud
+          checksum=(unit @t)
+      ==
+  ^+  cor
+  =/  st=bucket-state:b  (need-state flag)
+  ?>  (valid-parent st parent)
+  =/  id=@ud  +(next-id)
+  =.  next-id  id
+  =/  sid=@uv  `@uv`eny.bowl
+  =/  fil=file:b
+    [mime size checksum (scot %uv sid) ~ %pending]
+  =/  ent=entry:b
+    [id parent name src.bowl now.bowl src.bowl now.bowl [%file fil]]
+  =/  ses=upload-session:b
+    [sid id src.bowl now.bowl (add now.bowl ~h1) %pending ~]
+  =.  entries.st   (~(put by entries.st) id ent)
+  =.  sessions.st  (~(put by sessions.st) sid ses)
+  (commit-update flag st [%upload-begun ses ent])
+::
+++  finish-upload
+  |=  [=flag:b sid=@uv object-url=@t]
+  ^+  cor
+  =/  st=bucket-state:b  (need-state flag)
+  =/  ses=upload-session:b  (~(got by sessions.st) sid)
+  ?>  =(%pending status.ses)
+  ?>  =(requested-by.ses src.bowl)
+  =/  ent=entry:b  (~(got by entries.st) file-id.ses)
+  =/  fil=file:b  (entry-file ent)
+  =.  fil  fil(object-url `object-url, status %ready)
+  =.  ent  ent(updated-by src.bowl, updated-at now.bowl, kind [%file fil])
+  =.  ses  ses(status %complete)
+  =.  entries.st   (~(put by entries.st) id.ent ent)
+  =.  sessions.st  (~(put by sessions.st) sid ses)
+  (commit-update flag st [%upload-ready ses ent])
+::
+++  fail-upload
+  |=  [=flag:b sid=@uv reason=@t]
+  ^+  cor
+  =/  st=bucket-state:b  (need-state flag)
+  =/  ses=upload-session:b  (~(got by sessions.st) sid)
+  ?>  =(%pending status.ses)
+  ?>  =(requested-by.ses src.bowl)
+  =/  ent=entry:b  (~(got by entries.st) file-id.ses)
+  =/  fil=file:b  (entry-file ent)
+  =.  fil  fil(status %failed)
+  =.  ent  ent(updated-by src.bowl, updated-at now.bowl, kind [%file fil])
+  =.  ses  ses(status %failed, error `reason)
+  =.  entries.st   (~(put by entries.st) id.ent ent)
+  =.  sessions.st  (~(put by sessions.st) sid ses)
+  (commit-update flag st [%upload-failed ses ent])
+::
+++  rename-entry
+  |=  [=flag:b id=@ud name=@t]
+  ^+  cor
+  =/  st=bucket-state:b  (need-state flag)
+  =/  ent=entry:b  (~(got by entries.st) id)
+  =.  ent  ent(name name, updated-by src.bowl, updated-at now.bowl)
+  =.  entries.st  (~(put by entries.st) id ent)
+  (commit-update flag st [%entry-updated ent])
+::
+++  move-entry
+  |=  [=flag:b id=@ud parent=(unit @ud)]
+  ^+  cor
+  =/  st=bucket-state:b  (need-state flag)
+  ?>  (valid-parent st parent)
+  =/  ent=entry:b  (~(got by entries.st) id)
+  ?<  ?&  ?=(^ parent)
+          =(u.parent id)
+      ==
+  =?  st  ?&(?=(%folder -.kind.ent) ?=(^ parent))
+    ?<  (descendant st id u.parent)
+    st
+  =.  ent  ent(parent parent, updated-by src.bowl, updated-at now.bowl)
+  =.  entries.st  (~(put by entries.st) id ent)
+  (commit-update flag st [%entry-updated ent])
+::
+++  delete-entry
+  |=  [=flag:b id=@ud recursive=?]
+  ^+  cor
+  =/  st=bucket-state:b  (need-state flag)
+  =/  ids=(set @ud)  (descendants st id)
+  ?>  ?|(recursive =((lent ~(tap in ids)) 1))
+  =.  entries.st
+    %-  ~(rep in ids)
+    |=  [key=@ud acc=_entries.st]
+    (~(del by acc) key)
+  =.  sessions.st
+    %-  malt
+    %+  skip  ~(tap by sessions.st)
+    |=  [key=@uv ses=upload-session:b]
+    (~(has in ids) file-id.ses)
+  (commit-update flag st [%entries-deleted ~(tap in ids)])
+::
+++  commit-update
+  |=  [=flag:b st=bucket-state:b upd=update:b]
+  ^+  cor
+  =.  revision.st  +(revision.st)
+  =.  bucket.st
+    bucket.st(updated-by src.bowl, updated-at now.bowl)
+  =.  cor  (put-state flag st)
+  =/  res=response:b  [%update flag revision.st src.bowl upd]
+  (give [%fact ~[/v1 (updates-path flag)] buckets-response-1+!>(res)])
+::
+++  valid-parent
+  |=  [st=bucket-state:b parent=(unit @ud)]
+  ^-  ?
+  ?~  parent  &
+  ?~  ent=(~(get by entries.st) u.parent)  |
+  =(%folder -.kind.u.ent)
+::
+++  entry-file
+  |=  ent=entry:b
+  ^-  file:b
+  ?-  -.kind.ent
+    %folder  ~|(%entry-is-a-folder !!)
+    %file    +.kind.ent
+  ==
+::
+++  descendant
+  |=  [st=bucket-state:b ancestor=@ud candidate=@ud]
+  ^-  ?
+  =/  cur=(unit @ud)  `candidate
+  |-
+  ?~  cur  |
+  ?:  =(u.cur ancestor)  &
+  ?~  ent=(~(get by entries.st) u.cur)  |
+  $(cur parent.u.ent)
+::
+++  descendants
+  |=  [st=bucket-state:b root=@ud]
+  ^-  (set @ud)
+  ?>  (~(has by entries.st) root)
+  =/  acc=(set @ud)  (silt ~[root])
+  =/  queue=(list @ud)  ~[root]
+  |-
+  ?~  queue  acc
+  =/  kids=(list @ud)
+    %+  murn  ~(tap by entries.st)
+    |=  [id=@ud ent=entry:b]
+    ?~  parent.ent  ~
+    ?:  =(u.parent.ent i.queue)  `id  ~
+  %=  $
+    queue  (weld t.queue kids)
+    acc    (~(gas in acc) kids)
+  ==
+::
+++  group-can-read
+  |=  [group=flag:b =flag:b who=ship]
+  ^-  ?
+  ?:  =(who ship.flag)  &
+  =/  pax=path
+    /(scot %p our.bowl)/groups/(scot %da now.bowl)/v2/groups/(scot %p ship.group)/[name.group]/channels/can-read/noun
+  =/  test=$-([ship nest:b] ?)  .^($-([ship nest:b] ?) %gx pax)
+  (test who [%buckets ship.flag name.flag])
+::
+++  updates-path
+  |=  =flag:b
+  ^-  path
+  /v1/buckets/(scot %p ship.flag)/[name.flag]/updates
+::
+++  sub-wire
+  |=  =flag:b
+  ^-  wire
+  /buckets/sub/(scot %p ship.flag)/[name.flag]
+::
+++  start-sub
+  |=  [=flag:b group=flag:b]
+  ^+  cor
+  ?:  (~(has by spaces) flag)  cor
+  =.  spaces  (~(put by spaces) flag [%sub ~ `group])
+  %-  emit
+  [%pass (sub-wire flag) %agent [ship.flag %buckets] %watch (updates-path flag)]
+::
+++  stop-sub
+  |=  =flag:b
+  ^+  cor
+  ?~  sp=(~(get by spaces) flag)  cor
+  ?.  =(%sub net.u.sp)  cor
+  =.  cor  (emil (drop (report-active flag u.sp |)))
+  =.  spaces  (~(del by spaces) flag)
+  %-  emit
+  [%pass (sub-wire flag) %agent [ship.flag %buckets] %leave ~]
+::
+++  report-active
+  |=  [=flag:b sp=space:b joined=?]
+  ^-  (unit card)
+  =/  grp=(unit flag:b)
+    ?~  state.sp  pending-group.sp
+    `group.u.state.sp
+  ?~  grp  ~
+  =/  nes=nest:b  [%buckets ship.flag name.flag]
+  :-  ~
+  :*  %pass  /report-active  %agent  [our.bowl %groups]
+      %poke  group-channel-active+!>([u.grp nes joined])
+  ==
+::
+++  watch
+  |=  =(pole knot)
+  ^+  cor
+  ?+  pole  ~|(bad-buckets-watch+pole !!)
+      [%v1 ~]
+    ?>  =(src.bowl our.bowl)
+    =/  facts=(list card)
+      %+  murn  local-snapshots
+      |=  snap=snapshot:b
+      `[%give %fact ~ buckets-response-1+!>(`response:b`[%snapshot flag.snap bucket-state.snap])]
+    (emil facts)
+  ::
+      [%v1 %buckets host=@ name=@ %updates ~]
+    =/  =flag:b  [(slav %p host.pole) `@tas`name.pole]
+    ?>  =(ship.flag our.bowl)
+    =/  st=bucket-state:b  (need-state flag)
+    ?>  (group-can-read group.st flag src.bowl)
+    (give [%fact ~ buckets-response-1+!>(`response:b`[%snapshot flag st])])
+  ==
+::
+++  peek
+  |=  =(pole knot)
+  ^-  (unit (unit cage))
+  ?+  pole  ~
+      [%x %v1 %buckets ~]
+    ``buckets-snapshots-1+!>(local-snapshots)
+  ::
+      [%x %v1 %buckets host=@ name=@ ~]
+    =/  =flag:b  [(slav %p host.pole) `@tas`name.pole]
+    ?~  sp=(~(get by spaces) flag)  ~
+    ?~  state.u.sp  ~
+    ``buckets-response-1+!>(`response:b`[%snapshot flag u.state.u.sp])
+  ::
+      [%u %joined host=@ name=@ ~]
+    =/  =flag:b  [(slav %p host.pole) `@tas`name.pole]
+    ``loob+!>((~(has by spaces) flag))
+  ==
+::
+++  local-snapshots
+  ^-  (list snapshot:b)
+  %+  murn  ~(tap by spaces)
+  |=  [=flag:b sp=space:b]
+  ?~  state.sp  ~
+  `[flag u.state.sp]
+::
+++  agent
+  |=  [=(pole knot) =sign:agent:gall]
+  ^+  cor
+  ?+  pole  cor
+      [%groups ~]
+    ?+  -.sign  cor
+        %fact  recheck-host-subs
+        %kick  (emit [%pass /groups %agent [our.bowl %groups] %watch /v1/groups])
+        %watch-ack
+      ?~  p.sign  cor
+      ((slog leaf+"buckets: groups watch failed" u.p.sign) cor)
+    ==
+  ::
+      [%buckets %sub host=@ name=@ ~]
+    =/  =flag:b  [(slav %p host.pole) `@tas`name.pole]
+    ?~  sp=(~(get by spaces) flag)  cor
+    ?.  =(%sub net.u.sp)  cor
+    ?+  -.sign  cor
+        %fact
+      ?.  =(%buckets-response-1 p.cage.sign)  cor
+      (apply-response !<(response:b q.cage.sign))
+    ::
+        %kick
+      (stop-sub flag)
+    ::
+        %watch-ack
+      ?~  p.sign  cor
+      (stop-sub flag)
+    ==
+  ::
+      [%buckets %cmd *]
+    ?+  -.sign  cor
+        %poke-ack
+      ?~  p.sign  cor
+      ((slog leaf+"buckets: host command failed" u.p.sign) cor)
+    ==
+  ::
+      [%buckets @ @ ?(%create %delete) ~]
+    ?+  -.sign  cor
+        %poke-ack
+      ?~  p.sign  cor
+      ((slog leaf+"buckets: group channel registration failed" u.p.sign) cor)
+    ==
+  ::
+      [%report-active ~]
+    ?+  -.sign  cor
+        %poke-ack
+      ?~  p.sign  cor
+      ((slog leaf+"buckets: active-channel report failed" u.p.sign) cor)
+    ==
+  ==
+::
+++  apply-response
+  |=  res=response:b
+  ^+  cor
+  ?-  -.res
+      %snapshot
+    =/  sp=space:b  (need-space flag.res)
+    ?>  =(%sub net.sp)
+    =.  sp  sp(state `bucket-state.res, pending-group `group.bucket-state.res)
+    =.  spaces  (~(put by spaces) flag.res sp)
+    =.  cor  (emil (drop (report-active flag.res sp &)))
+    (give [%fact ~[/v1] buckets-response-1+!>(res)])
+  ::
+      %update
+    =/  sp=space:b  (need-space flag.res)
+    ?>  =(%sub net.sp)
+    ?~  state.sp  cor
+    =/  st=bucket-state:b  u.state.sp
+    ?:  =(%bucket-deleted -.update.res)
+      =.  cor  (give [%fact ~[/v1] buckets-response-1+!>(res)])
+      =.  cor  (emil (drop (report-active flag.res sp |)))
+      =.  spaces  (~(del by spaces) flag.res)
+      cor
+    =.  st  (apply-update st update.res)
+    =.  revision.st  revision.res
+    =.  spaces  (~(put by spaces) flag.res [net.sp `st `group.st])
+    (give [%fact ~[/v1] buckets-response-1+!>(res)])
+  ==
+::
+++  apply-update
+  |=  [st=bucket-state:b upd=update:b]
+  ^-  bucket-state:b
+  ?-  -.upd
+      %bucket-created
+    st(bucket bucket.upd)
+  ::
+      %bucket-deleted  st
+  ::
+      %folder-created
+    st(entries (~(put by entries.st) id.entry.upd entry.upd))
+  ::
+      %upload-begun
+    %=  st
+      entries   (~(put by entries.st) id.entry.upd entry.upd)
+      sessions  (~(put by sessions.st) id.upload-session.upd upload-session.upd)
+    ==
+  ::
+      %upload-ready
+    %=  st
+      entries   (~(put by entries.st) id.entry.upd entry.upd)
+      sessions  (~(put by sessions.st) id.upload-session.upd upload-session.upd)
+    ==
+  ::
+      %upload-failed
+    %=  st
+      entries   (~(put by entries.st) id.entry.upd entry.upd)
+      sessions  (~(put by sessions.st) id.upload-session.upd upload-session.upd)
+    ==
+  ::
+      %entry-updated
+    st(entries (~(put by entries.st) id.entry.upd entry.upd))
+  ::
+      %entries-deleted
+    =.  entries.st
+      %-  ~(rep in (silt ids.upd))
+      |=  [key=@ud acc=_entries.st]
+      (~(del by acc) key)
+    =.  sessions.st
+      %-  malt
+      %+  skip  ~(tap by sessions.st)
+      |=  [key=@uv ses=upload-session:b]
+      (~(has in (silt ids.upd)) file-id.ses)
+    st
+  ==
+::
+++  recheck-host-subs
+  ^+  cor
+  =/  kicks=(list card)
+    %+  murn  ~(val by sup.bowl)
+    |=  [who=ship pax=path]
+    ^-  (unit card)
+    ?.  ?=([%v1 %buckets @ @ %updates ~] pax)  ~
+    =/  =flag:b  [(slav %p i.t.t.pax) `@tas`i.t.t.t.pax]
+    ?~  sp=(~(get by spaces) flag)  ~
+    ?.  =(%pub net.u.sp)  ~
+    ?~  state.u.sp  ~
+    ?:  (group-can-read group.u.state.u.sp flag who)  ~
+    `[%give %kick ~[pax] `who]
+  (emil kicks)
+--
diff --git a/desk/desk.bill b/desk/desk.bill
index 7163b750b1..5d55384476 100644
--- a/desk/desk.bill
+++ b/desk/desk.bill
@@ -21,4 +21,5 @@
     %gateway-status
     %presence
     %steward
+    %buckets
 ==
diff --git a/desk/lib/buckets/json.hoon b/desk/lib/buckets/json.hoon
new file mode 100644
index 0000000000..69a6e95f7c
--- /dev/null
+++ b/desk/lib/buckets/json.hoon
@@ -0,0 +1,274 @@
+::  JSON codecs for the Buckets client surface
+::
+/-  b=buckets
+|%
+::
+++  enjs
+  =,  enjs:format
+  |%
+  ++  flag
+    |=  f=flag:b
+    ^-  json
+    (pairs ~[['host' s+(scot %p ship.f)] ['name' s+name.f]])
+  ::
+  ++  bucket
+    |=  buc=bucket:b
+    ^-  json
+    %-  pairs
+    :~  ['id' (numb id.buc)]
+        ['title' s+title.buc]
+        ['createdBy' s+(scot %p created-by.buc)]
+        ['createdAt' (numb (unt:chrono:userlib created-at.buc))]
+        ['updatedBy' s+(scot %p updated-by.buc)]
+        ['updatedAt' (numb (unt:chrono:userlib updated-at.buc))]
+    ==
+  ::
+  ++  file
+    |=  fil=file:b
+    ^-  json
+    %-  pairs
+    :~  ['mime' s+mime.fil]
+        ['size' (numb size.fil)]
+        ['checksum' ?~(checksum.fil ~ s+u.checksum.fil)]
+        ['objectKey' s+object-key.fil]
+        ['objectUrl' ?~(object-url.fil ~ s+u.object-url.fil)]
+        ['status' s+(scot %tas status.fil)]
+    ==
+  ::
+  ++  entry
+    |=  ent=entry:b
+    ^-  json
+    =/  common=(list [cord json])
+      :~  ['id' (numb id.ent)]
+          ['parentId' ?~(parent.ent ~ (numb u.parent.ent))]
+          ['name' s+name.ent]
+          ['createdBy' s+(scot %p created-by.ent)]
+          ['createdAt' (numb (unt:chrono:userlib created-at.ent))]
+          ['updatedBy' s+(scot %p updated-by.ent)]
+          ['updatedAt' (numb (unt:chrono:userlib updated-at.ent))]
+      ==
+    ?-  -.kind.ent
+      %folder  (pairs (snoc common ['kind' s+'folder']))
+      %file
+    %-  pairs
+    %+  snoc  (snoc common ['kind' s+'file'])
+    ['file' (file +.kind.ent)]
+    ==
+  ::
+  ++  session
+    |=  ses=upload-session:b
+    ^-  json
+    %-  pairs
+    :~  ['id' s+(scot %uv id.ses)]
+        ['fileId' (numb file-id.ses)]
+        ['requestedBy' s+(scot %p requested-by.ses)]
+        ['createdAt' (numb (unt:chrono:userlib created-at.ses))]
+        ['expiresAt' (numb (unt:chrono:userlib expires-at.ses))]
+        ['status' s+(scot %tas status.ses)]
+        ['error' ?~(error.ses ~ s+u.error.ses)]
+    ==
+  ::
+  ++  bucket-state
+    |=  st=bucket-state:b
+    ^-  json
+    =/  ents=(list json)
+      %+  turn  ~(val by entries.st)
+      entry
+    =/  sess=(list json)
+      %+  turn  ~(val by sessions.st)
+      session
+    =/  roles=(list json)
+      %+  turn  ~(tap in readers.st)
+      |=(role=@tas s+(scot %tas role))
+    %-  pairs
+    :~  ['bucket' (bucket bucket.st)]
+        ['group' (flag group.st)]
+        ['readers' [%a roles]]
+        ['entries' [%a ents]]
+        ['sessions' [%a sess]]
+        ['revision' (numb revision.st)]
+    ==
+  ::
+  ++  update
+    |=  upd=update:b
+    ^-  json
+    ?-  -.upd
+        %bucket-created
+      (pairs ~[['type' s+'bucket-created'] ['bucket' (bucket bucket.upd)]])
+    ::
+        %bucket-deleted
+      (pairs ~[['type' s+'bucket-deleted']])
+    ::
+        %folder-created
+      (pairs ~[['type' s+'folder-created'] ['entry' (entry entry.upd)]])
+    ::
+        %upload-begun
+      %-  pairs
+      :~  ['type' s+'upload-begun']
+          ['session' (session upload-session.upd)]
+          ['entry' (entry entry.upd)]
+      ==
+    ::
+        %upload-ready
+      %-  pairs
+      :~  ['type' s+'upload-ready']
+          ['session' (session upload-session.upd)]
+          ['entry' (entry entry.upd)]
+      ==
+    ::
+        %upload-failed
+      %-  pairs
+      :~  ['type' s+'upload-failed']
+          ['session' (session upload-session.upd)]
+          ['entry' (entry entry.upd)]
+      ==
+    ::
+        %entry-updated
+      (pairs ~[['type' s+'entry-updated'] ['entry' (entry entry.upd)]])
+    ::
+        %entries-deleted
+      =/  ids=(list json)  (turn ids.upd numb)
+      (pairs ~[['type' s+'entries-deleted'] ['ids' [%a ids]]])
+    ==
+  ::
+  ++  response
+    |=  res=response:b
+    ^-  json
+    ?-  -.res
+        %snapshot
+      %-  pairs
+      :~  ['type' s+'snapshot']
+          ['flag' (flag flag.res)]
+          ['state' (bucket-state bucket-state.res)]
+      ==
+    ::
+        %update
+      %-  pairs
+      :~  ['type' s+'update']
+          ['flag' (flag flag.res)]
+          ['revision' (numb revision.res)]
+          ['actor' s+(scot %p actor.res)]
+          ['update' (update update.res)]
+      ==
+    ==
+  ::
+  ++  snapshots
+    |=  snaps=(list snapshot:b)
+    ^-  json
+    :-  %a
+    %+  turn  snaps
+    |=  snap=snapshot:b
+    (pairs ~[['flag' (flag flag.snap)] ['state' (bucket-state bucket-state.snap)]])
+  --
+::
+++  dejs
+  =,  dejs:format
+  |%
+  ++  get
+    |=  [key=@t jon=json]
+    ^-  json
+    ?>  ?=([%o *] jon)
+    =/  val=(unit json)  (~(get by p.jon) key)
+    ?>  ?=(^ val)
+    u.val
+  ::
+  ++  maybe
+    |=  [key=@t jon=json decoder=$-(json @t)]
+    ^-  (unit @t)
+    ?>  ?=([%o *] jon)
+    =/  val=(unit json)  (~(get by p.jon) key)
+    ?~  val  ~
+    ((mu decoder) u.val)
+  ::
+  ++  maybe-ud
+    |=  [key=@t jon=json]
+    ^-  (unit @ud)
+    ?>  ?=([%o *] jon)
+    =/  val=(unit json)  (~(get by p.jon) key)
+    ?~  val  ~
+    ((mu ni) u.val)
+  ::
+  ++  flag
+    |=  jon=json
+    ^-  flag:b
+    =/  raw
+      %.  jon
+      (ot ~[['host' (su ;~(pfix sig fed:ag))] ['name' so]])
+    [-.raw `@tas`+.raw]
+  ::
+  ++  readers
+    |=  jon=json
+    ^-  (set @tas)
+    ((as (cu |=(t=@t `@tas``@`t) so)) jon)
+  ::
+  ++  action
+    |=  jon=json
+    ^-  action:b
+    ?>  ?=([%o *] jon)
+    =/  typ=@t  (so (get 'type' jon))
+    ?+  typ  ~|(unknown-buckets-action+typ !!)
+        %'create'
+      :*  %create
+          `@tas`(so (get 'name' jon))
+          (so (get 'title' jon))
+          (flag (get 'group' jon))
+          (readers (get 'readers' jon))
+      ==
+    ::
+        %'delete-bucket'
+      [%delete-bucket (flag (get 'flag' jon))]
+    ::
+        %'create-folder'
+      :*  %create-folder
+          (flag (get 'flag' jon))
+          (maybe-ud 'parentId' jon)
+          (so (get 'name' jon))
+      ==
+    ::
+        %'begin-upload'
+      :*  %begin-upload
+          (flag (get 'flag' jon))
+          (maybe-ud 'parentId' jon)
+          (so (get 'name' jon))
+          (so (get 'mime' jon))
+          (ni (get 'size' jon))
+          (maybe 'checksum' jon so)
+      ==
+    ::
+        %'finish-upload'
+      :*  %finish-upload
+          (flag (get 'flag' jon))
+          ((se %uv) (get 'sessionId' jon))
+          (so (get 'objectUrl' jon))
+      ==
+    ::
+        %'fail-upload'
+      :*  %fail-upload
+          (flag (get 'flag' jon))
+          ((se %uv) (get 'sessionId' jon))
+          (so (get 'reason' jon))
+      ==
+    ::
+        %'rename-entry'
+      :*  %rename-entry
+          (flag (get 'flag' jon))
+          (ni (get 'id' jon))
+          (so (get 'name' jon))
+      ==
+    ::
+        %'move-entry'
+      :*  %move-entry
+          (flag (get 'flag' jon))
+          (ni (get 'id' jon))
+          (maybe-ud 'parentId' jon)
+      ==
+    ::
+        %'delete-entry'
+      :*  %delete-entry
+          (flag (get 'flag' jon))
+          (ni (get 'id' jon))
+          (bo (get 'recursive' jon))
+      ==
+    ==
+  --
+--
diff --git a/desk/mar/buckets-action-1.hoon b/desk/mar/buckets-action-1.hoon
new file mode 100644
index 0000000000..0bcf94de86
--- /dev/null
+++ b/desk/mar/buckets-action-1.hoon
@@ -0,0 +1,16 @@
+::  buckets-action-1: local client actions
+::
+/-  b=buckets
+/=  buckets-json  /lib/buckets/json
+|_  =action:b
+++  grad  %noun
+++  grab
+  |%
+  ++  noun  action:b
+  ++  json  action:dejs:buckets-json
+  --
+++  grow
+  |%
+  ++  noun  action
+  --
+--
diff --git a/desk/mar/buckets-command-1.hoon b/desk/mar/buckets-command-1.hoon
new file mode 100644
index 0000000000..bb40e72fa5
--- /dev/null
+++ b/desk/mar/buckets-command-1.hoon
@@ -0,0 +1,14 @@
+::  buckets-command-1: noun-only cross-ship commands
+::
+/-  b=buckets
+|_  =command:b
+++  grad  %noun
+++  grab
+  |%
+  ++  noun  command:b
+  --
+++  grow
+  |%
+  ++  noun  command
+  --
+--
diff --git a/desk/mar/buckets-response-1.hoon b/desk/mar/buckets-response-1.hoon
new file mode 100644
index 0000000000..a60b9b0dc3
--- /dev/null
+++ b/desk/mar/buckets-response-1.hoon
@@ -0,0 +1,16 @@
+::  buckets-response-1: snapshots and manifest updates
+::
+/-  b=buckets
+/=  buckets-json  /lib/buckets/json
+|_  =response:b
+++  grad  %noun
+++  grab
+  |%
+  ++  noun  response:b
+  --
+++  grow
+  |%
+  ++  noun  response
+  ++  json  (response:enjs:buckets-json response)
+  --
+--
diff --git a/desk/mar/buckets-snapshots-1.hoon b/desk/mar/buckets-snapshots-1.hoon
new file mode 100644
index 0000000000..0003e54be3
--- /dev/null
+++ b/desk/mar/buckets-snapshots-1.hoon
@@ -0,0 +1,16 @@
+::  buckets-snapshots-1: complete local manifest replica
+::
+/-  b=buckets
+/=  buckets-json  /lib/buckets/json
+|_  snaps=(list snapshot:b)
+++  grad  %noun
+++  grab
+  |%
+  ++  noun  (list snapshot:b)
+  --
+++  grow
+  |%
+  ++  noun  snaps
+  ++  json  (snapshots:enjs:buckets-json snaps)
+  --
+--
diff --git a/desk/sur/buckets.hoon b/desk/sur/buckets.hoon
new file mode 100644
index 0000000000..fc4b5fd306
--- /dev/null
+++ b/desk/sur/buckets.hoon
@@ -0,0 +1,147 @@
+::  buckets: shared group file-space protocol
+::
+::  Gall owns only the logical manifest and upload lifecycle. File bytes and
+::  signed object-store grants must never be stored in this state or sent over
+::  Ames.
+::
+|%
++$  flag  [=ship name=@tas]
++$  nest  [kind=@tas host=@p name=@tas]
+::
+::  Channel-host messages used by %groups for third-party channel kinds.
+::
++$  channel-join   [=nest group=flag]
++$  channel-leave  [=nest]
+::
+::  Minimal %groups channel-registration payloads. These intentionally mirror
+::  the protocol shapes consumed by %group-action-4.
+::
++$  group-channel
+  $:  meta=[title=@t description=@t image=@t cover=@t]
+      created=@da
+      section=@tas
+      readers=(set @tas)
+      join=?
+  ==
++$  group-create
+  $:  %group
+      =flag
+      %channel
+      =nest
+      %add
+      channel=group-channel
+  ==
++$  group-channel-del
+  $:  %group
+      =flag
+      %channel
+      =nest
+      %del
+      ~
+  ==
+::
++$  bucket
+  $:  id=@ud
+      title=@t
+      created-by=ship
+      created-at=@da
+      updated-by=ship
+      updated-at=@da
+  ==
+::
++$  upload-status  ?(%pending %ready %failed)
++$  file
+  $:  mime=@t
+      size=@ud
+      checksum=(unit @t)
+      object-key=@t
+      object-url=(unit @t)
+      status=upload-status
+  ==
++$  entry-kind
+  $%  [%folder ~]
+      [%file =file]
+  ==
++$  entry
+  $:  id=@ud
+      parent=(unit @ud)
+      name=@t
+      created-by=ship
+      created-at=@da
+      updated-by=ship
+      updated-at=@da
+      kind=entry-kind
+  ==
+::
++$  session-status  ?(%pending %complete %failed)
++$  upload-session
+  $:  id=@uv
+      file-id=@ud
+      requested-by=ship
+      created-at=@da
+      expires-at=@da
+      status=session-status
+      error=(unit @t)
+  ==
+::
+::  A group Bucket uses the group's live can-read gate as its read and write
+::  authority in v1. `readers` is preserved for channel registration and UI.
+::
++$  bucket-state
+  $:  =bucket
+      group=flag
+      readers=(set @tas)
+      entries=(map @ud entry)
+      sessions=(map @uv upload-session)
+      revision=@ud
+  ==
+::
+::  Client actions. Non-create actions carry a complete Bucket flag so a
+::  subscriber can forward the same noun to the authoritative host.
+::
++$  action
+  $%  [%create name=@tas title=@t group=flag readers=(set @tas)]
+      [%delete-bucket =flag]
+      [%create-folder =flag parent=(unit @ud) name=@t]
+      [%begin-upload =flag parent=(unit @ud) name=@t mime=@t size=@ud checksum=(unit @t)]
+      [%finish-upload =flag session=@uv object-url=@t]
+      [%fail-upload =flag session=@uv reason=@t]
+      [%rename-entry =flag id=@ud name=@t]
+      [%move-entry =flag id=@ud parent=(unit @ud)]
+      [%delete-entry =flag id=@ud recursive=?]
+  ==
+::
+::  Cross-ship commands are noun-only. The actor is always src.bowl; no
+::  claimed principal appears in the payload.
+::
++$  command  [=action]
+::
++$  update
+  $%  [%bucket-created =bucket]
+      [%bucket-deleted ~]
+      [%folder-created =entry]
+      [%upload-begun =upload-session =entry]
+      [%upload-ready =upload-session =entry]
+      [%upload-failed =upload-session =entry]
+      [%entry-updated =entry]
+      [%entries-deleted ids=(list @ud)]
+  ==
++$  response
+  $%  [%snapshot =flag =bucket-state]
+      [%update =flag revision=@ud actor=ship =update]
+  ==
++$  snapshot  [=flag =bucket-state]
+::
++$  net  ?(%pub %sub)
++$  space  [=net state=(unit bucket-state) pending-group=(unit flag)]
+::
+::  Greenfield state. Future changes must add state-N and an explicit
+::  state-(N-1)-to-N migration in +on-load; never mutate this mold in place.
+::
++$  state-0
+  $:  %0
+      spaces=(map flag space)
+      next-id=@ud
+  ==
++$  state  state-0
+--
diff --git a/desk/tests/app/buckets.hoon b/desk/tests/app/buckets.hoon
new file mode 100644
index 0000000000..03511b8a91
--- /dev/null
+++ b/desk/tests/app/buckets.hoon
@@ -0,0 +1,111 @@
+::  behavior tests for the %buckets Gall agent
+::
+/-  bu=buckets
+/+  *test-agent
+/=  buckets-agent  /app/buckets
+|%
+++  dap  %buckets
+::
+++  flag
+  ^-  flag:bu
+  [~zod %project-files]
+::
+++  group
+  ^-  flag:bu
+  [~zod %test-group]
+::
+++  setup
+  =/  m  (mare ,~)
+  ^-  form:m
+  ;<  ~  bind:m  (jab-bowl |=(b=bowl b(our ~zod, src ~zod)))
+  ;<  *  bind:m  (do-init dap buckets-agent)
+  ;<  ~  bind:m
+    (jab-bowl |=(b=bowl b(now ~2026.1.1, eny 0v1234)))
+  (pure:m ~)
+::
+++  create
+  =/  m  (mare ,~)
+  ^-  form:m
+  ;<  *  bind:m
+    (do-poke %buckets-action-1 !>(`action:bu`[%create %project-files 'Project Files' group ~]))
+  (pure:m ~)
+::
+++  file-of
+  |=  ent=entry:bu
+  ^-  file:bu
+  ?-  -.kind.ent
+    %folder  ~|(%expected-file !!)
+    %file    +.kind.ent
+  ==
+::
+++  state-for
+  |=  [st=state-0:bu =flag:bu]
+  ^-  bucket-state:bu
+  =/  sp=space:bu  (~(got by spaces.st) flag)
+  (need state.sp)
+::
+++  deny-group-scries
+  |=  pax=path
+  ^-  (unit vase)
+  ?.  ?=([%gx @ %groups @ %v2 %groups @ @ %channels %can-read %noun ~] pax)  ~
+  `!>(|=([who=ship =nest:bu] |))
+::
+::  A complete metadata-only upload lifecycle. The bytes never enter Gall;
+::  only the host-issued session, object key, and final object URL do.
+::
+++  test-upload-lifecycle
+  %-  eval-mare
+  =/  m  (mare ,~)
+  =*  b  bind:m
+  ^-  form:m
+  ;<  ~  b  setup
+  ;<  ~  b  create
+  ;<  *  b
+    (do-poke %buckets-action-1 !>(`action:bu`[%create-folder flag ~ 'Launch']))
+  ;<  *  b
+    (do-poke %buckets-action-1 !>(`action:bu`[%begin-upload flag `2 'meadow.png' 'image/png' 2.048 ~]))
+  ;<  sv=vase  b  get-save
+  =/  st=state-0:bu  !<(state-0:bu sv)
+  =/  bs=bucket-state:bu  (state-for st flag)
+  =/  session-list=(list upload-session:bu)  ~(val by sessions.bs)
+  =/  ses=upload-session:bu  ?~(session-list !! i.session-list)
+  ;<  *  b
+    (do-poke %buckets-action-1 !>(`action:bu`[%finish-upload flag id.ses 'https://objects.test/meadow.png']))
+  ;<  sv2=vase  b  get-save
+  =/  st2=state-0:bu  !<(state-0:bu sv2)
+  =/  bs2=bucket-state:bu  (state-for st2 flag)
+  =/  ent=entry:bu  (~(got by entries.bs2) 3)
+  =/  fil=file:bu  (file-of ent)
+  =/  ses2=upload-session:bu  (~(got by sessions.bs2) id.ses)
+  =/  expected-url=(unit @t)  (some 'https://objects.test/meadow.png')
+  =/  expected-parent=(unit @ud)  (some 2)
+  (ex-equal !>([revision.bs2 status.fil status.ses2 object-url.fil parent.ent]) !>([3 %ready %complete expected-url expected-parent]))
+::
+::  Folder parents must exist and must themselves be folders.
+::
+++  test-invalid-parent-rejected
+  %-  eval-mare
+  =/  m  (mare ,~)
+  =*  b  bind:m
+  ^-  form:m
+  ;<  ~  b  setup
+  ;<  ~  b  create
+  %-  ex-fail
+  (do-poke %buckets-action-1 !>(`action:bu`[%create-folder flag `999 'Bad']))
+::
+::  Cross-ship writes are re-authorized against %groups' live can-read gate;
+::  membership recorded in old state is never treated as permanent authority.
+::
+++  test-remote-write-revoked
+  %-  eval-mare
+  =/  m  (mare ,~)
+  =*  b  bind:m
+  ^-  form:m
+  ;<  ~  b  setup
+  ;<  ~  b  create
+  ;<  ~  b  (set-scry-gate deny-group-scries)
+  %-  ex-fail
+  %-  (do-as ~bus)
+  %+  do-poke  %buckets-command-1
+  !>([[%create-folder flag ~ 'Denied']])
+--
diff --git a/docs/backend/desk/app/buckets.md b/docs/backend/desk/app/buckets.md
new file mode 100644
index 0000000000..1e620f29ec
--- /dev/null
+++ b/docs/backend/desk/app/buckets.md
@@ -0,0 +1,79 @@
+# `%buckets`
+
+`%buckets` is a third-party `%groups` channel host for group-owned file spaces. It owns the logical folder tree, file metadata, authorization, and upload lifecycle. It does not store or transport file bytes.
+
+The channel nest is `buckets/~host/name`. The Bucket host is authoritative, while member ships keep subscribed replicas and expose those replicas to their local clients.
+
+## Authority and storage boundary
+
+- `%groups` remains the authority for membership and channel visibility.
+- The Bucket host re-checks the affiliated group's live `can-read` gate for every remote command and subscription. In version 1, anyone who can read the channel can also mutate it.
+- The acting principal is always `src.bowl`; commands cannot claim a different ship.
+- Gall persists only the manifest and bounded upload-session metadata. Object bytes, storage credentials, and signed URLs must not travel over Ames or enter Gall state.
+- Object keys are host-generated and independent of display names, so rename and move operations only change manifest metadata.
+
+The current upload completion action accepts an object URL supplied by the requester. That is sufficient for the fakezod slice, but it is not the production trust boundary. Ylem/Memex integration must mint a scoped grant and verify object existence, size, and optional checksum before `%finish-upload` is accepted.
+
+## State
+
+The protocol and persisted molds are in `desk/sur/buckets.hoon`.
+
+Each Bucket contains:
+
+- Bucket metadata and affiliated group flag
+- File/folder entries keyed by stable numeric ID
+- Upload sessions keyed by host entropy
+- A monotonically increasing manifest revision
+
+Files transition from `%pending` to `%ready` or `%failed`. Upload sessions independently transition from `%pending` to `%complete` or `%failed`. State is explicitly tagged `%0`; any future mold change must add a migration rather than changing `state-0` in place.
+
+## Pokes
+
+Local clients poke `%buckets-action-1`. The mark accepts JSON and noun input.
+
+| Action | Purpose |
+| --- | --- |
+| `%create` | Create a host-owned Bucket and register the channel with `%groups` |
+| `%delete-bucket` | Delete the Bucket and remove its `%groups` channel registration |
+| `%create-folder` | Add a folder beneath an existing folder or the root |
+| `%begin-upload` | Allocate a pending file, opaque object key, and one-hour upload session |
+| `%finish-upload` | Mark the requester's pending upload ready |
+| `%fail-upload` | Mark the requester's pending upload failed |
+| `%rename-entry` | Change an entry's display name |
+| `%move-entry` | Move an entry while preventing folder cycles |
+| `%delete-entry` | Delete a file or recursively delete a folder tree |
+
+Subscriber agents forward non-create actions to the host with the noun-only `%buckets-command-1` mark. The host derives the actor from the Gall bowl and re-authorizes the command.
+
+## Scries and subscriptions
+
+| Path | Mark | Description |
+| --- | --- | --- |
+| `/x/v1/buckets` | `%buckets-snapshots-1` | All locally available Bucket snapshots |
+| `/x/v1/buckets/<host>/<name>` | `%buckets-response-1` | One local Bucket snapshot |
+| `/u/joined/<host>/<name>` | `%loob` | Whether the local agent has the Bucket |
+| `/v1` | `%buckets-response-1` | Initial snapshots and all local replica updates |
+| `/v1/buckets/<host>/<name>/updates` | `%buckets-response-1` | Host-authorized snapshot followed by manifest updates |
+
+Direct scries are self-only. Remote consumers subscribe to the host's update path, where the host can apply the live group authorization check. Subscriber agents report joined/left state to local `%groups` using `%group-channel-active`.
+
+## Intended hosted upload flow
+
+1. The client calls `%begin-upload` through its local `%buckets` agent.
+2. The host authorizes the caller, allocates the file ID, object key, and session.
+3. A Ylem/Memex broker exchanges that authorized session for a short-lived PUT grant bound to the host, Bucket, key, caller, size, content type, and expiry.
+4. The client uploads bytes directly to object storage with progress and retry.
+5. The broker HEAD-verifies the object and finalizes the reservation.
+6. The client calls `%finish-upload`; the host emits a revisioned manifest update to every subscriber.
+
+The broker/grant steps are deliberately not implemented in the Gall slice yet. The client fixture's upload queue is therefore a UI simulation, not a live object transfer.
+
+## Tests
+
+`desk/tests/app/buckets.hoon` covers:
+
+- Folder creation plus a complete metadata-only upload lifecycle
+- Rejection of nonexistent folder parents
+- Rejection of a remote write after the live `%groups` permission gate denies access
+
+Run the targeted fakezod test with the repository's normal `%test` thread against `/tests/app/buckets/hoon`. Marks must remain top-level files such as `desk/mar/buckets-action-1.hoon`; nesting them under `desk/mar/buckets/` changes the mark name and prevents Gall from resolving the protocol.
diff --git a/packages/app/fixtures/BucketsChannel.fixture.tsx b/packages/app/fixtures/BucketsChannel.fixture.tsx
index 3d16d6434d..68a1b4099e 100644
--- a/packages/app/fixtures/BucketsChannel.fixture.tsx
+++ b/packages/app/fixtures/BucketsChannel.fixture.tsx
@@ -1,4 +1,5 @@
 import * as db from '@tloncorp/shared/db';
+import * as DocumentPicker from 'expo-document-picker';
 import { useEffect, useMemo, useState } from 'react';
 import { Linking, useWindowDimensions } from 'react-native';
 
@@ -6,6 +7,7 @@ import {
   BucketFileViewer,
   BucketItem,
   BucketSearchResult,
+  BucketUploadCandidate,
   BucketsHeaderActions,
   BucketsNewSheet,
   BucketsPane,
@@ -81,6 +83,7 @@ const initialFiles: Record<string, BucketItem[]> = {
         'application/zip'
       ),
       uploadProgress: 42,
+      uploadState: 'uploading',
     },
   ],
   brand: [
@@ -119,6 +122,45 @@ const initialFiles: Record<string, BucketItem[]> = {
   archive: [],
 };
 
+const sampleUploadQueue: BucketItem[] = [
+  {
+    ...file(
+      'upload-field-photo',
+      'field-photo.jpg',
+      '~zod',
+      'Uploading',
+      '4.8 MB',
+      'image/jpeg'
+    ),
+    uploadProgress: 62,
+    uploadState: 'uploading',
+  },
+  {
+    ...file(
+      'upload-interviews',
+      'interview-recordings.zip',
+      '~zod',
+      'Waiting',
+      '184 MB',
+      'application/zip'
+    ),
+    uploadProgress: 0,
+    uploadState: 'queued',
+  },
+  {
+    ...file(
+      'upload-research-notes',
+      'research-notes.pdf',
+      '~zod',
+      'Failed',
+      '8.1 MB',
+      'application/pdf'
+    ),
+    uploadError: 'Connection lost',
+    uploadState: 'failed',
+  },
+];
+
 const fakeChannel = {
   id: 'buckets/~zod/project-files',
   type: 'gallery',
@@ -174,6 +216,7 @@ function BucketsFixture({
   initialSearchQuery = '',
   newSheetInitiallyOpen = false,
   searchInitiallyOpen = false,
+  showUploadQueueInitially = false,
   state = 'populated',
   viewport,
 }: {
@@ -182,6 +225,7 @@ function BucketsFixture({
   initialSearchQuery?: string;
   newSheetInitiallyOpen?: boolean;
   searchInitiallyOpen?: boolean;
+  showUploadQueueInitially?: boolean;
   state?: FixtureState;
   viewport: 'mobile' | 'desktop' | 'responsive';
 }) {
@@ -211,11 +255,17 @@ function BucketsFixture({
   const [searchOrigin, setSearchOrigin] = useState<SearchOrigin | null>(null);
   const [query, setQuery] = useState(initialSearchQuery);
   const [previewItem, setPreviewItem] = useState<BucketItem | null>(null);
-  const [localFiles, setLocalFiles] = useState(() =>
-    includeSearchRevealFolder
+  const [localFiles, setLocalFiles] = useState(() => {
+    const baseFiles = includeSearchRevealFolder
       ? { ...initialFiles, 'field-notes': searchRevealFiles }
-      : initialFiles
-  );
+      : initialFiles;
+    if (!showUploadQueueInitially) return baseFiles;
+
+    return {
+      ...baseFiles,
+      launch: [...sampleUploadQueue, ...(baseFiles.launch ?? [])],
+    };
+  });
   const canEdit = state !== 'read-only';
   const paneState: BucketsPaneState =
     state === 'read-only' ? 'populated' : state;
@@ -279,29 +329,84 @@ function BucketsFixture({
     }
   };
 
-  const addFolder = () => {
-    const item = folder(`new-folder-${Date.now()}`, 'New folder', 0);
+  const addFolder = (name: string) => {
+    const item = folder(`new-folder-${Date.now()}`, name, 0);
     setLocalFiles((current) => ({
       ...current,
       [currentKey]: [item, ...(current[currentKey] ?? [])],
     }));
   };
 
-  const addUpload = () => {
-    const item = {
-      ...file(
-        `field-photo-${Date.now()}`,
-        'field-photo.jpg',
-        '~zod',
-        'Uploading',
-        '4.8 MB',
-        'image/jpeg'
+  const addUploads = (candidates: BucketUploadCandidate[]) => {
+    const now = Date.now();
+    const items = candidates.map((candidate, index): BucketItem => {
+      const uploadState =
+        candidates.length > 2 && index === candidates.length - 1
+          ? 'failed'
+          : index % 2 === 1
+            ? 'queued'
+            : 'uploading';
+      return {
+        ...file(
+          `upload-${now}-${index}`,
+          candidate.name,
+          '~zod',
+          uploadState === 'failed' ? 'Failed' : 'Uploading',
+          formatFileSize(candidate.size),
+          candidate.mimeType ?? 'application/octet-stream'
+        ),
+        uploadError: uploadState === 'failed' ? 'Connection lost' : undefined,
+        uploadProgress: uploadState === 'failed' ? undefined : index * 22 + 18,
+        uploadState,
+      };
+    });
+
+    setLocalFiles((current) => ({
+      ...current,
+      [currentKey]: [...items, ...(current[currentKey] ?? [])],
+    }));
+  };
+
+  const chooseUploads = async () => {
+    const result = await DocumentPicker.getDocumentAsync({
+      copyToCacheDirectory: true,
+      multiple: true,
+      type: '*/*',
+    });
+    if (!result.assets?.length) return;
+
+    addUploads(
+      result.assets.map((asset) => ({
+        mimeType: asset.mimeType ?? undefined,
+        name: asset.name,
+        size: asset.size ?? -1,
+      }))
+    );
+  };
+
+  const cancelUpload = (item: BucketItem) => {
+    setLocalFiles((current) => ({
+      ...current,
+      [currentKey]: (current[currentKey] ?? []).filter(
+        (candidate) => candidate.id !== item.id
       ),
-      uploadProgress: 18,
-    };
+    }));
+  };
+
+  const retryUpload = (item: BucketItem) => {
     setLocalFiles((current) => ({
       ...current,
-      [currentKey]: [item, ...(current[currentKey] ?? [])],
+      [currentKey]: (current[currentKey] ?? []).map((candidate) =>
+        candidate.id === item.id
+          ? {
+              ...candidate,
+              modifiedLabel: 'Uploading',
+              uploadError: undefined,
+              uploadProgress: 8,
+              uploadState: 'uploading',
+            }
+          : candidate
+      ),
     }));
   };
 
@@ -339,7 +444,10 @@ function BucketsFixture({
     items: paneState === 'empty' ? [] : visibleItems,
     selectedItemId,
     state: paneState,
+    onCancelUpload: cancelUpload,
+    onFilesDropped: addUploads,
     onOpenItem: openItem,
+    onRetryUpload: retryUpload,
     onDeleteItem: (item: BucketItem) =>
       setLocalFiles((current) => ({
         ...current,
@@ -412,7 +520,7 @@ function BucketsFixture({
                 open={newSheetOpen}
                 onNewFolder={addFolder}
                 onOpenChange={setNewSheetOpen}
-                onUploadFiles={addUpload}
+                onUploadFiles={() => void chooseUploads()}
               />
             </YStack>
           ) : (
@@ -460,7 +568,7 @@ function BucketsFixture({
                   open={newSheetOpen}
                   onNewFolder={addFolder}
                   onOpenChange={setNewSheetOpen}
-                  onUploadFiles={addUpload}
+                  onUploadFiles={() => void chooseUploads()}
                 />
               </YStack>
             </XStack>
@@ -471,6 +579,16 @@ function BucketsFixture({
   );
 }
 
+function formatFileSize(size: number) {
+  if (size < 0) return 'Unknown size';
+  if (size < 1024) return `${size} B`;
+  if (size < 1024 * 1024) return `${Math.round(size / 1024)} KB`;
+  if (size < 1024 * 1024 * 1024) {
+    return `${(size / (1024 * 1024)).toFixed(1)} MB`;
+  }
+  return `${(size / (1024 * 1024 * 1024)).toFixed(1)} GB`;
+}
+
 function RegisteredHeaderActions({
   canEdit,
   onNew,
@@ -511,6 +629,13 @@ export default {
     />
   ),
   'New action': <BucketsFixture viewport="mobile" newSheetInitiallyOpen />,
+  'Upload queue': (
+    <BucketsFixture
+      viewport="mobile"
+      initialFolderId="launch"
+      showUploadQueueInitially
+    />
+  ),
   Empty: <BucketsFixture viewport="mobile" state="empty" />,
   Loading: <BucketsFixture viewport="mobile" state="loading" />,
   'Read only': <BucketsFixture viewport="responsive" state="read-only" />,
diff --git a/packages/app/ui/components/BucketsChannel/BucketsChannel.tsx b/packages/app/ui/components/BucketsChannel/BucketsChannel.tsx
index 488f87773e..32ae2129f0 100644
--- a/packages/app/ui/components/BucketsChannel/BucketsChannel.tsx
+++ b/packages/app/ui/components/BucketsChannel/BucketsChannel.tsx
@@ -1,4 +1,5 @@
 import {
+  Button,
   FilePreview,
   Icon,
   Pressable,
@@ -7,15 +8,21 @@ import {
 } from '@tloncorp/ui';
 import { useEffect, useRef, useState } from 'react';
 import { Platform } from 'react-native';
+import { useSafeAreaInsets } from 'react-native-safe-area-context';
 import { ScrollView, View, XStack, YStack } from 'tamagui';
 
 import { ActionSheet, createActionGroups } from '../ActionSheet';
 import { Badge } from '../Badge';
+import { TextInput } from '../Form';
 import { ListItem } from '../ListItem';
 import { NotesActionMenu } from '../NotesChannel/NotesActions';
 import { OverflowTriggerButton } from '../OverflowMenuButton';
 import { ScreenHeader } from '../ScreenHeader';
 import { SearchBar } from '../SearchBar';
+import { BucketsDropTarget } from './BucketsDropTarget';
+import { BucketUploadCandidate } from './BucketsDropTarget.types';
+
+export type BucketUploadState = 'queued' | 'uploading' | 'failed';
 
 export type BucketItem = {
   id: string;
@@ -29,7 +36,9 @@ export type BucketItem = {
   mimeType?: string;
   previewUri?: string;
   textContent?: string;
+  uploadError?: string;
   uploadProgress?: number;
+  uploadState?: BucketUploadState;
 };
 
 export type BucketsPaneState = 'empty' | 'loading' | 'populated';
@@ -201,9 +210,12 @@ export function BucketsPane({
   state = 'populated',
   onDeleteItem,
   onDownloadItem,
+  onCancelUpload,
+  onFilesDropped,
   onMoveItem,
   onOpenItem,
   onRenameItem,
+  onRetryUpload,
 }: {
   canEdit: boolean;
   currentFolder?: string | null;
@@ -214,15 +226,19 @@ export function BucketsPane({
   state?: BucketsPaneState;
   onDeleteItem?: (item: BucketItem) => void;
   onDownloadItem?: (item: BucketItem) => void;
+  onCancelUpload?: (item: BucketItem) => void;
+  onFilesDropped?: (files: BucketUploadCandidate[]) => void;
   onMoveItem?: (item: BucketItem) => void;
   onOpenItem: (item: BucketItem) => void;
   onRenameItem?: (item: BucketItem) => void;
+  onRetryUpload?: (item: BucketItem) => void;
 }) {
   const scrollViewRef = useRef<ScrollView>(null);
   const [viewportHeight, setViewportHeight] = useState(0);
   const selectedIndex = selectedItemId
     ? items.findIndex((item) => item.id === selectedItemId)
     : -1;
+  const uploadItems = items.filter((item) => uploadStateFor(item));
 
   useEffect(() => {
     if (selectedIndex < 0 || !viewportHeight) {
@@ -256,36 +272,54 @@ export function BucketsPane({
             selected={selectedItemId === item.id}
             onDeleteItem={onDeleteItem}
             onDownloadItem={onDownloadItem}
+            onCancelUpload={onCancelUpload}
             onMoveItem={onMoveItem}
             onOpenItem={onOpenItem}
             onRenameItem={onRenameItem}
+            onRetryUpload={onRetryUpload}
           />
         ))}
       </YStack>
     );
 
   return (
-    <YStack flex={1} minHeight={0} backgroundColor="$background">
-      {currentFolder ? (
-        <BucketBreadcrumb rootLabel={rootLabel} folderLabel={currentFolder} />
-      ) : null}
-      <ScrollView
-        ref={scrollViewRef}
-        flex={1}
-        onLayout={(event) => setViewportHeight(event.nativeEvent.layout.height)}
-      >
-        <YStack
-          width="100%"
-          maxWidth={layout === 'takeover' ? 'unset' : 760}
-          marginHorizontal="auto"
-          paddingHorizontal="$l"
-          paddingTop={currentFolder ? '$xs' : '$m'}
-          paddingBottom="$2xl"
+    <BucketsDropTarget
+      disabled={!canEdit}
+      dropLabel={currentFolder ?? rootLabel}
+      flex={1}
+      minHeight={0}
+      onFilesDropped={onFilesDropped}
+    >
+      <YStack flex={1} minHeight={0} backgroundColor="$background">
+        {currentFolder ? (
+          <BucketBreadcrumb rootLabel={rootLabel} folderLabel={currentFolder} />
+        ) : null}
+        <ScrollView
+          ref={scrollViewRef}
+          flex={1}
+          onLayout={(event) =>
+            setViewportHeight(event.nativeEvent.layout.height)
+          }
         >
-          {list}
-        </YStack>
-      </ScrollView>
-    </YStack>
+          <YStack
+            width="100%"
+            maxWidth={layout === 'takeover' ? 'unset' : 760}
+            marginHorizontal="auto"
+            paddingHorizontal="$l"
+            paddingTop={currentFolder ? '$xs' : '$m'}
+            paddingBottom="$2xl"
+          >
+            {list}
+          </YStack>
+        </ScrollView>
+        {uploadItems.length > 0 ? (
+          <BucketsUploadTray
+            items={uploadItems}
+            onRetryUpload={onRetryUpload}
+          />
+        ) : null}
+      </YStack>
+    </BucketsDropTarget>
   );
 }
 
@@ -295,24 +329,29 @@ function BucketRow({
   selected,
   onDeleteItem,
   onDownloadItem,
+  onCancelUpload,
   onMoveItem,
   onOpenItem,
   onRenameItem,
+  onRetryUpload,
 }: {
   canEdit: boolean;
   item: BucketItem;
   selected: boolean;
   onDeleteItem?: (item: BucketItem) => void;
   onDownloadItem?: (item: BucketItem) => void;
+  onCancelUpload?: (item: BucketItem) => void;
   onMoveItem?: (item: BucketItem) => void;
   onOpenItem: (item: BucketItem) => void;
   onRenameItem?: (item: BucketItem) => void;
+  onRetryUpload?: (item: BucketItem) => void;
 }) {
   const [isHovered, setIsHovered] = useState(false);
   const [open, setOpen] = useState(false);
   const isWindowNarrow = useIsWindowNarrow();
   const showOverflow =
     Platform.OS !== 'web' || isWindowNarrow || isHovered || open;
+  const uploadState = uploadStateFor(item);
   const groups = createActionGroups(
     [
       'neutral',
@@ -367,10 +406,14 @@ function BucketRow({
   return (
     <Pressable
       aria-label={`${item.kind === 'folder' ? 'Folder' : 'File'} ${item.name}`}
-      onLongPress={() => setOpen(true)}
+      onLongPress={() => {
+        if (!uploadState) setOpen(true);
+      }}
       onMouseEnter={() => setIsHovered(true)}
       onMouseLeave={() => setIsHovered(false)}
-      onPress={() => onOpenItem(item)}
+      onPress={() => {
+        if (!uploadState) onOpenItem(item);
+      }}
       testID={`BucketsItem-${item.id}`}
     >
       <ListItem
@@ -395,7 +438,30 @@ function BucketRow({
           <BucketItemMetadata item={item} />
         </ListItem.MainContent>
         <ListItem.EndContent minWidth="$3xl">
-          {showOverflow ? (
+          {uploadState === 'failed' ? (
+            <XStack alignItems="center" gap="$xs">
+              <UploadAction
+                accessibilityLabel={`Remove ${item.name} from uploads`}
+                label="Remove"
+                onPress={() => onCancelUpload?.(item)}
+                testID={`BucketsRemoveUpload-${item.id}`}
+              />
+              <UploadAction
+                accessibilityLabel={`Retry uploading ${item.name}`}
+                accent="positive"
+                label="Retry"
+                onPress={() => onRetryUpload?.(item)}
+                testID={`BucketsRetryUpload-${item.id}`}
+              />
+            </XStack>
+          ) : uploadState ? (
+            <UploadAction
+              accessibilityLabel={`Cancel uploading ${item.name}`}
+              label="Cancel"
+              onPress={() => onCancelUpload?.(item)}
+              testID={`BucketsCancelUpload-${item.id}`}
+            />
+          ) : showOverflow ? (
             <NotesActionMenu
               groups={groups}
               header={{
@@ -479,48 +545,114 @@ export function BucketsNewSheet({
   onUploadFiles,
 }: {
   open: boolean;
-  onNewFolder: () => void;
+  onNewFolder: (name: string) => void;
   onOpenChange: (open: boolean) => void;
   onUploadFiles: () => void;
 }) {
+  const [view, setView] = useState<'actions' | 'folder'>('actions');
+  const [folderName, setFolderName] = useState('');
+  const isWeb = Platform.OS === 'web';
+  const normalizedFolderName = folderName.trim();
+
+  useEffect(() => {
+    if (open) {
+      setView('actions');
+      setFolderName('');
+    }
+  }, [open]);
+
+  const createFolder = () => {
+    if (!normalizedFolderName) return;
+    onNewFolder(normalizedFolderName);
+    onOpenChange(false);
+  };
+
   return (
     <ActionSheet
+      closeButton={isWeb}
+      dialogContentProps={{ width: 420, maxWidth: '90%', minWidth: 320 }}
+      keyboardBehavior="interactive"
+      moveOnKeyboardChange
       open={open}
       onOpenChange={onOpenChange}
       modal
       snapPointsMode="fit"
+      title={view === 'folder' ? 'New folder' : 'New'}
       unmountOnClose
     >
-      <ActionSheet.SimpleHeader
-        title="New"
-        subtitle="Add something to this folder"
-      />
-      <ActionSheet.Content>
-        <ActionSheet.ActionGroup accent="neutral">
-          <ActionSheet.Action
-            action={{
-              title: 'Upload files',
-              startIcon: 'Attachment',
-              action: () => {
-                onOpenChange(false);
-                onUploadFiles();
-              },
-            }}
-            testID="BucketsUploadFilesAction"
+      {view === 'actions' ? (
+        <>
+          <ActionSheet.SimpleHeader
+            title="New"
+            subtitle="Add something to this folder"
           />
-          <ActionSheet.Action
-            action={{
-              title: 'New folder',
-              startIcon: 'Folder',
-              action: () => {
-                onOpenChange(false);
-                onNewFolder();
-              },
-            }}
-            testID="BucketsNewFolderAction"
+          <ActionSheet.Content>
+            <ActionSheet.ActionGroup accent="neutral">
+              <ActionSheet.Action
+                action={{
+                  title: 'Upload files',
+                  startIcon: 'Attachment',
+                  action: () => {
+                    onOpenChange(false);
+                    onUploadFiles();
+                  },
+                }}
+                testID="BucketsUploadFilesAction"
+              />
+              <ActionSheet.Action
+                action={{
+                  title: 'New folder',
+                  startIcon: 'Folder',
+                  action: () => setView('folder'),
+                }}
+                testID="BucketsNewFolderAction"
+              />
+            </ActionSheet.ActionGroup>
+          </ActionSheet.Content>
+        </>
+      ) : (
+        <>
+          <ActionSheet.SimpleHeader
+            title="New folder"
+            subtitle="Add it to this folder"
           />
-        </ActionSheet.ActionGroup>
-      </ActionSheet.Content>
+          <ActionSheet.Content testID="BucketsNewFolderForm">
+            <ActionSheet.FormBlock>
+              <YStack gap="$s">
+                <Text color="$secondaryText" size="$label/s">
+                  Name
+                </Text>
+                <TextInput
+                  autoFocus
+                  maxLength={120}
+                  onChangeText={setFolderName}
+                  onSubmitEditing={createFolder}
+                  placeholder="Folder name"
+                  returnKeyType="done"
+                  testID="BucketsNewFolderNameInput"
+                  value={folderName}
+                />
+              </YStack>
+            </ActionSheet.FormBlock>
+            <ActionSheet.FormBlock>
+              <XStack alignItems="center" gap="$m" justifyContent="flex-end">
+                <Button
+                  label="Cancel"
+                  onPress={() => onOpenChange(false)}
+                  preset="minimal"
+                />
+                <Button
+                  centered
+                  disabled={!normalizedFolderName}
+                  label="Create folder"
+                  onPress={createFolder}
+                  preset="primary"
+                />
+              </XStack>
+            </ActionSheet.FormBlock>
+          </ActionSheet.Content>
+        </>
+      )}
     </ActionSheet>
   );
 }
@@ -562,7 +694,27 @@ function BucketItemMetadata({ item }: { item: BucketItem }) {
     );
   }
 
-  if (item.uploadProgress !== undefined) {
+  const uploadState = uploadStateFor(item);
+  if (uploadState === 'failed') {
+    return (
+      <XStack alignItems="center" gap="$xs" minWidth={0}>
+        <Text color="$negativeActionText" numberOfLines={1} size="$label/m">
+          Upload failed
+          {item.uploadError ? ` · ${item.uploadError}` : ''}
+        </Text>
+      </XStack>
+    );
+  }
+
+  if (uploadState === 'queued') {
+    return (
+      <Text color="$tertiaryText" numberOfLines={1} size="$label/m">
+        Waiting to upload
+      </Text>
+    );
+  }
+
+  if (uploadState === 'uploading') {
     return (
       <XStack alignItems="center" gap="$s" minWidth={0}>
         <XStack alignItems="center" gap="$xs" flex={1} minWidth={0}>
@@ -579,7 +731,7 @@ function BucketItemMetadata({ item }: { item: BucketItem }) {
             · Uploading
           </Text>
         </XStack>
-        <UploadProgress progress={item.uploadProgress} />
+        <UploadProgress progress={item.uploadProgress ?? 0} />
       </XStack>
     );
   }
@@ -658,6 +810,150 @@ function UploadProgress({ progress }: { progress: number }) {
   );
 }
 
+function BucketsUploadTray({
+  items,
+  onRetryUpload,
+}: {
+  items: BucketItem[];
+  onRetryUpload?: (item: BucketItem) => void;
+}) {
+  const insets = useSafeAreaInsets();
+  const failedItems = items.filter((item) => uploadStateFor(item) === 'failed');
+  const activeItems = items.filter((item) => uploadStateFor(item) !== 'failed');
+  const activeProgress =
+    activeItems.length === 0
+      ? 0
+      : Math.round(
+          activeItems.reduce(
+            (sum, item) => sum + (item.uploadProgress ?? 0),
+            0
+          ) / activeItems.length
+        );
+  const title =
+    activeItems.length > 0
+      ? `${activeItems.length} ${
+          activeItems.length === 1 ? 'upload' : 'uploads'
+        } in progress`
+      : `${failedItems.length} ${
+          failedItems.length === 1 ? 'upload' : 'uploads'
+        } failed`;
+
+  return (
+    <XStack
+      accessibilityLiveRegion="polite"
+      alignItems="center"
+      borderTopColor="$border"
+      borderTopWidth={1}
+      backgroundColor="$background"
+      gap="$m"
+      minHeight={64}
+      paddingHorizontal="$l"
+      paddingTop="$l"
+      paddingBottom={Math.max(insets.bottom, 16)}
+    >
+      <YStack
+        width="$3xl"
+        height="$3xl"
+        alignItems="center"
+        justifyContent="center"
+        borderRadius="$l"
+        backgroundColor={
+          failedItems.length > 0
+            ? '$negativeBackground'
+            : '$secondaryBackground'
+        }
+      >
+        <Icon
+          color={
+            failedItems.length > 0
+              ? '$negativeActionText'
+              : '$positiveActionText'
+          }
+          size="$m"
+          type="Attachment"
+        />
+      </YStack>
+      <YStack flex={1} minWidth={0} gap="$xs">
+        <Text color="$primaryText" numberOfLines={1} size="$label/l">
+          {title}
+        </Text>
+        <Text color="$tertiaryText" numberOfLines={1} size="$label/s">
+          {failedItems.length > 0
+            ? `${failedItems.length} needs attention`
+            : 'You can keep browsing'}
+        </Text>
+      </YStack>
+      {failedItems.length > 0 ? (
+        <UploadAction
+          accessibilityLabel={
+            failedItems.length === 1
+              ? 'Retry failed upload'
+              : 'Retry all failed uploads'
+          }
+          accent="negative"
+          label={failedItems.length === 1 ? 'Retry' : 'Retry all'}
+          onPress={() => failedItems.forEach((item) => onRetryUpload?.(item))}
+          testID="BucketsRetryFailedUploads"
+        />
+      ) : (
+        <UploadProgress progress={activeProgress} />
+      )}
+    </XStack>
+  );
+}
+
+function UploadAction({
+  accessibilityLabel,
+  accent = 'neutral',
+  label,
+  onPress,
+  testID,
+}: {
+  accessibilityLabel?: string;
+  accent?: 'neutral' | 'positive' | 'negative';
+  label: string;
+  onPress: () => void;
+  testID: string;
+}) {
+  return (
+    <Pressable
+      accessibilityLabel={accessibilityLabel ?? label}
+      accessibilityRole="button"
+      alignItems="center"
+      justifyContent="center"
+      minHeight={44}
+      minWidth={44}
+      borderRadius="$l"
+      hoverStyle={{ backgroundColor: '$secondaryBackground' }}
+      onPress={(event) => {
+        event.stopPropagation();
+        onPress();
+      }}
+      paddingHorizontal="$s"
+      testID={testID}
+    >
+      <Text
+        color={
+          accent === 'positive'
+            ? '$positiveActionText'
+            : accent === 'negative'
+              ? '$negativeActionText'
+              : '$secondaryText'
+        }
+        fontWeight="600"
+        size="$label/m"
+      >
+        {label}
+      </Text>
+    </Pressable>
+  );
+}
+
+function uploadStateFor(item: BucketItem): BucketUploadState | null {
+  if (item.uploadState) return item.uploadState;
+  return item.uploadProgress !== undefined ? 'uploading' : null;
+}
+
 function BucketsLoadingRows() {
   return (
     <YStack gap="$xs" accessibilityLabel="Loading files">
diff --git a/packages/app/ui/components/BucketsChannel/BucketsDropTarget.native.tsx b/packages/app/ui/components/BucketsChannel/BucketsDropTarget.native.tsx
new file mode 100644
index 0000000000..29c5493024
--- /dev/null
+++ b/packages/app/ui/components/BucketsChannel/BucketsDropTarget.native.tsx
@@ -0,0 +1,10 @@
+import { View } from 'tamagui';
+
+import { BucketsDropTargetComponent } from './BucketsDropTarget.types';
+
+export const BucketsDropTarget: BucketsDropTargetComponent = ({
+  disabled: _disabled,
+  dropLabel: _dropLabel,
+  onFilesDropped: _onFilesDropped,
+  ...props
+}) => <View {...props} />;
diff --git a/packages/app/ui/components/BucketsChannel/BucketsDropTarget.tsx b/packages/app/ui/components/BucketsChannel/BucketsDropTarget.tsx
new file mode 100644
index 0000000000..adc958afa4
--- /dev/null
+++ b/packages/app/ui/components/BucketsChannel/BucketsDropTarget.tsx
@@ -0,0 +1,104 @@
+import { Icon, Text } from '@tloncorp/ui';
+import { useCallback } from 'react';
+import { useDropzone } from 'react-dropzone';
+import { View, YStack } from 'tamagui';
+
+import {
+  BucketUploadCandidate,
+  BucketsDropTargetComponent,
+} from './BucketsDropTarget.types';
+
+export const BucketsDropTarget: BucketsDropTargetComponent = ({
+  children,
+  disabled,
+  dropLabel,
+  onFilesDropped,
+  ...props
+}) => {
+  const handleDrop = useCallback(
+    (files: File[]) => {
+      const candidates: BucketUploadCandidate[] = files.map((file) => ({
+        mimeType: file.type || undefined,
+        name: file.name,
+        size: file.size,
+      }));
+      if (candidates.length > 0) {
+        onFilesDropped?.(candidates);
+      }
+    },
+    [onFilesDropped]
+  );
+  const { getInputProps, getRootProps, isDragActive, isDragReject } =
+    useDropzone({
+      disabled: disabled || !onFilesDropped,
+      noClick: true,
+      noKeyboard: true,
+      onDrop: handleDrop,
+    });
+
+  return (
+    // @ts-expect-error getRootProps() supplies web-only drag event props.
+    <View {...getRootProps()} {...props}>
+      {/* @ts-expect-error this hidden input exists only in the web build. */}
+      <View
+        {...getInputProps()}
+        render="input"
+        width={0}
+        height={0}
+        position="absolute"
+      />
+      {children}
+      {isDragActive ? (
+        <YStack
+          position="absolute"
+          top="$m"
+          right="$m"
+          bottom="$m"
+          left="$m"
+          zIndex={100}
+          alignItems="center"
+          justifyContent="center"
+          gap="$m"
+          borderColor={isDragReject ? '$negativeBorder' : '$border'}
+          borderRadius="$2xl"
+          borderStyle="dashed"
+          borderWidth={2}
+          backgroundColor="$background"
+          opacity={0.97}
+          pointerEvents="none"
+        >
+          <YStack
+            width="$5xl"
+            height="$5xl"
+            alignItems="center"
+            justifyContent="center"
+            borderRadius="$xl"
+            backgroundColor={
+              isDragReject ? '$negativeBackground' : '$secondaryBackground'
+            }
+          >
+            <Icon
+              color={
+                isDragReject ? '$negativeActionText' : '$positiveActionText'
+              }
+              size="$xl"
+              type="Attachment"
+            />
+          </YStack>
+          <YStack alignItems="center" gap="$xs" paddingHorizontal="$2xl">
+            <Text color="$primaryText" size="$label/xl" textAlign="center">
+              {isDragReject
+                ? 'These files cannot be uploaded'
+                : 'Drop to upload'}
+            </Text>
+            <Text color="$secondaryText" size="$label/m" textAlign="center">
+              {isDragReject
+                ? 'Try a different file.'
+                : `Files will be added to ${dropLabel}.`}
+            </Text>
+          </YStack>
+        </YStack>
+      ) : null}
+    </View>
+  );
+};
diff --git a/packages/app/ui/components/BucketsChannel/BucketsDropTarget.types.ts b/packages/app/ui/components/BucketsChannel/BucketsDropTarget.types.ts
new file mode 100644
index 0000000000..c917eb3c3d
--- /dev/null
+++ b/packages/app/ui/components/BucketsChannel/BucketsDropTarget.types.ts
@@ -0,0 +1,16 @@
+import { ComponentProps, ComponentType } from 'react';
+import { View } from 'tamagui';
+
+export type BucketUploadCandidate = {
+  name: string;
+  size: number;
+  mimeType?: string;
+};
+
+export type BucketsDropTargetComponent = ComponentType<
+  {
+    disabled?: boolean;
+    dropLabel: string;
+    onFilesDropped?: (files: BucketUploadCandidate[]) => void;
+  } & ComponentProps<typeof View>
+>;
diff --git a/packages/app/ui/components/BucketsChannel/index.ts b/packages/app/ui/components/BucketsChannel/index.ts
index 86a6886a31..875258f160 100644
--- a/packages/app/ui/components/BucketsChannel/index.ts
+++ b/packages/app/ui/components/BucketsChannel/index.ts
@@ -1,3 +1,4 @@
 export * from './BucketFileViewer';
 export * from './BucketFileViewer.shared';
+export * from './BucketsDropTarget.types';
 export * from './BucketsChannel';

From 4be7085d95c6a7bc3b0a40ff7f24150f8b24567e Mon Sep 17 00:00:00 2001
From: william arzt <bill@tlon.io>
Date: Fri, 7 Aug 2026 09:11:42 -0400
Subject: [PATCH 03/19] feat: add Buckets group file channels

---
 apps/tlon-mobile/cosmos.imports.ts            | 393 +++++------
 .../screens/Onboarding/ShipLoginScreen.tsx    |   6 +-
 desk/app/buckets.hoon                         | 352 +++++++++-
 desk/lib/buckets/json.hoon                    |  41 ++
 desk/mar/buckets-broker-command-1.hoon        |  14 +
 desk/sur/buckets.hoon                         |  74 +-
 .../ted/pioneer/buckets-authorize-delete.hoon |  21 +
 desk/ted/pioneer/buckets-authorize-read.hoon  |  21 +
 .../ted/pioneer/buckets-authorize-upload.hoon |  25 +
 desk/ted/pioneer/buckets-complete-upload.hoon |  37 +
 desk/tests/app/buckets.hoon                   | 199 +++++-
 docs/backend/desk/app/buckets.md              | 114 ++--
 packages/api/src/__tests__/apiUtils.test.ts   |  13 +
 packages/api/src/__tests__/bucketsApi.test.ts |  60 ++
 .../src/__tests__/thirdPartyChannel.test.ts   |  14 +-
 packages/api/src/client/apiUtils.ts           |   3 +-
 packages/api/src/client/bucketsApi.ts         |  73 ++
 .../api/src/client/channelContentConfig.ts    |  12 +
 packages/api/src/client/index.ts              |   1 +
 packages/api/src/index.ts                     |   2 +
 .../src/types/PostCollectionConfiguration.ts  |   7 +
 packages/api/src/types/models.ts              |   3 +-
 packages/api/src/urbit/buckets.ts             | 168 +++++
 packages/api/src/urbit/channel.ts             |   2 +-
 packages/api/src/urbit/index.ts               |   2 +
 packages/api/src/urbit/utils.ts               |   8 +-
 .../features/buckets/BucketsLiveChannel.tsx   | 535 +++++++++++++++
 .../app/features/buckets/bucketMediaPicker.ts |  49 ++
 .../buckets/bucketUploadTask.native.ts        |  49 ++
 .../app/features/buckets/bucketUploadTask.ts  |  64 ++
 .../buckets/bucketUploadTask.types.ts         |  13 +
 .../app/features/buckets/useLiveBucket.ts     | 639 ++++++++++++++++++
 .../groups/CreateChannelPermissionsScreen.tsx |  41 +-
 .../app/features/top/ChannelDetailsScreen.tsx |   6 +-
 packages/app/features/top/ChannelScreen.tsx   |  11 +-
 packages/app/features/top/chatDetails.tsx     |  12 +-
 .../app/fixtures/BucketsChannel.fixture.tsx   |  23 +-
 .../fixtures/BucketsChannel.live.fixture.tsx  |  65 ++
 packages/app/fixtures/FixtureWrapper.tsx      |  74 +-
 .../app/fixtures/fixtureUrbitFetch.native.ts  |  58 ++
 packages/app/fixtures/fixtureUrbitFetch.ts    |   3 +
 packages/app/navigation/types.ts              |   4 +-
 .../BucketsChannel/BucketsChannel.tsx         |  57 +-
 .../BucketsChannel/BucketsDropTarget.tsx      |   1 +
 .../BucketsChannel/BucketsDropTarget.types.ts |   2 +
 .../BucketsChannel/BucketsPostCollection.tsx  |  25 +
 .../ui/components/Channel/ChannelHeader.tsx   |   8 +-
 .../app/ui/components/Channel/PostView.tsx    |   1 +
 packages/app/ui/components/Channel/index.tsx  |   6 +-
 .../components/FileDrop/FileDrop.native.tsx   |   5 +-
 .../app/ui/components/FileDrop/FileDrop.tsx   |   2 +
 packages/app/ui/components/FileDrop/types.ts  |   1 +
 .../ManageChannels/CreateChannelSheet.tsx     |  69 +-
 .../app/ui/components/PostCollectionView.tsx  |   2 +
 .../componentsKits/ComponentsKitProvider.tsx  |   5 +
 packages/app/ui/utils/channelUtils.tsx        |  11 +-
 .../shared/src/store/channelActions.test.ts   |  72 ++
 packages/shared/src/store/channelActions.ts   | 144 +++-
 packages/shared/src/store/dbHooks.ts          |  17 +
 .../src/store/storage/bucketsBroker.test.ts   |  96 +++
 .../shared/src/store/storage/bucketsBroker.ts | 157 +++++
 packages/shared/src/store/storage/index.ts    |   1 +
 packages/shared/src/store/sync/sync.ts        |  12 +
 scripts/buckets-live-check.mjs                |  48 ++
 scripts/buckets-live-e2e.mjs                  | 279 ++++++++
 scripts/buckets-live-upload-smoke.mjs         | 104 +++
 scripts/run-buckets-live-app.mjs              |  52 ++
 scripts/run-buckets-live-cosmos.mjs           |  54 ++
 68 files changed, 4156 insertions(+), 386 deletions(-)
 create mode 100644 desk/mar/buckets-broker-command-1.hoon
 create mode 100644 desk/ted/pioneer/buckets-authorize-delete.hoon
 create mode 100644 desk/ted/pioneer/buckets-authorize-read.hoon
 create mode 100644 desk/ted/pioneer/buckets-authorize-upload.hoon
 create mode 100644 desk/ted/pioneer/buckets-complete-upload.hoon
 create mode 100644 packages/api/src/__tests__/bucketsApi.test.ts
 create mode 100644 packages/api/src/client/bucketsApi.ts
 create mode 100644 packages/api/src/urbit/buckets.ts
 create mode 100644 packages/app/features/buckets/BucketsLiveChannel.tsx
 create mode 100644 packages/app/features/buckets/bucketMediaPicker.ts
 create mode 100644 packages/app/features/buckets/bucketUploadTask.native.ts
 create mode 100644 packages/app/features/buckets/bucketUploadTask.ts
 create mode 100644 packages/app/features/buckets/bucketUploadTask.types.ts
 create mode 100644 packages/app/features/buckets/useLiveBucket.ts
 create mode 100644 packages/app/fixtures/BucketsChannel.live.fixture.tsx
 create mode 100644 packages/app/fixtures/fixtureUrbitFetch.native.ts
 create mode 100644 packages/app/fixtures/fixtureUrbitFetch.ts
 create mode 100644 packages/app/ui/components/BucketsChannel/BucketsPostCollection.tsx
 create mode 100644 packages/shared/src/store/storage/bucketsBroker.test.ts
 create mode 100644 packages/shared/src/store/storage/bucketsBroker.ts
 create mode 100644 scripts/buckets-live-check.mjs
 create mode 100644 scripts/buckets-live-e2e.mjs
 create mode 100644 scripts/buckets-live-upload-smoke.mjs
 create mode 100644 scripts/run-buckets-live-app.mjs
 create mode 100644 scripts/run-buckets-live-cosmos.mjs

diff --git a/apps/tlon-mobile/cosmos.imports.ts b/apps/tlon-mobile/cosmos.imports.ts
index 10dea07a5f..d04f12b2a2 100644
--- a/apps/tlon-mobile/cosmos.imports.ts
+++ b/apps/tlon-mobile/cosmos.imports.ts
@@ -1,265 +1,196 @@
 // NOTE: This file is auto-generated by React Cosmos.
 // It imports all fixture and decorator modules, making them available to the
 // React Cosmos renderer along with the renderer config.
+
 import type { RendererConfig, UserModuleWrappers } from 'react-cosmos-core';
 
-import * as fixture0 from './../../packages/app/fixtures/ActionSheet/AddGalleryPostSheet.fixture';
-import * as fixture1 from './../../packages/app/fixtures/ActionSheet/AttachmentSheet.fixture';
-import * as fixture2 from './../../packages/app/fixtures/ActionSheet/CreateChannelSheet.fixture';
-import * as fixture3 from './../../packages/app/fixtures/ActionSheet/EditSectionNameSheet.fixture';
-import * as fixture4 from './../../packages/app/fixtures/ActionSheet/GenericActionSheet.fixture';
-import * as fixture5 from './../../packages/app/fixtures/ActionSheet/GroupJoinRequestSheet.fixture';
-import * as fixture6 from './../../packages/app/fixtures/ActionSheet/GroupPreviewSheet.fixture';
-import * as fixture7 from './../../packages/app/fixtures/ActionSheet/ProfileSheet.fixture';
-import * as fixture8 from './../../packages/app/fixtures/Activity.fixture';
-import * as fixture9 from './../../packages/app/fixtures/AddContactsView.fixture';
-import * as fixture10 from './../../packages/app/fixtures/AttachmentPreviewList.fixture';
-import * as fixture11 from './../../packages/app/fixtures/AttestationPane.fixture';
+import * as fixture0 from './../../packages/app/fixtures/A2UI.fixture';
+import * as fixture1 from './../../packages/app/fixtures/ActionSheet/AddGalleryPostSheet.fixture';
+import * as fixture2 from './../../packages/app/fixtures/ActionSheet/AttachmentSheet.fixture';
+import * as fixture3 from './../../packages/app/fixtures/ActionSheet/CreateChannelSheet.fixture';
+import * as fixture4 from './../../packages/app/fixtures/ActionSheet/EditSectionNameSheet.fixture';
+import * as fixture5 from './../../packages/app/fixtures/ActionSheet/GenericActionSheet.fixture';
+import * as fixture6 from './../../packages/app/fixtures/ActionSheet/GroupJoinRequestSheet.fixture';
+import * as fixture7 from './../../packages/app/fixtures/ActionSheet/GroupPreviewSheet.fixture';
+import * as fixture8 from './../../packages/app/fixtures/ActionSheet/ProfileSheet.fixture';
+import * as fixture9 from './../../packages/app/fixtures/Activity.fixture';
+import * as fixture10 from './../../packages/app/fixtures/AddContactsView.fixture';
+import * as fixture11 from './../../packages/app/fixtures/AttachmentPreviewList.fixture';
+import * as fixture12 from './../../packages/app/fixtures/AttestationPane.fixture';
 import * as fixture13 from './../../packages/app/fixtures/AudioRecorder.fixture';
 import * as fixture14 from './../../packages/app/fixtures/Avatar.fixture';
 import * as fixture15 from './../../packages/app/fixtures/BlockSectionList.fixture';
-import * as fixture16 from './../../packages/app/fixtures/Button.fixture';
-import * as fixture17 from './../../packages/app/fixtures/ButtonV2.fixture';
-import * as fixture18 from './../../packages/app/fixtures/Carousel.fixture';
-import * as fixture19 from './../../packages/app/fixtures/Channel.fixture';
-import * as fixture21 from './../../packages/app/fixtures/ChannelDivider.fixture';
-import * as fixture22 from './../../packages/app/fixtures/ChannelHeader.fixture';
-import * as fixture23 from './../../packages/app/fixtures/ChannelListItem.fixture';
-import * as fixture24 from './../../packages/app/fixtures/ChatMessage.fixture';
-import * as fixture25 from './../../packages/app/fixtures/ChatOptionsSheet.fixture';
-import * as fixture26 from './../../packages/app/fixtures/ConfirmDialog.fixture';
-import * as fixture27 from './../../packages/app/fixtures/ContactList.fixture';
-import * as fixture28 from './../../packages/app/fixtures/CreateChatSheet.fixture';
-import * as fixture29 from './../../packages/app/fixtures/DetailView/ChatDetailView.fixture';
-import * as fixture30 from './../../packages/app/fixtures/DetailView/GalleryDetailView.fixture';
-import * as fixture31 from './../../packages/app/fixtures/DetailView/NotebookDetailView.fixture';
-import * as fixture32 from './../../packages/app/fixtures/DmInviteOptions.fixture';
-import * as fixture33 from './../../packages/app/fixtures/EditProfileScreen.fixture';
+import * as fixture16 from './../../packages/app/fixtures/BucketsChannel.fixture';
+import * as fixture17 from './../../packages/app/fixtures/BucketsChannel.live.fixture';
+import * as fixture18 from './../../packages/app/fixtures/Button.fixture';
+import * as fixture19 from './../../packages/app/fixtures/ButtonV2.fixture';
+import * as fixture20 from './../../packages/app/fixtures/Carousel.fixture';
+import * as fixture21 from './../../packages/app/fixtures/Channel.fixture';
+import * as fixture22 from './../../packages/app/fixtures/ChannelDivider.fixture';
+import * as fixture23 from './../../packages/app/fixtures/ChannelHeader.fixture';
+import * as fixture24 from './../../packages/app/fixtures/ChannelListItem.fixture';
+import * as fixture25 from './../../packages/app/fixtures/ChatMessage.fixture';
+import * as fixture26 from './../../packages/app/fixtures/ChatOptionsSheet.fixture';
+import * as fixture27 from './../../packages/app/fixtures/ConfirmDialog.fixture';
+import * as fixture28 from './../../packages/app/fixtures/ContactList.fixture';
+import * as fixture29 from './../../packages/app/fixtures/CreateChatSheet.fixture';
+import * as fixture30 from './../../packages/app/fixtures/DetailView/ChatDetailView.fixture';
+import * as fixture31 from './../../packages/app/fixtures/DetailView/GalleryDetailView.fixture';
+import * as fixture32 from './../../packages/app/fixtures/DetailView/NotebookDetailView.fixture';
+import * as fixture33 from './../../packages/app/fixtures/DmInviteOptions.fixture';
+import * as fixture34 from './../../packages/app/fixtures/EditProfileScreen.fixture';
 import * as fixture35 from './../../packages/app/fixtures/EmptyChannelNotice.fixture';
 import * as fixture36 from './../../packages/app/fixtures/FacePile.fixture';
 import * as fixture37 from './../../packages/app/fixtures/Form.fixture';
 import * as fixture38 from './../../packages/app/fixtures/ForwardChannelListItem.fixture';
 import * as fixture39 from './../../packages/app/fixtures/GalleryPost.fixture';
-import * as fixture40 from './../../packages/app/fixtures/GroupListItem.fixture';
-import * as fixture41 from './../../packages/app/fixtures/Input.fixture';
-import * as fixture42 from './../../packages/app/fixtures/InviteFriendsToTlonButton.fixture';
-import * as fixture43 from './../../packages/app/fixtures/InviteUsersSheet.fixture';
-import * as fixture44 from './../../packages/app/fixtures/MediaImageViewer.fixture';
-import * as fixture45 from './../../packages/app/fixtures/MessageActions.fixture';
-import * as fixture46 from './../../packages/app/fixtures/MessageInput.fixture';
-import * as fixture47 from './../../packages/app/fixtures/MetaEditorScreen.fixture';
-import * as fixture48 from './../../packages/app/fixtures/NotebookPost.fixture';
-import * as fixture49 from './../../packages/app/fixtures/Onboarding.fixture';
-import * as fixture50 from './../../packages/app/fixtures/ParentAgnosticKeyboardAvoidingView.fixture';
-import * as fixture51 from './../../packages/app/fixtures/PostErrorMessage.fixture';
-import * as fixture52 from './../../packages/app/fixtures/PostReference.fixture';
-import * as fixture53 from './../../packages/app/fixtures/PostScreen.fixture';
-import * as fixture54 from './../../packages/app/fixtures/Pressable.fixture';
-import * as fixture55 from './../../packages/app/fixtures/ProfileBlock.fixture';
-import * as fixture56 from './../../packages/app/fixtures/ProfileSheet.fixture';
-import * as fixture57 from './../../packages/app/fixtures/ProfileStatusSheet.fixture';
-import * as fixture58 from './../../packages/app/fixtures/ReferenceSkeleton.fixture';
-import * as fixture59 from './../../packages/app/fixtures/ScreenHeader.fixture';
-import * as fixture60 from './../../packages/app/fixtures/SearchBar.fixture';
-import * as fixture61 from './../../packages/app/fixtures/SplashSequence.fixture';
-import * as fixture62 from './../../packages/app/fixtures/StoppedNodePushSheet.fixture';
-import * as fixture63 from './../../packages/app/fixtures/StorageQuotaIndicator.fixture';
-import * as fixture65 from './../../packages/app/fixtures/SystemNotice.fixture';
-import * as fixture66 from './../../packages/app/fixtures/SystemNotices.fixture';
-import * as fixture67 from './../../packages/app/fixtures/Text.fixture';
-import * as fixture68 from './../../packages/app/fixtures/Toast.fixture';
-import * as fixture69 from './../../packages/app/fixtures/TwitterVerification.fixture';
-import * as fixture70 from './../../packages/app/fixtures/UserProfileScreen.fixture';
-import * as fixture71 from './../../packages/app/fixtures/VideoPreview.fixture';
-import * as fixture72 from './../../packages/app/fixtures/ViewReactionsSheet.fixture';
-import * as fixture73 from './../../packages/app/fixtures/Waveform.fixture';
-import * as fixture74 from './../../packages/app/fixtures/WayfindingNotices.fixture';
+import * as fixture40 from './../../packages/app/fixtures/GestureMediaViewer.fixture';
+import * as fixture41 from './../../packages/app/fixtures/GroupListItem.fixture';
+import * as fixture42 from './../../packages/app/fixtures/Input.fixture';
+import * as fixture43 from './../../packages/app/fixtures/InviteFriendsToTlonButton.fixture';
+import * as fixture44 from './../../packages/app/fixtures/InviteUsersSheet.fixture';
+import * as fixture45 from './../../packages/app/fixtures/MediaImageViewer.fixture';
+import * as fixture46 from './../../packages/app/fixtures/MessageActions.fixture';
+import * as fixture47 from './../../packages/app/fixtures/MessageInput.fixture';
+import * as fixture48 from './../../packages/app/fixtures/MetaEditorScreen.fixture';
+import * as fixture49 from './../../packages/app/fixtures/NotebookPost.fixture';
+import * as fixture50 from './../../packages/app/fixtures/NotesChannel.fixture';
+import * as fixture51 from './../../packages/app/fixtures/Onboarding.fixture';
+import * as fixture52 from './../../packages/app/fixtures/ParentAgnosticKeyboardAvoidingView.fixture';
+import * as fixture53 from './../../packages/app/fixtures/PhoneNumberInput.fixture';
+import * as fixture54 from './../../packages/app/fixtures/PostErrorMessage.fixture';
+import * as fixture55 from './../../packages/app/fixtures/PostReference.fixture';
+import * as fixture56 from './../../packages/app/fixtures/PostScreen.fixture';
+import * as fixture57 from './../../packages/app/fixtures/Pressable.fixture';
+import * as fixture58 from './../../packages/app/fixtures/ProfileBlock.fixture';
+import * as fixture59 from './../../packages/app/fixtures/ProfileSheet.fixture';
+import * as fixture60 from './../../packages/app/fixtures/ProfileStatusSheet.fixture';
+import * as fixture61 from './../../packages/app/fixtures/ReactionsDisplay.fixture';
+import * as fixture62 from './../../packages/app/fixtures/ReferenceSkeleton.fixture';
+import * as fixture63 from './../../packages/app/fixtures/ScreenHeader.fixture';
+import * as fixture64 from './../../packages/app/fixtures/SearchBar.fixture';
+import * as fixture65 from './../../packages/app/fixtures/SplashSequence.fixture';
+import * as fixture66 from './../../packages/app/fixtures/StoppedNodePushSheet.fixture';
+import * as fixture67 from './../../packages/app/fixtures/StorageQuotaIndicator.fixture';
+import * as fixture68 from './../../packages/app/fixtures/SystemNotice.fixture';
+import * as fixture69 from './../../packages/app/fixtures/SystemNotices.fixture';
+import * as fixture70 from './../../packages/app/fixtures/Text.fixture';
+import * as fixture71 from './../../packages/app/fixtures/Toast.fixture';
+import * as fixture72 from './../../packages/app/fixtures/TwitterVerification.fixture';
+import * as fixture73 from './../../packages/app/fixtures/UserProfileScreen.fixture';
+import * as fixture74 from './../../packages/app/fixtures/VideoPreview.fixture';
+import * as fixture75 from './../../packages/app/fixtures/ViewReactionsSheet.fixture';
+import * as fixture76 from './../../packages/app/fixtures/Waveform.fixture';
+import * as fixture77 from './../../packages/app/fixtures/WayfindingNotices.fixture';
+import * as fixture78 from './../../packages/app/fixtures/WebAppSplashSheet.fixture';
+import * as fixture79 from './src/App.fixture';
+import * as fixture80 from './src/fixtures/InputToolbar.fixture';
+import * as fixture81 from './src/fixtures/Onboarding.fixture';
+import * as fixture82 from './src/fixtures/SetNicknameScreen.fixture';
+import * as fixture83 from './src/fixtures/TlonbotSetupScreen.fixture';
+
 import * as decorator0 from './../../packages/app/fixtures/cosmos.decorator';
-import * as fixture75 from './src/App.fixture';
-import * as fixture76 from './src/fixtures/InputToolbar.fixture';
-import * as fixture77 from './src/fixtures/Onboarding.fixture';
-import * as fixture78 from './src/fixtures/SetNicknameScreen.fixture';
 import * as decorator1 from './src/fixtures/cosmos.decorator';
 
 export const rendererConfig: RendererConfig = {
-  webSocketUrl: 'ws://192.168.50.55:5003',
-  rendererUrl: null,
+  "webSocketUrl": "ws://192.168.1.61:5050",
+  "rendererUrl": null
 };
 
 const fixtures = {
-  '../../packages/app/fixtures/ActionSheet/AddGalleryPostSheet.fixture.tsx': {
-    module: fixture0,
-  },
-  '../../packages/app/fixtures/ActionSheet/AttachmentSheet.fixture.tsx': {
-    module: fixture1,
-  },
-  '../../packages/app/fixtures/ActionSheet/CreateChannelSheet.fixture.tsx': {
-    module: fixture2,
-  },
-  '../../packages/app/fixtures/ActionSheet/EditSectionNameSheet.fixture.tsx': {
-    module: fixture3,
-  },
-  '../../packages/app/fixtures/ActionSheet/GenericActionSheet.fixture.tsx': {
-    module: fixture4,
-  },
-  '../../packages/app/fixtures/ActionSheet/GroupJoinRequestSheet.fixture.tsx': {
-    module: fixture5,
-  },
-  '../../packages/app/fixtures/ActionSheet/GroupPreviewSheet.fixture.tsx': {
-    module: fixture6,
-  },
-  '../../packages/app/fixtures/ActionSheet/ProfileSheet.fixture.tsx': {
-    module: fixture7,
-  },
-  '../../packages/app/fixtures/Activity.fixture.tsx': { module: fixture8 },
-  '../../packages/app/fixtures/AddContactsView.fixture.tsx': {
-    module: fixture9,
-  },
-  '../../packages/app/fixtures/AttachmentPreviewList.fixture.tsx': {
-    module: fixture10,
-  },
-  '../../packages/app/fixtures/AttestationPane.fixture.tsx': {
-    module: fixture11,
-  },
-  '../../packages/app/fixtures/AudioRecorder.fixture.tsx': {
-    module: fixture13,
-  },
+  '../../packages/app/fixtures/A2UI.fixture.tsx': { module: fixture0 },
+  '../../packages/app/fixtures/ActionSheet/AddGalleryPostSheet.fixture.tsx': { module: fixture1 },
+  '../../packages/app/fixtures/ActionSheet/AttachmentSheet.fixture.tsx': { module: fixture2 },
+  '../../packages/app/fixtures/ActionSheet/CreateChannelSheet.fixture.tsx': { module: fixture3 },
+  '../../packages/app/fixtures/ActionSheet/EditSectionNameSheet.fixture.tsx': { module: fixture4 },
+  '../../packages/app/fixtures/ActionSheet/GenericActionSheet.fixture.tsx': { module: fixture5 },
+  '../../packages/app/fixtures/ActionSheet/GroupJoinRequestSheet.fixture.tsx': { module: fixture6 },
+  '../../packages/app/fixtures/ActionSheet/GroupPreviewSheet.fixture.tsx': { module: fixture7 },
+  '../../packages/app/fixtures/ActionSheet/ProfileSheet.fixture.tsx': { module: fixture8 },
+  '../../packages/app/fixtures/Activity.fixture.tsx': { module: fixture9 },
+  '../../packages/app/fixtures/AddContactsView.fixture.tsx': { module: fixture10 },
+  '../../packages/app/fixtures/AttachmentPreviewList.fixture.tsx': { module: fixture11 },
+  '../../packages/app/fixtures/AttestationPane.fixture.tsx': { module: fixture12 },
+  '../../packages/app/fixtures/AudioRecorder.fixture.tsx': { module: fixture13 },
   '../../packages/app/fixtures/Avatar.fixture.tsx': { module: fixture14 },
-  '../../packages/app/fixtures/BlockSectionList.fixture.tsx': {
-    module: fixture15,
-  },
-  '../../packages/app/fixtures/Button.fixture.tsx': { module: fixture16 },
-  '../../packages/app/fixtures/ButtonV2.fixture.tsx': { module: fixture17 },
-  '../../packages/app/fixtures/Carousel.fixture.tsx': { module: fixture18 },
-  '../../packages/app/fixtures/Channel.fixture.tsx': { module: fixture19 },
-  '../../packages/app/fixtures/ChannelDivider.fixture.tsx': {
-    module: fixture21,
-  },
-  '../../packages/app/fixtures/ChannelHeader.fixture.tsx': {
-    module: fixture22,
-  },
-  '../../packages/app/fixtures/ChannelListItem.fixture.tsx': {
-    module: fixture23,
-  },
-  '../../packages/app/fixtures/ChatMessage.fixture.tsx': { module: fixture24 },
-  '../../packages/app/fixtures/ChatOptionsSheet.fixture.tsx': {
-    module: fixture25,
-  },
-  '../../packages/app/fixtures/ConfirmDialog.fixture.tsx': {
-    module: fixture26,
-  },
-  '../../packages/app/fixtures/ContactList.fixture.tsx': { module: fixture27 },
-  '../../packages/app/fixtures/CreateChatSheet.fixture.tsx': {
-    module: fixture28,
-  },
-  '../../packages/app/fixtures/DetailView/ChatDetailView.fixture.tsx': {
-    module: fixture29,
-  },
-  '../../packages/app/fixtures/DetailView/GalleryDetailView.fixture.tsx': {
-    module: fixture30,
-  },
-  '../../packages/app/fixtures/DetailView/NotebookDetailView.fixture.tsx': {
-    module: fixture31,
-  },
-  '../../packages/app/fixtures/DmInviteOptions.fixture.tsx': {
-    module: fixture32,
-  },
-  '../../packages/app/fixtures/EditProfileScreen.fixture.tsx': {
-    module: fixture33,
-  },
-  '../../packages/app/fixtures/EmptyChannelNotice.fixture.tsx': {
-    module: fixture35,
-  },
+  '../../packages/app/fixtures/BlockSectionList.fixture.tsx': { module: fixture15 },
+  '../../packages/app/fixtures/BucketsChannel.fixture.tsx': { module: fixture16 },
+  '../../packages/app/fixtures/BucketsChannel.live.fixture.tsx': { module: fixture17 },
+  '../../packages/app/fixtures/Button.fixture.tsx': { module: fixture18 },
+  '../../packages/app/fixtures/ButtonV2.fixture.tsx': { module: fixture19 },
+  '../../packages/app/fixtures/Carousel.fixture.tsx': { module: fixture20 },
+  '../../packages/app/fixtures/Channel.fixture.tsx': { module: fixture21 },
+  '../../packages/app/fixtures/ChannelDivider.fixture.tsx': { module: fixture22 },
+  '../../packages/app/fixtures/ChannelHeader.fixture.tsx': { module: fixture23 },
+  '../../packages/app/fixtures/ChannelListItem.fixture.tsx': { module: fixture24 },
+  '../../packages/app/fixtures/ChatMessage.fixture.tsx': { module: fixture25 },
+  '../../packages/app/fixtures/ChatOptionsSheet.fixture.tsx': { module: fixture26 },
+  '../../packages/app/fixtures/ConfirmDialog.fixture.tsx': { module: fixture27 },
+  '../../packages/app/fixtures/ContactList.fixture.tsx': { module: fixture28 },
+  '../../packages/app/fixtures/CreateChatSheet.fixture.tsx': { module: fixture29 },
+  '../../packages/app/fixtures/DetailView/ChatDetailView.fixture.tsx': { module: fixture30 },
+  '../../packages/app/fixtures/DetailView/GalleryDetailView.fixture.tsx': { module: fixture31 },
+  '../../packages/app/fixtures/DetailView/NotebookDetailView.fixture.tsx': { module: fixture32 },
+  '../../packages/app/fixtures/DmInviteOptions.fixture.tsx': { module: fixture33 },
+  '../../packages/app/fixtures/EditProfileScreen.fixture.tsx': { module: fixture34 },
+  '../../packages/app/fixtures/EmptyChannelNotice.fixture.tsx': { module: fixture35 },
   '../../packages/app/fixtures/FacePile.fixture.tsx': { module: fixture36 },
   '../../packages/app/fixtures/Form.fixture.tsx': { module: fixture37 },
-  '../../packages/app/fixtures/ForwardChannelListItem.fixture.tsx': {
-    module: fixture38,
-  },
+  '../../packages/app/fixtures/ForwardChannelListItem.fixture.tsx': { module: fixture38 },
   '../../packages/app/fixtures/GalleryPost.fixture.tsx': { module: fixture39 },
-  '../../packages/app/fixtures/GroupListItem.fixture.tsx': {
-    module: fixture40,
-  },
-  '../../packages/app/fixtures/Input.fixture.tsx': { module: fixture41 },
-  '../../packages/app/fixtures/InviteFriendsToTlonButton.fixture.tsx': {
-    module: fixture42,
-  },
-  '../../packages/app/fixtures/InviteUsersSheet.fixture.tsx': {
-    module: fixture43,
-  },
-  '../../packages/app/fixtures/MediaImageViewer.fixture.tsx': {
-    module: fixture44,
-  },
-  '../../packages/app/fixtures/MessageActions.fixture.tsx': {
-    module: fixture45,
-  },
-  '../../packages/app/fixtures/MessageInput.fixture.tsx': { module: fixture46 },
-  '../../packages/app/fixtures/MetaEditorScreen.fixture.tsx': {
-    module: fixture47,
-  },
-  '../../packages/app/fixtures/NotebookPost.fixture.tsx': { module: fixture48 },
-  '../../packages/app/fixtures/Onboarding.fixture.tsx': { module: fixture49 },
-  '../../packages/app/fixtures/ParentAgnosticKeyboardAvoidingView.fixture.tsx':
-    { module: fixture50 },
-  '../../packages/app/fixtures/PostErrorMessage.fixture.tsx': {
-    module: fixture51,
-  },
-  '../../packages/app/fixtures/PostReference.fixture.tsx': {
-    module: fixture52,
-  },
-  '../../packages/app/fixtures/PostScreen.fixture.tsx': { module: fixture53 },
-  '../../packages/app/fixtures/Pressable.fixture.tsx': { module: fixture54 },
-  '../../packages/app/fixtures/ProfileBlock.fixture.tsx': { module: fixture55 },
-  '../../packages/app/fixtures/ProfileSheet.fixture.tsx': { module: fixture56 },
-  '../../packages/app/fixtures/ProfileStatusSheet.fixture.tsx': {
-    module: fixture57,
-  },
-  '../../packages/app/fixtures/ReferenceSkeleton.fixture.tsx': {
-    module: fixture58,
-  },
-  '../../packages/app/fixtures/ScreenHeader.fixture.tsx': { module: fixture59 },
-  '../../packages/app/fixtures/SearchBar.fixture.tsx': { module: fixture60 },
-  '../../packages/app/fixtures/SplashSequence.fixture.tsx': {
-    module: fixture61,
-  },
-  '../../packages/app/fixtures/StoppedNodePushSheet.fixture.tsx': {
-    module: fixture62,
-  },
-  '../../packages/app/fixtures/StorageQuotaIndicator.fixture.tsx': {
-    module: fixture63,
-  },
-  '../../packages/app/fixtures/SystemNotice.fixture.tsx': { module: fixture65 },
-  '../../packages/app/fixtures/SystemNotices.fixture.tsx': {
-    module: fixture66,
-  },
-  '../../packages/app/fixtures/Text.fixture.tsx': { module: fixture67 },
-  '../../packages/app/fixtures/Toast.fixture.tsx': { module: fixture68 },
-  '../../packages/app/fixtures/TwitterVerification.fixture.tsx': {
-    module: fixture69,
-  },
-  '../../packages/app/fixtures/UserProfileScreen.fixture.tsx': {
-    module: fixture70,
-  },
-  '../../packages/app/fixtures/VideoPreview.fixture.tsx': { module: fixture71 },
-  '../../packages/app/fixtures/ViewReactionsSheet.fixture.tsx': {
-    module: fixture72,
-  },
-  '../../packages/app/fixtures/Waveform.fixture.tsx': { module: fixture73 },
-  '../../packages/app/fixtures/WayfindingNotices.fixture.tsx': {
-    module: fixture74,
-  },
-  'src/App.fixture.tsx': { module: fixture75 },
-  'src/fixtures/InputToolbar.fixture.tsx': { module: fixture76 },
-  'src/fixtures/Onboarding.fixture.tsx': { module: fixture77 },
-  'src/fixtures/SetNicknameScreen.fixture.tsx': { module: fixture78 },
+  '../../packages/app/fixtures/GestureMediaViewer.fixture.tsx': { module: fixture40 },
+  '../../packages/app/fixtures/GroupListItem.fixture.tsx': { module: fixture41 },
+  '../../packages/app/fixtures/Input.fixture.tsx': { module: fixture42 },
+  '../../packages/app/fixtures/InviteFriendsToTlonButton.fixture.tsx': { module: fixture43 },
+  '../../packages/app/fixtures/InviteUsersSheet.fixture.tsx': { module: fixture44 },
+  '../../packages/app/fixtures/MediaImageViewer.fixture.tsx': { module: fixture45 },
+  '../../packages/app/fixtures/MessageActions.fixture.tsx': { module: fixture46 },
+  '../../packages/app/fixtures/MessageInput.fixture.tsx': { module: fixture47 },
+  '../../packages/app/fixtures/MetaEditorScreen.fixture.tsx': { module: fixture48 },
+  '../../packages/app/fixtures/NotebookPost.fixture.tsx': { module: fixture49 },
+  '../../packages/app/fixtures/NotesChannel.fixture.tsx': { module: fixture50 },
+  '../../packages/app/fixtures/Onboarding.fixture.tsx': { module: fixture51 },
+  '../../packages/app/fixtures/ParentAgnosticKeyboardAvoidingView.fixture.tsx': { module: fixture52 },
+  '../../packages/app/fixtures/PhoneNumberInput.fixture.tsx': { module: fixture53 },
+  '../../packages/app/fixtures/PostErrorMessage.fixture.tsx': { module: fixture54 },
+  '../../packages/app/fixtures/PostReference.fixture.tsx': { module: fixture55 },
+  '../../packages/app/fixtures/PostScreen.fixture.tsx': { module: fixture56 },
+  '../../packages/app/fixtures/Pressable.fixture.tsx': { module: fixture57 },
+  '../../packages/app/fixtures/ProfileBlock.fixture.tsx': { module: fixture58 },
+  '../../packages/app/fixtures/ProfileSheet.fixture.tsx': { module: fixture59 },
+  '../../packages/app/fixtures/ProfileStatusSheet.fixture.tsx': { module: fixture60 },
+  '../../packages/app/fixtures/ReactionsDisplay.fixture.tsx': { module: fixture61 },
+  '../../packages/app/fixtures/ReferenceSkeleton.fixture.tsx': { module: fixture62 },
+  '../../packages/app/fixtures/ScreenHeader.fixture.tsx': { module: fixture63 },
+  '../../packages/app/fixtures/SearchBar.fixture.tsx': { module: fixture64 },
+  '../../packages/app/fixtures/SplashSequence.fixture.tsx': { module: fixture65 },
+  '../../packages/app/fixtures/StoppedNodePushSheet.fixture.tsx': { module: fixture66 },
+  '../../packages/app/fixtures/StorageQuotaIndicator.fixture.tsx': { module: fixture67 },
+  '../../packages/app/fixtures/SystemNotice.fixture.tsx': { module: fixture68 },
+  '../../packages/app/fixtures/SystemNotices.fixture.tsx': { module: fixture69 },
+  '../../packages/app/fixtures/Text.fixture.tsx': { module: fixture70 },
+  '../../packages/app/fixtures/Toast.fixture.tsx': { module: fixture71 },
+  '../../packages/app/fixtures/TwitterVerification.fixture.tsx': { module: fixture72 },
+  '../../packages/app/fixtures/UserProfileScreen.fixture.tsx': { module: fixture73 },
+  '../../packages/app/fixtures/VideoPreview.fixture.tsx': { module: fixture74 },
+  '../../packages/app/fixtures/ViewReactionsSheet.fixture.tsx': { module: fixture75 },
+  '../../packages/app/fixtures/Waveform.fixture.tsx': { module: fixture76 },
+  '../../packages/app/fixtures/WayfindingNotices.fixture.tsx': { module: fixture77 },
+  '../../packages/app/fixtures/WebAppSplashSheet.fixture.tsx': { module: fixture78 },
+  'src/App.fixture.tsx': { module: fixture79 },
+  'src/fixtures/InputToolbar.fixture.tsx': { module: fixture80 },
+  'src/fixtures/Onboarding.fixture.tsx': { module: fixture81 },
+  'src/fixtures/SetNicknameScreen.fixture.tsx': { module: fixture82 },
+  'src/fixtures/TlonbotSetupScreen.fixture.tsx': { module: fixture83 }
 };
 
 const decorators = {
   '../../packages/app/fixtures/cosmos.decorator.tsx': { module: decorator0 },
-  'src/fixtures/cosmos.decorator.tsx': { module: decorator1 },
+  'src/fixtures/cosmos.decorator.tsx': { module: decorator1 }
 };
 
 export const moduleWrappers: UserModuleWrappers = {
   lazy: false,
   fixtures,
-  decorators,
+  decorators
 };
diff --git a/apps/tlon-mobile/src/screens/Onboarding/ShipLoginScreen.tsx b/apps/tlon-mobile/src/screens/Onboarding/ShipLoginScreen.tsx
index 95e1e12e55..3aac3ab566 100644
--- a/apps/tlon-mobile/src/screens/Onboarding/ShipLoginScreen.tsx
+++ b/apps/tlon-mobile/src/screens/Onboarding/ShipLoginScreen.tsx
@@ -65,10 +65,14 @@ export const ShipLoginScreen = ({ navigation }: Props) => {
     const urlPattern =
       /^(https?:\/\/)?(localhost|(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})|[\w.-]+\.([a-z]{2,}))(:\d+)?$/i;
     const hostedPattern = /tlon\.network/i;
+    const isConfiguredDevelopmentShip =
+      __DEV__ &&
+      DEFAULT_SHIP_LOGIN_URL.length > 0 &&
+      url.replace(/\/$/, '') === DEFAULT_SHIP_LOGIN_URL.replace(/\/$/, '');
     if (!urlPattern.test(url)) {
       return false;
     }
-    if (hostedPattern.test(url)) {
+    if (hostedPattern.test(url) && !isConfiguredDevelopmentShip) {
       return 'hosted';
     }
     return true;
diff --git a/desk/app/buckets.hoon b/desk/app/buckets.hoon
index 40a6e1ece6..1ebefd19ab 100644
--- a/desk/app/buckets.hoon
+++ b/desk/app/buckets.hoon
@@ -8,7 +8,7 @@
 /+  default-agent, dbug, verb
 |%
 +$  card  card:agent:gall
-+$  current-state  state-0:b
++$  current-state  state:b
 --
 =|  current-state
 =*  state  -
@@ -70,18 +70,36 @@
   ^+  cor
   (emit [%pass /groups %agent [our.bowl %groups] %watch /v1/groups])
 ::
-::  Greenfield version 0. Future state versions must migrate explicitly here.
+::  Persisted state migrations are explicit. Version 2 separates the writer
+::  role-set from the group's reader roles; existing Buckets preserve their
+::  previous behavior by initially granting those reader roles write access.
 ::
 ++  load
   |=  old=vase
   ^+  cor
-  =+  !<(loaded=state-0:b old)
-  ?>  =(%0 -.loaded)
-  =.  state  loaded
+  =+  !<(loaded=versioned-state:b old)
+  =.  state
+    ?-  -.loaded
+      %0  [%2 (migrate-spaces spaces.loaded) next-id.loaded ~ ~]
+      %1  [%2 (migrate-spaces spaces.loaded) next-id.loaded broker-capabilities.loaded broker-reservations.loaded]
+      %2  loaded
+    ==
   =?  cor  !(~(has by wex.bowl) [/groups our.bowl %groups])
     (emit [%pass /groups %agent [our.bowl %groups] %watch /v1/groups])
   cor
 ::
+++  migrate-spaces
+  |=  old=(map flag:b space-1:b)
+  ^-  (map flag:b space:b)
+  %-  malt
+  %+  turn  ~(tap by old)
+  |=  [=flag:b old-space=space-1:b]
+  =/  new-state=(unit bucket-state:b)
+    ?~  state.old-space  ~
+    =/  old-state=bucket-state-1:b  u.state.old-space
+    `[bucket.old-state group.old-state readers.old-state readers.old-state entries.old-state sessions.old-state revision.old-state]
+  [flag net.old-space new-state pending-group.old-space]
+::
 ++  poke
   |=  [=mark =vase]
   ^+  cor
@@ -97,8 +115,12 @@
     =/  =flag:b  (action-flag act)
     ?>  =(ship.flag our.bowl)
     =/  st=bucket-state:b  (need-state flag)
-    ?>  (group-can-read group.st flag src.bowl)
+    ?>  (action-authorized st flag src.bowl act)
     (apply-action act)
+  ::
+      %buckets-broker-command-1
+    ?>  =(src.bowl our.bowl)
+    (apply-broker-command !<(broker-command:b vase))
   ::
       %group-channel-join
     ?>  =(src.bowl our.bowl)
@@ -122,7 +144,7 @@
   ^+  cor
   ?+  -.act  (dispatch-existing act)
     %create
-  (create-bucket name.act title.act group.act readers.act)
+  (create-bucket name.act title.act group.act readers.act writers.act)
   ==
 ::
 ++  dispatch-existing
@@ -140,10 +162,14 @@
   ?-  -.act
     %create          ~|(%create-has-no-flag !!)
     %delete-bucket   flag.act
+    %set-title       flag.act
+    %set-writers     flag.act
     %create-folder   flag.act
     %begin-upload    flag.act
     %finish-upload   flag.act
     %fail-upload     flag.act
+    %issue-read      flag.act
+    %issue-delete    flag.act
     %rename-entry    flag.act
     %move-entry      flag.act
     %delete-entry    flag.act
@@ -169,7 +195,7 @@
   cor
 ::
 ++  create-bucket
-  |=  [name=@tas title=@t group=flag:b readers=(set @tas)]
+  |=  [name=@tas title=@t group=flag:b readers=(set @tas) writers=(set @tas)]
   ^+  cor
   ?>  =(ship.group our.bowl)
   =/  =flag:b  [our.bowl name]
@@ -177,7 +203,7 @@
   =/  id=@ud  +(next-id)
   =.  next-id  id
   =/  buc=bucket:b  [id title our.bowl now.bowl our.bowl now.bowl]
-  =/  st=bucket-state:b  [buc group readers ~ ~ 0]
+  =/  st=bucket-state:b  [buc group readers writers ~ ~ 0]
   =.  spaces  (~(put by spaces) flag [%pub `st `group])
   =/  channel=group-channel:b
     [[title '' '' ''] now.bowl %default readers |]
@@ -197,10 +223,14 @@
   ?-  -.act
     %create          ~|(%cannot-forward-create !!)
     %delete-bucket   (delete-bucket flag.act)
+    %set-title       (set-title flag.act title.act)
+    %set-writers     (set-writers flag.act writers.act)
     %create-folder   (create-folder flag.act parent.act name.act)
-    %begin-upload    (begin-upload flag.act parent.act name.act mime.act size.act checksum.act)
+    %begin-upload    (begin-upload flag.act parent.act name.act mime.act size.act checksum.act capability.act)
     %finish-upload   (finish-upload flag.act session.act object-url.act)
     %fail-upload     (fail-upload flag.act session.act reason.act)
+    %issue-read      (issue-object-capability %read flag.act id.act capability.act)
+    %issue-delete    (issue-object-capability %delete flag.act id.act capability.act)
     %rename-entry    (rename-entry flag.act id.act name.act)
     %move-entry      (move-entry flag.act id.act parent.act)
     %delete-entry    (delete-entry flag.act id.act recursive.act)
@@ -218,7 +248,6 @@
 ++  delete-bucket
   |=  =flag:b
   ^+  cor
-  ?>  =(src.bowl our.bowl)
   =/  st=bucket-state:b  (need-state flag)
   =/  del=group-channel-del:b
     [%group group.st %channel [%buckets flag] %del ~]
@@ -234,6 +263,21 @@
   =.  spaces  (~(del by spaces) flag)
   cor
 ::
+++  set-title
+  |=  [=flag:b title=@t]
+  ^+  cor
+  =/  st=bucket-state:b  (need-state flag)
+  =.  bucket.st
+    bucket.st(title title, updated-by src.bowl, updated-at now.bowl)
+  (commit-update flag st [%bucket-updated bucket.st])
+::
+++  set-writers
+  |=  [=flag:b writers=(set @tas)]
+  ^+  cor
+  =/  st=bucket-state:b  (need-state flag)
+  =.  writers.st  writers
+  (commit-update flag st [%writers-updated writers])
+::
 ++  create-folder
   |=  [=flag:b parent=(unit @ud) name=@t]
   ^+  cor
@@ -253,10 +297,14 @@
           mime=@t
           size=@ud
           checksum=(unit @t)
+          capability=@t
       ==
   ^+  cor
   =/  st=bucket-state:b  (need-state flag)
   ?>  (valid-parent st parent)
+  ?>  (gth (met 3 capability) 15)
+  =.  cor  prune-broker-authority
+  ?>  !(~(has by broker-capabilities) capability)
   =/  id=@ud  +(next-id)
   =.  next-id  id
   =/  sid=@uv  `@uv`eny.bowl
@@ -266,8 +314,12 @@
     [id parent name src.bowl now.bowl src.bowl now.bowl [%file fil]]
   =/  ses=upload-session:b
     [sid id src.bowl now.bowl (add now.bowl ~h1) %pending ~]
+  =/  aut=broker-capability:b
+    [%upload flag `sid id object-key.fil src.bowl expires-at.ses ~]
   =.  entries.st   (~(put by entries.st) id ent)
   =.  sessions.st  (~(put by sessions.st) sid ses)
+  =.  broker-capabilities
+    (~(put by broker-capabilities) capability aut)
   (commit-update flag st [%upload-begun ses ent])
 ::
 ++  finish-upload
@@ -302,6 +354,114 @@
   =.  sessions.st  (~(put by sessions.st) sid ses)
   (commit-update flag st [%upload-failed ses ent])
 ::
+++  issue-object-capability
+  |=  [kind=broker-kind:b =flag:b id=@ud capability=@t]
+  ^+  cor
+  ?>  !=(%upload kind)
+  ?>  (gth (met 3 capability) 15)
+  =.  cor  prune-broker-authority
+  ?>  !(~(has by broker-capabilities) capability)
+  =/  st=bucket-state:b  (need-state flag)
+  =/  ent=entry:b  (~(got by entries.st) id)
+  =/  fil=file:b  (entry-file ent)
+  ?>  =(%ready status.fil)
+  =/  aut=broker-capability:b
+    [kind flag ~ id object-key.fil src.bowl (add now.bowl ~m10) ~]
+  =.  broker-capabilities
+    (~(put by broker-capabilities) capability aut)
+  cor
+::
+++  prune-broker-authority
+  ^+  cor
+  =/  kept=(map @t broker-capability:b)
+    %-  malt
+    %+  skim  ~(tap by broker-capabilities)
+    |=  [capability=@t aut=broker-capability:b]
+    (gth expires-at.aut now.bowl)
+  =.  broker-capabilities  kept
+  =.  broker-reservations
+    %-  malt
+    %+  skim  ~(tap by broker-reservations)
+    |=  [reservation=@t capability=@t]
+    (~(has by kept) capability)
+  cor
+::
+++  apply-broker-command
+  |=  cmd=broker-command:b
+  ^+  cor
+  ?-  -.cmd
+      %authorize-upload
+    (authorize-broker-upload capability.cmd broker-reservation-id.cmd)
+  ::
+      %complete-upload
+    (complete-broker-upload broker-receipt.cmd)
+  ==
+::
+++  authorize-broker-upload
+  |=  [capability=@t reservation=@t]
+  ^+  cor
+  ?~  got=(~(get by broker-capabilities) capability)  cor
+  =/  aut=broker-capability:b  u.got
+  ?.  =(%upload broker-kind.aut)  cor
+  ?.  (gth expires-at.aut now.bowl)  cor
+  ?~  sid=session.aut  cor
+  =/  st=bucket-state:b  (need-state flag.aut)
+  ?~  ses=(~(get by sessions.st) u.sid)  cor
+  ?.  =(%pending status.u.ses)  cor
+  ?.  (group-can-write group.st flag.aut writers.st actor.aut)  cor
+  ?~  accepted=broker-reservation-id.aut
+    ?^  occupied=(~(get by broker-reservations) reservation)  cor
+    =/  updated=broker-capability:b
+      :*  %upload
+          flag.aut
+          session.aut
+          entry-id.aut
+          object-id.aut
+          actor.aut
+          expires-at.aut
+          [~ reservation]
+      ==
+    =.  broker-capabilities
+      (~(put by broker-capabilities) capability updated)
+    =.  broker-reservations
+      (~(put by broker-reservations) reservation capability)
+    cor
+  ?:  =(u.accepted reservation)  cor
+  cor
+::
+++  complete-broker-upload
+  |=  receipt=broker-receipt:b
+  ^+  cor
+  ?~  cap=(~(get by broker-reservations) broker-reservation-id.receipt)  cor
+  ?~  got=(~(get by broker-capabilities) u.cap)  cor
+  =/  aut=broker-capability:b  u.got
+  ?.  =(%upload broker-kind.aut)  cor
+  ?~  sid=session.aut  cor
+  =/  st=bucket-state:b  (need-state flag.aut)
+  ?.  (group-can-write group.st flag.aut writers.st actor.aut)  cor
+  ?~  ses-unit=(~(get by sessions.st) u.sid)  cor
+  =/  ses=upload-session:b  u.ses-unit
+  ?:  =(%complete status.ses)  cor
+  ?.  =(%pending status.ses)  cor
+  =/  ent=entry:b  (~(got by entries.st) entry-id.aut)
+  =/  fil=file:b  (entry-file ent)
+  ?.  ?&  =(object-id.receipt object-id.aut)
+          ?|  =(host.receipt (ship-text our.bowl))
+              =(host.receipt (scot %p our.bowl))
+          ==
+          =(bucket-id.receipt (scot %ud id.bucket.st))
+          =(size.receipt size.fil)
+          =(mime-type.receipt mime.fil)
+      ==
+    cor
+  =.  fil  fil(object-url ~, status %ready)
+  =.  ent
+    ent(updated-by actor.aut, updated-at now.bowl, kind [%file fil])
+  =.  ses  ses(status %complete)
+  =.  entries.st   (~(put by entries.st) id.ent ent)
+  =.  sessions.st  (~(put by sessions.st) id.ses ses)
+  (commit-update flag.aut st [%upload-ready ses ent])
+::
 ++  rename-entry
   |=  [=flag:b id=@ud name=@t]
   ^+  cor
@@ -406,6 +566,158 @@
   =/  test=$-([ship nest:b] ?)  .^($-([ship nest:b] ?) %gx pax)
   (test who [%buckets ship.flag name.flag])
 ::
+++  group-permissions
+  |=  [group=flag:b =flag:b who=ship]
+  ^-  [admin=? roles=(set @tas)]
+  ?:  =(who ship.flag)  [& ~]
+  =/  pax=path
+    /(scot %p our.bowl)/groups/(scot %da now.bowl)/v2/groups/(scot %p ship.group)/[name.group]/channels/buckets/(scot %p ship.flag)/[name.flag]/can-write/(scot %p who)/noun
+  .^([admin=? roles=(set @tas)] %gx pax)
+::
+++  group-is-admin
+  |=  [group=flag:b =flag:b who=ship]
+  ^-  ?
+  =/  permissions=[admin=? roles=(set @tas)]
+    (group-permissions group flag who)
+  admin.permissions
+::
+++  group-can-write
+  |=  [group=flag:b =flag:b writers=(set @tas) who=ship]
+  ^-  ?
+  ?.  (group-can-read group flag who)  |
+  =/  permissions=[admin=? roles=(set @tas)]
+    (group-permissions group flag who)
+  ?|  admin.permissions
+      =(~ writers)
+      !=(~ (~(int in writers) roles.permissions))
+  ==
+::
+++  action-authorized
+  |=  [st=bucket-state:b =flag:b who=ship act=action:b]
+  ^-  ?
+  ?-  -.act
+    %create          |
+    %delete-bucket   (group-is-admin group.st flag who)
+    %set-title       (group-is-admin group.st flag who)
+    %set-writers     (group-is-admin group.st flag who)
+    %issue-read      (group-can-read group.st flag who)
+    %create-folder   (group-can-write group.st flag writers.st who)
+    %begin-upload    (group-can-write group.st flag writers.st who)
+    %finish-upload   (group-can-write group.st flag writers.st who)
+    %fail-upload     (group-can-write group.st flag writers.st who)
+    %issue-delete    (group-can-write group.st flag writers.st who)
+    %rename-entry    (group-can-write group.st flag writers.st who)
+    %move-entry      (group-can-write group.st flag writers.st who)
+    %delete-entry    (group-can-write group.st flag writers.st who)
+  ==
+::
+++  ship-text
+  |=  who=ship
+  ^-  @t
+  (crip (slag 1 (trip (scot %p who))))
+::
+++  broker-simple-verdict
+  |=  result=@t
+  ^-  json
+  (pairs:enjs:format ~[['result' s+result]])
+::
+++  broker-upload-verdict
+  |=  [capability=@t reservation=@t]
+  ^-  json
+  =/  denied=json  (broker-simple-verdict 'denied')
+  ?~  got=(~(get by broker-capabilities) capability)  denied
+  =/  aut=broker-capability:b  u.got
+  ?.  =(%upload broker-kind.aut)  denied
+  ?.  (gth expires-at.aut now.bowl)
+    (broker-simple-verdict 'expired')
+  ?~  accepted=broker-reservation-id.aut  denied
+  ?.  =(u.accepted reservation)  denied
+  ?~  sid=session.aut  denied
+  ?~  sp=(~(get by spaces) flag.aut)  denied
+  ?~  st-unit=state.u.sp  denied
+  =/  st=bucket-state:b  u.st-unit
+  ?~  ses=(~(get by sessions.st) u.sid)  denied
+  ?.  =(%pending status.u.ses)  denied
+  ?.  (group-can-write group.st flag.aut writers.st actor.aut)  denied
+  =/  ent=entry:b  (~(got by entries.st) entry-id.aut)
+  =/  fil=file:b  (entry-file ent)
+  =/  checksum-json=json
+    ?~  checksum.fil  ~
+    %-  pairs:enjs:format
+    :~  ['algorithm' s+'crc32c']
+        ['value' s+u.checksum.fil]
+    ==
+  =/  upload=json
+    %-  pairs:enjs:format
+    :~  ['bucketName' s+(scot %tas name.flag.aut)]
+        ['bucketId' s+(scot %ud id.bucket.st)]
+        ['sessionId' s+(scot %uv u.sid)]
+        ['objectId' s+object-id.aut]
+        ['actorShip' s+(ship-text actor.aut)]
+        ['size' (numb:enjs:format size.fil)]
+        ['mimeType' s+mime.fil]
+        ['checksum' checksum-json]
+        ['expiresAtMillis' (numb:enjs:format (mul 1.000 (unt:chrono:userlib expires-at.aut)))]
+        ['brokerReservationId' s+u.accepted]
+    ==
+  %-  pairs:enjs:format
+  :~  ['result' s+'authorized']
+      ['upload' upload]
+  ==
+::
+++  broker-object-verdict
+  |=  [kind=broker-kind:b capability=@t object=@t]
+  ^-  json
+  =/  denied=json  (broker-simple-verdict 'denied')
+  ?~  got=(~(get by broker-capabilities) capability)  denied
+  =/  aut=broker-capability:b  u.got
+  ?.  =(kind broker-kind.aut)  denied
+  ?.  =(object object-id.aut)  denied
+  ?.  (gth expires-at.aut now.bowl)
+    (broker-simple-verdict 'expired')
+  ?~  sp=(~(get by spaces) flag.aut)  denied
+  ?~  st-unit=state.u.sp  denied
+  =/  st=bucket-state:b  u.st-unit
+  ?.  ?:  =(%read kind)
+        (group-can-read group.st flag.aut actor.aut)
+      (group-can-write group.st flag.aut writers.st actor.aut)
+    denied
+  ?~  ent-unit=(~(get by entries.st) entry-id.aut)  denied
+  =/  ent=entry:b  u.ent-unit
+  ?.  ?=(%file -.kind.ent)  denied
+  =/  fil=file:b  +.kind.ent
+  ?.  =(%ready status.fil)  denied
+  =/  payload=json
+    ?:  =(kind %read)
+      %-  pairs:enjs:format
+      :~  ['bucketId' s+(scot %ud id.bucket.st)]
+          ['objectId' s+object-id.aut]
+          ['displayFilename' s+name.ent]
+      ==
+    %-  pairs:enjs:format
+    :~  ['bucketId' s+(scot %ud id.bucket.st)]
+        ['objectId' s+object-id.aut]
+    ==
+  =/  key=@t  ?:(=(kind %read) 'read' 'delete')
+  %-  pairs:enjs:format
+  :~  ['result' s+'authorized']
+      [key payload]
+  ==
+::
+++  broker-complete-verdict
+  |=  reservation=@t
+  ^-  json
+  =/  denied=json  (broker-simple-verdict 'denied')
+  ?~  cap=(~(get by broker-reservations) reservation)  denied
+  ?~  got=(~(get by broker-capabilities) u.cap)  denied
+  =/  aut=broker-capability:b  u.got
+  ?~  sid=session.aut  denied
+  ?~  sp=(~(get by spaces) flag.aut)  denied
+  ?~  st-unit=state.u.sp  denied
+  ?~  ses=(~(get by sessions.u.st-unit) u.sid)  denied
+  ?.  =(%complete status.u.ses)  denied
+  (broker-simple-verdict 'completed')
+::
 ++  updates-path
   |=  =flag:b
   ^-  path
@@ -479,6 +791,18 @@
     ?~  sp=(~(get by spaces) flag)  ~
     ?~  state.u.sp  ~
     ``buckets-response-1+!>(`response:b`[%snapshot flag u.state.u.sp])
+  ::
+      [%x %v1 %broker %upload cap=@ reservation=@ ~]
+    ``json+!>((broker-upload-verdict cap.pole reservation.pole))
+  ::
+      [%x %v1 %broker %read cap=@ object=@ ~]
+    ``json+!>((broker-object-verdict %read cap.pole object.pole))
+  ::
+      [%x %v1 %broker %delete cap=@ object=@ ~]
+    ``json+!>((broker-object-verdict %delete cap.pole object.pole))
+  ::
+      [%x %v1 %broker %complete reservation=@ ~]
+    ``json+!>((broker-complete-verdict reservation.pole))
   ::
       [%u %joined host=@ name=@ ~]
     =/  =flag:b  [(slav %p host.pole) `@tas`name.pole]
@@ -580,6 +904,12 @@
     st(bucket bucket.upd)
   ::
       %bucket-deleted  st
+  ::
+      %bucket-updated
+    st(bucket bucket.upd)
+  ::
+      %writers-updated
+    st(writers writers.upd)
   ::
       %folder-created
     st(entries (~(put by entries.st) id.entry.upd entry.upd))
diff --git a/desk/lib/buckets/json.hoon b/desk/lib/buckets/json.hoon
index 69a6e95f7c..243c7ff014 100644
--- a/desk/lib/buckets/json.hoon
+++ b/desk/lib/buckets/json.hoon
@@ -80,10 +80,14 @@
     =/  roles=(list json)
       %+  turn  ~(tap in readers.st)
       |=(role=@tas s+(scot %tas role))
+    =/  writer-roles=(list json)
+      %+  turn  ~(tap in writers.st)
+      |=(role=@tas s+(scot %tas role))
     %-  pairs
     :~  ['bucket' (bucket bucket.st)]
         ['group' (flag group.st)]
         ['readers' [%a roles]]
+        ['writers' [%a writer-roles]]
         ['entries' [%a ents]]
         ['sessions' [%a sess]]
         ['revision' (numb revision.st)]
@@ -98,6 +102,15 @@
     ::
         %bucket-deleted
       (pairs ~[['type' s+'bucket-deleted']])
+    ::
+        %bucket-updated
+      (pairs ~[['type' s+'bucket-updated'] ['bucket' (bucket bucket.upd)]])
+    ::
+        %writers-updated
+      =/  roles=(list json)
+        %+  turn  ~(tap in writers.upd)
+        |=(role=@tas s+(scot %tas role))
+      (pairs ~[['type' s+'writers-updated'] ['writers' [%a roles]]])
     ::
         %folder-created
       (pairs ~[['type' s+'folder-created'] ['entry' (entry entry.upd)]])
@@ -213,10 +226,23 @@
           (so (get 'title' jon))
           (flag (get 'group' jon))
           (readers (get 'readers' jon))
+          (readers (get 'writers' jon))
       ==
     ::
         %'delete-bucket'
       [%delete-bucket (flag (get 'flag' jon))]
+    ::
+        %'set-title'
+      :*  %set-title
+          (flag (get 'flag' jon))
+          (so (get 'title' jon))
+      ==
+    ::
+        %'set-writers'
+      :*  %set-writers
+          (flag (get 'flag' jon))
+          (readers (get 'writers' jon))
+      ==
     ::
         %'create-folder'
       :*  %create-folder
@@ -233,6 +259,7 @@
           (so (get 'mime' jon))
           (ni (get 'size' jon))
           (maybe 'checksum' jon so)
+          (so (get 'capability' jon))
       ==
     ::
         %'finish-upload'
@@ -248,6 +275,20 @@
           ((se %uv) (get 'sessionId' jon))
           (so (get 'reason' jon))
       ==
+    ::
+        %'issue-read'
+      :*  %issue-read
+          (flag (get 'flag' jon))
+          (ni (get 'id' jon))
+          (so (get 'capability' jon))
+      ==
+    ::
+        %'issue-delete'
+      :*  %issue-delete
+          (flag (get 'flag' jon))
+          (ni (get 'id' jon))
+          (so (get 'capability' jon))
+      ==
     ::
         %'rename-entry'
       :*  %rename-entry
diff --git a/desk/mar/buckets-broker-command-1.hoon b/desk/mar/buckets-broker-command-1.hoon
new file mode 100644
index 0000000000..66fb2c3497
--- /dev/null
+++ b/desk/mar/buckets-broker-command-1.hoon
@@ -0,0 +1,14 @@
+::  buckets-broker-command-1: noun-only Pioneer broker callbacks
+::
+/-  b=buckets
+|_  =broker-command:b
+++  grad  %noun
+++  grab
+  |%
+  ++  noun  broker-command:b
+  --
+++  grow
+  |%
+  ++  noun  broker-command
+  --
+--
diff --git a/desk/sur/buckets.hoon b/desk/sur/buckets.hoon
index fc4b5fd306..2042a1eb2a 100644
--- a/desk/sur/buckets.hoon
+++ b/desk/sur/buckets.hoon
@@ -84,13 +84,27 @@
       error=(unit @t)
   ==
 ::
-::  A group Bucket uses the group's live can-read gate as its read and write
-::  authority in v1. `readers` is preserved for channel registration and UI.
+::  State as persisted by versions 0 and 1. Keep this mold frozen so upgrades
+::  can explicitly preserve the old "readers can write" behavior.
+::
++$  bucket-state-1
+  $:  =bucket
+      group=flag
+      readers=(set @tas)
+      entries=(map @ud entry)
+      sessions=(map @uv upload-session)
+      revision=@ud
+  ==
+::
+::  Group readability remains authoritative in %groups. Bucket writers are a
+::  separate subset of group roles; an empty set means every readable member
+::  may write, matching the convention used by %channels.
 ::
 +$  bucket-state
   $:  =bucket
       group=flag
       readers=(set @tas)
+      writers=(set @tas)
       entries=(map @ud entry)
       sessions=(map @uv upload-session)
       revision=@ud
@@ -100,12 +114,16 @@
 ::  subscriber can forward the same noun to the authoritative host.
 ::
 +$  action
-  $%  [%create name=@tas title=@t group=flag readers=(set @tas)]
+  $%  [%create name=@tas title=@t group=flag readers=(set @tas) writers=(set @tas)]
       [%delete-bucket =flag]
+      [%set-title =flag title=@t]
+      [%set-writers =flag writers=(set @tas)]
       [%create-folder =flag parent=(unit @ud) name=@t]
-      [%begin-upload =flag parent=(unit @ud) name=@t mime=@t size=@ud checksum=(unit @t)]
+      [%begin-upload =flag parent=(unit @ud) name=@t mime=@t size=@ud checksum=(unit @t) capability=@t]
       [%finish-upload =flag session=@uv object-url=@t]
       [%fail-upload =flag session=@uv reason=@t]
+      [%issue-read =flag id=@ud capability=@t]
+      [%issue-delete =flag id=@ud capability=@t]
       [%rename-entry =flag id=@ud name=@t]
       [%move-entry =flag id=@ud parent=(unit @ud)]
       [%delete-entry =flag id=@ud recursive=?]
@@ -115,10 +133,40 @@
 ::  claimed principal appears in the payload.
 ::
 +$  command  [=action]
+
+::  Opaque, short-lived bearer capabilities exchanged by Memex through
+::  Pioneer's local spider threads. They are host-only authority state and
+::  are never included in Bucket snapshots or Ames updates.
+::
++$  broker-kind  ?(%upload %read %delete)
++$  broker-capability
+  $:  =broker-kind
+      =flag
+      session=(unit @uv)
+      entry-id=@ud
+      object-id=@t
+      actor=ship
+      expires-at=@da
+      broker-reservation-id=(unit @t)
+  ==
++$  broker-receipt
+  $:  broker-reservation-id=@t
+      object-id=@t
+      host=@t
+      bucket-id=@t
+      size=@ud
+      mime-type=@t
+  ==
++$  broker-command
+  $%  [%authorize-upload capability=@t broker-reservation-id=@t]
+      [%complete-upload =broker-receipt]
+  ==
 ::
 +$  update
   $%  [%bucket-created =bucket]
       [%bucket-deleted ~]
+      [%bucket-updated =bucket]
+      [%writers-updated writers=(set @tas)]
       [%folder-created =entry]
       [%upload-begun =upload-session =entry]
       [%upload-ready =upload-session =entry]
@@ -134,14 +182,30 @@
 ::
 +$  net  ?(%pub %sub)
 +$  space  [=net state=(unit bucket-state) pending-group=(unit flag)]
++$  space-1  [=net state=(unit bucket-state-1) pending-group=(unit flag)]
 ::
 ::  Greenfield state. Future changes must add state-N and an explicit
 ::  state-(N-1)-to-N migration in +on-load; never mutate this mold in place.
 ::
 +$  state-0
   $:  %0
+      spaces=(map flag space-1)
+      next-id=@ud
+  ==
++$  state-1
+  $:  %1
+      spaces=(map flag space-1)
+      next-id=@ud
+      broker-capabilities=(map @t broker-capability)
+      broker-reservations=(map @t @t)
+  ==
++$  state-2
+  $:  %2
       spaces=(map flag space)
       next-id=@ud
+      broker-capabilities=(map @t broker-capability)
+      broker-reservations=(map @t @t)
   ==
-+$  state  state-0
++$  versioned-state  $%(state-0 state-1 state-2)
++$  state  state-2
 --
diff --git a/desk/ted/pioneer/buckets-authorize-delete.hoon b/desk/ted/pioneer/buckets-authorize-delete.hoon
new file mode 100644
index 0000000000..c1325c78f4
--- /dev/null
+++ b/desk/ted/pioneer/buckets-authorize-delete.hoon
@@ -0,0 +1,21 @@
+::  Exchange an opaque delete capability for an object-bound verdict.
+::
+/-  spider
+/+  *strandio
+/=  buckets-json  /lib/buckets/json
+=,  strand=strand:spider
+=,  dejs:format
+^-  thread:spider
+|=  arg=vase
+=/  m  (strand ,vase)
+^-  form:m
+=+  !<(arg=(unit json) arg)
+?>  ?=(^ arg)
+=*  jon  u.arg
+=/  capability=@t
+  (so (get:dejs:buckets-json 'capability' jon))
+=/  object=@t
+  (so (get:dejs:buckets-json 'objectId' jon))
+;<  verdict=json  bind:m
+  (scry json /gx/buckets/v1/broker/delete/[capability]/[object]/json)
+(pure:m !>(verdict))
diff --git a/desk/ted/pioneer/buckets-authorize-read.hoon b/desk/ted/pioneer/buckets-authorize-read.hoon
new file mode 100644
index 0000000000..c24575553a
--- /dev/null
+++ b/desk/ted/pioneer/buckets-authorize-read.hoon
@@ -0,0 +1,21 @@
+::  Exchange an opaque read capability for an object-bound verdict.
+::
+/-  spider
+/+  *strandio
+/=  buckets-json  /lib/buckets/json
+=,  strand=strand:spider
+=,  dejs:format
+^-  thread:spider
+|=  arg=vase
+=/  m  (strand ,vase)
+^-  form:m
+=+  !<(arg=(unit json) arg)
+?>  ?=(^ arg)
+=*  jon  u.arg
+=/  capability=@t
+  (so (get:dejs:buckets-json 'capability' jon))
+=/  object=@t
+  (so (get:dejs:buckets-json 'objectId' jon))
+;<  verdict=json  bind:m
+  (scry json /gx/buckets/v1/broker/read/[capability]/[object]/json)
+(pure:m !>(verdict))
diff --git a/desk/ted/pioneer/buckets-authorize-upload.hoon b/desk/ted/pioneer/buckets-authorize-upload.hoon
new file mode 100644
index 0000000000..fcfd2f9432
--- /dev/null
+++ b/desk/ted/pioneer/buckets-authorize-upload.hoon
@@ -0,0 +1,25 @@
+::  Exchange an opaque upload capability for authoritative Bucket metadata.
+::
+/-  spider, b=buckets
+/+  *strandio
+/=  buckets-json  /lib/buckets/json
+=,  strand=strand:spider
+=,  dejs:format
+^-  thread:spider
+|=  arg=vase
+=/  m  (strand ,vase)
+^-  form:m
+;<  our=@p  bind:m  get-our
+=+  !<(arg=(unit json) arg)
+?>  ?=(^ arg)
+=*  jon  u.arg
+=/  capability=@t
+  (so (get:dejs:buckets-json 'capability' jon))
+=/  reservation=@t
+  (so (get:dejs:buckets-json 'brokerReservationId' jon))
+;<  ~  bind:m
+  %+  poke  [our %buckets]
+  buckets-broker-command-1+!>(`broker-command:b`[%authorize-upload capability reservation])
+;<  verdict=json  bind:m
+  (scry json /gx/buckets/v1/broker/upload/[capability]/[reservation]/json)
+(pure:m !>(verdict))
diff --git a/desk/ted/pioneer/buckets-complete-upload.hoon b/desk/ted/pioneer/buckets-complete-upload.hoon
new file mode 100644
index 0000000000..9c20956788
--- /dev/null
+++ b/desk/ted/pioneer/buckets-complete-upload.hoon
@@ -0,0 +1,37 @@
+::  Commit Memex's verified object receipt to the Bucket manifest.
+::
+/-  spider, b=buckets
+/+  *strandio
+/=  buckets-json  /lib/buckets/json
+=,  strand=strand:spider
+=,  dejs:format
+^-  thread:spider
+|=  arg=vase
+=/  m  (strand ,vase)
+^-  form:m
+;<  our=@p  bind:m  get-our
+=+  !<(arg=(unit json) arg)
+?>  ?=(^ arg)
+=*  jon  u.arg
+=/  reservation=@t
+  (so (get:dejs:buckets-json 'brokerReservationId' jon))
+=/  receipt=json
+  (get:dejs:buckets-json 'receipt' jon)
+=/  object=@t
+  (so (get:dejs:buckets-json 'objectId' receipt))
+=/  host=@t
+  (so (get:dejs:buckets-json 'host' receipt))
+=/  bucket=@t
+  (so (get:dejs:buckets-json 'bucketId' receipt))
+=/  size=@ud
+  (ni (get:dejs:buckets-json 'size' receipt))
+=/  mime=@t
+  (so (get:dejs:buckets-json 'mimeType' receipt))
+=/  broker-receipt=broker-receipt:b
+  [reservation object host bucket size mime]
+;<  ~  bind:m
+  %+  poke  [our %buckets]
+  buckets-broker-command-1+!>(`broker-command:b`[%complete-upload broker-receipt])
+;<  verdict=json  bind:m
+  (scry json /gx/buckets/v1/broker/complete/[reservation]/json)
+(pure:m !>(verdict))
diff --git a/desk/tests/app/buckets.hoon b/desk/tests/app/buckets.hoon
index 03511b8a91..c8e4ec8ba3 100644
--- a/desk/tests/app/buckets.hoon
+++ b/desk/tests/app/buckets.hoon
@@ -3,6 +3,7 @@
 /-  bu=buckets
 /+  *test-agent
 /=  buckets-agent  /app/buckets
+/=  buckets-json  /lib/buckets/json
 |%
 ++  dap  %buckets
 ::
@@ -27,7 +28,7 @@
   =/  m  (mare ,~)
   ^-  form:m
   ;<  *  bind:m
-    (do-poke %buckets-action-1 !>(`action:bu`[%create %project-files 'Project Files' group ~]))
+    (do-poke %buckets-action-1 !>(`action:bu`[%create %project-files 'Project Files' group ~ ~]))
   (pure:m ~)
 ::
 ++  file-of
@@ -39,7 +40,7 @@
   ==
 ::
 ++  state-for
-  |=  [st=state-0:bu =flag:bu]
+  |=  [st=state-2:bu =flag:bu]
   ^-  bucket-state:bu
   =/  sp=space:bu  (~(got by spaces.st) flag)
   (need state.sp)
@@ -50,6 +51,41 @@
   ?.  ?=([%gx @ %groups @ %v2 %groups @ @ %channels %can-read %noun ~] pax)  ~
   `!>(|=([who=ship =nest:bu] |))
 ::
+++  group-permission-scries
+  |=  pax=path
+  ^-  (unit vase)
+  ?:  ?=([%gx @ %groups @ %v2 %groups @ @ %channels %can-read %noun ~] pax)
+    `!>(|=([who=ship =nest:bu] &))
+  ?.  ?=([%gx @ %groups @ %v2 %groups @ @ %channels %buckets @ @ %can-write @ %noun ~] pax)  ~
+  `!>([admin=| roles=(silt ~[%editor])])
+::
+::  Existing state-1 Buckets keep all metadata and preserve the old
+::  "readers can write" behavior when the writer role-set is introduced.
+::
+++  test-migrate-state-1-to-2
+  %-  eval-mare
+  =/  m  (mare ,~)
+  =*  b  bind:m
+  ^-  form:m
+  ;<  ~  b  setup
+  =/  legacy-bucket=bucket:bu
+    [41 'Legacy Files' ~zod ~2025.1.1 ~zod ~2025.1.2]
+  =/  legacy-readers=(set @tas)
+    (~(put in (~(put in *(set @tas)) %editor)) %member)
+  =/  legacy-state=bucket-state-1:bu
+    [legacy-bucket group legacy-readers ~ ~ 9]
+  =/  legacy-space=space-1:bu  [%pub `legacy-state ~]
+  =/  legacy-spaces=(map flag:bu space-1:bu)
+    (~(put by *(map flag:bu space-1:bu)) flag legacy-space)
+  =/  old=state-1:bu  [%1 legacy-spaces 42 ~ ~]
+  ;<  *  b  (do-load buckets-agent `!>(old))
+  ;<  sv=vase  b  get-save
+  =/  migrated=state-2:bu  !<(state-2:bu sv)
+  =/  bucket-state=bucket-state:bu  (state-for migrated flag)
+  %+  ex-equal
+  !>([next-id.migrated id.bucket.bucket-state title.bucket.bucket-state readers.bucket-state writers.bucket-state revision.bucket-state])
+  !>([42 41 'Legacy Files' legacy-readers legacy-readers 9])
+::
 ::  A complete metadata-only upload lifecycle. The bytes never enter Gall;
 ::  only the host-issued session, object key, and final object URL do.
 ::
@@ -63,16 +99,16 @@
   ;<  *  b
     (do-poke %buckets-action-1 !>(`action:bu`[%create-folder flag ~ 'Launch']))
   ;<  *  b
-    (do-poke %buckets-action-1 !>(`action:bu`[%begin-upload flag `2 'meadow.png' 'image/png' 2.048 ~]))
+    (do-poke %buckets-action-1 !>(`action:bu`[%begin-upload flag `2 'meadow.png' 'image/png' 2.048 ~ 'legacy-capability-0000000000000000']))
   ;<  sv=vase  b  get-save
-  =/  st=state-0:bu  !<(state-0:bu sv)
+  =/  st=state-2:bu  !<(state-2:bu sv)
   =/  bs=bucket-state:bu  (state-for st flag)
   =/  session-list=(list upload-session:bu)  ~(val by sessions.bs)
   =/  ses=upload-session:bu  ?~(session-list !! i.session-list)
   ;<  *  b
     (do-poke %buckets-action-1 !>(`action:bu`[%finish-upload flag id.ses 'https://objects.test/meadow.png']))
   ;<  sv2=vase  b  get-save
-  =/  st2=state-0:bu  !<(state-0:bu sv2)
+  =/  st2=state-2:bu  !<(state-2:bu sv2)
   =/  bs2=bucket-state:bu  (state-for st2 flag)
   =/  ent=entry:bu  (~(got by entries.bs2) 3)
   =/  fil=file:bu  (file-of ent)
@@ -81,6 +117,137 @@
   =/  expected-parent=(unit @ud)  (some 2)
   (ex-equal !>([revision.bs2 status.fil status.ses2 object-url.fil parent.ent]) !>([3 %ready %complete expected-url expected-parent]))
 ::
+::  The Pioneer bridge binds Memex's proposed reservation exactly once and
+::  only marks the file ready after a matching verified receipt callback.
+::
+++  test-broker-upload-lifecycle
+  %-  eval-mare
+  =/  m  (mare ,~)
+  =*  b  bind:m
+  ^-  form:m
+  =/  cap=@t  'broker-capability-00000000000000000000'
+  =/  rid=@t  '00000000-0000-0000-0000-000000000001'
+  ;<  ~  b  setup
+  ;<  ~  b  create
+  ;<  *  b
+    (do-poke %buckets-action-1 !>(`action:bu`[%begin-upload flag ~ 'private.pdf' 'application/pdf' 42 ~ cap]))
+  ;<  *  b
+    (do-poke %buckets-broker-command-1 !>(`broker-command:bu`[%authorize-upload cap rid]))
+  ;<  upload-cage=cage  b
+    (got-peek /x/v1/broker/upload/[cap]/[rid])
+  =/  upload-json=json  !<(json q.upload-cage)
+  =/  upload-result=@t
+    (so:dejs:format (get:dejs:buckets-json 'result' upload-json))
+  ;<  sv=vase  b  get-save
+  =/  st=state-2:bu  !<(state-2:bu sv)
+  =/  aut=broker-capability:bu  (~(got by broker-capabilities.st) cap)
+  =/  bs=bucket-state:bu  (state-for st flag)
+  =/  session-list=(list upload-session:bu)  ~(val by sessions.bs)
+  =/  ses=upload-session:bu  ?~(session-list !! i.session-list)
+  =/  ent=entry:bu  (~(got by entries.bs) file-id.ses)
+  =/  fil=file:bu  (file-of ent)
+  ;<  ~  b
+    (ex-equal !>(broker-reservation-id.aut) !>(`rid))
+  =/  receipt=broker-receipt:bu
+    [rid object-key.fil 'zod' (scot %ud id.bucket.bs) 42 'application/pdf']
+  ;<  *  b
+    (do-poke %buckets-broker-command-1 !>(`broker-command:bu`[%complete-upload receipt]))
+  ::  Completion retries are idempotent.
+  ;<  *  b
+    (do-poke %buckets-broker-command-1 !>(`broker-command:bu`[%complete-upload receipt]))
+  ;<  sv2=vase  b  get-save
+  =/  st2=state-2:bu  !<(state-2:bu sv2)
+  =/  bs2=bucket-state:bu  (state-for st2 flag)
+  =/  ent2=entry:bu  (~(got by entries.bs2) file-id.ses)
+  =/  fil2=file:bu  (file-of ent2)
+  =/  ses2=upload-session:bu  (~(got by sessions.bs2) id.ses)
+  =/  read-cap=@t  'read-capability-0000000000000000000000'
+  =/  delete-cap=@t  'delete-capability-00000000000000000000'
+  ;<  *  b
+    (do-poke %buckets-action-1 !>(`action:bu`[%issue-read flag file-id.ses read-cap]))
+  ;<  *  b
+    (do-poke %buckets-action-1 !>(`action:bu`[%issue-delete flag file-id.ses delete-cap]))
+  ;<  read-cage=cage  b
+    (got-peek /x/v1/broker/read/[read-cap]/[object-key.fil2])
+  ;<  delete-cage=cage  b
+    (got-peek /x/v1/broker/delete/[delete-cap]/[object-key.fil2])
+  ;<  denied-cage=cage  b
+    (got-peek /x/v1/broker/read/[read-cap]/wrong-object)
+  =/  read-json=json  !<(json q.read-cage)
+  =/  delete-json=json  !<(json q.delete-cage)
+  =/  denied-json=json  !<(json q.denied-cage)
+  =/  read-payload=json
+    (get:dejs:buckets-json 'read' read-json)
+  =/  delete-payload=json
+    (get:dejs:buckets-json 'delete' delete-json)
+  ?>  ?=([%o *] delete-payload)
+  =/  delete-filename=(unit json)
+    (~(get by p.delete-payload) 'displayFilename')
+  =/  read-result=@t
+    (so:dejs:format (get:dejs:buckets-json 'result' read-json))
+  =/  read-object=@t
+    (so:dejs:format (get:dejs:buckets-json 'objectId' read-payload))
+  =/  read-name=@t
+    (so:dejs:format (get:dejs:buckets-json 'displayFilename' read-payload))
+  =/  delete-result=@t
+    (so:dejs:format (get:dejs:buckets-json 'result' delete-json))
+  =/  delete-object=@t
+    (so:dejs:format (get:dejs:buckets-json 'objectId' delete-payload))
+  =/  denied-result=@t
+    (so:dejs:format (get:dejs:buckets-json 'result' denied-json))
+  =/  next-read-cap=@t  'next-read-capability-000000000000000000'
+  ;<  ~  b
+    (jab-bowl |=(bol=bowl bol(now ~2026.1.1..02.00.00)))
+  ;<  *  b
+    (do-poke %buckets-action-1 !>(`action:bu`[%issue-read flag file-id.ses next-read-cap]))
+  ;<  sv3=vase  b  get-save
+  =/  st3=state-2:bu  !<(state-2:bu sv3)
+  =/  old-upload-pruned=?
+    !(~(has by broker-capabilities.st3) cap)
+  =/  old-read-pruned=?
+    !(~(has by broker-capabilities.st3) read-cap)
+  =/  old-delete-pruned=?
+    !(~(has by broker-capabilities.st3) delete-cap)
+  =/  old-reservation-pruned=?
+    !(~(has by broker-reservations.st3) rid)
+  =/  next-read-kept=?
+    (~(has by broker-capabilities.st3) next-read-cap)
+  %+  ex-equal
+  !>  :*  upload-result
+          status.fil2
+          object-url.fil2
+          status.ses2
+          read-result
+          read-object
+          read-name
+          delete-result
+          delete-object
+          delete-filename
+          denied-result
+          old-upload-pruned
+          old-read-pruned
+          old-delete-pruned
+          old-reservation-pruned
+          next-read-kept
+      ==
+  !>  :*  'authorized'
+          %ready
+          ~
+          %complete
+          'authorized'
+          object-key.fil2
+          'private.pdf'
+          'authorized'
+          object-key.fil2
+          ~
+          'denied'
+          &
+          &
+          &
+          &
+          &
+      ==
+::
 ::  Folder parents must exist and must themselves be folders.
 ::
 ++  test-invalid-parent-rejected
@@ -93,7 +260,7 @@
   %-  ex-fail
   (do-poke %buckets-action-1 !>(`action:bu`[%create-folder flag `999 'Bad']))
 ::
-::  Cross-ship writes are re-authorized against %groups' live can-read gate;
+::  Cross-ship writes are re-authorized against %groups' live read gate;
 ::  membership recorded in old state is never treated as permanent authority.
 ::
 ++  test-remote-write-revoked
@@ -108,4 +275,24 @@
   %-  (do-as ~bus)
   %+  do-poke  %buckets-command-1
   !>([[%create-folder flag ~ 'Denied']])
+::
+::  A readable member still needs a matching writer role for mutations.
+::
+++  test-remote-writer-role
+  %-  eval-mare
+  =/  m  (mare ,~)
+  =*  b  bind:m
+  ^-  form:m
+  ;<  ~  b  setup
+  ;<  *  b
+    (do-poke %buckets-action-1 !>(`action:bu`[%create %project-files 'Project Files' group ~ (silt ~[%editor])]))
+  ;<  ~  b  (set-scry-gate group-permission-scries)
+  ;<  *  b
+    %-  (do-as ~bus)
+    %+  do-poke  %buckets-command-1
+    !>([[%create-folder flag ~ 'Allowed']])
+  ;<  sv=vase  b  get-save
+  =/  st=state-2:bu  !<(state-2:bu sv)
+  =/  bs=bucket-state:bu  (state-for st flag)
+  (ex-equal !>((lent ~(val by entries.bs))) !>(1))
 --
diff --git a/docs/backend/desk/app/buckets.md b/docs/backend/desk/app/buckets.md
index 1e620f29ec..e7836bdfce 100644
--- a/docs/backend/desk/app/buckets.md
+++ b/docs/backend/desk/app/buckets.md
@@ -6,13 +6,15 @@ The channel nest is `buckets/~host/name`. The Bucket host is authoritative, whil
 
 ## Authority and storage boundary
 
-- `%groups` remains the authority for membership and channel visibility.
-- The Bucket host re-checks the affiliated group's live `can-read` gate for every remote command and subscription. In version 1, anyone who can read the channel can also mutate it.
-- The acting principal is always `src.bowl`; commands cannot claim a different ship.
-- Gall persists only the manifest and bounded upload-session metadata. Object bytes, storage credentials, and signed URLs must not travel over Ames or enter Gall state.
-- Object keys are host-generated and independent of display names, so rename and move operations only change manifest metadata.
+-   `%groups` remains the authority for membership and channel visibility.
+-   The Bucket host re-checks the affiliated group's live `can-read` gate for subscriptions and read grants.
+-   Mutations require either group-admin authority or a group role in the Bucket's writer set. An empty writer set means every readable group member may write. Writer roles are independent from the reader roles stored by `%groups`.
+-   Title changes, writer-role changes, and Bucket deletion require a live group-admin check.
+-   The acting principal is always `src.bowl`; commands cannot claim a different ship.
+-   Gall persists only the manifest, bounded upload-session metadata, and opaque short-lived broker capabilities. Object bytes, storage credentials, and signed URLs must not travel over Ames or enter Gall state.
+-   Object keys are host-generated and independent of display names, so rename and move operations only change manifest metadata.
 
-The current upload completion action accepts an object URL supplied by the requester. That is sufficient for the fakezod slice, but it is not the production trust boundary. Ylem/Memex integration must mint a scoped grant and verify object existence, size, and optional checksum before `%finish-upload` is accepted.
+Hosted clients use the private Ylem/Memex broker path described below. `%finish-upload` remains available for the legacy public Memex fallback while the private broker is rolled out by canary.
 
 ## State
 
@@ -20,60 +22,94 @@ The protocol and persisted molds are in `desk/sur/buckets.hoon`.
 
 Each Bucket contains:
 
-- Bucket metadata and affiliated group flag
-- File/folder entries keyed by stable numeric ID
-- Upload sessions keyed by host entropy
-- A monotonically increasing manifest revision
+-   Bucket metadata and affiliated group flag
+-   File/folder entries keyed by stable numeric ID
+-   Upload sessions keyed by host entropy
+-   Reader and writer role sets used by the group channel and Bucket writer gate
+-   A monotonically increasing manifest revision
 
-Files transition from `%pending` to `%ready` or `%failed`. Upload sessions independently transition from `%pending` to `%complete` or `%failed`. State is explicitly tagged `%0`; any future mold change must add a migration rather than changing `state-0` in place.
+Files transition from `%pending` to `%ready` or `%failed`. Upload sessions independently transition from `%pending` to `%complete` or `%failed`.
+
+State `%1` adds two host-private maps to the original `%0` state: capability-to-authority records and broker-reservation-to-capability bindings. State `%2` adds a distinct writer-role set to each Bucket. `+on-load` explicitly migrates `%0` and `%1` to `%2`, initially copying the old reader roles into writers so existing Buckets retain their previous write behavior. Future mold changes must add another version and migration rather than changing an existing mold in place. The host-private broker maps are not included in Bucket snapshots or Ames updates.
 
 ## Pokes
 
 Local clients poke `%buckets-action-1`. The mark accepts JSON and noun input.
 
-| Action | Purpose |
-| --- | --- |
-| `%create` | Create a host-owned Bucket and register the channel with `%groups` |
-| `%delete-bucket` | Delete the Bucket and remove its `%groups` channel registration |
-| `%create-folder` | Add a folder beneath an existing folder or the root |
-| `%begin-upload` | Allocate a pending file, opaque object key, and one-hour upload session |
-| `%finish-upload` | Mark the requester's pending upload ready |
-| `%fail-upload` | Mark the requester's pending upload failed |
-| `%rename-entry` | Change an entry's display name |
-| `%move-entry` | Move an entry while preventing folder cycles |
-| `%delete-entry` | Delete a file or recursively delete a folder tree |
+| Action           | Purpose                                                                                                             |
+| ---------------- | ------------------------------------------------------------------------------------------------------------------- |
+| `%create`        | Create a host-owned Bucket and register the channel with `%groups`                                                  |
+| `%delete-bucket` | Delete the Bucket and remove its `%groups` channel registration                                                     |
+| `%set-title`     | Update the Bucket's authoritative title; group metadata is updated separately through `%groups`                     |
+| `%set-writers`   | Replace the group-role writer set                                                                                   |
+| `%create-folder` | Add a folder beneath an existing folder or the root                                                                 |
+| `%begin-upload`  | Allocate a pending file, opaque object key, one-hour upload session, and bind the caller's opaque broker capability |
+| `%finish-upload` | Mark the requester's pending upload ready                                                                           |
+| `%fail-upload`   | Mark the requester's pending upload failed                                                                          |
+| `%issue-read`    | Bind a ten-minute read capability to a ready file and the requesting ship                                           |
+| `%issue-delete`  | Bind a ten-minute delete capability to a ready file and the requesting ship                                         |
+| `%rename-entry`  | Change an entry's display name                                                                                      |
+| `%move-entry`    | Move an entry while preventing folder cycles                                                                        |
+| `%delete-entry`  | Delete a file or recursively delete a folder tree                                                                   |
 
 Subscriber agents forward non-create actions to the host with the noun-only `%buckets-command-1` mark. The host derives the actor from the Gall bowl and re-authorizes the command.
 
+Creation is host-local in this version: the group host creates and hosts the Bucket. The client therefore offers the Buckets channel type only when `%buckets` is installed and the current ship hosts the group. Non-host group admins may edit permissions after creation, but remote creation needs a separate host-request protocol.
+
+The Gall delete action removes the manifest and `%groups` registration, but storage-wide object cleanup is not atomic yet. The client intentionally withholds Bucket deletion until Memex exposes a host-authorized bulk cleanup operation.
+
 ## Scries and subscriptions
 
-| Path | Mark | Description |
-| --- | --- | --- |
-| `/x/v1/buckets` | `%buckets-snapshots-1` | All locally available Bucket snapshots |
-| `/x/v1/buckets/<host>/<name>` | `%buckets-response-1` | One local Bucket snapshot |
-| `/u/joined/<host>/<name>` | `%loob` | Whether the local agent has the Bucket |
-| `/v1` | `%buckets-response-1` | Initial snapshots and all local replica updates |
-| `/v1/buckets/<host>/<name>/updates` | `%buckets-response-1` | Host-authorized snapshot followed by manifest updates |
+| Path                                | Mark                   | Description                                           |
+| ----------------------------------- | ---------------------- | ----------------------------------------------------- |
+| `/x/v1/buckets`                     | `%buckets-snapshots-1` | All locally available Bucket snapshots                |
+| `/x/v1/buckets/<host>/<name>`       | `%buckets-response-1`  | One local Bucket snapshot                             |
+| `/u/joined/<host>/<name>`           | `%loob`                | Whether the local agent has the Bucket                |
+| `/v1`                               | `%buckets-response-1`  | Initial snapshots and all local replica updates       |
+| `/v1/buckets/<host>/<name>/updates` | `%buckets-response-1`  | Host-authorized snapshot followed by manifest updates |
 
 Direct scries are self-only. Remote consumers subscribe to the host's update path, where the host can apply the live group authorization check. Subscriber agents report joined/left state to local `%groups` using `%group-channel-active`.
 
-## Intended hosted upload flow
+## Hosted private-broker flow
 
-1. The client calls `%begin-upload` through its local `%buckets` agent.
+1. The client generates an opaque capability and sends it with `%begin-upload` through its local `%buckets` agent.
 2. The host authorizes the caller, allocates the file ID, object key, and session.
-3. A Ylem/Memex broker exchanges that authorized session for a short-lived PUT grant bound to the host, Bucket, key, caller, size, content type, and expiry.
-4. The client uploads bytes directly to object storage with progress and retry.
-5. The broker HEAD-verifies the object and finalizes the reservation.
-6. The client calls `%finish-upload`; the host emits a revisioned manifest update to every subscriber.
+3. The client presents the capability and Bucket host to Memex `POST /v2/buckets/uploads/grant`.
+4. Memex asks the host's Pioneer sidecar to run `%pioneer-buckets-authorize-upload`. The thread binds Memex's reservation ID exactly once and returns authoritative Bucket metadata. Pioneer stamps the host from its own ship identity.
+5. Memex returns a short-lived PUT grant bound to the host, Bucket, object ID, caller, size, content type, and expiry.
+6. The client uploads bytes directly to object storage with progress, cancel, and retry support.
+7. The client calls Memex's completion endpoint. Memex HEAD-verifies the object and sends its receipt through `%pioneer-buckets-complete-upload`.
+8. Gall validates the reservation, object ID, host, Bucket ID, size, and MIME type before marking the file ready and emitting a revisioned update.
+
+Completion is idempotent. Re-exchanging an upload capability with the same reservation is also idempotent; a different reservation is denied.
+
+For a private read, the client sends `%issue-read`, exchanges the capability at Memex, and receives a short-lived read URL after `%pioneer-buckets-authorize-read` re-checks live group access. Delete follows the same pattern through `%issue-delete` and `%pioneer-buckets-authorize-delete` before the manifest entry is removed.
+
+The client falls back to the legacy public Memex upload only when the private endpoint reports that the feature is disabled, unavailable, or absent. Authorization failures do not fall back.
+
+## Pioneer thread contract
+
+All four threads live under `desk/ted/pioneer/` and are invoked by Pioneer with the flattened `%pioneer-buckets-*` file names. They accept `(unit json)` and return JSON.
+
+| Thread                              | Input                               | Successful result                                                                                                                                        |
+| ----------------------------------- | ----------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `%pioneer-buckets-authorize-upload` | `{capability, brokerReservationId}` | `{result: "authorized", upload: {bucketName, bucketId, sessionId, objectId, actorShip, size, mimeType, checksum, expiresAtMillis, brokerReservationId}}` |
+| `%pioneer-buckets-complete-upload`  | `{brokerReservationId, receipt}`    | `{result: "completed"}`                                                                                                                                  |
+| `%pioneer-buckets-authorize-read`   | `{capability, objectId}`            | `{result: "authorized", read: {bucketId, objectId, displayFilename}}`                                                                                    |
+| `%pioneer-buckets-authorize-delete` | `{capability, objectId}`            | `{result: "authorized", delete: {bucketId, objectId}}`                                                                                                   |
 
-The broker/grant steps are deliberately not implemented in the Gall slice yet. The client fixture's upload queue is therefore a UI simulation, not a live object transfer.
+Authorization failures return `{result: "denied"}` and expired capabilities return `{result: "expired"}`. `expiresAtMillis` is Unix time in milliseconds.
 
 ## Tests
 
 `desk/tests/app/buckets.hoon` covers:
 
-- Folder creation plus a complete metadata-only upload lifecycle
-- Rejection of nonexistent folder parents
-- Rejection of a remote write after the live `%groups` permission gate denies access
+-   Folder creation plus a complete metadata-only upload lifecycle
+-   Private reservation binding and verified completion, including idempotent retries
+-   Exact upload/read/delete broker verdicts and denial for a mismatched object ID
+-   Lazy cleanup of expired capabilities and their reservation bindings
+-   Rejection of nonexistent folder parents
+-   Rejection of a remote write after the live `%groups` permission gate denies access
+-   Acceptance of a remote write only when the member has a configured writer role
 
 Run the targeted fakezod test with the repository's normal `%test` thread against `/tests/app/buckets/hoon`. Marks must remain top-level files such as `desk/mar/buckets-action-1.hoon`; nesting them under `desk/mar/buckets/` changes the mark name and prevents Gall from resolving the protocol.
diff --git a/packages/api/src/__tests__/apiUtils.test.ts b/packages/api/src/__tests__/apiUtils.test.ts
index a4c8bc84c5..a00910cb3a 100644
--- a/packages/api/src/__tests__/apiUtils.test.ts
+++ b/packages/api/src/__tests__/apiUtils.test.ts
@@ -2,7 +2,10 @@ import { describe, expect, test } from 'vitest';
 
 import {
   getBotUserIdForUser,
+  getChannelIdType,
   isBotUserIdForUser,
+  isChannelId,
+  isGroupChannelId,
   isMoonOfUser,
 } from '../client/apiUtils';
 
@@ -52,3 +55,13 @@ describe('isMoonOfUser', () => {
     ).toBe(false);
   });
 });
+
+describe('bucket channel ids', () => {
+  const channelId = 'buckets/~zod/project-files';
+
+  test('treats Buckets as group channels', () => {
+    expect(isGroupChannelId(channelId)).toBe(true);
+    expect(isChannelId(channelId)).toBe(true);
+    expect(getChannelIdType(channelId)).toBe('channel');
+  });
+});
diff --git a/packages/api/src/__tests__/bucketsApi.test.ts b/packages/api/src/__tests__/bucketsApi.test.ts
new file mode 100644
index 0000000000..034037a898
--- /dev/null
+++ b/packages/api/src/__tests__/bucketsApi.test.ts
@@ -0,0 +1,60 @@
+import { beforeEach, expect, test, vi } from 'vitest';
+
+import { getBuckets, subscribeToBuckets } from '../client/bucketsApi';
+import { scry, subscribe } from '../client/urbit';
+import type { BucketsResponse, BucketsSnapshot } from '../urbit/buckets';
+
+vi.mock('../client/urbit', () => ({
+  poke: vi.fn(),
+  scry: vi.fn(),
+  subscribe: vi.fn(),
+  unsubscribe: vi.fn(),
+}));
+
+const legacySnapshot = {
+  flag: { host: '~zod', name: 'files' },
+  state: {
+    bucket: {
+      id: 1,
+      title: 'Files',
+      createdBy: '~zod',
+      createdAt: 0,
+      updatedBy: '~zod',
+      updatedAt: 0,
+    },
+    group: { host: '~zod', name: 'group' },
+    readers: ['member'],
+    entries: [],
+    sessions: [],
+    revision: 1,
+  },
+} as unknown as BucketsSnapshot;
+
+beforeEach(() => {
+  vi.mocked(scry).mockReset();
+  vi.mocked(subscribe).mockReset();
+});
+
+test('getBuckets gives legacy snapshots their implicit writer roles', async () => {
+  vi.mocked(scry).mockResolvedValueOnce([legacySnapshot]);
+
+  await expect(getBuckets()).resolves.toMatchObject([
+    { state: { readers: ['member'], writers: ['member'] } },
+  ]);
+});
+
+test('subscribeToBuckets normalizes legacy snapshot events', async () => {
+  vi.mocked(subscribe).mockImplementationOnce(async (_endpoint, onUpdate) => {
+    onUpdate({ type: 'snapshot', ...legacySnapshot } as BucketsResponse);
+    return 7;
+  });
+  const handler = vi.fn();
+
+  await subscribeToBuckets(handler);
+
+  expect(handler).toHaveBeenCalledWith(
+    expect.objectContaining({
+      state: expect.objectContaining({ writers: ['member'] }),
+    })
+  );
+});
diff --git a/packages/api/src/__tests__/thirdPartyChannel.test.ts b/packages/api/src/__tests__/thirdPartyChannel.test.ts
index 63c1224644..0e55b04f8b 100644
--- a/packages/api/src/__tests__/thirdPartyChannel.test.ts
+++ b/packages/api/src/__tests__/thirdPartyChannel.test.ts
@@ -1,6 +1,11 @@
 import { describe, expect, test } from 'vitest';
 
-import { getThirdPartyChannelAgent, isThirdPartyChannel } from '../urbit/utils';
+import {
+  getChannelKindFromType,
+  getChannelType,
+  getThirdPartyChannelAgent,
+  isThirdPartyChannel,
+} from '../urbit/utils';
 
 describe('third party channels', () => {
   test('%channels-backed kinds have no third-party agent', () => {
@@ -13,6 +18,13 @@ describe('third party channels', () => {
   test('non-%channels kinds report their backing agent', () => {
     expect(getThirdPartyChannelAgent('notes/~zod/book')).toBe('notes');
     expect(isThirdPartyChannel('notes/~zod/book')).toBe(true);
+    expect(getThirdPartyChannelAgent('buckets/~zod/files')).toBe('buckets');
+    expect(isThirdPartyChannel('buckets/~zod/files')).toBe(true);
+  });
+
+  test('Bucket nests map to the first-class client channel type', () => {
+    expect(getChannelType('buckets/~zod/files')).toBe('buckets');
+    expect(getChannelKindFromType('buckets')).toBe('buckets');
   });
 
   test('non-nest ids (DMs, clubs) are not third-party channels', () => {
diff --git a/packages/api/src/client/apiUtils.ts b/packages/api/src/client/apiUtils.ts
index d71593a8b1..9b74f5caae 100644
--- a/packages/api/src/client/apiUtils.ts
+++ b/packages/api/src/client/apiUtils.ts
@@ -124,7 +124,8 @@ export function isGroupChannelId(channelId: string) {
     channelId.startsWith('chat') ||
     channelId.startsWith('diary') ||
     channelId.startsWith('heap') ||
-    channelId.startsWith('notes')
+    channelId.startsWith('notes') ||
+    channelId.startsWith('buckets')
   );
 }
 
diff --git a/packages/api/src/client/bucketsApi.ts b/packages/api/src/client/bucketsApi.ts
new file mode 100644
index 0000000000..92c1fce238
--- /dev/null
+++ b/packages/api/src/client/bucketsApi.ts
@@ -0,0 +1,73 @@
+import type {
+  BucketsAction,
+  BucketsFlag,
+  BucketsResponse,
+  BucketsSnapshot,
+} from '../urbit/buckets';
+import { poke, scry, subscribe, unsubscribe } from './urbit';
+
+const BUCKETS_APP = 'buckets';
+const BUCKETS_ACTION_MARK = 'buckets-action-1';
+
+function normalizeBucketsSnapshot<T extends BucketsSnapshot>(snapshot: T): T {
+  const state = snapshot.state as BucketsSnapshot['state'] & {
+    writers?: string[];
+  };
+
+  return {
+    ...snapshot,
+    state: {
+      ...state,
+      // State versions before %2 used the reader roles as the implicit writer
+      // roles. Keeping that interpretation here makes client/server upgrades
+      // order-independent for already-live Buckets.
+      writers: state.writers ?? state.readers,
+    },
+  } as T;
+}
+
+export function bucketsFlagKey(flag: BucketsFlag) {
+  return `${flag.host}/${flag.name}`;
+}
+
+export function formatBucketsChannelId(flag: BucketsFlag) {
+  return `buckets/${flag.host}/${flag.name}`;
+}
+
+export function parseBucketsChannelId(channelId: string): BucketsFlag | null {
+  const [kind, host, name, ...rest] = channelId.split('/');
+  if (kind !== 'buckets' || !host || !name || rest.length > 0) return null;
+  return { host, name };
+}
+
+export async function getBuckets() {
+  const snapshots = await scry<BucketsSnapshot[]>({
+    app: BUCKETS_APP,
+    path: '/v1/buckets',
+  });
+  return snapshots.map(normalizeBucketsSnapshot);
+}
+
+export function sendBucketsAction(action: BucketsAction) {
+  return poke({
+    app: BUCKETS_APP,
+    mark: BUCKETS_ACTION_MARK,
+    json: action,
+  });
+}
+
+export async function subscribeToBuckets(
+  handler: (response: BucketsResponse) => void
+) {
+  const subscriptionId = await subscribe<BucketsResponse>(
+    { app: BUCKETS_APP, path: '/v1' },
+    (response) =>
+      handler(
+        response.type === 'snapshot'
+          ? normalizeBucketsSnapshot(response)
+          : response
+      )
+  );
+
+  return () => unsubscribe(subscriptionId);
+}
diff --git a/packages/api/src/client/channelContentConfig.ts b/packages/api/src/client/channelContentConfig.ts
index 6b9623a1d0..d7636dfb65 100644
--- a/packages/api/src/client/channelContentConfig.ts
+++ b/packages/api/src/client/channelContentConfig.ts
@@ -62,6 +62,10 @@ export const allCollectionRenderers = {
     displayName: 'Notes',
     enumTag: 'notes',
   },
+  'tlon.r0.collection.buckets': {
+    displayName: 'Buckets',
+    enumTag: 'buckets',
+  },
 } as const satisfies Record<string, ComponentSpec>;
 
 export const allDraftInputs = {
@@ -81,6 +85,10 @@ export const allDraftInputs = {
     displayName: 'Notes',
     enumTag: 'notes',
   },
+  'tlon.r0.input.buckets': {
+    displayName: 'Buckets',
+    enumTag: 'buckets',
+  },
 } as const satisfies Record<string, ComponentSpec>;
 
 export const allContentRenderers = {
@@ -120,6 +128,10 @@ export const allContentRenderers = {
     displayName: 'Notes',
     enumTag: 'notes',
   },
+  'tlon.r0.content.buckets': {
+    displayName: 'Buckets',
+    enumTag: 'buckets',
+  },
 } as const satisfies Record<string, ComponentSpec>;
 
 export const CollectionRendererId = makeEnum(allCollectionRenderers);
diff --git a/packages/api/src/client/index.ts b/packages/api/src/client/index.ts
index c9eea31027..9661ed1510 100644
--- a/packages/api/src/client/index.ts
+++ b/packages/api/src/client/index.ts
@@ -2,6 +2,7 @@ export { udToDate } from './apiUtils';
 export * from './a2ui';
 export * from './channelContentConfig';
 export * from './channelsApi';
+export * from './bucketsApi';
 export * from './chatApi';
 export * from './contactsApi';
 export * from './groupsApi';
diff --git a/packages/api/src/index.ts b/packages/api/src/index.ts
index f4cafb4316..54eda4baa3 100644
--- a/packages/api/src/index.ts
+++ b/packages/api/src/index.ts
@@ -28,6 +28,7 @@ export {
   type Scry,
 } from './http-api';
 export type { Contact, Group, Channel, Post } from './types/models';
+export * from './urbit/buckets';
 export type {
   AppReference,
   ChannelReference,
@@ -37,6 +38,7 @@ export type {
 export {
   checkNest,
   getChannelType,
+  isThirdPartyChannel,
   nestToFlag,
   whomIsDm,
   whomIsMultiDm,
diff --git a/packages/api/src/types/PostCollectionConfiguration.ts b/packages/api/src/types/PostCollectionConfiguration.ts
index b503809640..3b4f94c06a 100644
--- a/packages/api/src/types/PostCollectionConfiguration.ts
+++ b/packages/api/src/types/PostCollectionConfiguration.ts
@@ -38,6 +38,9 @@ export function layoutTypeFromChannel(
       case CollectionRendererId.gallery:
         return 'grid';
 
+      case CollectionRendererId.buckets:
+        return 'comfy-list-top-to-bottom';
+
       default:
         // fallthrough to legacy logic
         break;
@@ -65,6 +68,9 @@ export function layoutTypeFromChannel(
 
     case 'notes':
       return 'comfy-list-top-to-bottom';
+
+    case 'buckets':
+      return 'comfy-list-top-to-bottom';
   }
 }
 
@@ -198,6 +204,7 @@ export function configurationFromChannel(
       };
 
     case 'notes':
+    case 'buckets':
       return {
         includeDeletedPosts: false,
         postActionIds: [],
diff --git a/packages/api/src/types/models.ts b/packages/api/src/types/models.ts
index 9f67b3a74f..9f915dbdd6 100644
--- a/packages/api/src/types/models.ts
+++ b/packages/api/src/types/models.ts
@@ -49,7 +49,8 @@ export type ChannelType =
   | 'gallery'
   | 'dm'
   | 'groupDm'
-  | 'notes';
+  | 'notes'
+  | 'buckets';
 export type UnreadChannelType = 'channel' | 'dm';
 export type ActivityBucket = 'all' | 'mentions' | 'replies';
 export type PinType = 'group' | 'channel' | 'dm' | 'groupDm';
diff --git a/packages/api/src/urbit/buckets.ts b/packages/api/src/urbit/buckets.ts
new file mode 100644
index 0000000000..4dceaa9517
--- /dev/null
+++ b/packages/api/src/urbit/buckets.ts
@@ -0,0 +1,168 @@
+export type BucketsFlag = {
+  host: string;
+  name: string;
+};
+
+export type BucketsBucket = {
+  id: number;
+  title: string;
+  createdBy: string;
+  createdAt: number;
+  updatedBy: string;
+  updatedAt: number;
+};
+
+export type BucketsFile = {
+  mime: string;
+  size: number;
+  checksum: string | null;
+  objectKey: string;
+  objectUrl: string | null;
+  status: 'pending' | 'ready' | 'failed';
+};
+
+type BucketsEntryBase = {
+  id: number;
+  parentId: number | null;
+  name: string;
+  createdBy: string;
+  createdAt: number;
+  updatedBy: string;
+  updatedAt: number;
+};
+
+export type BucketsFolderEntry = BucketsEntryBase & {
+  kind: 'folder';
+};
+
+export type BucketsFileEntry = BucketsEntryBase & {
+  kind: 'file';
+  file: BucketsFile;
+};
+
+export type BucketsEntry = BucketsFolderEntry | BucketsFileEntry;
+
+export type BucketsUploadSession = {
+  id: string;
+  fileId: number;
+  requestedBy: string;
+  createdAt: number;
+  expiresAt: number;
+  status: 'pending' | 'complete' | 'failed';
+  error: string | null;
+};
+
+export type BucketsState = {
+  bucket: BucketsBucket;
+  group: BucketsFlag;
+  readers: string[];
+  writers: string[];
+  entries: BucketsEntry[];
+  sessions: BucketsUploadSession[];
+  revision: number;
+};
+
+export type BucketsSnapshot = {
+  flag: BucketsFlag;
+  state: BucketsState;
+};
+
+export type BucketsUpdate =
+  | { type: 'bucket-created'; bucket: BucketsBucket }
+  | { type: 'bucket-deleted' }
+  | { type: 'bucket-updated'; bucket: BucketsBucket }
+  | { type: 'writers-updated'; writers: string[] }
+  | { type: 'folder-created'; entry: BucketsFolderEntry }
+  | {
+      type: 'upload-begun';
+      session: BucketsUploadSession;
+      entry: BucketsFileEntry;
+    }
+  | {
+      type: 'upload-ready';
+      session: BucketsUploadSession;
+      entry: BucketsFileEntry;
+    }
+  | {
+      type: 'upload-failed';
+      session: BucketsUploadSession;
+      entry: BucketsFileEntry;
+    }
+  | { type: 'entry-updated'; entry: BucketsEntry }
+  | { type: 'entries-deleted'; ids: number[] };
+
+export type BucketsResponse =
+  | { type: 'snapshot'; flag: BucketsFlag; state: BucketsState }
+  | {
+      type: 'update';
+      flag: BucketsFlag;
+      revision: number;
+      actor: string;
+      update: BucketsUpdate;
+    };
+
+export type BucketsAction =
+  | {
+      type: 'create';
+      name: string;
+      title: string;
+      group: BucketsFlag;
+      readers: string[];
+      writers: string[];
+    }
+  | { type: 'delete-bucket'; flag: BucketsFlag }
+  | { type: 'set-title'; flag: BucketsFlag; title: string }
+  | { type: 'set-writers'; flag: BucketsFlag; writers: string[] }
+  | {
+      type: 'create-folder';
+      flag: BucketsFlag;
+      parentId: number | null;
+      name: string;
+    }
+  | {
+      type: 'begin-upload';
+      flag: BucketsFlag;
+      parentId: number | null;
+      name: string;
+      mime: string;
+      size: number;
+      checksum: string | null;
+      capability: string;
+    }
+  | {
+      type: 'finish-upload';
+      flag: BucketsFlag;
+      sessionId: string;
+      objectUrl: string;
+    }
+  | {
+      type: 'fail-upload';
+      flag: BucketsFlag;
+      sessionId: string;
+      reason: string;
+    }
+  | {
+      type: 'issue-read';
+      flag: BucketsFlag;
+      id: number;
+      capability: string;
+    }
+  | {
+      type: 'issue-delete';
+      flag: BucketsFlag;
+      id: number;
+      capability: string;
+    }
+  | { type: 'rename-entry'; flag: BucketsFlag; id: number; name: string }
+  | {
+      type: 'move-entry';
+      flag: BucketsFlag;
+      id: number;
+      parentId: number | null;
+    }
+  | {
+      type: 'delete-entry';
+      flag: BucketsFlag;
+      id: number;
+      recursive: boolean;
+    };
diff --git a/packages/api/src/urbit/channel.ts b/packages/api/src/urbit/channel.ts
index c0564f8acc..3f83bb286b 100644
--- a/packages/api/src/urbit/channel.ts
+++ b/packages/api/src/urbit/channel.ts
@@ -110,7 +110,7 @@ export type KindDataChat = {
 };
 
 export type KindData = KindDataDiary | KindDataChat | KindDataHeap;
-export type Kind = 'heap' | 'diary' | 'chat' | 'notes';
+export type Kind = 'heap' | 'diary' | 'chat' | 'notes' | 'buckets';
 
 export interface PostEssay {
   content: Story;
diff --git a/packages/api/src/urbit/index.ts b/packages/api/src/urbit/index.ts
index af280afdc1..5df73f38b7 100644
--- a/packages/api/src/urbit/index.ts
+++ b/packages/api/src/urbit/index.ts
@@ -3,6 +3,8 @@ import * as content from './content';
 import * as dms from './dms';
 import * as groups from './groups';
 
+export * from './buckets';
+
 // These re-exports are necessary in order to resolve overlaps between the below
 // types so that everything can fit in a single namespace.
 export type Ship = channel.Ship;
diff --git a/packages/api/src/urbit/utils.ts b/packages/api/src/urbit/utils.ts
index 91ada327e2..a521d5b0ef 100644
--- a/packages/api/src/urbit/utils.ts
+++ b/packages/api/src/urbit/utils.ts
@@ -13,8 +13,8 @@ import type * as ubg from './groups';
 
 const logger = createDevLogger('urbitUtils', false);
 
-type App = 'chat' | 'heap' | 'diary' | 'notes';
-const APP_PREFIXES = ['chat', 'heap', 'diary', 'notes'];
+type App = 'chat' | 'heap' | 'diary' | 'notes' | 'buckets';
+const APP_PREFIXES = ['chat', 'heap', 'diary', 'notes', 'buckets'];
 
 export function checkNest(nest: string): boolean {
   const parts = nest.split('/');
@@ -163,6 +163,8 @@ export function getChannelType(channelId: string) {
     return 'notebook';
   } else if (app === 'notes') {
     return 'notes';
+  } else if (app === 'buckets') {
+    return 'buckets';
   } else {
     return 'chat';
   }
@@ -179,6 +181,8 @@ export function getChannelKindFromType(
     return 'diary';
   } else if (type === 'notes') {
     return 'notes';
+  } else if (type === 'buckets') {
+    return 'buckets';
   } else {
     return 'chat';
   }
diff --git a/packages/app/features/buckets/BucketsLiveChannel.tsx b/packages/app/features/buckets/BucketsLiveChannel.tsx
new file mode 100644
index 0000000000..28847ec4ef
--- /dev/null
+++ b/packages/app/features/buckets/BucketsLiveChannel.tsx
@@ -0,0 +1,535 @@
+import type { BucketsEntry, BucketsFlag } from '@tloncorp/api';
+import * as db from '@tloncorp/shared/db';
+import { Text } from '@tloncorp/ui';
+import * as DocumentPicker from 'expo-document-picker';
+import * as ImagePicker from 'expo-image-picker';
+import { ReactElement, useMemo, useState } from 'react';
+import { Linking, useWindowDimensions } from 'react-native';
+
+import {
+  BucketFileViewer,
+  BucketItem,
+  BucketSearchResult,
+  BucketUploadCandidate,
+  BucketsHeaderActions,
+  BucketsNewSheet,
+  BucketsPane,
+  BucketsSearchScreen,
+  ChannelHeader,
+  ChannelHeaderItemsProvider,
+  ScreenHeader,
+  XStack,
+  YStack,
+  getBucketPreviewKind,
+  useCanWrite,
+  useCurrentUserId,
+  useIsWindowNarrow,
+  useRegisterChannelHeaderItem,
+} from '../../ui';
+import { imagePickerAssetsToBucketUploadCandidates } from './bucketMediaPicker';
+import {
+  formatBucketTimestamp,
+  formatFileSize,
+  useLiveBucket,
+} from './useLiveBucket';
+
+type SearchOrigin = {
+  activeFolderId: number | null;
+  selectedItemId: string | null;
+};
+
+function toItem(entry: BucketsEntry, entries: BucketsEntry[]): BucketItem {
+  if (entry.kind === 'folder') {
+    return {
+      author: entry.updatedBy,
+      id: String(entry.id),
+      itemCount: entries.filter((candidate) => candidate.parentId === entry.id)
+        .length,
+      kind: 'folder',
+      modifiedLabel: formatBucketTimestamp(entry.updatedAt),
+      name: entry.name,
+    };
+  }
+
+  return {
+    author: entry.updatedBy,
+    id: String(entry.id),
+    kind: 'file',
+    mimeType: entry.file.mime,
+    modifiedLabel: formatBucketTimestamp(entry.updatedAt),
+    name: entry.name,
+    previewUri:
+      entry.file.status === 'ready'
+        ? entry.file.objectUrl ?? undefined
+        : undefined,
+    sizeLabel: formatFileSize(entry.file.size),
+    uploadError:
+      entry.file.status === 'failed'
+        ? 'The object was not finalized'
+        : undefined,
+    uploadProgress: entry.file.status === 'pending' ? 0 : undefined,
+    uploadState:
+      entry.file.status === 'pending'
+        ? 'uploading'
+        : entry.file.status === 'failed'
+          ? 'failed'
+          : undefined,
+  };
+}
+
+function sortItems(items: BucketItem[]) {
+  return [...items].sort((left, right) => {
+    if (left.kind !== right.kind) return left.kind === 'folder' ? -1 : 1;
+    return left.name.localeCompare(right.name);
+  });
+}
+
+function pathLabelFor(
+  entry: BucketsEntry,
+  entries: BucketsEntry[],
+  rootLabel: string
+) {
+  const names: string[] = [];
+  let parentId = entry.parentId;
+  while (parentId !== null) {
+    const parent = entries.find((candidate) => candidate.id === parentId);
+    if (!parent) break;
+    names.unshift(parent.name);
+    parentId = parent.parentId;
+  }
+  return [rootLabel, ...names].join(' / ');
+}
+
+export function BucketsLiveChannel({
+  channel: providedChannel,
+  embedded = false,
+  flag,
+  viewport = 'responsive',
+}: {
+  channel?: db.Channel;
+  embedded?: boolean;
+  flag: BucketsFlag;
+  viewport?: 'mobile' | 'responsive';
+}) {
+  const { height: windowHeight } = useWindowDimensions();
+  const isWindowNarrow = useIsWindowNarrow();
+  const isMobileLayout = viewport === 'mobile' || isWindowNarrow;
+  const live = useLiveBucket(flag);
+  const [activeFolderId, setActiveFolderId] = useState<number | null>(null);
+  const [selectedItemId, setSelectedItemId] = useState<string | null>(null);
+  const [newSheetOpen, setNewSheetOpen] = useState(false);
+  const [searchOpen, setSearchOpen] = useState(false);
+  const [searchOrigin, setSearchOrigin] = useState<SearchOrigin | null>(null);
+  const [query, setQuery] = useState('');
+  const [previewItem, setPreviewItem] = useState<BucketItem | null>(null);
+  const [operationError, setOperationError] = useState<string | null>(null);
+  const [mediaLibraryPermissionStatus, requestMediaLibraryPermission] =
+    ImagePicker.useMediaLibraryPermissions();
+  const entries = useMemo(
+    () => live.snapshot?.state.entries ?? [],
+    [live.snapshot?.state.entries]
+  );
+  const suppressedIds = useMemo(
+    () =>
+      new Set(
+        live.uploads
+          .map((upload) => upload.serverEntryId)
+          .filter((id): id is number => id !== undefined)
+      ),
+    [live.uploads]
+  );
+  const serverEntries = useMemo(
+    () => entries.filter((entry) => !suppressedIds.has(entry.id)),
+    [entries, suppressedIds]
+  );
+  const rootLabel = live.snapshot?.state.bucket.title ?? 'Bucket';
+  const activeFolder = entries.find(
+    (entry) => entry.kind === 'folder' && entry.id === activeFolderId
+  );
+  const rootFolders = serverEntries.filter(
+    (entry) => entry.kind === 'folder' && entry.parentId === null
+  );
+  const visibleServerItems = serverEntries
+    .filter((entry) => entry.parentId === activeFolderId)
+    .map((entry) => toItem(entry, entries));
+  const visibleLocalItems = live.uploads
+    .filter((upload) => upload.parentId === activeFolderId)
+    .map((upload) => live.localItems.find((item) => item.id === upload.id))
+    .filter((item): item is BucketItem => item !== undefined);
+  const visibleItems = sortItems([...visibleLocalItems, ...visibleServerItems]);
+  const sidebarItems = sortItems(
+    rootFolders.map((entry) => toItem(entry, entries))
+  );
+  const allSearchResults = useMemo<BucketSearchResult[]>(
+    () =>
+      serverEntries.map((entry) => ({
+        ...toItem(entry, entries),
+        parentFolderId: entry.parentId === null ? null : String(entry.parentId),
+        pathLabel: pathLabelFor(entry, entries, rootLabel),
+      })),
+    [entries, rootLabel, serverEntries]
+  );
+  const normalizedQuery = query.trim().toLowerCase();
+  const searchResults = normalizedQuery
+    ? allSearchResults.filter((item) =>
+        [item.name, item.pathLabel, item.author, item.mimeType]
+          .filter(Boolean)
+          .join(' ')
+          .toLowerCase()
+          .includes(normalizedQuery)
+      )
+    : [];
+
+  const fallbackChannel = useMemo(
+    () =>
+      ({
+        description: '',
+        id: `buckets/${flag.host}/${flag.name}`,
+        title: rootLabel,
+        type: 'buckets',
+      }) as db.Channel,
+    [flag.host, flag.name, rootLabel]
+  );
+  const channel = providedChannel ?? fallbackChannel;
+  const currentUserId = useCurrentUserId();
+  const canEdit = useCanWrite(channel, currentUserId);
+
+  const reportOperation = async (operation: Promise<unknown>) => {
+    try {
+      setOperationError(null);
+      await operation;
+      await live.refresh();
+    } catch (cause) {
+      setOperationError(cause instanceof Error ? cause.message : String(cause));
+    }
+  };
+
+  const openItem = async (item: BucketItem) => {
+    if (item.kind === 'folder') {
+      setActiveFolderId(Number(item.id));
+      setSelectedItemId(null);
+      return;
+    }
+    setSelectedItemId(item.id);
+    let previewUri = item.previewUri;
+    if (!previewUri) {
+      try {
+        setOperationError(null);
+        previewUri = await live.readUrl(Number(item.id));
+      } catch (cause) {
+        setOperationError(
+          cause instanceof Error ? cause.message : String(cause)
+        );
+        return;
+      }
+    }
+
+    const readableItem = { ...item, previewUri };
+    setPreviewItem(readableItem);
+    if (
+      getBucketPreviewKind(readableItem) === 'text' &&
+      !readableItem.textContent
+    ) {
+      try {
+        const response = await fetch(previewUri);
+        if (!response.ok) return;
+        const textContent = await response.text();
+        setPreviewItem((current) =>
+          current?.id === item.id ? { ...current, textContent } : current
+        );
+      } catch {
+        // The viewer can still offer the external open action.
+      }
+    }
+  };
+
+  const chooseUploads = async () => {
+    const result = await DocumentPicker.getDocumentAsync({
+      copyToCacheDirectory: true,
+      multiple: true,
+      type: '*/*',
+    });
+    if (!result.assets?.length) return;
+    const candidates: BucketUploadCandidate[] = result.assets.map((asset) => ({
+      mimeType: asset.mimeType ?? undefined,
+      name: asset.name,
+      size: asset.size ?? -1,
+      uri: asset.uri,
+    }));
+    live.addUploads(candidates, activeFolderId);
+  };
+
+  const choosePhotos = async () => {
+    try {
+      setOperationError(null);
+      if (mediaLibraryPermissionStatus?.granted === false) {
+        const permissionResult = await requestMediaLibraryPermission();
+        if (!permissionResult.granted) {
+          setOperationError(
+            'Photo library access is required to choose photos.'
+          );
+          return;
+        }
+      }
+
+      const result = await ImagePicker.launchImageLibraryAsync({
+        allowsEditing: false,
+        allowsMultipleSelection: true,
+        exif: false,
+        mediaTypes: ['images', 'videos'],
+        orderedSelection: true,
+        quality: 1,
+        selectionLimit: 0,
+        shouldDownloadFromNetwork: true,
+      });
+      if (result.canceled || !result.assets.length) return;
+
+      live.addUploads(
+        imagePickerAssetsToBucketUploadCandidates(result.assets),
+        activeFolderId
+      );
+    } catch (cause) {
+      setOperationError(cause instanceof Error ? cause.message : String(cause));
+    }
+  };
+
+  const openSearch = () => {
+    setSearchOrigin({ activeFolderId, selectedItemId });
+    setSearchOpen(true);
+    setQuery('');
+  };
+
+  const closeSearch = () => {
+    if (searchOrigin) {
+      setActiveFolderId(searchOrigin.activeFolderId);
+      setSelectedItemId(searchOrigin.selectedItemId);
+    }
+    setSearchOrigin(null);
+    setSearchOpen(false);
+    setQuery('');
+  };
+
+  const openSearchResult = (result: BucketSearchResult) => {
+    setSearchOrigin((current) => current ?? { activeFolderId, selectedItemId });
+    if (result.kind === 'folder') {
+      setActiveFolderId(Number(result.id));
+      setSelectedItemId(null);
+    } else {
+      setActiveFolderId(
+        result.parentFolderId === null ? null : Number(result.parentFolderId)
+      );
+      setSelectedItemId(result.id);
+    }
+    setSearchOpen(false);
+  };
+
+  const goBack = () => {
+    if (searchOrigin) {
+      setSearchOpen(true);
+      return;
+    }
+    if (activeFolder) {
+      setActiveFolderId(activeFolder.parentId);
+      setSelectedItemId(null);
+    }
+  };
+
+  const paneProps = {
+    canEdit,
+    currentFolder: isMobileLayout ? undefined : activeFolder?.name,
+    items: visibleItems,
+    rootLabel,
+    selectedItemId,
+    state: live.loading ? ('loading' as const) : ('populated' as const),
+    onCancelUpload: (item: BucketItem) => void live.cancelUpload(item.id),
+    onDeleteItem: (item: BucketItem) =>
+      void reportOperation(
+        live.deleteEntry(Number(item.id), item.kind === 'folder')
+      ),
+    onDownloadItem: (item: BucketItem) => {
+      void live
+        .readUrl(Number(item.id))
+        .then((url) => Linking.openURL(url))
+        .catch((cause) =>
+          setOperationError(
+            cause instanceof Error ? cause.message : String(cause)
+          )
+        );
+    },
+    onFilesDropped: (files: BucketUploadCandidate[]) =>
+      live.addUploads(files, activeFolderId),
+    onOpenItem: (item: BucketItem) => void openItem(item),
+    onRetryUpload: (item: BucketItem) => void live.retryUpload(item.id),
+  };
+
+  const newSheet = (
+    <BucketsNewSheet
+      open={newSheetOpen}
+      onNewFolder={(name) =>
+        void reportOperation(live.createFolder(activeFolderId, name))
+      }
+      onOpenChange={setNewSheetOpen}
+      onChoosePhotos={() => void choosePhotos()}
+      onUploadFiles={() => void chooseUploads()}
+    />
+  );
+
+  const errorMessage = operationError ?? live.error;
+
+  return (
+    <YStack
+      width="100%"
+      height={embedded ? '100%' : windowHeight}
+      backgroundColor="$background"
+    >
+      <MaybeChannelHeaderItemsProvider embedded={embedded}>
+        {previewItem?.previewUri ? (
+          <BucketFileViewer
+            item={{
+              name: previewItem.name,
+              mimeType: previewItem.mimeType,
+              sizeLabel: previewItem.sizeLabel,
+              textContent: previewItem.textContent,
+              uri: previewItem.previewUri,
+            }}
+            onClose={() => setPreviewItem(null)}
+            onOpenExternally={() =>
+              void Linking.openURL(previewItem.previewUri!)
+            }
+          />
+        ) : searchOpen ? (
+          <BucketsSearchScreen
+            bucketTitle={rootLabel}
+            query={query}
+            results={searchResults}
+            onChangeQuery={setQuery}
+            onClose={closeSearch}
+            onOpenResult={openSearchResult}
+          />
+        ) : isMobileLayout ? (
+          <YStack flex={1} width="100%" height="100%">
+            <RegisteredLiveHeaderActions
+              canEdit={canEdit}
+              showSearch={embedded}
+              onNew={() => setNewSheetOpen(true)}
+              onSearch={openSearch}
+            />
+            {!embedded ? (
+              <ChannelHeader
+                channel={channel}
+                description=""
+                goBack={goBack}
+                goToSearch={openSearch}
+                hideIdentity
+                preferProvidedTitle
+                showSearchButton
+                title={activeFolder?.name ?? rootLabel}
+              />
+            ) : null}
+            {errorMessage ? <LiveError message={errorMessage} /> : null}
+            <BucketsPane {...paneProps} layout="stack" />
+            {newSheet}
+          </YStack>
+        ) : (
+          <XStack flex={1} width="100%" height="100%">
+            <YStack
+              width={325}
+              height="100%"
+              backgroundColor="$background"
+              borderRightColor="$border"
+              borderRightWidth={1}
+            >
+              <ScreenHeader borderBottom title={rootLabel} />
+              <BucketsPane
+                canEdit={canEdit}
+                items={sidebarItems}
+                layout="takeover"
+                rootLabel={rootLabel}
+                selectedItemId={
+                  rootFolders.some((folder) => folder.id === activeFolderId)
+                    ? String(activeFolderId)
+                    : null
+                }
+                state={live.loading ? 'loading' : 'populated'}
+                onOpenItem={(item) => void openItem(item)}
+              />
+            </YStack>
+            <YStack flex={1} minWidth={0} backgroundColor="$background">
+              <ScreenHeader
+                borderBottom
+                rightControls={
+                  <BucketsHeaderActions
+                    canEdit={canEdit}
+                    onNew={() => setNewSheetOpen(true)}
+                    onSearch={openSearch}
+                  />
+                }
+                showSubtitle
+                subtitle="Bucket"
+                title={rootLabel}
+                useHorizontalTitleLayout
+              />
+              {errorMessage ? <LiveError message={errorMessage} /> : null}
+              <BucketsPane {...paneProps} layout="stack" />
+              {newSheet}
+            </YStack>
+          </XStack>
+        )}
+      </MaybeChannelHeaderItemsProvider>
+    </YStack>
+  );
+}
+
+function LiveError({ message }: { message: string }) {
+  return (
+    <YStack
+      backgroundColor="$negativeBackground"
+      paddingHorizontal="$l"
+      paddingVertical="$m"
+    >
+      <Text color="$negativeActionText" size="$label/m">
+        {message}
+      </Text>
+    </YStack>
+  );
+}
+
+function RegisteredLiveHeaderActions({
+  canEdit,
+  onNew,
+  onSearch,
+  showSearch,
+}: {
+  canEdit: boolean;
+  onNew: () => void;
+  onSearch: () => void;
+  showSearch: boolean;
+}) {
+  const actions = useMemo(
+    () => (
+      <BucketsHeaderActions
+        canEdit={canEdit}
+        onNew={onNew}
+        onSearch={onSearch}
+        showSearch={showSearch}
+      />
+    ),
+    [canEdit, onNew, onSearch, showSearch]
+  );
+  useRegisterChannelHeaderItem(actions);
+  return null;
+}
+
+function MaybeChannelHeaderItemsProvider({
+  children,
+  embedded,
+}: {
+  children: ReactElement;
+  embedded: boolean;
+}) {
+  return embedded ? (
+    children
+  ) : (
+    <ChannelHeaderItemsProvider>{children}</ChannelHeaderItemsProvider>
+  );
+}
diff --git a/packages/app/features/buckets/bucketMediaPicker.ts b/packages/app/features/buckets/bucketMediaPicker.ts
new file mode 100644
index 0000000000..39c9431e99
--- /dev/null
+++ b/packages/app/features/buckets/bucketMediaPicker.ts
@@ -0,0 +1,49 @@
+import type { ImagePickerAsset } from 'expo-image-picker';
+
+import type { BucketUploadCandidate } from '../../ui';
+import { getFileSize } from '../../utils/files';
+
+function getAssetSize(asset: ImagePickerAsset) {
+  if (asset.fileSize != null) return asset.fileSize;
+  if (asset.file) return asset.file.size;
+
+  try {
+    return getFileSize(asset.uri) ?? -1;
+  } catch {
+    return -1;
+  }
+}
+
+function fallbackMediaName(asset: ImagePickerAsset, index: number) {
+  const uriName = asset.uri.split('/').pop()?.split(/[?#]/)[0]?.trim();
+  if (uriName) return uriName;
+
+  const mimeSubtype = asset.mimeType?.split('/')[1]?.toLowerCase();
+  const extension =
+    mimeSubtype === 'jpeg'
+      ? 'jpg'
+      : mimeSubtype === 'quicktime'
+        ? 'mov'
+        : mimeSubtype;
+  const isVideo =
+    asset.type === 'video' ||
+    asset.type === 'pairedVideo' ||
+    asset.mimeType?.startsWith('video/');
+
+  return `${isVideo ? 'video' : 'photo'}-${index + 1}.${extension ?? (isVideo ? 'mov' : 'jpg')}`;
+}
+
+export function imagePickerAssetsToBucketUploadCandidates(
+  assets: ImagePickerAsset[]
+): BucketUploadCandidate[] {
+  return assets.map((asset, index) => ({
+    file: asset.file,
+    mimeType: asset.mimeType ?? asset.file?.type ?? undefined,
+    name:
+      asset.fileName?.trim() ||
+      asset.file?.name ||
+      fallbackMediaName(asset, index),
+    size: getAssetSize(asset),
+    uri: asset.uri,
+  }));
+}
diff --git a/packages/app/features/buckets/bucketUploadTask.native.ts b/packages/app/features/buckets/bucketUploadTask.native.ts
new file mode 100644
index 0000000000..925b95f9f4
--- /dev/null
+++ b/packages/app/features/buckets/bucketUploadTask.native.ts
@@ -0,0 +1,49 @@
+import * as FileSystem from 'expo-file-system/legacy';
+
+import type { CreateBucketUploadTask } from './bucketUploadTask.types';
+
+export const createBucketUploadTask: CreateBucketUploadTask = (
+  uploadUrl,
+  candidate,
+  headers,
+  onProgress
+) => {
+  if (!candidate.uri) {
+    return {
+      cancel: async () => {},
+      upload: Promise.reject(
+        new Error('This file does not have a local upload URI')
+      ),
+    };
+  }
+
+  const task = FileSystem.createUploadTask(
+    uploadUrl,
+    candidate.uri,
+    {
+      headers,
+      httpMethod: 'PUT',
+      uploadType: FileSystem.FileSystemUploadType.BINARY_CONTENT,
+    },
+    ({ totalBytesExpectedToSend, totalBytesSent }) => {
+      if (totalBytesExpectedToSend > 0) {
+        onProgress(
+          Math.round((totalBytesSent / totalBytesExpectedToSend) * 100)
+        );
+      }
+    }
+  );
+
+  return {
+    cancel: () => task.cancelAsync(),
+    upload: task.uploadAsync().then((response) => {
+      if (!response) {
+        throw new Error('Object upload was cancelled');
+      }
+      if (response.status < 200 || response.status >= 300) {
+        throw new Error(`Object upload failed (${response.status})`);
+      }
+      onProgress(100);
+    }),
+  };
+};
diff --git a/packages/app/features/buckets/bucketUploadTask.ts b/packages/app/features/buckets/bucketUploadTask.ts
new file mode 100644
index 0000000000..5ae5a4e06f
--- /dev/null
+++ b/packages/app/features/buckets/bucketUploadTask.ts
@@ -0,0 +1,64 @@
+import type { CreateBucketUploadTask } from './bucketUploadTask.types';
+
+export const createBucketUploadTask: CreateBucketUploadTask = (
+  uploadUrl,
+  candidate,
+  headers,
+  onProgress
+) => {
+  let request: XMLHttpRequest | null = null;
+  const abortController = new AbortController();
+
+  const upload = (async () => {
+    const body =
+      candidate.file ??
+      (candidate.uri
+        ? await fetch(candidate.uri, { signal: abortController.signal }).then(
+            (response) => {
+              if (!response.ok) {
+                throw new Error(`Could not read file (${response.status})`);
+              }
+              return response.blob();
+            }
+          )
+        : null);
+
+    if (!body) {
+      throw new Error('This file does not have an upload source');
+    }
+
+    await new Promise<void>((resolve, reject) => {
+      const xhr = new XMLHttpRequest();
+      request = xhr;
+      xhr.open('PUT', uploadUrl);
+      Object.entries(headers).forEach(([name, value]) => {
+        if (name.toLowerCase() === 'content-length') return;
+        xhr.setRequestHeader(name, value);
+      });
+      xhr.upload.onprogress = (event) => {
+        if (event.lengthComputable && event.total > 0) {
+          onProgress(Math.round((event.loaded / event.total) * 100));
+        }
+      };
+      xhr.onerror = () => reject(new Error('Object upload failed'));
+      xhr.onabort = () => reject(new Error('Upload cancelled'));
+      xhr.onload = () => {
+        if (xhr.status >= 200 && xhr.status < 300) {
+          onProgress(100);
+          resolve();
+        } else {
+          reject(new Error(`Object upload failed (${xhr.status})`));
+        }
+      };
+      xhr.send(body);
+    });
+  })();
+
+  return {
+    upload,
+    cancel: async () => {
+      abortController.abort();
+      request?.abort();
+    },
+  };
+};
diff --git a/packages/app/features/buckets/bucketUploadTask.types.ts b/packages/app/features/buckets/bucketUploadTask.types.ts
new file mode 100644
index 0000000000..dd664f6c0d
--- /dev/null
+++ b/packages/app/features/buckets/bucketUploadTask.types.ts
@@ -0,0 +1,13 @@
+import type { BucketUploadCandidate } from '../../ui';
+
+export type BucketUploadTask = {
+  cancel: () => Promise<void>;
+  upload: Promise<void>;
+};
+
+export type CreateBucketUploadTask = (
+  uploadUrl: string,
+  candidate: BucketUploadCandidate,
+  headers: Record<string, string>,
+  onProgress: (progress: number) => void
+) => BucketUploadTask;
diff --git a/packages/app/features/buckets/useLiveBucket.ts b/packages/app/features/buckets/useLiveBucket.ts
new file mode 100644
index 0000000000..ad7098fe62
--- /dev/null
+++ b/packages/app/features/buckets/useLiveBucket.ts
@@ -0,0 +1,639 @@
+import {
+  BucketsEntry,
+  BucketsFileEntry,
+  BucketsFlag,
+  BucketsResponse,
+  BucketsSnapshot,
+  bucketsFlagKey,
+  formatBucketsChannelId,
+  getBuckets,
+  getCurrentUserId,
+  sendBucketsAction,
+  subscribeToBuckets,
+} from '@tloncorp/api';
+import {
+  BucketsBrokerError,
+  brokerRequiredHeaders,
+  canFallBackFromBucketsBroker,
+  cancelBucketUpload,
+  completeBucketUpload,
+  createBucketCapability,
+  deleteBucketObject,
+  getMemexUpload,
+  grantBucketRead,
+  grantBucketUpload,
+  retryBucketUpload,
+} from '@tloncorp/shared';
+import * as db from '@tloncorp/shared/db';
+import { useCallback, useEffect, useMemo, useRef, useState } from 'react';
+
+import type { BucketItem, BucketUploadCandidate } from '../../ui';
+import { createBucketUploadTask } from './bucketUploadTask';
+import type { BucketUploadTask } from './bucketUploadTask.types';
+
+type LocalUpload = {
+  brokerBytesUploaded?: boolean;
+  brokerReservationId?: string;
+  candidate: BucketUploadCandidate;
+  capability?: string;
+  error?: string;
+  id: string;
+  parentId: number | null;
+  progress: number;
+  serverEntryId?: number;
+  sessionId?: string;
+  state: 'queued' | 'uploading' | 'failed';
+};
+
+function matchesFlag(left: BucketsFlag, right: BucketsFlag) {
+  return bucketsFlagKey(left) === bucketsFlagKey(right);
+}
+
+function upsertEntry(entries: BucketsEntry[], entry: BucketsEntry) {
+  const currentIndex = entries.findIndex(
+    (candidate) => candidate.id === entry.id
+  );
+  if (currentIndex === -1) return [...entries, entry];
+  return entries.map((candidate) =>
+    candidate.id === entry.id ? entry : candidate
+  );
+}
+
+function reduceBucketResponse(
+  current: BucketsSnapshot | null,
+  response: BucketsResponse
+): BucketsSnapshot | null {
+  if (response.type === 'snapshot') {
+    return { flag: response.flag, state: response.state };
+  }
+  if (!current || response.revision <= current.state.revision) {
+    return current;
+  }
+
+  const update = response.update;
+  if (update.type === 'bucket-deleted') return null;
+
+  let entries = current.state.entries;
+  let sessions = current.state.sessions;
+  let bucket = current.state.bucket;
+  let writers = current.state.writers ?? current.state.readers;
+
+  switch (update.type) {
+    case 'bucket-created':
+    case 'bucket-updated':
+      bucket = update.bucket;
+      break;
+    case 'writers-updated':
+      writers = update.writers;
+      break;
+    case 'folder-created':
+    case 'entry-updated':
+      entries = upsertEntry(entries, update.entry);
+      break;
+    case 'upload-begun':
+    case 'upload-ready':
+    case 'upload-failed':
+      entries = upsertEntry(entries, update.entry);
+      sessions = [
+        ...sessions.filter((session) => session.id !== update.session.id),
+        update.session,
+      ];
+      break;
+    case 'entries-deleted':
+      entries = entries.filter((entry) => !update.ids.includes(entry.id));
+      sessions = sessions.filter(
+        (session) => !update.ids.includes(session.fileId)
+      );
+      break;
+  }
+
+  return {
+    ...current,
+    state: {
+      ...current.state,
+      bucket,
+      entries,
+      revision: response.revision,
+      sessions,
+      writers,
+    },
+  };
+}
+
+function errorMessage(cause: unknown) {
+  return cause instanceof Error ? cause.message : String(cause);
+}
+
+function delay(milliseconds: number) {
+  return new Promise((resolve) => setTimeout(resolve, milliseconds));
+}
+
+async function waitForBrokerCapability<T>(operation: () => Promise<T>) {
+  let lastError: unknown;
+  for (let attempt = 0; attempt < 40; attempt += 1) {
+    try {
+      return await operation();
+    } catch (cause) {
+      lastError = cause;
+      if (
+        !(cause instanceof BucketsBrokerError) ||
+        cause.status !== 403 ||
+        cause.code !== 'capability_denied'
+      ) {
+        throw cause;
+      }
+      await delay(250);
+    }
+  }
+  throw lastError;
+}
+
+export function useLiveBucket(requestedFlag: BucketsFlag) {
+  const flag = useMemo(
+    () => ({ host: requestedFlag.host, name: requestedFlag.name }),
+    [requestedFlag.host, requestedFlag.name]
+  );
+  const flagKey = bucketsFlagKey(flag);
+  const [snapshot, setSnapshot] = useState<BucketsSnapshot | null>(null);
+  const [loading, setLoading] = useState(true);
+  const [error, setError] = useState<string | null>(null);
+  const [uploads, setUploads] = useState<LocalUpload[]>([]);
+  const snapshotRef = useRef<BucketsSnapshot | null>(null);
+  const tasksRef = useRef(new Map<string, BucketUploadTask>());
+  const cancelledRef = useRef(new Set<string>());
+
+  const commitSnapshot = useCallback((next: BucketsSnapshot | null) => {
+    snapshotRef.current = next;
+    setSnapshot(next);
+    if (next) {
+      const channelId = formatBucketsChannelId(next.flag);
+      void db.updateChannel({
+        id: channelId,
+        readerRoles: next.state.readers.map((roleId) => ({
+          channelId,
+          roleId,
+        })),
+        writerRoles: (next.state.writers ?? next.state.readers).map(
+          (roleId) => ({
+            channelId,
+            roleId,
+          })
+        ),
+      });
+    }
+  }, []);
+
+  const selectSnapshot = useCallback(
+    (snapshots: BucketsSnapshot[]) =>
+      snapshots.find((candidate) => matchesFlag(candidate.flag, flag)) ?? null,
+    [flag]
+  );
+
+  const refresh = useCallback(async () => {
+    const next = selectSnapshot(await getBuckets());
+    commitSnapshot(next);
+    return next;
+  }, [commitSnapshot, selectSnapshot]);
+
+  useEffect(() => {
+    let active = true;
+    let stopSubscription: (() => Promise<void>) | undefined;
+    const uploadTasks = tasksRef.current;
+
+    const start = async () => {
+      try {
+        stopSubscription = await subscribeToBuckets((response) => {
+          if (!active || !matchesFlag(response.flag, flag)) return;
+          const next = reduceBucketResponse(snapshotRef.current, response);
+          commitSnapshot(next);
+          setLoading(false);
+        });
+        if (!active) {
+          await stopSubscription();
+          return;
+        }
+        const next = await refresh();
+        if (active) {
+          setLoading(false);
+          setError(next ? null : `Bucket ${flagKey} was not found`);
+        }
+      } catch (cause) {
+        if (active) {
+          setError(errorMessage(cause));
+          setLoading(false);
+        }
+      }
+    };
+
+    void start();
+    return () => {
+      active = false;
+      if (stopSubscription) void stopSubscription();
+      uploadTasks.forEach((task) => void task.cancel());
+      uploadTasks.clear();
+    };
+  }, [commitSnapshot, flag, flagKey, refresh]);
+
+  const updateLocalUpload = useCallback(
+    (id: string, patch: Partial<LocalUpload>) => {
+      setUploads((current) =>
+        current.map((upload) =>
+          upload.id === id ? { ...upload, ...patch } : upload
+        )
+      );
+    },
+    []
+  );
+
+  const waitForSession = useCallback(
+    async (
+      candidate: BucketUploadCandidate,
+      parentId: number | null,
+      priorSessionIds: Set<string>
+    ) => {
+      for (let attempt = 0; attempt < 40; attempt += 1) {
+        const next = selectSnapshot(await getBuckets());
+        if (next) commitSnapshot(next);
+        const entry = next?.state.entries.find(
+          (candidateEntry): candidateEntry is BucketsFileEntry =>
+            candidateEntry.kind === 'file' &&
+            candidateEntry.name === candidate.name &&
+            candidateEntry.parentId === parentId &&
+            next.state.sessions.some(
+              (session) =>
+                session.fileId === candidateEntry.id &&
+                !priorSessionIds.has(session.id)
+            )
+        );
+        const session = next?.state.sessions.find(
+          (candidateSession) =>
+            candidateSession.fileId === entry?.id &&
+            !priorSessionIds.has(candidateSession.id)
+        );
+        if (entry && session) return { entry, session };
+        await delay(250);
+      }
+      throw new Error('The ship did not start the upload in time');
+    },
+    [commitSnapshot, selectSnapshot]
+  );
+
+  const runUpload = useCallback(
+    async (upload: LocalUpload) => {
+      const { candidate, id, parentId } = upload;
+      let sessionId = upload.sessionId;
+      let serverEntryId = upload.serverEntryId;
+      let brokerReservationId = upload.brokerReservationId;
+      let brokerBytesUploaded = upload.brokerBytesUploaded ?? false;
+      let brokerCompleted = false;
+
+      try {
+        if (candidate.size < 0) {
+          throw new Error('The file size could not be determined');
+        }
+        const mimeType = candidate.mimeType ?? 'application/octet-stream';
+        let privateGrant:
+          | Awaited<ReturnType<typeof grantBucketUpload>>
+          | undefined;
+        let legacyGrant: Awaited<ReturnType<typeof getMemexUpload>> | undefined;
+
+        if (brokerReservationId && sessionId && serverEntryId) {
+          updateLocalUpload(id, {
+            error: undefined,
+            progress: brokerBytesUploaded ? 96 : 5,
+            state: 'uploading',
+          });
+          if (!brokerBytesUploaded) {
+            privateGrant = await retryBucketUpload(brokerReservationId);
+          }
+        } else {
+          const current = snapshotRef.current ?? (await refresh());
+          if (!current) throw new Error(`Bucket ${flagKey} was not found`);
+          const priorSessionIds = new Set(
+            current.state.sessions.map((session) => session.id)
+          );
+          const capability = createBucketCapability();
+
+          updateLocalUpload(id, {
+            capability,
+            error: undefined,
+            progress: 1,
+            state: 'uploading',
+          });
+          await sendBucketsAction({
+            type: 'begin-upload',
+            checksum: null,
+            capability,
+            flag,
+            mime: mimeType,
+            name: candidate.name,
+            parentId,
+            size: candidate.size,
+          });
+          const begun = await waitForSession(
+            candidate,
+            parentId,
+            priorSessionIds
+          );
+          sessionId = begun.session.id;
+          serverEntryId = begun.entry.id;
+          updateLocalUpload(id, { progress: 3, serverEntryId, sessionId });
+
+          if (cancelledRef.current.has(id)) {
+            throw new Error('Upload cancelled');
+          }
+
+          try {
+            privateGrant = await waitForBrokerCapability(() =>
+              grantBucketUpload(capability, flag.host)
+            );
+          } catch (cause) {
+            if (!canFallBackFromBucketsBroker(cause)) throw cause;
+          }
+
+          legacyGrant = privateGrant
+            ? undefined
+            : await getMemexUpload({
+                contentLength: candidate.size,
+                contentType: mimeType,
+                fileName: `${getCurrentUserId().replace(/^~/, '')}/buckets/${flag.name}/${Date.now()}-${candidate.name.replace(/[/\\]/g, '-')}`,
+              });
+          brokerReservationId = privateGrant?.reservationId;
+          updateLocalUpload(id, { brokerReservationId, progress: 5 });
+        }
+
+        if (!brokerBytesUploaded) {
+          const task = createBucketUploadTask(
+            privateGrant?.uploadUrl ?? legacyGrant!.uploadUrl,
+            candidate,
+            privateGrant
+              ? brokerRequiredHeaders(privateGrant)
+              : {
+                  'Cache-Control': 'public, max-age=3600',
+                  'Content-Type': mimeType,
+                },
+            (progress) =>
+              updateLocalUpload(id, {
+                progress: Math.max(5, Math.round(5 + progress * 0.9)),
+              })
+          );
+          tasksRef.current.set(id, task);
+          await task.upload;
+          tasksRef.current.delete(id);
+          brokerBytesUploaded = Boolean(brokerReservationId);
+          updateLocalUpload(id, { brokerBytesUploaded });
+        }
+
+        if (cancelledRef.current.has(id)) {
+          throw new Error('Upload cancelled');
+        }
+        if (!sessionId) {
+          throw new Error('The upload session was lost');
+        }
+        updateLocalUpload(id, { progress: 96 });
+        if (brokerReservationId) {
+          await completeBucketUpload(brokerReservationId);
+          brokerCompleted = true;
+        } else {
+          await sendBucketsAction({
+            type: 'finish-upload',
+            flag,
+            objectUrl: legacyGrant!.hostedUrl,
+            sessionId,
+          });
+        }
+        updateLocalUpload(id, { progress: 100 });
+        await refresh();
+        setUploads((currentUploads) =>
+          currentUploads.filter((candidateUpload) => candidateUpload.id !== id)
+        );
+      } catch (cause) {
+        tasksRef.current.delete(id);
+        if (sessionId && !brokerReservationId && !brokerCompleted) {
+          await sendBucketsAction({
+            type: 'fail-upload',
+            flag,
+            reason: errorMessage(cause),
+            sessionId,
+          }).catch(() => undefined);
+        }
+        if (!cancelledRef.current.has(id)) {
+          updateLocalUpload(id, {
+            error: errorMessage(cause),
+            brokerBytesUploaded,
+            brokerReservationId,
+            progress: 0,
+            serverEntryId,
+            sessionId,
+            state: 'failed',
+          });
+        }
+      }
+    },
+    [flag, flagKey, refresh, updateLocalUpload, waitForSession]
+  );
+
+  const addUploads = useCallback(
+    (candidates: BucketUploadCandidate[], parentId: number | null) => {
+      const now = Date.now();
+      candidates.forEach((candidate, index) => {
+        const upload: LocalUpload = {
+          candidate,
+          id: `local-upload-${now}-${index}`,
+          parentId,
+          progress: 0,
+          state: 'queued',
+        };
+        setUploads((current) => [...current, upload]);
+        void runUpload(upload);
+      });
+    },
+    [runUpload]
+  );
+
+  const cancelUpload = useCallback(
+    async (id: string) => {
+      cancelledRef.current.add(id);
+      await tasksRef.current
+        .get(id)
+        ?.cancel()
+        .catch(() => undefined);
+      tasksRef.current.delete(id);
+      const upload = uploads.find((candidate) => candidate.id === id);
+      if (upload?.sessionId) {
+        await sendBucketsAction({
+          type: 'fail-upload',
+          flag,
+          reason: 'Cancelled',
+          sessionId: upload.sessionId,
+        }).catch(() => undefined);
+      }
+      if (upload?.brokerReservationId) {
+        await cancelBucketUpload(upload.brokerReservationId).catch(
+          () => undefined
+        );
+      }
+      if (upload?.serverEntryId) {
+        await sendBucketsAction({
+          type: 'delete-entry',
+          flag,
+          id: upload.serverEntryId,
+          recursive: false,
+        }).catch(() => undefined);
+      }
+      setUploads((current) =>
+        current.filter((candidate) => candidate.id !== id)
+      );
+      void refresh();
+    },
+    [flag, refresh, uploads]
+  );
+
+  const retryUpload = useCallback(
+    async (id: string) => {
+      const upload = uploads.find((candidate) => candidate.id === id);
+      if (!upload) return;
+      cancelledRef.current.delete(id);
+      const isPrivateRetry = Boolean(
+        upload.brokerReservationId && upload.sessionId && upload.serverEntryId
+      );
+      if (!isPrivateRetry && upload.serverEntryId) {
+        await sendBucketsAction({
+          type: 'delete-entry',
+          flag,
+          id: upload.serverEntryId,
+          recursive: false,
+        }).catch(() => undefined);
+      }
+      const next = {
+        ...upload,
+        error: undefined,
+        brokerBytesUploaded: isPrivateRetry
+          ? upload.brokerBytesUploaded
+          : undefined,
+        brokerReservationId: isPrivateRetry
+          ? upload.brokerReservationId
+          : undefined,
+        capability: isPrivateRetry ? upload.capability : undefined,
+        progress: 0,
+        serverEntryId: isPrivateRetry ? upload.serverEntryId : undefined,
+        sessionId: isPrivateRetry ? upload.sessionId : undefined,
+        state: 'queued' as const,
+      };
+      setUploads((current) =>
+        current.map((candidate) => (candidate.id === id ? next : candidate))
+      );
+      void runUpload(next);
+    },
+    [flag, runUpload, uploads]
+  );
+
+  const localItems = useMemo<BucketItem[]>(
+    () =>
+      uploads.map((upload) => ({
+        author: snapshot?.state.bucket.updatedBy ?? '',
+        id: upload.id,
+        kind: 'file',
+        mimeType: upload.candidate.mimeType,
+        modifiedLabel: upload.state === 'failed' ? 'Failed' : 'Uploading',
+        name: upload.candidate.name,
+        sizeLabel: formatFileSize(upload.candidate.size),
+        uploadError: upload.error,
+        uploadProgress: upload.progress,
+        uploadState: upload.state,
+      })),
+    [snapshot?.state.bucket.updatedBy, uploads]
+  );
+
+  return {
+    addUploads,
+    cancelUpload,
+    createFolder: (parentId: number | null, name: string) =>
+      sendBucketsAction({ type: 'create-folder', flag, name, parentId }),
+    deleteEntry: async (id: number, recursive: boolean) => {
+      const current = snapshotRef.current;
+      const root = current?.state.entries.find((entry) => entry.id === id);
+      const ids = new Set<number>([id]);
+      if (root?.kind === 'folder' && recursive && current) {
+        let changed = true;
+        while (changed) {
+          changed = false;
+          current.state.entries.forEach((entry) => {
+            if (entry.parentId !== null && ids.has(entry.parentId)) {
+              if (!ids.has(entry.id)) changed = true;
+              ids.add(entry.id);
+            }
+          });
+        }
+      }
+      const privateFiles = current?.state.entries.filter(
+        (entry): entry is BucketsFileEntry =>
+          ids.has(entry.id) &&
+          entry.kind === 'file' &&
+          entry.file.status === 'ready' &&
+          !entry.file.objectUrl
+      );
+      for (const entry of privateFiles ?? []) {
+        const capability = createBucketCapability();
+        await sendBucketsAction({
+          type: 'issue-delete',
+          capability,
+          flag,
+          id: entry.id,
+        });
+        await waitForBrokerCapability(() =>
+          deleteBucketObject(capability, flag.host, entry.file.objectKey)
+        );
+      }
+      return sendBucketsAction({ type: 'delete-entry', flag, id, recursive });
+    },
+    error,
+    loading,
+    localItems,
+    readUrl: async (id: number) => {
+      const entry = snapshotRef.current?.state.entries.find(
+        (candidate) => candidate.id === id
+      );
+      if (!entry || entry.kind !== 'file' || entry.file.status !== 'ready') {
+        throw new Error('This file is not ready to open');
+      }
+      if (entry.file.objectUrl) return entry.file.objectUrl;
+      const capability = createBucketCapability();
+      await sendBucketsAction({
+        type: 'issue-read',
+        capability,
+        flag,
+        id,
+      });
+      const grant = await waitForBrokerCapability(() =>
+        grantBucketRead(capability, flag.host, entry.file.objectKey)
+      );
+      return grant.readUrl;
+    },
+    refresh,
+    retryUpload,
+    snapshot,
+    uploads,
+  };
+}
+
+export function formatFileSize(size: number) {
+  if (size < 0) return 'Unknown size';
+  if (size < 1024) return `${size} B`;
+  if (size < 1024 * 1024) return `${Math.round(size / 1024)} KB`;
+  if (size < 1024 * 1024 * 1024) {
+    return `${(size / (1024 * 1024)).toFixed(1)} MB`;
+  }
+  return `${(size / (1024 * 1024 * 1024)).toFixed(1)} GB`;
+}
+
+export function formatBucketTimestamp(timestamp: number) {
+  const milliseconds =
+    timestamp < 1_000_000_000_000 ? timestamp * 1000 : timestamp;
+  const elapsed = Math.max(0, Date.now() - milliseconds);
+  if (elapsed < 60_000) return 'Just now';
+  if (elapsed < 3_600_000) return `${Math.floor(elapsed / 60_000)} min ago`;
+  if (elapsed < 86_400_000) return `${Math.floor(elapsed / 3_600_000)} hr ago`;
+  if (elapsed < 172_800_000) return 'Yesterday';
+  return new Date(milliseconds).toLocaleDateString();
+}
diff --git a/packages/app/features/groups/CreateChannelPermissionsScreen.tsx b/packages/app/features/groups/CreateChannelPermissionsScreen.tsx
index b41ccf4d03..8ec0b8de3f 100644
--- a/packages/app/features/groups/CreateChannelPermissionsScreen.tsx
+++ b/packages/app/features/groups/CreateChannelPermissionsScreen.tsx
@@ -5,8 +5,8 @@ import {
   NOTES_PERMISSIONS_COMPAT_NOTICE,
   notesPermissionsCompatActive,
 } from '@tloncorp/shared/logic/notesPermissionsCompat';
-import { Button, Text } from '@tloncorp/ui';
-import { useCallback, useEffect } from 'react';
+import { Button, Text, useToast } from '@tloncorp/ui';
+import { useCallback, useEffect, useState } from 'react';
 import { FormProvider, useForm } from 'react-hook-form';
 import { useSafeAreaInsets } from 'react-native-safe-area-context';
 import { ScrollView, View, YStack } from 'tamagui';
@@ -30,6 +30,8 @@ export function CreateChannelPermissionsScreen() {
       RouteProp<GroupSettingsStackParamList, 'CreateChannelPermissions'>
     >();
   const insets = useSafeAreaInsets();
+  const toast = useToast();
+  const [isCreating, setIsCreating] = useState(false);
 
   const { groupId, channelTitle, channelType, createdRoleId, selectedRoleIds } =
     route.params;
@@ -87,7 +89,7 @@ export function CreateChannelPermissionsScreen() {
     });
   }, [navigation, groupId, form, channelTitle, channelType]);
 
-  const handleCreateChannel = useCallback(() => {
+  const handleCreateChannel = useCallback(async () => {
     const {
       readers: currentReaders,
       writers: currentWriters,
@@ -100,17 +102,28 @@ export function CreateChannelPermissionsScreen() {
       channelType
     );
 
-    createChannel({
-      groupId,
-      title: channelTitle,
-      channelType,
-      readers: finalReaders,
-      writers: finalWriters,
-    });
+    try {
+      setIsCreating(true);
+      await createChannel({
+        groupId,
+        title: channelTitle,
+        channelType,
+        readers: finalReaders,
+        writers: finalWriters,
+      });
 
-    // Navigate back to channel list
-    navigation.navigate('ManageChannels', { groupId }, { pop: true });
-  }, [navigation, groupId, form, channelTitle, channelType]);
+      navigation.navigate('ManageChannels', { groupId }, { pop: true });
+    } catch (cause) {
+      toast({
+        message:
+          cause instanceof Error
+            ? cause.message
+            : 'Could not create this channel',
+      });
+    } finally {
+      setIsCreating(false);
+    }
+  }, [navigation, groupId, form, channelTitle, channelType, toast]);
 
   if (!group) {
     return null;
@@ -142,6 +155,8 @@ export function CreateChannelPermissionsScreen() {
               preset="primary"
               onPress={handleCreateChannel}
               label="Create channel"
+              loading={isCreating}
+              disabled={isCreating}
             />
           </YStack>
         </ScrollView>
diff --git a/packages/app/features/top/ChannelDetailsScreen.tsx b/packages/app/features/top/ChannelDetailsScreen.tsx
index 9471425fee..95cf29a682 100644
--- a/packages/app/features/top/ChannelDetailsScreen.tsx
+++ b/packages/app/features/top/ChannelDetailsScreen.tsx
@@ -71,7 +71,9 @@ export function ChannelDetailsScreenView({
         return group
           ? group.channels?.length === 1
             ? `Group with ${group.members?.length ?? 0} members`
-            : `Channel in ${groupTitle}`
+            : channel.type === 'buckets'
+              ? `Bucket in ${groupTitle}`
+              : `Channel in ${groupTitle}`
           : '';
     }
   }, [channel, group, groupTitle]);
@@ -138,7 +140,7 @@ export function ChannelDetailsScreenView({
           paddingHorizontal="$xl"
           marginVertical="$l"
         >
-          {group ? (
+          {group && channel.type !== 'buckets' ? (
             <ListItem.GroupIcon model={group} size="$5xl" />
           ) : (
             <ListItem.ChannelIcon model={channel} size="$5xl" />
diff --git a/packages/app/features/top/ChannelScreen.tsx b/packages/app/features/top/ChannelScreen.tsx
index 09841566b8..64efc4bd0d 100644
--- a/packages/app/features/top/ChannelScreen.tsx
+++ b/packages/app/features/top/ChannelScreen.tsx
@@ -108,7 +108,7 @@ export default function ChannelScreen(props: Props) {
   );
 
   useEffect(() => {
-    if (!channelIsPending) {
+    if (!channelIsPending && channel?.type !== 'buckets') {
       if (channelThreadAbortController.current) {
         channelThreadAbortController.current.abort();
       }
@@ -118,7 +118,7 @@ export default function ChannelScreen(props: Props) {
         abortSignal: channelThreadAbortController.current?.signal,
       });
     }
-  }, [channelIsPending, channelId]);
+  }, [channel?.type, channelIsPending, channelId]);
 
   // for the unread channel divider, we care about the unread state when you enter but don't want it to update over
   // time
@@ -199,7 +199,8 @@ export default function ChannelScreen(props: Props) {
     loadOlder,
     isLoading: isLoadingPosts,
   } = store.useChannelPosts({
-    enabled: !!channel && !channel?.isPendingChannel,
+    enabled:
+      !!channel && !channel.isPendingChannel && channel.type !== 'buckets',
     channelId: currentChannelId,
     count: 30,
     filterDeleted: !channelConfiguration?.includeDeletedPosts,
@@ -334,13 +335,13 @@ export default function ChannelScreen(props: Props) {
   );
 
   const handleMarkRead = useCallback(async () => {
-    if (channel && !channel.isPendingChannel) {
+    if (channel && !channel.isPendingChannel && channel.type !== 'buckets') {
       store.markChannelRead({
         id: channel.id,
         groupId: channel.groupId ?? undefined,
       });
     }
-  }, [channel?.type, channel?.id, channel?.groupId]);
+  }, [channel]);
 
   const handlePressInvite = useCallback(
     (groupId: string) => {
diff --git a/packages/app/features/top/chatDetails.tsx b/packages/app/features/top/chatDetails.tsx
index 1cbe4bf48e..f3a3aa02af 100644
--- a/packages/app/features/top/chatDetails.tsx
+++ b/packages/app/features/top/chatDetails.tsx
@@ -427,6 +427,7 @@ export function SettingsSection({
   }, [entityType, group, channel, onPressChatVolume]);
 
   const actions = useMemo(() => {
+    const supportsNotifications = channel?.type !== 'buckets';
     const notificationAction: SettingsActionProps = {
       title: 'Notifications',
       description: notificationTitle,
@@ -437,7 +438,7 @@ export function SettingsSection({
     };
 
     if (!currentUserIsAdmin) {
-      return [notificationAction];
+      return supportsNotifications ? [notificationAction] : [];
     }
 
     if (entityType === 'group' && group) {
@@ -472,7 +473,7 @@ export function SettingsSection({
       const isPrivate =
         (channel.readerRoles?.length ?? 0) > 0 ||
         (channel.writerRoles?.length ?? 0) > 0;
-      return [
+      const channelActions: SettingsActionProps[] = [
         {
           title: 'Permissions',
           endValue: isPrivate ? 'Custom' : 'Public',
@@ -480,8 +481,9 @@ export function SettingsSection({
           disabled: !actionsEnabled,
           onPress: handlePressEditChannelPrivacy,
         },
-        notificationAction,
       ];
+      if (supportsNotifications) channelActions.push(notificationAction);
+      return channelActions;
     }
 
     return [notificationAction];
@@ -568,7 +570,9 @@ export function LeaveActionsSection({
   const channelActionCapabilities = getChannelActionCapabilities(channel);
   const canLeave =
     !isHost && (entityType !== 'channel' || channelActionCapabilities.canLeave);
-  const canDelete = isHost || (entityType === 'channel' && currentUserIsAdmin);
+  const canDelete =
+    (entityType !== 'channel' || channelActionCapabilities.canDelete) &&
+    (isHost || (entityType === 'channel' && currentUserIsAdmin));
 
   const chatTitle =
     entityType === 'group'
diff --git a/packages/app/fixtures/BucketsChannel.fixture.tsx b/packages/app/fixtures/BucketsChannel.fixture.tsx
index 68a1b4099e..d055a5a791 100644
--- a/packages/app/fixtures/BucketsChannel.fixture.tsx
+++ b/packages/app/fixtures/BucketsChannel.fixture.tsx
@@ -1,8 +1,10 @@
 import * as db from '@tloncorp/shared/db';
 import * as DocumentPicker from 'expo-document-picker';
+import * as ImagePicker from 'expo-image-picker';
 import { useEffect, useMemo, useState } from 'react';
 import { Linking, useWindowDimensions } from 'react-native';
 
+import { imagePickerAssetsToBucketUploadCandidates } from '../features/buckets/bucketMediaPicker';
 import {
   BucketFileViewer,
   BucketItem,
@@ -163,7 +165,7 @@ const sampleUploadQueue: BucketItem[] = [
 
 const fakeChannel = {
   id: 'buckets/~zod/project-files',
-  type: 'gallery',
+  type: 'buckets',
   title: 'Project Files',
   description: '',
 } as db.Channel;
@@ -380,10 +382,27 @@ function BucketsFixture({
         mimeType: asset.mimeType ?? undefined,
         name: asset.name,
         size: asset.size ?? -1,
+        uri: asset.uri,
       }))
     );
   };
 
+  const choosePhotos = async () => {
+    const result = await ImagePicker.launchImageLibraryAsync({
+      allowsEditing: false,
+      allowsMultipleSelection: true,
+      exif: false,
+      mediaTypes: ['images', 'videos'],
+      orderedSelection: true,
+      quality: 1,
+      selectionLimit: 0,
+      shouldDownloadFromNetwork: true,
+    });
+    if (result.canceled || !result.assets.length) return;
+
+    addUploads(imagePickerAssetsToBucketUploadCandidates(result.assets));
+  };
+
   const cancelUpload = (item: BucketItem) => {
     setLocalFiles((current) => ({
       ...current,
@@ -518,6 +537,7 @@ function BucketsFixture({
               <BucketsPane {...paneProps} layout="stack" />
               <BucketsNewSheet
                 open={newSheetOpen}
+                onChoosePhotos={() => void choosePhotos()}
                 onNewFolder={addFolder}
                 onOpenChange={setNewSheetOpen}
                 onUploadFiles={() => void chooseUploads()}
@@ -566,6 +586,7 @@ function BucketsFixture({
                 <BucketsPane {...paneProps} layout="stack" />
                 <BucketsNewSheet
                   open={newSheetOpen}
+                  onChoosePhotos={() => void choosePhotos()}
                   onNewFolder={addFolder}
                   onOpenChange={setNewSheetOpen}
                   onUploadFiles={() => void chooseUploads()}
diff --git a/packages/app/fixtures/BucketsChannel.live.fixture.tsx b/packages/app/fixtures/BucketsChannel.live.fixture.tsx
new file mode 100644
index 0000000000..2f744dc0da
--- /dev/null
+++ b/packages/app/fixtures/BucketsChannel.live.fixture.tsx
@@ -0,0 +1,65 @@
+import { Text } from '@tloncorp/ui';
+
+import { BucketsLiveChannel } from '../features/buckets/BucketsLiveChannel';
+import {
+  DEFAULT_SHIP_LOGIN_ACCESS_CODE,
+  DEFAULT_SHIP_LOGIN_URL,
+} from '../lib/envVars';
+import { YStack } from '../ui';
+import { FixtureUrbitClient, FixtureWrapper } from './FixtureWrapper';
+
+function shipFromUrl(shipUrl: string) {
+  try {
+    return `~${new URL(shipUrl).hostname.split('.')[0]}`;
+  } catch {
+    return '';
+  }
+}
+
+const shipName = shipFromUrl(DEFAULT_SHIP_LOGIN_URL);
+const urbitClient: FixtureUrbitClient | undefined =
+  shipName && DEFAULT_SHIP_LOGIN_URL && DEFAULT_SHIP_LOGIN_ACCESS_CODE
+    ? {
+        accessCode: DEFAULT_SHIP_LOGIN_ACCESS_CODE,
+        shipName,
+        shipUrl: DEFAULT_SHIP_LOGIN_URL,
+      }
+    : undefined;
+
+function LiveHostedBucket() {
+  if (!urbitClient) {
+    return (
+      <FixtureWrapper fillHeight fillWidth>
+        <YStack
+          flex={1}
+          alignItems="center"
+          justifyContent="center"
+          padding="$2xl"
+        >
+          <Text color="$primaryText" size="$label/l" textAlign="center">
+            Start Cosmos with the hosted ship login environment variables to use
+            this fixture.
+          </Text>
+        </YStack>
+      </FixtureWrapper>
+    );
+  }
+
+  return (
+    <FixtureWrapper
+      fillHeight
+      fillWidth
+      currentUserId={shipName}
+      urbitClient={urbitClient}
+    >
+      <BucketsLiveChannel
+        flag={{ host: shipName, name: 'live-canary' }}
+        viewport="responsive"
+      />
+    </FixtureWrapper>
+  );
+}
+
+export default {
+  'Live hosted ship': <LiveHostedBucket />,
+};
diff --git a/packages/app/fixtures/FixtureWrapper.tsx b/packages/app/fixtures/FixtureWrapper.tsx
index 21b2b1aad4..feca58ba8d 100644
--- a/packages/app/fixtures/FixtureWrapper.tsx
+++ b/packages/app/fixtures/FixtureWrapper.tsx
@@ -4,10 +4,15 @@ import {
   NavigationContainer,
   NavigationIndependentTree,
 } from '@react-navigation/native';
-import { internalConfigureClient } from '@tloncorp/api';
+import {
+  configureClient,
+  internalConfigureClient,
+  internalRemoveClient,
+} from '@tloncorp/api';
 import { QueryClientProvider, queryClient } from '@tloncorp/shared';
 import { type PropsWithChildren, useEffect, useState } from 'react';
 import { useFixtureSelect } from 'react-cosmos/client';
+import { Text as NativeText } from 'react-native';
 import { GestureHandlerRootView } from 'react-native-gesture-handler';
 import { useSafeAreaInsets } from 'react-native-safe-area-context';
 
@@ -22,6 +27,13 @@ import {
   View,
 } from '../ui';
 import { initialContacts } from './fakeData';
+import { createFixtureUrbitFetch } from './fixtureUrbitFetch';
+
+export type FixtureUrbitClient = {
+  shipName: string;
+  shipUrl: string;
+  accessCode: string;
+};
 
 type FixtureWrapperProps = PropsWithChildren<{
   fillWidth?: boolean;
@@ -31,17 +43,56 @@ type FixtureWrapperProps = PropsWithChildren<{
   backgroundColor?: ColorProp;
   innerBackgroundColor?: ColorProp;
   safeArea?: boolean;
+  currentUserId?: string;
+  urbitClient?: FixtureUrbitClient;
 }>;
 
-function MockedUrbitClientProvider({ children }: PropsWithChildren<object>) {
+function FixtureUrbitClientProvider({
+  children,
+  urbitClient,
+}: PropsWithChildren<{ urbitClient?: FixtureUrbitClient }>) {
   const [ready, setReady] = useState(false);
+  const [error, setError] = useState<string | null>(null);
+
   useEffect(() => {
-    internalConfigureClient({
-      shipName: 'zod',
-      shipUrl: 'whitehouse.com',
-    });
-    setReady(true);
-  }, []);
+    let active = true;
+    internalRemoveClient();
+    setReady(false);
+    setError(null);
+
+    const setup = async () => {
+      try {
+        if (urbitClient) {
+          await configureClient({
+            fetchFn: createFixtureUrbitFetch(urbitClient.shipUrl),
+            shipName: urbitClient.shipName,
+            shipUrl: urbitClient.shipUrl,
+            getCode: async () => urbitClient.accessCode,
+          });
+        } else {
+          internalConfigureClient({
+            shipName: 'zod',
+            shipUrl: 'whitehouse.com',
+          });
+        }
+        if (active) setReady(true);
+      } catch (cause) {
+        if (active) {
+          setError(cause instanceof Error ? cause.message : String(cause));
+        }
+      }
+    };
+
+    void setup();
+    return () => {
+      active = false;
+      internalRemoveClient();
+    };
+  }, [urbitClient]);
+
+  if (error) {
+    return <NativeText>Could not connect to the ship: {error}</NativeText>;
+  }
 
   return <>{ready ? children : null}</>;
 }
@@ -51,9 +102,9 @@ export const FixtureWrapper = (props: FixtureWrapperProps) => {
     <ToastProvider>
       <NavigationIndependentTree>
         <NavigationContainer navigationInChildEnabled>
-          <MockedUrbitClientProvider>
+          <FixtureUrbitClientProvider urbitClient={props.urbitClient}>
             <InnerWrapper {...props} />
-          </MockedUrbitClientProvider>
+          </FixtureUrbitClientProvider>
         </NavigationContainer>
       </NavigationIndependentTree>
     </ToastProvider>
@@ -70,6 +121,7 @@ const InnerWrapper = ({
   backgroundColor,
   innerBackgroundColor,
   safeArea,
+  currentUserId = '~zod',
   children,
 }: FixtureWrapperProps) => {
   const insets = useSafeAreaInsets();
@@ -83,7 +135,7 @@ const InnerWrapper = ({
       <GestureHandlerRootView style={{ flex: 1 }}>
         <BottomSheetModalProvider>
           <AppDataContextProvider
-            currentUserId="~zod"
+            currentUserId={currentUserId}
             contacts={[...initialContacts]}
             branchDomain="test"
             branchKey="test"
diff --git a/packages/app/fixtures/fixtureUrbitFetch.native.ts b/packages/app/fixtures/fixtureUrbitFetch.native.ts
new file mode 100644
index 0000000000..9fd6c6824f
--- /dev/null
+++ b/packages/app/fixtures/fixtureUrbitFetch.native.ts
@@ -0,0 +1,58 @@
+import CookieManager from '@react-native-cookies/cookies';
+
+function proxyHeaders(headers: Headers, setCookie: string) {
+  return new Proxy(headers, {
+    get(target, property) {
+      if (property === 'get') {
+        return (name: string) =>
+          name.toLowerCase() === 'set-cookie' ? setCookie : target.get(name);
+      }
+      const value = Reflect.get(target, property, target);
+      return typeof value === 'function' ? value.bind(target) : value;
+    },
+  });
+}
+
+function proxyResponse(response: Response, setCookie: string) {
+  const headers = proxyHeaders(response.headers, setCookie);
+  return new Proxy(response, {
+    get(target, property) {
+      if (property === 'headers') return headers;
+      const value = Reflect.get(target, property, target);
+      return typeof value === 'function' ? value.bind(target) : value;
+    },
+  });
+}
+
+export function createFixtureUrbitFetch(shipUrl: string): typeof fetch {
+  const ship = new URL(shipUrl).hostname.split('.')[0];
+  const authCookieName = `urbauth-~${ship}`;
+
+  return async (input, init) => {
+    const headers = new Headers(init?.headers);
+    headers.delete('Cookie');
+    const response = await fetch(input, {
+      ...init,
+      credentials: undefined,
+      headers,
+    });
+    const url =
+      typeof input === 'string'
+        ? input
+        : input instanceof URL
+          ? input.toString()
+          : input.url;
+    if (!url.endsWith('/~/login') || !response.ok) return response;
+    const responseCookie = response.headers.get('set-cookie');
+
+    const cookies = await CookieManager.get(shipUrl);
+    if (responseCookie?.startsWith(`${authCookieName}=`)) return response;
+    const authCookie = cookies[authCookieName];
+    if (!authCookie) return response;
+
+    return proxyResponse(
+      response,
+      `${authCookie.name}=${authCookie.value}; Path=/; HttpOnly`
+    );
+  };
+}
diff --git a/packages/app/fixtures/fixtureUrbitFetch.ts b/packages/app/fixtures/fixtureUrbitFetch.ts
new file mode 100644
index 0000000000..83666659ef
--- /dev/null
+++ b/packages/app/fixtures/fixtureUrbitFetch.ts
@@ -0,0 +1,3 @@
+export function createFixtureUrbitFetch(_shipUrl: string): typeof fetch {
+  return fetch;
+}
diff --git a/packages/app/navigation/types.ts b/packages/app/navigation/types.ts
index 4a822d27a9..7c3e29dd91 100644
--- a/packages/app/navigation/types.ts
+++ b/packages/app/navigation/types.ts
@@ -248,7 +248,7 @@ export type RoleSelectionReturn =
       returnParams: {
         groupId: string;
         channelTitle: string;
-        channelType: 'chat' | 'notebook' | 'gallery' | 'notes';
+        channelType: 'chat' | 'notebook' | 'gallery' | 'notes' | 'buckets';
       };
     }
   | {
@@ -329,7 +329,7 @@ export type GroupSettingsStackParamList = {
   CreateChannelPermissions: {
     groupId: string;
     channelTitle: string;
-    channelType: 'chat' | 'notebook' | 'gallery' | 'notes';
+    channelType: 'chat' | 'notebook' | 'gallery' | 'notes' | 'buckets';
     createdRoleId?: string;
     selectedRoleIds?: string[];
   };
diff --git a/packages/app/ui/components/BucketsChannel/BucketsChannel.tsx b/packages/app/ui/components/BucketsChannel/BucketsChannel.tsx
index 32ae2129f0..189c80ea49 100644
--- a/packages/app/ui/components/BucketsChannel/BucketsChannel.tsx
+++ b/packages/app/ui/components/BucketsChannel/BucketsChannel.tsx
@@ -366,27 +366,29 @@ function BucketRow({
         action: () => onDownloadItem?.(item),
       },
     ],
-    canEdit && [
-      'neutral',
-      {
-        title: `Rename ${item.kind}`,
-        startIcon: 'EditList',
-        action: () => onRenameItem?.(item),
-      },
-      {
-        title: `Move ${item.kind}`,
-        startIcon: 'Folder',
-        action: () => onMoveItem?.(item),
-      },
-    ],
-    canEdit && [
-      'negative',
-      {
-        title: `Delete ${item.kind}`,
-        startIcon: 'Trash',
-        action: () => onDeleteItem?.(item),
-      },
-    ]
+    canEdit &&
+      (onRenameItem || onMoveItem) && [
+        'neutral',
+        onRenameItem && {
+          title: `Rename ${item.kind}`,
+          startIcon: 'EditList',
+          action: () => onRenameItem(item),
+        },
+        onMoveItem && {
+          title: `Move ${item.kind}`,
+          startIcon: 'Folder',
+          action: () => onMoveItem(item),
+        },
+      ],
+    canEdit &&
+      onDeleteItem && [
+        'negative',
+        {
+          title: `Delete ${item.kind}`,
+          startIcon: 'Trash',
+          action: () => onDeleteItem(item),
+        },
+      ]
   );
   const trigger = showOverflow ? (
     <OverflowTriggerButton
@@ -540,11 +542,13 @@ function BucketSearchRow({
 
 export function BucketsNewSheet({
   open,
+  onChoosePhotos,
   onNewFolder,
   onOpenChange,
   onUploadFiles,
 }: {
   open: boolean;
+  onChoosePhotos: () => void;
   onNewFolder: (name: string) => void;
   onOpenChange: (open: boolean) => void;
   onUploadFiles: () => void;
@@ -599,6 +603,17 @@ export function BucketsNewSheet({
                 }}
                 testID="BucketsUploadFilesAction"
               />
+              <ActionSheet.Action
+                action={{
+                  title: 'Choose photos',
+                  startIcon: 'Camera',
+                  action: () => {
+                    onOpenChange(false);
+                    onChoosePhotos();
+                  },
+                }}
+                testID="BucketsChoosePhotosAction"
+              />
               <ActionSheet.Action
                 action={{
                   title: 'New folder',
diff --git a/packages/app/ui/components/BucketsChannel/BucketsDropTarget.tsx b/packages/app/ui/components/BucketsChannel/BucketsDropTarget.tsx
index adc958afa4..d434894abe 100644
--- a/packages/app/ui/components/BucketsChannel/BucketsDropTarget.tsx
+++ b/packages/app/ui/components/BucketsChannel/BucketsDropTarget.tsx
@@ -18,6 +18,7 @@ export const BucketsDropTarget: BucketsDropTargetComponent = ({
   const handleDrop = useCallback(
     (files: File[]) => {
       const candidates: BucketUploadCandidate[] = files.map((file) => ({
+        file,
         mimeType: file.type || undefined,
         name: file.name,
         size: file.size,
diff --git a/packages/app/ui/components/BucketsChannel/BucketsDropTarget.types.ts b/packages/app/ui/components/BucketsChannel/BucketsDropTarget.types.ts
index c917eb3c3d..d677385d00 100644
--- a/packages/app/ui/components/BucketsChannel/BucketsDropTarget.types.ts
+++ b/packages/app/ui/components/BucketsChannel/BucketsDropTarget.types.ts
@@ -5,6 +5,8 @@ export type BucketUploadCandidate = {
   name: string;
   size: number;
   mimeType?: string;
+  uri?: string;
+  file?: File;
 };
 
 export type BucketsDropTargetComponent = ComponentType<
diff --git a/packages/app/ui/components/BucketsChannel/BucketsPostCollection.tsx b/packages/app/ui/components/BucketsChannel/BucketsPostCollection.tsx
new file mode 100644
index 0000000000..cfcd42a3ed
--- /dev/null
+++ b/packages/app/ui/components/BucketsChannel/BucketsPostCollection.tsx
@@ -0,0 +1,25 @@
+import { parseBucketsChannelId } from '@tloncorp/api';
+import { Text } from '@tloncorp/ui';
+import { forwardRef } from 'react';
+import { YStack } from 'tamagui';
+
+import { BucketsLiveChannel } from '../../../features/buckets/BucketsLiveChannel';
+import { usePostCollectionContext } from '../../contexts/postCollection';
+import { IPostCollectionView } from '../postCollectionViews/shared';
+
+export const BucketsPostCollection: IPostCollectionView = forwardRef(
+  function BucketsPostCollection() {
+    const { channel } = usePostCollectionContext();
+    const flag = parseBucketsChannelId(channel.id);
+
+    if (!flag) {
+      return (
+        <YStack flex={1} alignItems="center" justifyContent="center">
+          <Text color="$secondaryText">This Bucket address is invalid.</Text>
+        </YStack>
+      );
+    }
+
+    return <BucketsLiveChannel channel={channel} embedded flag={flag} />;
+  }
+);
diff --git a/packages/app/ui/components/Channel/ChannelHeader.tsx b/packages/app/ui/components/Channel/ChannelHeader.tsx
index 879a5b2059..26d4afe24e 100644
--- a/packages/app/ui/components/Channel/ChannelHeader.tsx
+++ b/packages/app/ui/components/Channel/ChannelHeader.tsx
@@ -168,6 +168,8 @@ export function ChannelHeader({
           return 'Notebook channel';
         case 'gallery':
           return 'Gallery channel';
+        case 'buckets':
+          return 'Bucket';
         default:
           return 'Channel';
       }
@@ -269,7 +271,8 @@ export function ChannelHeader({
       channel.type === 'chat' ||
       channel.type === 'notebook' ||
       channel.type === 'notes' ||
-      channel.type === 'gallery'
+      channel.type === 'gallery' ||
+      channel.type === 'buckets'
     ) {
       const channelType = getChannelTypeName(channel.type);
       return channelType;
@@ -359,7 +362,8 @@ export function ChannelHeader({
         channel.type === 'chat' ||
         channel.type === 'notebook' ||
         channel.type === 'notes' ||
-        channel.type === 'gallery') &&
+        channel.type === 'gallery' ||
+        channel.type === 'buckets') &&
       goToChatDetails
     ) {
       return goToChatDetails;
diff --git a/packages/app/ui/components/Channel/PostView.tsx b/packages/app/ui/components/Channel/PostView.tsx
index 85e02e0b36..6c84389bc8 100644
--- a/packages/app/ui/components/Channel/PostView.tsx
+++ b/packages/app/ui/components/Channel/PostView.tsx
@@ -50,6 +50,7 @@ export const PostView: RenderItemType = (props) => {
         return GalleryPost;
 
       case 'notes':
+      case 'buckets':
         // Notes channels are rendered entirely by the collection WebView; no
         // per-post content is shown, but we still need something to return.
         return ChatMessage;
diff --git a/packages/app/ui/components/Channel/index.tsx b/packages/app/ui/components/Channel/index.tsx
index fd27261b2b..a9d6e73deb 100644
--- a/packages/app/ui/components/Channel/index.tsx
+++ b/packages/app/ui/components/Channel/index.tsx
@@ -3,6 +3,7 @@ import {
   ChannelContentConfiguration,
   isDmChannelId,
   isGroupDmChannelId,
+  isThirdPartyChannel,
 } from '@tloncorp/api';
 import { JSONContent } from '@tloncorp/api/urbit';
 import {
@@ -407,7 +408,7 @@ export function Channel({
     hasChildThreadUnreadActivity,
   });
   const shouldShowPostLoading =
-    channel.type !== 'notes' && Boolean(isLoadingPosts);
+    !isThirdPartyChannel(channel.id) && Boolean(isLoadingPosts);
 
   useEffect(() => {
     const clearShowTimeout = () => {
@@ -657,7 +658,7 @@ export function Channel({
 
   usePrefillDraftFromShareIntent({
     channelId: channel.id,
-    disabled: !canWrite || !inView,
+    disabled: !canWrite || !inView || isThirdPartyChannel(channel.id),
     appendSharedTextToDraft,
     didProcessShareIntent: handleProcessedShareIntent,
   });
@@ -716,6 +717,7 @@ export function Channel({
             >
               <View backgroundColor={backgroundColor} flex={1}>
                 <FileDrop
+                  dropEnabled={channel.type !== 'buckets'}
                   flexDirection="column"
                   justifyContent="space-between"
                   width="100%"
diff --git a/packages/app/ui/components/FileDrop/FileDrop.native.tsx b/packages/app/ui/components/FileDrop/FileDrop.native.tsx
index 2ebac6da1c..ff638753d4 100644
--- a/packages/app/ui/components/FileDrop/FileDrop.native.tsx
+++ b/packages/app/ui/components/FileDrop/FileDrop.native.tsx
@@ -2,6 +2,9 @@ import { View } from 'tamagui';
 
 import { FileDropComponent } from './types';
 
-export const FileDrop: FileDropComponent = (props) => {
+export const FileDrop: FileDropComponent = ({
+  dropEnabled: _dropEnabled,
+  ...props
+}) => {
   return <View {...props} />;
 };
diff --git a/packages/app/ui/components/FileDrop/FileDrop.tsx b/packages/app/ui/components/FileDrop/FileDrop.tsx
index a064f4f7c4..0a95532cc7 100644
--- a/packages/app/ui/components/FileDrop/FileDrop.tsx
+++ b/packages/app/ui/components/FileDrop/FileDrop.tsx
@@ -8,6 +8,7 @@ import { getVideoPreviewData } from '../../utils/videoPreviewData';
 import { FileDropComponent } from './types';
 
 export const FileDrop: FileDropComponent = ({
+  dropEnabled = true,
   onAssetsDropped,
   children,
   ...props
@@ -48,6 +49,7 @@ export const FileDrop: FileDropComponent = ({
   const { getInputProps, getRootProps } = useDropzone({
     onDrop: handleDrop,
     noClick: true,
+    noDrag: !dropEnabled,
   });
 
   return (
diff --git a/packages/app/ui/components/FileDrop/types.ts b/packages/app/ui/components/FileDrop/types.ts
index 3d59d3d0c5..9b238b186a 100644
--- a/packages/app/ui/components/FileDrop/types.ts
+++ b/packages/app/ui/components/FileDrop/types.ts
@@ -4,6 +4,7 @@ import { View } from 'tamagui';
 
 export type FileDropComponent = ComponentType<
   {
+    dropEnabled?: boolean;
     onAssetsDropped: (files: Attachment.UploadIntent[]) => void;
   } & ComponentProps<typeof View>
 >;
diff --git a/packages/app/ui/components/ManageChannels/CreateChannelSheet.tsx b/packages/app/ui/components/ManageChannels/CreateChannelSheet.tsx
index 48f9f6b360..791c6a7cce 100644
--- a/packages/app/ui/components/ManageChannels/CreateChannelSheet.tsx
+++ b/packages/app/ui/components/ManageChannels/CreateChannelSheet.tsx
@@ -1,9 +1,13 @@
 import { useNavigation } from '@react-navigation/native';
 import { NativeStackNavigationProp } from '@react-navigation/native-stack';
-import { createChannel, useNotesDeskAvailable } from '@tloncorp/shared';
+import {
+  createChannel,
+  useBucketsDeskAvailable,
+  useNotesDeskAvailable,
+} from '@tloncorp/shared';
 import * as db from '@tloncorp/shared/db';
-import { Button } from '@tloncorp/ui';
-import { useCallback, useMemo } from 'react';
+import { Button, useToast } from '@tloncorp/ui';
+import { useCallback, useMemo, useState } from 'react';
 import { FormProvider, useForm, useWatch } from 'react-hook-form';
 import { YStack } from 'tamagui';
 
@@ -15,13 +19,19 @@ import * as Form from '../Form';
 import SystemNotices from '../SystemNotices';
 import { PrivateChannelToggle } from './ChannelPermissions';
 
-export type ChannelTypeName = 'chat' | 'notebook' | 'gallery' | 'notes';
+export type ChannelTypeName =
+  | 'chat'
+  | 'notebook'
+  | 'gallery'
+  | 'notes'
+  | 'buckets';
 
 // When the notes desk is installed, we offer 'Notebook' as the new
 // %notes-backed type and rename the legacy diary type to 'Bulletin'.
 // Without the notes desk, the legacy diary type keeps its 'Notebook' label.
 function buildChannelTypes(
-  notesAvailable: boolean
+  notesAvailable: boolean,
+  bucketsAvailable: boolean
 ): Form.ListItemInputOption<ChannelTypeName>[] {
   const chat: Form.ListItemInputOption<ChannelTypeName> = {
     title: 'Chat',
@@ -47,9 +57,16 @@ function buildChannelTypes(
     value: 'gallery',
     icon: 'ChannelGalleries',
   };
-  return notesAvailable
+  const buckets: Form.ListItemInputOption<ChannelTypeName> = {
+    title: 'Buckets',
+    subtitle: 'Shared files for members and agents',
+    value: 'buckets',
+    icon: 'Folder',
+  };
+  const channelTypes = notesAvailable
     ? [chat, notes, diary, gallery]
     : [chat, diary, gallery];
+  return bucketsAvailable ? [...channelTypes, buckets] : channelTypes;
 }
 
 interface CreateChannelFormSchema {
@@ -85,12 +102,16 @@ export function CreateChannelSheet({
   const { control, handleSubmit, watch, setValue } = form;
 
   const currentUserId = useCurrentUserId();
+  const toast = useToast();
+  const [isCreating, setIsCreating] = useState(false);
   const isGroupAdmin = useIsAdmin(group.id, currentUserId);
   const isNonHostAdmin = isGroupAdmin && !group.currentUserIsHost;
   const { data: notesAvailable = false } = useNotesDeskAvailable();
+  const { data: bucketsDeskAvailable = false } = useBucketsDeskAvailable();
+  const bucketsAvailable = bucketsDeskAvailable && group.currentUserIsHost;
   const channelTypes = useMemo(
-    () => buildChannelTypes(notesAvailable),
-    [notesAvailable]
+    () => buildChannelTypes(notesAvailable, bucketsAvailable),
+    [bucketsAvailable, notesAvailable]
   );
 
   const isPrivate = useWatch({ control, name: 'isPrivate' });
@@ -120,16 +141,28 @@ export function CreateChannelSheet({
 
   const handlePressSave = useCallback(
     async (data: CreateChannelFormSchema) => {
-      createChannel({
-        groupId: group.id,
-        title: data.title,
-        channelType: data.channelType,
-        readers: [],
-        writers: [],
-      });
-      onOpenChange(false);
+      try {
+        setIsCreating(true);
+        await createChannel({
+          groupId: group.id,
+          title: data.title,
+          channelType: data.channelType,
+          readers: [],
+          writers: [],
+        });
+        onOpenChange(false);
+      } catch (cause) {
+        toast({
+          message:
+            cause instanceof Error
+              ? cause.message
+              : 'Could not create this channel',
+        });
+      } finally {
+        setIsCreating(false);
+      }
     },
-    [group.id, onOpenChange]
+    [group.id, onOpenChange, toast]
   );
 
   return (
@@ -182,6 +215,8 @@ export function CreateChannelSheet({
                 isPrivate ? handlePressNext : handleSubmit(handlePressSave)
               }
               label={isPrivate ? 'Next' : 'Create channel'}
+              loading={isCreating}
+              disabled={isCreating}
               centered
             />
           </ActionSheet.FormBlock>
diff --git a/packages/app/ui/components/PostCollectionView.tsx b/packages/app/ui/components/PostCollectionView.tsx
index 89b5e93a2d..e7c10b0d36 100644
--- a/packages/app/ui/components/PostCollectionView.tsx
+++ b/packages/app/ui/components/PostCollectionView.tsx
@@ -18,6 +18,8 @@ function fallbackRendererIdForChannelType(
   switch (type) {
     case 'notes':
       return CollectionRendererId.notes;
+    case 'buckets':
+      return CollectionRendererId.buckets;
     default:
       return null;
   }
diff --git a/packages/app/ui/contexts/componentsKits/ComponentsKitProvider.tsx b/packages/app/ui/contexts/componentsKits/ComponentsKitProvider.tsx
index 0c52c73b0b..b610657b1e 100644
--- a/packages/app/ui/contexts/componentsKits/ComponentsKitProvider.tsx
+++ b/packages/app/ui/contexts/componentsKits/ComponentsKitProvider.tsx
@@ -5,6 +5,7 @@ import {
 } from '@tloncorp/shared';
 import { useMemo } from 'react';
 
+import { BucketsPostCollection } from '../../components/BucketsChannel/BucketsPostCollection';
 import { ChatMessage } from '../../components/ChatMessage';
 import { GalleryPost } from '../../components/GalleryPost';
 import { NotebookPost } from '../../components/NotebookPost';
@@ -24,18 +25,21 @@ import {
 } from './componentsKits';
 
 const EmptyNotesRenderer = () => null;
+const EmptyBucketsRenderer = () => null;
 
 const BUILTIN_CONTENT_RENDERERS: { [id: string]: RenderItemType } = {
   [PostContentRendererId.chat]: ChatMessage,
   [PostContentRendererId.gallery]: GalleryPost,
   [PostContentRendererId.notebook]: NotebookPost,
   [PostContentRendererId.notes]: EmptyNotesRenderer,
+  [PostContentRendererId.buckets]: EmptyBucketsRenderer,
 };
 const BUILTIN_DRAFT_INPUTS: { [id: string]: DraftInputRendererComponent } = {
   [DraftInputId.chat]: ChatInput,
   [DraftInputId.gallery]: GalleryInput,
   [DraftInputId.notebook]: NotebookInput,
   [DraftInputId.notes]: EmptyNotesRenderer,
+  [DraftInputId.buckets]: EmptyBucketsRenderer,
 };
 const BUILTIN_COLLECTION_RENDERERS: {
   [id in CollectionRendererId]: IPostCollectionView;
@@ -44,6 +48,7 @@ const BUILTIN_COLLECTION_RENDERERS: {
   [CollectionRendererId.gallery]: ListPostCollection,
   [CollectionRendererId.notebook]: ListPostCollection,
   [CollectionRendererId.notes]: NotesPostCollection,
+  [CollectionRendererId.buckets]: BucketsPostCollection,
 };
 
 export function ComponentsKitProvider({
diff --git a/packages/app/ui/utils/channelUtils.tsx b/packages/app/ui/utils/channelUtils.tsx
index 049f7a8674..18cd4da19d 100644
--- a/packages/app/ui/utils/channelUtils.tsx
+++ b/packages/app/ui/utils/channelUtils.tsx
@@ -96,15 +96,20 @@ export function useChatDescription(
 }
 
 export function getChannelActionCapabilities(channel?: db.Channel | null): {
+  canDelete: boolean;
   canLeave: boolean;
   deleteDescription: string;
 } {
   return {
-    canLeave: !!channel && channel.type !== 'notes',
+    canDelete: !!channel && channel.type !== 'buckets',
+    canLeave:
+      !!channel && channel.type !== 'notes' && channel.type !== 'buckets',
     deleteDescription:
       channel?.type === 'notes'
         ? 'This action cannot be undone. The notebook and its notes will be permanently deleted.'
-        : 'This action cannot be undone. All messages in this channel will be permanently deleted.',
+        : channel?.type === 'buckets'
+          ? 'Bucket deletion will be available once stored objects can be removed atomically.'
+          : 'This action cannot be undone. All messages in this channel will be permanently deleted.',
   };
 }
 
@@ -251,6 +256,8 @@ export function getChannelTypeIcon(type: db.Channel['type']): IconType {
       return 'ChannelNotebooks';
     case 'gallery':
       return 'ChannelGalleries';
+    case 'buckets':
+      return 'Folder';
     default:
       return 'ChannelTalk';
   }
diff --git a/packages/shared/src/store/channelActions.test.ts b/packages/shared/src/store/channelActions.test.ts
index 7040270302..3a8724d379 100644
--- a/packages/shared/src/store/channelActions.test.ts
+++ b/packages/shared/src/store/channelActions.test.ts
@@ -371,6 +371,78 @@ test('updateChannel saves notes readers without sending writer actions', async (
   });
 });
 
+test('createChannel creates a Bucket with independent reader and writer roles', async () => {
+  await insertGroup();
+  vi.spyOn(api, 'getCurrentUserId').mockReturnValue('~zod');
+  const sendBucketsAction = vi
+    .spyOn(api, 'sendBucketsAction')
+    .mockResolvedValue(1);
+  vi.spyOn(api, 'getGroup').mockResolvedValue({
+    id: groupId,
+    channels: [
+      {
+        id: 'buckets/~zod/project-files',
+        title: 'Project files',
+        type: 'buckets',
+        groupId,
+        currentUserIsMember: true,
+        currentUserIsHost: true,
+        readerRoles: [
+          {
+            channelId: 'buckets/~zod/project-files',
+            roleId: 'member',
+          },
+        ],
+      },
+    ],
+  } as unknown as db.Group);
+
+  const channel = await createChannel({
+    customSlug: 'project-files',
+    groupId,
+    title: 'Project files',
+    channelType: 'buckets',
+    readers: ['member'],
+    writers: ['editor'],
+  });
+
+  expect(sendBucketsAction).toHaveBeenCalledWith({
+    type: 'create',
+    group: { host: '~zod', name: 'stale-notify' },
+    name: 'project-files',
+    readers: ['member'],
+    title: 'Project files',
+    writers: ['editor'],
+  });
+  expect(channel).toMatchObject({
+    id: 'buckets/~zod/project-files',
+    type: 'buckets',
+  });
+  await expect(
+    db.getChannelWithRelations({ id: channel.id })
+  ).resolves.toMatchObject({
+    readerRoles: [{ channelId: channel.id, roleId: 'member' }],
+    writerRoles: [{ channelId: channel.id, roleId: 'editor' }],
+  });
+});
+
+test('createChannel rejects Bucket creation by a non-host admin', async () => {
+  vi.spyOn(api, 'getCurrentUserId').mockReturnValue('~solfer-magfed');
+  const sendBucketsAction = vi.spyOn(api, 'sendBucketsAction');
+
+  await expect(
+    createChannel({
+      customSlug: 'project-files',
+      groupId,
+      title: 'Project files',
+      channelType: 'buckets',
+    })
+  ).rejects.toThrow(
+    'Buckets can currently be created only by the host of this group'
+  );
+  expect(sendBucketsAction).not.toHaveBeenCalled();
+});
+
 test('joinGroupChannel routes notes channels through the notes API', async () => {
   const notesChannelId = 'notes/~zod/native-notes';
   await insertGroupAndChannel({ id: notesChannelId, type: 'notes' });
diff --git a/packages/shared/src/store/channelActions.ts b/packages/shared/src/store/channelActions.ts
index 9072e42c20..8ffce9073d 100644
--- a/packages/shared/src/store/channelActions.ts
+++ b/packages/shared/src/store/channelActions.ts
@@ -19,6 +19,8 @@ import { syncNotesNotebook } from './notesActions';
 const logger = createDevLogger('ChannelActions', false);
 const NOTES_CHANNEL_LISTING_ATTEMPTS = 5;
 const NOTES_CHANNEL_LISTING_DELAY_MS = 250;
+const BUCKETS_CHANNEL_LISTING_ATTEMPTS = 20;
+const BUCKETS_CHANNEL_LISTING_DELAY_MS = 250;
 
 class NotesChannelListingUnverifiedError extends Error {}
 
@@ -54,6 +56,16 @@ export async function createChannel({
     });
   }
 
+  if (channelType === 'buckets') {
+    return createBucketsChannel({
+      customSlug,
+      groupId,
+      readers,
+      title,
+      writers,
+    });
+  }
+
   const channelSlug = customSlug || getRandomId();
   const channelId = `${getChannelKindFromType(channelType)}/${currentUserId}/${channelSlug}`;
 
@@ -116,6 +128,103 @@ export async function createChannel({
   return newChannel;
 }
 
+async function createBucketsChannel({
+  customSlug,
+  groupId,
+  readers = [],
+  title,
+  writers = [],
+}: {
+  customSlug?: string;
+  groupId: string;
+  readers?: string[];
+  title: string;
+  writers?: string[];
+}): Promise<db.Channel> {
+  const currentUserId = api.getCurrentUserId();
+  const [groupHost, groupName, ...rest] = groupId.split('/');
+  if (!groupHost || !groupName || rest.length > 0) {
+    throw new Error(`Invalid group id: ${groupId}`);
+  }
+  if (groupHost !== currentUserId) {
+    throw new Error(
+      'Buckets can currently be created only by the host of this group'
+    );
+  }
+
+  const name = customSlug || getRandomId();
+  const flag: api.BucketsFlag = { host: currentUserId, name };
+  const channelId = api.formatBucketsChannelId(flag);
+  let created = false;
+
+  logger.trackEvent(
+    AnalyticsEvent.ActionCreateChannel,
+    logic.getModelAnalytics({
+      channel: { id: channelId, type: 'buckets' },
+      group: { id: groupId },
+    })
+  );
+
+  try {
+    await api.sendBucketsAction({
+      type: 'create',
+      group: { host: groupHost, name: groupName },
+      name,
+      readers,
+      title,
+      writers,
+    });
+    created = true;
+
+    const listedChannel = await waitForBucketsChannelListing(
+      groupId,
+      channelId
+    );
+    const newChannel: db.Channel = {
+      ...listedChannel,
+      contentConfiguration:
+        channelContentConfigurationForChannelType('buckets'),
+      type: 'buckets',
+      writerRoles: writers.map((roleId) => ({ channelId, roleId })),
+    };
+    await db.insertChannels([newChannel]);
+    await db.insertChannelPerms([{ channelId, readers, writers }]);
+    return newChannel;
+  } catch (e) {
+    await db.deleteChannels([channelId]).catch(() => undefined);
+    if (created) {
+      await api
+        .sendBucketsAction({ type: 'delete-bucket', flag })
+        .catch((rollbackError) =>
+          logger.error('Failed to roll back Bucket creation', rollbackError)
+        );
+    }
+    logger.error('Failed to add Buckets channel', e);
+    throw new Error('Failed to add Buckets channel to group');
+  }
+}
+
+async function waitForBucketsChannelListing(
+  groupId: string,
+  channelId: string
+) {
+  for (
+    let attempt = 1;
+    attempt <= BUCKETS_CHANNEL_LISTING_ATTEMPTS;
+    attempt += 1
+  ) {
+    const group = await api.getGroup(groupId).catch(() => null);
+    const listedChannel = group?.channels?.find(
+      (channel) => channel.id === channelId
+    );
+    if (listedChannel) return listedChannel;
+    if (attempt < BUCKETS_CHANNEL_LISTING_ATTEMPTS) {
+      await wait(BUCKETS_CHANNEL_LISTING_DELAY_MS);
+    }
+  }
+  throw new Error(`Bucket channel listing did not appear: ${channelId}`);
+}
+
 async function createNotesChannel({
   groupId,
   title,
@@ -280,6 +389,12 @@ function channelContentConfigurationForChannelType(
         defaultPostContentRenderer: api.PostContentRendererId.notes,
         defaultPostCollectionRenderer: api.CollectionRendererId.notes,
       };
+    case 'buckets':
+      return {
+        draftInput: api.DraftInputId.buckets,
+        defaultPostContentRenderer: api.PostContentRendererId.buckets,
+        defaultPostCollectionRenderer: api.CollectionRendererId.buckets,
+      };
   }
 
   throw new Error('Unknown channel type');
@@ -300,17 +415,23 @@ export async function deleteChannel({
     })
   );
 
+  const deletedChannel = await db.getChannel({ id: channelId });
+
   // optimistic update
   await db.deleteChannels([channelId]);
 
   try {
-    await api.deleteChannel({ channelId, groupId });
+    const bucketFlag = api.parseBucketsChannelId(channelId);
+    if (bucketFlag) {
+      await api.sendBucketsAction({ type: 'delete-bucket', flag: bucketFlag });
+    } else {
+      await api.deleteChannel({ channelId, groupId });
+    }
   } catch (e) {
     console.error('Failed to delete channel', e);
     // rollback optimistic update
-    const channel = await db.getChannel({ id: channelId });
-    if (channel) {
-      await db.insertChannels([channel]);
+    if (deletedChannel) {
+      await db.insertChannels([deletedChannel]);
     }
     return;
   }
@@ -420,6 +541,21 @@ export async function updateChannel({
       channelId: channel.id,
       channel: groupChannel,
     });
+    const bucketFlag = api.parseBucketsChannelId(channel.id);
+    if (bucketFlag) {
+      await api.sendBucketsAction({
+        type: 'set-title',
+        flag: bucketFlag,
+        title: channel.title ?? '',
+      });
+      await api.sendBucketsAction({
+        type: 'set-writers',
+        flag: bucketFlag,
+        writers,
+      });
+      logger.log('updated Bucket channel on server');
+      return;
+    }
     if (writersToAdd.length > 0) {
       logger.log('adding writers', writersToAdd);
       await api.addChannelWriters({
diff --git a/packages/shared/src/store/dbHooks.ts b/packages/shared/src/store/dbHooks.ts
index b3c2c5408b..9beec43df5 100644
--- a/packages/shared/src/store/dbHooks.ts
+++ b/packages/shared/src/store/dbHooks.ts
@@ -63,6 +63,23 @@ export const useNotesDeskAvailable = () => {
   });
 };
 
+// Probe %buckets once so channel creation only offers the type when the desk
+// is installed on the current ship.
+export const useBucketsDeskAvailable = () => {
+  return useQuery({
+    queryKey: ['bucketsDeskAvailable'],
+    queryFn: async () => {
+      try {
+        await api.getBuckets();
+        return true;
+      } catch (e) {
+        return false;
+      }
+    },
+    staleTime: 60_000,
+  });
+};
+
 export const useUnjoinedGroupChannels = (groupId: string) => {
   const deps = useKeyFromQueryDeps(db.getUnjoinedGroupChannels);
   return useQuery({
diff --git a/packages/shared/src/store/storage/bucketsBroker.test.ts b/packages/shared/src/store/storage/bucketsBroker.test.ts
new file mode 100644
index 0000000000..6171dba2ab
--- /dev/null
+++ b/packages/shared/src/store/storage/bucketsBroker.test.ts
@@ -0,0 +1,96 @@
+import { afterEach, describe, expect, test, vi } from 'vitest';
+
+import {
+  BucketsBrokerError,
+  canFallBackFromBucketsBroker,
+  completeBucketUpload,
+  grantBucketUpload,
+} from './bucketsBroker';
+
+afterEach(() => {
+  vi.unstubAllGlobals();
+});
+
+describe('Buckets broker client', () => {
+  test('exchanges a capability without including the sigil in the host', async () => {
+    const grant = {
+      objectId: 'object-1',
+      requiredHeaders: [['content-type', 'application/pdf']],
+      reservationId: 'reservation-1',
+      uploadExpiresAt: '2026-08-06T20:00:00Z',
+      uploadUrl: 'https://storage.test/upload',
+    };
+    const fetchMock = vi.fn().mockResolvedValue(
+      new Response(JSON.stringify(grant), {
+        headers: { 'Content-Type': 'application/json' },
+        status: 200,
+      })
+    );
+    vi.stubGlobal('fetch', fetchMock);
+
+    await expect(
+      grantBucketUpload('opaque-capability', '~zod')
+    ).resolves.toEqual(grant);
+    expect(fetchMock).toHaveBeenCalledWith(
+      'https://memex.tlon.network/v2/buckets/uploads/grant',
+      expect.objectContaining({
+        body: JSON.stringify({ host: 'zod' }),
+        headers: expect.objectContaining({
+          Authorization: 'Bearer opaque-capability',
+          'Content-Type': 'application/json',
+        }),
+        method: 'POST',
+      })
+    );
+  });
+
+  test('sends the reservation in both the completion path and body', async () => {
+    const fetchMock = vi
+      .fn()
+      .mockResolvedValue(
+        new Response(JSON.stringify({ objectId: 'object-1' }), { status: 200 })
+      );
+    vi.stubGlobal('fetch', fetchMock);
+
+    await completeBucketUpload('reservation/1');
+
+    expect(fetchMock).toHaveBeenCalledWith(
+      'https://memex.tlon.network/v2/buckets/uploads/reservation%2F1/complete',
+      expect.objectContaining({
+        body: JSON.stringify({ reservationId: 'reservation/1' }),
+        method: 'POST',
+      })
+    );
+  });
+
+  test('only treats rollout failures as legacy-fallback candidates', async () => {
+    const fetchMock = vi.fn().mockResolvedValue(
+      new Response(
+        JSON.stringify({
+          code: 'feature_disabled',
+          message: 'Buckets is disabled',
+          retryable: false,
+        }),
+        { status: 404 }
+      )
+    );
+    vi.stubGlobal('fetch', fetchMock);
+
+    const cause = await grantBucketUpload('opaque-capability', '~zod').catch(
+      (error: unknown) => error
+    );
+
+    expect(cause).toBeInstanceOf(BucketsBrokerError);
+    expect(canFallBackFromBucketsBroker(cause)).toBe(true);
+    expect(
+      canFallBackFromBucketsBroker(
+        new BucketsBrokerError(
+          'capability denied',
+          403,
+          'capability_denied',
+          false
+        )
+      )
+    ).toBe(false);
+  });
+});
diff --git a/packages/shared/src/store/storage/bucketsBroker.ts b/packages/shared/src/store/storage/bucketsBroker.ts
new file mode 100644
index 0000000000..153484c4e8
--- /dev/null
+++ b/packages/shared/src/store/storage/bucketsBroker.ts
@@ -0,0 +1,157 @@
+import { v4 as uuidv4 } from 'uuid';
+
+const BUCKETS_BROKER_URL = 'https://memex.tlon.network/v2/buckets';
+
+type BrokerErrorBody = {
+  code?: string;
+  message?: string;
+  retryable?: boolean;
+};
+
+export class BucketsBrokerError extends Error {
+  constructor(
+    message: string,
+    public readonly status: number,
+    public readonly code?: string,
+    public readonly retryable = false
+  ) {
+    super(message);
+    this.name = 'BucketsBrokerError';
+  }
+}
+
+export type BucketUploadGrant = {
+  reservationId: string;
+  objectId: string;
+  uploadUrl: string;
+  uploadExpiresAt: string;
+  requiredHeaders: [string, string][];
+};
+
+export type BucketObjectReceipt = {
+  reservationId: string;
+  objectId: string;
+  host: string;
+  bucketId: string;
+  size: number;
+  mimeType: string;
+  checksum: { algorithm: 'crc32c' | 'md5'; value: string } | null;
+  createdAt: string;
+};
+
+export type BucketReadGrant = {
+  objectId: string;
+  readUrl: string;
+  expiresAt: string;
+  acceptRanges: boolean;
+};
+
+export function createBucketCapability() {
+  return uuidv4().replaceAll('-', '');
+}
+
+function hostName(host: string) {
+  return host.replace(/^~/, '');
+}
+
+async function brokerRequest<T>(path: string, init: RequestInit): Promise<T> {
+  const response = await fetch(`${BUCKETS_BROKER_URL}${path}`, {
+    ...init,
+    headers: {
+      'Content-Type': 'application/json',
+      ...init.headers,
+    },
+  });
+
+  if (!response.ok) {
+    const body = (await response
+      .json()
+      .catch(() => null)) as BrokerErrorBody | null;
+    throw new BucketsBrokerError(
+      body?.message ?? `Buckets storage returned ${response.status}`,
+      response.status,
+      body?.code,
+      body?.retryable ?? false
+    );
+  }
+
+  return (await response.json()) as T;
+}
+
+export function grantBucketUpload(
+  capability: string,
+  host: string
+): Promise<BucketUploadGrant> {
+  return brokerRequest('/uploads/grant', {
+    method: 'POST',
+    headers: { Authorization: `Bearer ${capability}` },
+    body: JSON.stringify({ host: hostName(host) }),
+  });
+}
+
+export function completeBucketUpload(
+  reservationId: string
+): Promise<BucketObjectReceipt> {
+  return brokerRequest(
+    `/uploads/${encodeURIComponent(reservationId)}/complete`,
+    {
+      method: 'POST',
+      body: JSON.stringify({ reservationId }),
+    }
+  );
+}
+
+export function retryBucketUpload(
+  reservationId: string
+): Promise<BucketUploadGrant> {
+  return brokerRequest(`/uploads/${encodeURIComponent(reservationId)}/retry`, {
+    method: 'POST',
+  });
+}
+
+export function cancelBucketUpload(reservationId: string) {
+  return brokerRequest<{ reservationId: string; canceledAt: string }>(
+    `/uploads/${encodeURIComponent(reservationId)}/cancel`,
+    { method: 'POST' }
+  );
+}
+
+export function grantBucketRead(
+  capability: string,
+  host: string,
+  objectId: string
+): Promise<BucketReadGrant> {
+  return brokerRequest(`/objects/${encodeURIComponent(objectId)}/read-grant`, {
+    method: 'POST',
+    headers: { Authorization: `Bearer ${capability}` },
+    body: JSON.stringify({ host: hostName(host) }),
+  });
+}
+
+export function deleteBucketObject(
+  capability: string,
+  host: string,
+  objectId: string
+) {
+  return brokerRequest<{ objectId: string; deletedAt: string }>(
+    `/objects/${encodeURIComponent(objectId)}`,
+    {
+      method: 'DELETE',
+      headers: { Authorization: `Bearer ${capability}` },
+      body: JSON.stringify({ host: hostName(host) }),
+    }
+  );
+}
+
+export function brokerRequiredHeaders(grant: BucketUploadGrant) {
+  return Object.fromEntries(grant.requiredHeaders);
+}
+
+export function canFallBackFromBucketsBroker(cause: unknown) {
+  return (
+    cause instanceof BucketsBrokerError &&
+    (cause.status === 404 ||
+      cause.code === 'feature_disabled' ||
+      cause.code === 'pioneer_unavailable')
+  );
+}
diff --git a/packages/shared/src/store/storage/index.ts b/packages/shared/src/store/storage/index.ts
index 53691b85a5..640bdf7689 100644
--- a/packages/shared/src/store/storage/index.ts
+++ b/packages/shared/src/store/storage/index.ts
@@ -1,3 +1,4 @@
 export * from './storageUtils';
 export * from './storageActions';
 export * from './storageUploadState';
+export * from './bucketsBroker';
diff --git a/packages/shared/src/store/sync/sync.ts b/packages/shared/src/store/sync/sync.ts
index 8f5c5c8535..6a0ea149d1 100644
--- a/packages/shared/src/store/sync/sync.ts
+++ b/packages/shared/src/store/sync/sync.ts
@@ -63,6 +63,7 @@ export const syncInitData = async (
   const initData = await syncQueue.add('init', syncCtx, () =>
     api.getInitData()
   );
+  const bucketSnapshots = await api.getBuckets().catch(() => []);
   logger.crumb('got init data from api');
   initializeJoinedSet(initData.unreads);
   useLureState.getState().start();
@@ -105,6 +106,17 @@ export const syncInitData = async (
     await db
       .insertChannelPerms(initData.channelPerms, queryCtx)
       .then(() => logger.crumb('inserted channel perms'));
+    if (bucketSnapshots.length > 0) {
+      await db.insertChannelPerms(
+        bucketSnapshots.map((snapshot) => ({
+          channelId: api.formatBucketsChannelId(snapshot.flag),
+          readers: snapshot.state.readers,
+          writers: snapshot.state.writers,
+        })),
+        queryCtx
+      );
+      logger.crumb('inserted Bucket channel perms');
+    }
     await db
       .insertChannelOrder(initData.channelPerms, queryCtx)
       .then(() => logger.crumb('inserted channel order'));
diff --git a/scripts/buckets-live-check.mjs b/scripts/buckets-live-check.mjs
new file mode 100644
index 0000000000..7261415f0d
--- /dev/null
+++ b/scripts/buckets-live-check.mjs
@@ -0,0 +1,48 @@
+#!/usr/bin/env node
+import fs from 'node:fs/promises';
+
+const credentialsPath =
+  process.env.BUCKETS_SHIP_CREDENTIALS ??
+  '/Users/williamarzt/Desktop/buckets.md';
+const source = await fs.readFile(credentialsPath, 'utf8');
+const shipUrl = source.match(/https?:\/\/[^\s)]+/)?.[0]?.replace(/\/$/, '');
+const accessCode =
+  source.match(/\b[a-z]{6}(?:-[a-z]{6}){3}\b/)?.[0] ?? undefined;
+
+if (!shipUrl || !accessCode) {
+  throw new Error('Could not parse the hosted ship URL and access code');
+}
+
+const login = await fetch(`${shipUrl}/~/login`, {
+  method: 'POST',
+  redirect: 'manual',
+  headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+  body: new URLSearchParams({ password: accessCode }),
+});
+const cookie = login.headers.get('set-cookie')?.split(';', 1)[0];
+if (!login.ok || !cookie) {
+  throw new Error(`Ship login failed (${login.status})`);
+}
+
+const response = await fetch(`${shipUrl}/~/scry/buckets/v1/buckets.json`, {
+  headers: { Cookie: cookie },
+});
+if (!response.ok) {
+  throw new Error(`Buckets snapshot scry failed (${response.status})`);
+}
+
+const snapshots = await response.json();
+console.log(
+  JSON.stringify(
+    snapshots.map((snapshot) => ({
+      flag: snapshot.flag,
+      title: snapshot.state?.title,
+      readers: snapshot.state?.readers ?? [],
+      writers: snapshot.state?.writers ?? null,
+      revision: snapshot.state?.revision,
+      entryCount: snapshot.state?.entries?.length ?? 0,
+    })),
+    null,
+    2
+  )
+);
diff --git a/scripts/buckets-live-e2e.mjs b/scripts/buckets-live-e2e.mjs
new file mode 100644
index 0000000000..f08d184e32
--- /dev/null
+++ b/scripts/buckets-live-e2e.mjs
@@ -0,0 +1,279 @@
+#!/usr/bin/env node
+
+import fs from 'node:fs/promises';
+
+const credentialsPath =
+  process.env.BUCKETS_SHIP_CREDENTIALS ?? '/Users/williamarzt/Desktop/buckets.md';
+const memexBaseUrl = process.env.MEMEX_BASE_URL ?? 'https://memex.tlon.network';
+const bucketName = process.env.BUCKETS_CANARY_NAME ?? 'live-canary';
+const groupName = process.env.BUCKETS_CANARY_GROUP ?? 'home-group';
+
+const source = await fs.readFile(credentialsPath, 'utf8');
+const shipUrl = source.match(/https?:\/\/[^\s)]+/)?.[0]?.replace(/\/$/, '');
+const ship =
+  source.match(/~[a-z]+(?:-[a-z]+)+/)?.[0] ??
+  (shipUrl ? `~${new URL(shipUrl).hostname.split('.')[0]}` : undefined);
+const accessCode =
+  source.match(/\b[a-z]{6}(?:-[a-z]{6}){3}\b/)?.[0] ?? undefined;
+
+if (!shipUrl || !ship || !accessCode) {
+  throw new Error('Could not parse ship URL, ship name, and access code');
+}
+
+const login = await fetch(`${shipUrl}/~/login`, {
+  method: 'POST',
+  redirect: 'manual',
+  headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+  body: new URLSearchParams({ password: accessCode }),
+});
+const cookie = login.headers.get('set-cookie')?.split(';', 1)[0];
+if (!login.ok || !cookie) {
+  throw new Error(`Ship login failed (${login.status})`);
+}
+
+const headers = {
+  'Content-Type': 'application/json',
+  Cookie: cookie,
+};
+
+async function airlockPoke(json) {
+  const channelId = `${Math.floor(Date.now() / 1000)}-${crypto.randomUUID().slice(0, 8)}`;
+  const channelUrl = `${shipUrl}/~/channel/${channelId}`;
+  const request = {
+    id: 1,
+    action: 'poke',
+    ship: ship.slice(1),
+    app: 'buckets',
+    mark: 'buckets-action-1',
+    json,
+  };
+  const poke = await fetch(channelUrl, {
+    method: 'PUT',
+    headers,
+    body: JSON.stringify([request]),
+  });
+  if (!poke.ok) {
+    throw new Error(`Buckets poke HTTP request failed (${poke.status})`);
+  }
+
+  const controller = new AbortController();
+  const timeout = setTimeout(() => controller.abort(), 20_000);
+  try {
+    const stream = await fetch(channelUrl, {
+      headers: { ...headers, Accept: 'text/event-stream' },
+      signal: controller.signal,
+    });
+    if (!stream.ok || !stream.body) {
+      throw new Error(`Airlock response stream failed (${stream.status})`);
+    }
+    const reader = stream.body.getReader();
+    const decoder = new TextDecoder();
+    let buffer = '';
+    while (true) {
+      const { value, done } = await reader.read();
+      if (done) break;
+      buffer += decoder.decode(value, { stream: true });
+      let newline = buffer.indexOf('\n');
+      while (newline !== -1) {
+        const line = buffer.slice(0, newline).replace(/\r$/, '');
+        buffer = buffer.slice(newline + 1);
+        if (line.startsWith('data:')) {
+          const event = JSON.parse(line.slice(5).trim());
+          if (event.response === 'poke' && event.id === 1) {
+            if (event.err) {
+              throw new Error(`Buckets poke failed: ${event.err}`);
+            }
+            return;
+          }
+        }
+        newline = buffer.indexOf('\n');
+      }
+    }
+    throw new Error('Airlock closed before the Buckets poke response arrived');
+  } finally {
+    clearTimeout(timeout);
+    controller.abort();
+  }
+}
+
+async function snapshots() {
+  const response = await fetch(
+    `${shipUrl}/~/scry/buckets/v1/buckets.json`,
+    { headers: { Cookie: cookie } }
+  );
+  if (!response.ok) {
+    const body = (await response.text()).slice(0, 2_000);
+    const nounResponse = await fetch(
+      `${shipUrl}/~/scry/buckets/v1/buckets.noun`,
+      { headers: { Cookie: cookie } }
+    );
+    throw new Error(
+      `Buckets snapshot scry failed (${response.status}); noun=${nounResponse.status} ` +
+      `${nounResponse.headers.get('content-type') ?? 'unknown'}: ${body}`
+    );
+  }
+  return response.json();
+}
+
+const flag = { host: ship, name: bucketName };
+let allSnapshots = await snapshots();
+let snapshot = allSnapshots.find(
+  (item) => item.flag?.host === ship && item.flag?.name === bucketName
+);
+if (!snapshot) {
+  await airlockPoke({
+    type: 'create',
+    name: bucketName,
+    title: 'Live Canary',
+    group: { host: ship, name: groupName },
+    readers: [],
+  });
+  allSnapshots = await snapshots();
+  snapshot = allSnapshots.find(
+    (item) => item.flag?.host === ship && item.flag?.name === bucketName
+  );
+}
+if (!snapshot) {
+  throw new Error('Buckets agent accepted create but returned no snapshot');
+}
+
+const genuine = await fetch(`${shipUrl}/~/scry/genuine/secret.json`, {
+  headers: { Cookie: cookie },
+});
+if (!genuine.ok) {
+  throw new Error(`Could not read the ship's Memex token (${genuine.status})`);
+}
+const token = await genuine.json();
+if (typeof token !== 'string' || token.length === 0) {
+  throw new Error('The ship returned an invalid Memex token');
+}
+
+const bytes = Buffer.from(
+  'iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mNk+A8AAQUBAScY42YAAAAASUVORK5CYII=',
+  'base64'
+);
+const shipName = ship.slice(1);
+const canaryId = Date.now();
+const displayName = `buckets-live-${canaryId}.png`;
+const fileKey = `${shipName}/${displayName}`;
+const capability = crypto.randomUUID().replaceAll('-', '') + crypto.randomUUID().replaceAll('-', '');
+
+await airlockPoke({
+  type: 'begin-upload',
+  flag,
+  parentId: null,
+  name: displayName,
+  mime: 'image/png',
+  size: bytes.length,
+  checksum: null,
+  capability,
+});
+
+const brokerProbe = await fetch(
+  `${shipUrl}/~/scry/buckets/v1/broker/upload/${capability}/probe-reservation.json`,
+  { headers: { Cookie: cookie } }
+);
+if (!brokerProbe.ok) {
+  throw new Error(`Buckets private broker scry failed (${brokerProbe.status})`);
+}
+const brokerProbeBody = await brokerProbe.json();
+if (brokerProbeBody?.result !== 'denied') {
+  throw new Error(
+    `Buckets private broker returned an unexpected pre-authorization verdict: ${JSON.stringify(brokerProbeBody)}`
+  );
+}
+
+snapshot = (await snapshots()).find(
+  (item) => item.flag?.host === ship && item.flag?.name === bucketName
+);
+const pendingEntry = snapshot?.state?.entries?.find(
+  (entry) => entry.name === displayName && entry.kind === 'file'
+);
+const session = snapshot?.state?.sessions?.find(
+  (candidate) => candidate.fileId === pendingEntry?.id
+);
+if (!pendingEntry || !session) {
+  throw new Error('Buckets begin-upload did not produce a pending file session');
+}
+
+const grant = await fetch(`${memexBaseUrl}/v1/${shipName}/upload`, {
+  method: 'PUT',
+  headers: { 'Content-Type': 'application/json' },
+  body: JSON.stringify({
+    token,
+    contentLength: bytes.length,
+    contentType: 'image/png',
+    fileName: fileKey,
+  }),
+});
+if (!grant.ok) {
+  throw new Error(`Memex upload grant failed (${grant.status})`);
+}
+const grantBody = await grant.json();
+if (!grantBody?.url || !grantBody?.filePath) {
+  throw new Error('Memex returned an invalid upload grant');
+}
+
+const upload = await fetch(grantBody.url, {
+  method: 'PUT',
+  headers: {
+    'Cache-Control': 'public, max-age=3600',
+    'Content-Type': 'image/png',
+  },
+  body: bytes,
+});
+if (!upload.ok) {
+  throw new Error(`Signed object upload failed (${upload.status})`);
+}
+
+await airlockPoke({
+  type: 'finish-upload',
+  flag,
+  sessionId: session.id,
+  objectUrl: grantBody.filePath,
+});
+
+snapshot = (await snapshots()).find(
+  (item) => item.flag?.host === ship && item.flag?.name === bucketName
+);
+const completed = snapshot?.state?.entries?.find(
+  (entry) => entry.id === pendingEntry.id
+);
+if (
+  completed?.file?.status !== 'ready' ||
+  completed.file.objectUrl !== grantBody.filePath
+) {
+  throw new Error('Gall did not finalize the uploaded object in the manifest');
+}
+
+const download = await fetch(grantBody.filePath);
+const downloaded = download.ok
+  ? Buffer.from(await download.arrayBuffer())
+  : Buffer.alloc(0);
+if (!download.ok || !downloaded.equals(bytes)) {
+  throw new Error('The finalized manifest object did not download intact');
+}
+
+console.log(
+  JSON.stringify(
+    {
+      ship,
+      group: `${ship}/${groupName}`,
+      bucket: `${ship}/${bucketName}`,
+      gallSessionId: session.id,
+      gallObjectId: pendingEntry.id,
+      manifestRevision: snapshot.state.revision,
+      objectUrl: grantBody.filePath,
+      memexGrantStatus: grant.status,
+      uploadStatus: upload.status,
+      downloadStatus: download.status,
+      byteCount: bytes.length,
+      bytesMatch: true,
+      gallStatus: completed.file.status,
+      brokerProbeStatus: brokerProbe.status,
+      brokerProbeResult: brokerProbeBody.result,
+    },
+    null,
+    2
+  )
+);
diff --git a/scripts/buckets-live-upload-smoke.mjs b/scripts/buckets-live-upload-smoke.mjs
new file mode 100644
index 0000000000..4b4ba7bbd1
--- /dev/null
+++ b/scripts/buckets-live-upload-smoke.mjs
@@ -0,0 +1,104 @@
+#!/usr/bin/env node
+
+import fs from 'node:fs/promises';
+
+const credentialsPath =
+  process.env.BUCKETS_SHIP_CREDENTIALS ?? '/Users/williamarzt/Desktop/buckets.md';
+const memexBaseUrl = process.env.MEMEX_BASE_URL ?? 'https://memex.tlon.network';
+
+const source = await fs.readFile(credentialsPath, 'utf8');
+const shipUrl = source.match(/https?:\/\/[^\s)]+/)?.[0]?.replace(/\/$/, '');
+const ship =
+  source.match(/~[a-z]+(?:-[a-z]+)+/)?.[0] ??
+  (shipUrl ? `~${new URL(shipUrl).hostname.split('.')[0]}` : undefined);
+const accessCode =
+  source.match(/\b[a-z]{6}(?:-[a-z]{6}){3}\b/)?.[0] ?? undefined;
+
+if (!shipUrl || !ship || !accessCode) {
+  throw new Error('Could not parse ship URL, ship name, and access code');
+}
+
+const login = await fetch(`${shipUrl}/~/login`, {
+  method: 'POST',
+  redirect: 'manual',
+  headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+  body: new URLSearchParams({ password: accessCode }),
+});
+const cookie = login.headers.get('set-cookie')?.split(';', 1)[0];
+if (!login.ok || !cookie) {
+  throw new Error(`Ship login failed (${login.status})`);
+}
+
+const genuine = await fetch(`${shipUrl}/~/scry/genuine/secret.json`, {
+  headers: { Cookie: cookie },
+});
+if (!genuine.ok) {
+  throw new Error(`Could not read the ship's Memex token (${genuine.status})`);
+}
+const token = await genuine.json();
+if (typeof token !== 'string' || token.length === 0) {
+  throw new Error('The ship returned an invalid Memex token');
+}
+
+// A valid 1x1 transparent PNG. Keeping the payload tiny makes this safe to run
+// against a real hosted-user bucket while still proving byte integrity.
+const bytes = Buffer.from(
+  'iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mNk+A8AAQUBAScY42YAAAAASUVORK5CYII=',
+  'base64'
+);
+const shipName = ship.slice(1);
+const filename = `${shipName}/buckets-canary-${Date.now()}.png`;
+const grant = await fetch(`${memexBaseUrl}/v1/${shipName}/upload`, {
+  method: 'PUT',
+  headers: { 'Content-Type': 'application/json' },
+  body: JSON.stringify({
+    token,
+    contentLength: bytes.length,
+    contentType: 'image/png',
+    fileName: filename,
+  }),
+});
+if (!grant.ok) {
+  throw new Error(`Memex upload grant failed (${grant.status})`);
+}
+const grantBody = await grant.json();
+if (!grantBody?.url || !grantBody?.filePath) {
+  throw new Error('Memex returned an invalid upload grant');
+}
+
+const upload = await fetch(grantBody.url, {
+  method: 'PUT',
+  headers: {
+    'Cache-Control': 'public, max-age=3600',
+    'Content-Type': 'image/png',
+  },
+  body: bytes,
+});
+if (!upload.ok) {
+  throw new Error(`Signed object upload failed (${upload.status})`);
+}
+
+const download = await fetch(grantBody.filePath);
+if (!download.ok) {
+  throw new Error(`Uploaded object was not readable (${download.status})`);
+}
+const downloaded = Buffer.from(await download.arrayBuffer());
+if (!downloaded.equals(bytes)) {
+  throw new Error('Downloaded bytes did not match the uploaded file');
+}
+
+console.log(
+  JSON.stringify(
+    {
+      ship,
+      memexGrantStatus: grant.status,
+      uploadStatus: upload.status,
+      downloadStatus: download.status,
+      byteCount: bytes.length,
+      bytesMatch: true,
+      objectUrl: grantBody.filePath,
+    },
+    null,
+    2
+  )
+);
diff --git a/scripts/run-buckets-live-app.mjs b/scripts/run-buckets-live-app.mjs
new file mode 100644
index 0000000000..6fdda60dc5
--- /dev/null
+++ b/scripts/run-buckets-live-app.mjs
@@ -0,0 +1,52 @@
+#!/usr/bin/env node
+import { spawn } from 'node:child_process';
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import process from 'node:process';
+import { fileURLToPath } from 'node:url';
+
+const repoRoot = path.resolve(
+  path.dirname(fileURLToPath(import.meta.url)),
+  '..'
+);
+const mobileRoot = path.join(repoRoot, 'apps', 'tlon-mobile');
+const credentialsPath =
+  process.env.BUCKETS_SHIP_CREDENTIALS ??
+  '/Users/williamarzt/Desktop/buckets.md';
+const source = await fs.readFile(credentialsPath, 'utf8');
+const shipUrl = source.match(/https?:\/\/[^\s)]+/)?.[0]?.replace(/\/$/, '');
+const accessCode = source.match(/\b[a-z]{6}(?:-[a-z]{6}){3}\b/)?.[0];
+
+if (!shipUrl || !accessCode) {
+  throw new Error('Could not parse the hosted ship URL and access code');
+}
+
+const child = spawn(
+  'pnpm',
+  [
+    'exec',
+    'expo',
+    'start',
+    '--dev-client',
+    '--ios',
+    '--port',
+    process.env.BUCKETS_METRO_PORT ?? '8081',
+  ],
+  {
+    cwd: mobileRoot,
+    env: {
+      ...process.env,
+      DEFAULT_SHIP_LOGIN_ACCESS_CODE: accessCode,
+      DEFAULT_SHIP_LOGIN_URL: shipUrl,
+    },
+    stdio: 'inherit',
+  }
+);
+
+process.on('SIGINT', () => child.kill('SIGTERM'));
+process.on('SIGTERM', () => child.kill('SIGTERM'));
+
+await new Promise((resolve, reject) => {
+  child.once('error', reject);
+  child.once('exit', resolve);
+});
diff --git a/scripts/run-buckets-live-cosmos.mjs b/scripts/run-buckets-live-cosmos.mjs
new file mode 100644
index 0000000000..9566c73342
--- /dev/null
+++ b/scripts/run-buckets-live-cosmos.mjs
@@ -0,0 +1,54 @@
+#!/usr/bin/env node
+
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import process from 'node:process';
+import { spawn } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+
+const repoRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const mobileRoot = path.join(repoRoot, 'apps', 'tlon-mobile');
+const credentialsPath =
+  process.env.BUCKETS_SHIP_CREDENTIALS ??
+  '/Users/williamarzt/Desktop/buckets.md';
+const source = await fs.readFile(credentialsPath, 'utf8');
+const shipUrl = source.match(/https?:\/\/[^\s)]+/)?.[0]?.replace(/\/$/, '');
+const accessCode = source.match(/\b[a-z]{6}(?:-[a-z]{6}){3}\b/)?.[0];
+
+if (!shipUrl || !accessCode) {
+  throw new Error('Could not parse the hosted ship URL and access code');
+}
+
+const env = {
+  ...process.env,
+  DEFAULT_SHIP_LOGIN_ACCESS_CODE: accessCode,
+  DEFAULT_SHIP_LOGIN_URL: shipUrl,
+};
+const children = [
+  spawn('pnpm', ['exec', 'cosmos-native', '--port', '5050'], {
+    cwd: mobileRoot,
+    env,
+    stdio: 'inherit',
+  }),
+  spawn('pnpm', ['exec', 'expo', 'start', '--port', '8082'], {
+    cwd: mobileRoot,
+    env,
+    stdio: 'inherit',
+  }),
+];
+
+function stop() {
+  children.forEach((child) => child.kill('SIGTERM'));
+}
+
+process.on('SIGINT', stop);
+process.on('SIGTERM', stop);
+await Promise.all(
+  children.map(
+    (child) =>
+      new Promise((resolve, reject) => {
+        child.once('error', reject);
+        child.once('exit', resolve);
+      })
+  )
+);

From d91def9571fb911886ddc4d843115993e1b5fe76 Mon Sep 17 00:00:00 2001
From: william arzt <bill@tlon.io>
Date: Fri, 7 Aug 2026 12:33:56 -0400
Subject: [PATCH 04/19] feat: let group admins create Buckets

---
 desk/app/buckets.hoon                         |  69 +++++++++---
 desk/tests/app/buckets.hoon                   | 102 ++++++++++++++++++
 docs/backend/desk/app/buckets.md              |   6 +-
 .../ManageChannels/CreateChannelSheet.tsx     |   7 +-
 packages/app/ui/components/SystemNotices.tsx  |  11 +-
 .../shared/src/store/channelActions.test.ts   |  51 ++++++---
 packages/shared/src/store/channelActions.ts   |  11 +-
 7 files changed, 215 insertions(+), 42 deletions(-)

diff --git a/desk/app/buckets.hoon b/desk/app/buckets.hoon
index 1ebefd19ab..38f0110f50 100644
--- a/desk/app/buckets.hoon
+++ b/desk/app/buckets.hoon
@@ -2,7 +2,8 @@
 ::
 ::  This agent is a third-party %groups channel host. It stores metadata and
 ::  upload lifecycle only; file bytes move directly between clients and object
-::  storage.
+::  storage. Group admins may request creation, but the group host remains the
+::  authoritative Bucket and storage owner.
 ::
 /-  b=buckets
 /+  default-agent, dbug, verb
@@ -111,7 +112,10 @@
       %buckets-command-1
     =+  cmd=!<(command:b vase)
     =/  act=action:b  action.cmd
-    ?>  !=(%create -.act)
+    ?:  ?=(%create -.act)
+      ?>  =(ship.group.act our.bowl)
+      ?>  (group-is-admin-for-create group.act src.bowl)
+      (create-bucket name.act title.act group.act readers.act writers.act src.bowl)
     =/  =flag:b  (action-flag act)
     ?>  =(ship.flag our.bowl)
     =/  st=bucket-state:b  (need-state flag)
@@ -144,7 +148,22 @@
   ^+  cor
   ?+  -.act  (dispatch-existing act)
     %create
-  (create-bucket name.act title.act group.act readers.act writers.act)
+  ?>  (group-is-admin-for-create group.act our.bowl)
+  ?:  =(ship.group.act our.bowl)
+    (create-bucket name.act title.act group.act readers.act writers.act our.bowl)
+  (forward-create act)
+  ==
+::
+++  forward-create
+  |=  act=action:b
+  ^+  cor
+  ?+  -.act  ~|(%forward-create-requires-create !!)
+    %create
+  %-  emit
+  :*  %pass  /buckets/cmd/create/(scot %p ship.group.act)/[name.act]
+      %agent  [ship.group.act %buckets]
+      %poke  buckets-command-1+!>(`command:b`[act])
+  ==
   ==
 ::
 ++  dispatch-existing
@@ -195,27 +214,39 @@
   cor
 ::
 ++  create-bucket
-  |=  [name=@tas title=@t group=flag:b readers=(set @tas) writers=(set @tas)]
+  |=  [name=@tas title=@t group=flag:b readers=(set @tas) writers=(set @tas) actor=ship]
   ^+  cor
   ?>  =(ship.group our.bowl)
   =/  =flag:b  [our.bowl name]
-  ?>  !(~(has by spaces) flag)
+  ?:  (~(has by spaces) flag)
+    =/  st=bucket-state:b  (need-state flag)
+    ?>  =(group group.st)
+    ?>  =(title title.bucket.st)
+    ?>  =(readers readers.st)
+    ?>  =(writers writers.st)
+    ?>  =(actor created-by.bucket.st)
+    =.  cor  (register-bucket flag st)
+    (give [%fact ~[/v1] buckets-response-1+!>(`response:b`[%snapshot flag st])])
   =/  id=@ud  +(next-id)
   =.  next-id  id
-  =/  buc=bucket:b  [id title our.bowl now.bowl our.bowl now.bowl]
+  =/  buc=bucket:b  [id title actor now.bowl actor now.bowl]
   =/  st=bucket-state:b  [buc group readers writers ~ ~ 0]
   =.  spaces  (~(put by spaces) flag [%pub `st `group])
+  =.  cor  (register-bucket flag st)
+  (give [%fact ~[/v1] buckets-response-1+!>(`response:b`[%snapshot flag st])])
+::
+++  register-bucket
+  |=  [=flag:b st=bucket-state:b]
+  ^+  cor
   =/  channel=group-channel:b
-    [[title '' '' ''] now.bowl %default readers |]
+    [[title.bucket.st '' '' ''] now.bowl %default readers.st |]
   =/  add=group-create:b
-    [%group group %channel [%buckets flag] %add channel]
-  =.  cor
-    %-  emit
-    :*  %pass  /buckets/(scot %p ship.flag)/[name.flag]/create
-        %agent  [our.bowl %groups]
-        %poke  group-action-4+!>(add)
-    ==
-  (give [%fact ~[/v1] buckets-response-1+!>(`response:b`[%snapshot flag st])])
+    [%group group.st %channel [%buckets flag] %add channel]
+  %-  emit
+  :*  %pass  /buckets/(scot %p ship.flag)/[name.flag]/create
+      %agent  [our.bowl %groups]
+      %poke  group-action-4+!>(add)
+  ==
 ::
 ++  apply-action
   |=  act=action:b
@@ -566,6 +597,14 @@
   =/  test=$-([ship nest:b] ?)  .^($-([ship nest:b] ?) %gx pax)
   (test who [%buckets ship.flag name.flag])
 ::
+++  group-is-admin-for-create
+  |=  [group=flag:b who=ship]
+  ^-  ?
+  ?:  =(who ship.group)  &
+  =/  pax=path
+    /(scot %p our.bowl)/groups/(scot %da now.bowl)/v2/groups/(scot %p ship.group)/[name.group]/seats/(scot %p who)/is-admin/noun
+  .^(? %gx pax)
+::
 ++  group-permissions
   |=  [group=flag:b =flag:b who=ship]
   ^-  [admin=? roles=(set @tas)]
diff --git a/desk/tests/app/buckets.hoon b/desk/tests/app/buckets.hoon
index c8e4ec8ba3..a33cec7ada 100644
--- a/desk/tests/app/buckets.hoon
+++ b/desk/tests/app/buckets.hoon
@@ -24,6 +24,16 @@
     (jab-bowl |=(b=bowl b(now ~2026.1.1, eny 0v1234)))
   (pure:m ~)
 ::
+++  setup-as
+  |=  who=ship
+  =/  m  (mare ,~)
+  ^-  form:m
+  ;<  ~  bind:m  (jab-bowl |=(b=bowl b(our who, src who)))
+  ;<  *  bind:m  (do-init dap buckets-agent)
+  ;<  ~  bind:m
+    (jab-bowl |=(b=bowl b(now ~2026.1.1, eny 0v1234)))
+  (pure:m ~)
+::
 ++  create
   =/  m  (mare ,~)
   ^-  form:m
@@ -59,6 +69,98 @@
   ?.  ?=([%gx @ %groups @ %v2 %groups @ @ %channels %buckets @ @ %can-write @ %noun ~] pax)  ~
   `!>([admin=| roles=(silt ~[%editor])])
 ::
+++  allow-admin-create-scries
+  |=  pax=path
+  ^-  (unit vase)
+  ?.  ?=([%gx @ %groups @ %v2 %groups @ @ %seats @ %is-admin %noun ~] pax)  ~
+  `!>(&)
+::
+++  deny-admin-create-scries
+  |=  pax=path
+  ^-  (unit vase)
+  ?.  ?=([%gx @ %groups @ %v2 %groups @ @ %seats @ %is-admin %noun ~] pax)  ~
+  `!>(|)
+::
+::  A non-host admin's local agent forwards creation to the group host rather
+::  than allocating storage on the admin's ship.
+::
+++  test-non-host-admin-forwards-create
+  %-  eval-mare
+  =/  m  (mare ,~)
+  =*  b  bind:m
+  ^-  form:m
+  =/  act=action:bu
+    [%create %project-files 'Project Files' group ~ ~]
+  ;<  ~  b  (setup-as ~bus)
+  ;<  ~  b  (set-scry-gate allow-admin-create-scries)
+  ;<  caz=(list card)  b
+    (do-poke %buckets-action-1 !>(act))
+  %+  ex-cards  caz
+  :~  %-  ex-poke
+      :*  /buckets/cmd/create/~zod/project-files
+          [~zod %buckets]
+          %buckets-command-1
+          !>(`command:bu`[act])
+      ==
+  ==
+::
+::  The authoritative group host accepts a live remote admin, owns the Bucket,
+::  and records the initiating admin as its creator.
+::
+++  test-remote-admin-creates-on-group-host
+  %-  eval-mare
+  =/  m  (mare ,~)
+  =*  b  bind:m
+  ^-  form:m
+  ;<  ~  b  setup
+  ;<  ~  b  (set-scry-gate allow-admin-create-scries)
+  ;<  *  b
+    %-  (do-as ~bus)
+    %+  do-poke  %buckets-command-1
+    !>([[%create %project-files 'Project Files' group ~ ~]])
+  ;<  sv=vase  b  get-save
+  =/  st=state-2:bu  !<(state-2:bu sv)
+  =/  fl=flag:bu  flag
+  =/  bs=bucket-state:bu  (state-for st fl)
+  %+  ex-equal
+  !>([ship.fl created-by.bucket.bs updated-by.bucket.bs group.bs])
+  !>([~zod ~bus ~bus group])
+::
+::  A stale or forged admin request is rejected by the group host's own
+::  authoritative group state.
+::
+++  test-non-admin-cannot-create
+  %-  eval-mare
+  =/  m  (mare ,~)
+  =*  b  bind:m
+  ^-  form:m
+  ;<  ~  b  setup
+  ;<  ~  b  (set-scry-gate deny-admin-create-scries)
+  %-  ex-fail
+  %-  (do-as ~bus)
+  %+  do-poke  %buckets-command-1
+  !>([[%create %project-files 'Project Files' group ~ ~]])
+::
+::  Gall retries reuse the caller-selected random name. An identical retry
+::  must not allocate a second Bucket, but it does retry group registration.
+::
+++  test-create-retry-is-idempotent
+  %-  eval-mare
+  =/  m  (mare ,~)
+  =*  b  bind:m
+  ^-  form:m
+  =/  cmd=command:bu
+    [[%create %project-files 'Project Files' group ~ ~]]
+  ;<  ~  b  setup
+  ;<  ~  b  (set-scry-gate allow-admin-create-scries)
+  ;<  *  b  ((do-as ~bus) (do-poke %buckets-command-1 !>(cmd)))
+  ;<  *  b  ((do-as ~bus) (do-poke %buckets-command-1 !>(cmd)))
+  ;<  sv=vase  b  get-save
+  =/  st=state-2:bu  !<(state-2:bu sv)
+  %+  ex-equal
+  !>([next-id.st (lent ~(tap by spaces.st))])
+  !>([1 1])
+::
 ::  Existing state-1 Buckets keep all metadata and preserve the old
 ::  "readers can write" behavior when the writer role-set is introduced.
 ::
diff --git a/docs/backend/desk/app/buckets.md b/docs/backend/desk/app/buckets.md
index e7836bdfce..5aae3721cd 100644
--- a/docs/backend/desk/app/buckets.md
+++ b/docs/backend/desk/app/buckets.md
@@ -52,9 +52,9 @@ Local clients poke `%buckets-action-1`. The mark accepts JSON and noun input.
 | `%move-entry`    | Move an entry while preventing folder cycles                                                                        |
 | `%delete-entry`  | Delete a file or recursively delete a folder tree                                                                   |
 
-Subscriber agents forward non-create actions to the host with the noun-only `%buckets-command-1` mark. The host derives the actor from the Gall bowl and re-authorizes the command.
+Subscriber agents forward actions to the host with the noun-only `%buckets-command-1` mark. The host derives the actor from the Gall bowl and re-authorizes the command.
 
-Creation is host-local in this version: the group host creates and hosts the Bucket. The client therefore offers the Buckets channel type only when `%buckets` is installed and the current ship hosts the group. Non-host group admins may edit permissions after creation, but remote creation needs a separate host-request protocol.
+The group host always creates and hosts the Bucket, but any current group admin may initiate creation. A non-host admin's local `%buckets` agent first checks its group replica, then forwards the request to the group host. The host checks the actor against its authoritative `%groups` state before allocating the Bucket or registering its channel. Consequently the channel nest, object storage, quota, and eventual billing all remain attached to the group host rather than the initiating admin. Repeating an identical create request is idempotent and re-attempts channel registration; a conflicting request for an existing Bucket name is rejected.
 
 The Gall delete action removes the manifest and `%groups` registration, but storage-wide object cleanup is not atomic yet. The client intentionally withholds Bucket deletion until Memex exposes a host-authorized bulk cleanup operation.
 
@@ -111,5 +111,7 @@ Authorization failures return `{result: "denied"}` and expired capabilities retu
 -   Rejection of nonexistent folder parents
 -   Rejection of a remote write after the live `%groups` permission gate denies access
 -   Acceptance of a remote write only when the member has a configured writer role
+-   Group-hosted creation initiated by an authorized remote admin
+-   Rejection of creation by a non-admin and idempotent handling of retries
 
 Run the targeted fakezod test with the repository's normal `%test` thread against `/tests/app/buckets/hoon`. Marks must remain top-level files such as `desk/mar/buckets-action-1.hoon`; nesting them under `desk/mar/buckets/` changes the mark name and prevents Gall from resolving the protocol.
diff --git a/packages/app/ui/components/ManageChannels/CreateChannelSheet.tsx b/packages/app/ui/components/ManageChannels/CreateChannelSheet.tsx
index 791c6a7cce..dc8e1c66ca 100644
--- a/packages/app/ui/components/ManageChannels/CreateChannelSheet.tsx
+++ b/packages/app/ui/components/ManageChannels/CreateChannelSheet.tsx
@@ -108,13 +108,14 @@ export function CreateChannelSheet({
   const isNonHostAdmin = isGroupAdmin && !group.currentUserIsHost;
   const { data: notesAvailable = false } = useNotesDeskAvailable();
   const { data: bucketsDeskAvailable = false } = useBucketsDeskAvailable();
-  const bucketsAvailable = bucketsDeskAvailable && group.currentUserIsHost;
+  const bucketsAvailable = bucketsDeskAvailable && isGroupAdmin;
   const channelTypes = useMemo(
     () => buildChannelTypes(notesAvailable, bucketsAvailable),
     [bucketsAvailable, notesAvailable]
   );
 
   const isPrivate = useWatch({ control, name: 'isPrivate' });
+  const selectedChannelType = useWatch({ control, name: 'channelType' });
 
   // Only toggles isPrivate without setting readers/writers because:
   // - If private: the user proceeds to CreateChannelPermissionsScreen to configure permissions
@@ -205,7 +206,9 @@ export function CreateChannelSheet({
           </ActionSheet.FormBlock>
           {isNonHostAdmin && (
             <ActionSheet.FormBlock>
-              <SystemNotices.NonHostAdminChannelNotice />
+              <SystemNotices.NonHostAdminChannelNotice
+                bucketHostedByGroup={selectedChannelType === 'buckets'}
+              />
             </ActionSheet.FormBlock>
           )}
           <ActionSheet.FormBlock>
diff --git a/packages/app/ui/components/SystemNotices.tsx b/packages/app/ui/components/SystemNotices.tsx
index f9b37e9deb..08e899c596 100644
--- a/packages/app/ui/components/SystemNotices.tsx
+++ b/packages/app/ui/components/SystemNotices.tsx
@@ -282,12 +282,17 @@ export function ConnectedJoinRequestNotice({
   );
 }
 
-export function NonHostAdminChannelNotice() {
+export function NonHostAdminChannelNotice({
+  bucketHostedByGroup = false,
+}: {
+  bucketHostedByGroup?: boolean;
+}) {
   return (
     <NoticeFrame>
       <NoticeBody>
-        Note: You are not the host of this group. Channels you create will be
-        hosted on your node and will operate independently of the group host.
+        {bucketHostedByGroup
+          ? "This Bucket will be hosted by the group host and will use the group host's storage."
+          : 'Note: You are not the host of this group. Channels you create will be hosted on your node and will operate independently of the group host.'}
       </NoticeBody>
     </NoticeFrame>
   );
diff --git a/packages/shared/src/store/channelActions.test.ts b/packages/shared/src/store/channelActions.test.ts
index 3a8724d379..f43f5d393b 100644
--- a/packages/shared/src/store/channelActions.test.ts
+++ b/packages/shared/src/store/channelActions.test.ts
@@ -426,21 +426,46 @@ test('createChannel creates a Bucket with independent reader and writer roles',
   });
 });
 
-test('createChannel rejects Bucket creation by a non-host admin', async () => {
+test('createChannel lets a non-host admin create a group-hosted Bucket', async () => {
+  await insertGroup();
   vi.spyOn(api, 'getCurrentUserId').mockReturnValue('~solfer-magfed');
-  const sendBucketsAction = vi.spyOn(api, 'sendBucketsAction');
+  const sendBucketsAction = vi
+    .spyOn(api, 'sendBucketsAction')
+    .mockResolvedValue(1);
+  vi.spyOn(api, 'getGroup').mockResolvedValue({
+    id: groupId,
+    channels: [
+      {
+        id: 'buckets/~zod/project-files',
+        title: 'Project files',
+        type: 'buckets',
+        groupId,
+        currentUserIsMember: true,
+        currentUserIsHost: false,
+      },
+    ],
+  } as unknown as db.Group);
 
-  await expect(
-    createChannel({
-      customSlug: 'project-files',
-      groupId,
-      title: 'Project files',
-      channelType: 'buckets',
-    })
-  ).rejects.toThrow(
-    'Buckets can currently be created only by the host of this group'
-  );
-  expect(sendBucketsAction).not.toHaveBeenCalled();
+  const channel = await createChannel({
+    customSlug: 'project-files',
+    groupId,
+    title: 'Project files',
+    channelType: 'buckets',
+  });
+
+  expect(sendBucketsAction).toHaveBeenCalledWith({
+    type: 'create',
+    group: { host: '~zod', name: 'stale-notify' },
+    name: 'project-files',
+    readers: [],
+    title: 'Project files',
+    writers: [],
+  });
+  expect(channel).toMatchObject({
+    id: 'buckets/~zod/project-files',
+    currentUserIsHost: false,
+    type: 'buckets',
+  });
 });
 
 test('joinGroupChannel routes notes channels through the notes API', async () => {
diff --git a/packages/shared/src/store/channelActions.ts b/packages/shared/src/store/channelActions.ts
index 8ffce9073d..339d15e54b 100644
--- a/packages/shared/src/store/channelActions.ts
+++ b/packages/shared/src/store/channelActions.ts
@@ -141,19 +141,16 @@ async function createBucketsChannel({
   title: string;
   writers?: string[];
 }): Promise<db.Channel> {
-  const currentUserId = api.getCurrentUserId();
   const [groupHost, groupName, ...rest] = groupId.split('/');
   if (!groupHost || !groupName || rest.length > 0) {
     throw new Error(`Invalid group id: ${groupId}`);
   }
-  if (groupHost !== currentUserId) {
-    throw new Error(
-      'Buckets can currently be created only by the host of this group'
-    );
-  }
 
   const name = customSlug || getRandomId();
-  const flag: api.BucketsFlag = { host: currentUserId, name };
+  // Bucket storage belongs to the group host even when another group admin
+  // initiates creation. The local %buckets agent forwards the request and the
+  // group host re-checks the caller's live admin authority before creating it.
+  const flag: api.BucketsFlag = { host: groupHost, name };
   const channelId = api.formatBucketsChannelId(flag);
   let created = false;
 

From 935c98674f2e8b69b184deaa5e9baa7ca5377122 Mon Sep 17 00:00:00 2001
From: william arzt <bill@tlon.io>
Date: Tue, 11 Aug 2026 10:27:02 -0400
Subject: [PATCH 05/19] fix: polish Buckets client interactions

---
 .../features/buckets/BucketsLiveChannel.tsx   | 109 ++++++++----
 .../bucketUploadReconciliation.test.ts        | 167 ++++++++++++++++++
 .../buckets/bucketUploadReconciliation.ts     |  69 ++++++++
 .../app/features/buckets/useLiveBucket.ts     | 124 +++++++++++--
 .../app/fixtures/BucketsChannel.fixture.tsx   |   4 +
 .../BucketFileViewer.native.tsx               |  99 +++++++++--
 .../BucketsChannel/BucketFileViewer.shared.ts |   2 +-
 .../BucketsChannel/BucketFileViewer.tsx       |  99 +++++++++--
 .../BucketsChannel/BucketsChannel.tsx         |  30 ++--
 .../ui/components/Channel/ChannelHeader.tsx   |  40 ++++-
 packages/app/ui/components/ScreenHeader.tsx   |   4 +-
 .../app/utils/bucketUploadProgress.test.ts    |  77 ++++++++
 packages/app/utils/bucketUploadProgress.ts    |  51 ++++++
 13 files changed, 769 insertions(+), 106 deletions(-)
 create mode 100644 packages/app/features/buckets/bucketUploadReconciliation.test.ts
 create mode 100644 packages/app/features/buckets/bucketUploadReconciliation.ts
 create mode 100644 packages/app/utils/bucketUploadProgress.test.ts
 create mode 100644 packages/app/utils/bucketUploadProgress.ts

diff --git a/packages/app/features/buckets/BucketsLiveChannel.tsx b/packages/app/features/buckets/BucketsLiveChannel.tsx
index 28847ec4ef..a9d1748fa4 100644
--- a/packages/app/features/buckets/BucketsLiveChannel.tsx
+++ b/packages/app/features/buckets/BucketsLiveChannel.tsx
@@ -3,7 +3,7 @@ import * as db from '@tloncorp/shared/db';
 import { Text } from '@tloncorp/ui';
 import * as DocumentPicker from 'expo-document-picker';
 import * as ImagePicker from 'expo-image-picker';
-import { ReactElement, useMemo, useState } from 'react';
+import { ReactElement, useCallback, useMemo, useRef, useState } from 'react';
 import { Linking, useWindowDimensions } from 'react-native';
 
 import {
@@ -23,6 +23,7 @@ import {
   getBucketPreviewKind,
   useCanWrite,
   useCurrentUserId,
+  useHideChannelHeader,
   useIsWindowNarrow,
   useRegisterChannelHeaderItem,
 } from '../../ui';
@@ -63,6 +64,7 @@ function toItem(entry: BucketsEntry, entries: BucketsEntry[]): BucketItem {
         ? entry.file.objectUrl ?? undefined
         : undefined,
     sizeLabel: formatFileSize(entry.file.size),
+    uploadSize: entry.file.status === 'pending' ? entry.file.size : undefined,
     uploadError:
       entry.file.status === 'failed'
         ? 'The object was not finalized'
@@ -122,7 +124,11 @@ export function BucketsLiveChannel({
   const [searchOrigin, setSearchOrigin] = useState<SearchOrigin | null>(null);
   const [query, setQuery] = useState('');
   const [previewItem, setPreviewItem] = useState<BucketItem | null>(null);
+  const [previewLoading, setPreviewLoading] = useState(false);
+  const [previewError, setPreviewError] = useState<string | null>(null);
+  const previewRequestId = useRef(0);
   const [operationError, setOperationError] = useState<string | null>(null);
+  useHideChannelHeader(embedded && previewItem !== null);
   const [mediaLibraryPermissionStatus, requestMediaLibraryPermission] =
     ImagePicker.useMediaLibraryPermissions();
   const entries = useMemo(
@@ -204,43 +210,59 @@ export function BucketsLiveChannel({
     }
   };
 
-  const openItem = async (item: BucketItem) => {
+  const loadPreview = async (item: BucketItem) => {
+    const requestId = ++previewRequestId.current;
+    setPreviewItem(item);
+    setPreviewLoading(true);
+    setPreviewError(null);
+
+    try {
+      const previewUri =
+        item.previewUri ?? (await live.readUrl(Number(item.id)));
+      if (previewRequestId.current !== requestId) return;
+
+      const readableItem = { ...item, previewUri };
+      setPreviewItem(readableItem);
+
+      if (
+        getBucketPreviewKind(readableItem) === 'text' &&
+        readableItem.textContent === undefined
+      ) {
+        const response = await fetch(previewUri);
+        if (!response.ok) {
+          throw new Error(`File request failed (${response.status})`);
+        }
+        const textContent = await response.text();
+        if (previewRequestId.current !== requestId) return;
+        setPreviewItem({ ...readableItem, textContent });
+      }
+
+      if (previewRequestId.current === requestId) {
+        setPreviewLoading(false);
+      }
+    } catch (cause) {
+      if (previewRequestId.current !== requestId) return;
+      setPreviewLoading(false);
+      setPreviewError(cause instanceof Error ? cause.message : String(cause));
+    }
+  };
+
+  const openItem = (item: BucketItem) => {
     if (item.kind === 'folder') {
       setActiveFolderId(Number(item.id));
       setSelectedItemId(null);
       return;
     }
     setSelectedItemId(item.id);
-    let previewUri = item.previewUri;
-    if (!previewUri) {
-      try {
-        setOperationError(null);
-        previewUri = await live.readUrl(Number(item.id));
-      } catch (cause) {
-        setOperationError(
-          cause instanceof Error ? cause.message : String(cause)
-        );
-        return;
-      }
-    }
+    setOperationError(null);
+    void loadPreview(item);
+  };
 
-    const readableItem = { ...item, previewUri };
-    setPreviewItem(readableItem);
-    if (
-      getBucketPreviewKind(readableItem) === 'text' &&
-      !readableItem.textContent
-    ) {
-      try {
-        const response = await fetch(previewUri);
-        if (!response.ok) return;
-        const textContent = await response.text();
-        setPreviewItem((current) =>
-          current?.id === item.id ? { ...current, textContent } : current
-        );
-      } catch {
-        // The viewer can still offer the external open action.
-      }
-    }
+  const closePreview = () => {
+    previewRequestId.current += 1;
+    setPreviewItem(null);
+    setPreviewLoading(false);
+    setPreviewError(null);
   };
 
   const chooseUploads = async () => {
@@ -293,11 +315,15 @@ export function BucketsLiveChannel({
     }
   };
 
-  const openSearch = () => {
+  const openNewSheet = useCallback(() => {
+    setNewSheetOpen(true);
+  }, []);
+
+  const openSearch = useCallback(() => {
     setSearchOrigin({ activeFolderId, selectedItemId });
     setSearchOpen(true);
     setQuery('');
-  };
+  }, [activeFolderId, selectedItemId]);
 
   const closeSearch = () => {
     if (searchOrigin) {
@@ -341,6 +367,8 @@ export function BucketsLiveChannel({
     rootLabel,
     selectedItemId,
     state: live.loading ? ('loading' as const) : ('populated' as const),
+    uploadAggregateProgress: live.uploadAggregateProgress,
+    uploadItems: live.localItems,
     onCancelUpload: (item: BucketItem) => void live.cancelUpload(item.id),
     onDeleteItem: (item: BucketItem) =>
       void reportOperation(
@@ -383,8 +411,9 @@ export function BucketsLiveChannel({
       backgroundColor="$background"
     >
       <MaybeChannelHeaderItemsProvider embedded={embedded}>
-        {previewItem?.previewUri ? (
+        {previewItem ? (
           <BucketFileViewer
+            error={previewError}
             item={{
               name: previewItem.name,
               mimeType: previewItem.mimeType,
@@ -392,10 +421,14 @@ export function BucketsLiveChannel({
               textContent: previewItem.textContent,
               uri: previewItem.previewUri,
             }}
-            onClose={() => setPreviewItem(null)}
-            onOpenExternally={() =>
-              void Linking.openURL(previewItem.previewUri!)
+            loading={previewLoading}
+            onClose={closePreview}
+            onOpenExternally={
+              previewItem.previewUri
+                ? () => void Linking.openURL(previewItem.previewUri!)
+                : undefined
             }
+            onRetry={() => void loadPreview(previewItem)}
           />
         ) : searchOpen ? (
           <BucketsSearchScreen
@@ -411,7 +444,7 @@ export function BucketsLiveChannel({
             <RegisteredLiveHeaderActions
               canEdit={canEdit}
               showSearch={embedded}
-              onNew={() => setNewSheetOpen(true)}
+              onNew={openNewSheet}
               onSearch={openSearch}
             />
             {!embedded ? (
diff --git a/packages/app/features/buckets/bucketUploadReconciliation.test.ts b/packages/app/features/buckets/bucketUploadReconciliation.test.ts
new file mode 100644
index 0000000000..c28e27c825
--- /dev/null
+++ b/packages/app/features/buckets/bucketUploadReconciliation.test.ts
@@ -0,0 +1,167 @@
+import type { BucketsSnapshot } from '@tloncorp/api';
+import { describe, expect, it } from 'vitest';
+
+import { reconcileUploadsWithSnapshot } from './bucketUploadReconciliation';
+
+const snapshot = {
+  flag: { host: '~zod', name: 'project-files' },
+  state: {
+    bucket: {
+      createdAt: 1,
+      createdBy: '~zod',
+      id: 1,
+      title: 'Project Files',
+      updatedAt: 1,
+      updatedBy: '~zod',
+    },
+    entries: [
+      {
+        createdAt: 1,
+        createdBy: '~zod',
+        file: {
+          checksum: null,
+          mime: 'image/heic',
+          objectKey: 'first',
+          objectUrl: null,
+          size: 42,
+          status: 'pending',
+        },
+        id: 10,
+        kind: 'file',
+        name: 'IMG_0111.heic',
+        parentId: null,
+        updatedAt: 1,
+        updatedBy: '~zod',
+      },
+    ],
+    group: { host: '~zod', name: 'group' },
+    readers: ['member'],
+    revision: 2,
+    sessions: [
+      {
+        createdAt: 1,
+        error: null,
+        expiresAt: 2,
+        fileId: 10,
+        id: 'new-session',
+        requestedBy: '~zod',
+        status: 'pending',
+      },
+    ],
+    writers: ['admin'],
+  },
+} satisfies BucketsSnapshot;
+
+describe('reconcileUploadsWithSnapshot', () => {
+  it('associates the optimistic upload with the matching ship entry', () => {
+    const upload = {
+      candidate: {
+        mimeType: 'image/heic',
+        name: 'IMG_0111.heic',
+        size: 42,
+      },
+      id: 'local-upload',
+      parentId: null,
+      priorSessionIds: ['old-session'],
+    };
+
+    expect(reconcileUploadsWithSnapshot([upload], snapshot, '~zod')).toEqual([
+      {
+        ...upload,
+        serverEntryId: 10,
+        sessionId: 'new-session',
+      },
+    ]);
+  });
+
+  it('does not associate an entry from a session that predates the upload', () => {
+    const upload = {
+      candidate: {
+        mimeType: 'image/heic',
+        name: 'IMG_0111.heic',
+        size: 42,
+      },
+      id: 'local-upload',
+      parentId: null,
+      priorSessionIds: ['new-session'],
+    };
+
+    expect(reconcileUploadsWithSnapshot([upload], snapshot, '~zod')[0]).toBe(
+      upload
+    );
+  });
+
+  it('does not associate an upload session requested by another member', () => {
+    const upload = {
+      candidate: {
+        mimeType: 'image/heic',
+        name: 'IMG_0111.heic',
+        size: 42,
+      },
+      id: 'local-upload',
+      parentId: null,
+      priorSessionIds: [] as string[],
+    };
+
+    expect(
+      reconcileUploadsWithSnapshot([upload], snapshot, '~other-member')[0]
+    ).toBe(upload);
+  });
+
+  it('matches identical concurrent uploads one-to-one', () => {
+    const secondSnapshot: BucketsSnapshot = {
+      ...snapshot,
+      state: {
+        ...snapshot.state,
+        entries: [
+          ...snapshot.state.entries,
+          {
+            ...snapshot.state.entries[0],
+            id: 11,
+            file: { ...snapshot.state.entries[0].file, objectKey: 'second' },
+          },
+        ],
+        sessions: [
+          ...snapshot.state.sessions,
+          {
+            ...snapshot.state.sessions[0],
+            fileId: 11,
+            id: 'second-session',
+          },
+        ],
+      },
+    };
+    const uploads = [
+      {
+        candidate: {
+          mimeType: 'image/heic',
+          name: 'IMG_0111.heic',
+          size: 42,
+        },
+        id: 'first-local-upload',
+        parentId: null,
+        priorSessionIds: [] as string[],
+      },
+      {
+        candidate: {
+          mimeType: 'image/heic',
+          name: 'IMG_0111.heic',
+          size: 42,
+        },
+        id: 'second-local-upload',
+        parentId: null,
+        priorSessionIds: [] as string[],
+      },
+    ];
+
+    const reconciled = reconcileUploadsWithSnapshot(
+      uploads,
+      secondSnapshot,
+      '~zod'
+    );
+    expect(reconciled).toMatchObject([
+      { serverEntryId: 10, sessionId: 'new-session' },
+      { serverEntryId: 11, sessionId: 'second-session' },
+    ]);
+  });
+});
diff --git a/packages/app/features/buckets/bucketUploadReconciliation.ts b/packages/app/features/buckets/bucketUploadReconciliation.ts
new file mode 100644
index 0000000000..25e487fa36
--- /dev/null
+++ b/packages/app/features/buckets/bucketUploadReconciliation.ts
@@ -0,0 +1,69 @@
+import type { BucketsSnapshot } from '@tloncorp/api';
+
+type ReconcileableUpload = {
+  candidate: {
+    mimeType?: string;
+    name: string;
+    size: number;
+  };
+  parentId: number | null;
+  priorSessionIds?: readonly string[];
+  serverEntryId?: number;
+  sessionId?: string;
+};
+
+export function reconcileUploadsWithSnapshot<T extends ReconcileableUpload>(
+  uploads: T[],
+  snapshot: BucketsSnapshot,
+  requestedBy: string
+): T[] {
+  const usedEntryIds = new Set(
+    uploads
+      .map((upload) => upload.serverEntryId)
+      .filter((id): id is number => id !== undefined)
+  );
+  let changed = false;
+
+  const reconciled = uploads.map((upload) => {
+    if (upload.serverEntryId !== undefined || !upload.priorSessionIds) {
+      return upload;
+    }
+
+    const priorSessionIds = new Set(upload.priorSessionIds);
+    const entry = snapshot.state.entries.find(
+      (candidate) =>
+        candidate.kind === 'file' &&
+        !usedEntryIds.has(candidate.id) &&
+        candidate.parentId === upload.parentId &&
+        candidate.name === upload.candidate.name &&
+        candidate.file.mime ===
+          (upload.candidate.mimeType ?? 'application/octet-stream') &&
+        candidate.file.size === upload.candidate.size &&
+        snapshot.state.sessions.some(
+          (session) =>
+            session.fileId === candidate.id &&
+            session.requestedBy === requestedBy &&
+            !priorSessionIds.has(session.id)
+        )
+    );
+    if (!entry) return upload;
+
+    const session = snapshot.state.sessions.find(
+      (candidate) =>
+        candidate.fileId === entry.id &&
+        candidate.requestedBy === requestedBy &&
+        !priorSessionIds.has(candidate.id)
+    );
+    if (!session) return upload;
+
+    changed = true;
+    usedEntryIds.add(entry.id);
+    return {
+      ...upload,
+      serverEntryId: entry.id,
+      sessionId: session.id,
+    };
+  });
+
+  return changed ? reconciled : uploads;
+}
diff --git a/packages/app/features/buckets/useLiveBucket.ts b/packages/app/features/buckets/useLiveBucket.ts
index ad7098fe62..6cd2af7aae 100644
--- a/packages/app/features/buckets/useLiveBucket.ts
+++ b/packages/app/features/buckets/useLiveBucket.ts
@@ -28,6 +28,13 @@ import * as db from '@tloncorp/shared/db';
 import { useCallback, useEffect, useMemo, useRef, useState } from 'react';
 
 import type { BucketItem, BucketUploadCandidate } from '../../ui';
+import {
+  calculateBucketUploadProgress,
+  completeBucketUploadInBatch,
+  removeBucketUploadFromBatch,
+} from '../../utils/bucketUploadProgress';
+import type { BucketUploadBatchItem } from '../../utils/bucketUploadProgress';
+import { reconcileUploadsWithSnapshot } from './bucketUploadReconciliation';
 import { createBucketUploadTask } from './bucketUploadTask';
 import type { BucketUploadTask } from './bucketUploadTask.types';
 
@@ -40,6 +47,7 @@ type LocalUpload = {
   id: string;
   parentId: number | null;
   progress: number;
+  priorSessionIds?: string[];
   serverEntryId?: number;
   sessionId?: string;
   state: 'queued' | 'uploading' | 'failed';
@@ -158,12 +166,18 @@ export function useLiveBucket(requestedFlag: BucketsFlag) {
   const [loading, setLoading] = useState(true);
   const [error, setError] = useState<string | null>(null);
   const [uploads, setUploads] = useState<LocalUpload[]>([]);
+  const [uploadBatch, setUploadBatch] = useState<BucketUploadBatchItem[]>([]);
   const snapshotRef = useRef<BucketsSnapshot | null>(null);
   const tasksRef = useRef(new Map<string, BucketUploadTask>());
   const cancelledRef = useRef(new Set<string>());
 
   const commitSnapshot = useCallback((next: BucketsSnapshot | null) => {
     snapshotRef.current = next;
+    if (next) {
+      setUploads((current) =>
+        reconcileUploadsWithSnapshot(current, next, getCurrentUserId())
+      );
+    }
     setSnapshot(next);
     if (next) {
       const channelId = formatBucketsChannelId(next.flag);
@@ -241,6 +255,24 @@ export function useLiveBucket(requestedFlag: BucketsFlag) {
           upload.id === id ? { ...upload, ...patch } : upload
         )
       );
+      if (patch.progress !== undefined || patch.state !== undefined) {
+        setUploadBatch((current) =>
+          current.map((item) =>
+            item.id === id
+              ? {
+                  ...item,
+                  progress: patch.progress ?? item.progress,
+                  state:
+                    patch.state === undefined
+                      ? item.state
+                      : patch.state === 'failed'
+                        ? 'failed'
+                        : 'active',
+                }
+              : item
+          )
+        );
+      }
     },
     []
   );
@@ -318,6 +350,7 @@ export function useLiveBucket(requestedFlag: BucketsFlag) {
             capability,
             error: undefined,
             progress: 1,
+            priorSessionIds: [...priorSessionIds],
             state: 'uploading',
           });
           await sendBucketsAction({
@@ -404,6 +437,7 @@ export function useLiveBucket(requestedFlag: BucketsFlag) {
         }
         updateLocalUpload(id, { progress: 100 });
         await refresh();
+        setUploadBatch((current) => completeBucketUploadInBatch(current, id));
         setUploads((currentUploads) =>
           currentUploads.filter((candidateUpload) => candidateUpload.id !== id)
         );
@@ -436,36 +470,80 @@ export function useLiveBucket(requestedFlag: BucketsFlag) {
   const addUploads = useCallback(
     (candidates: BucketUploadCandidate[], parentId: number | null) => {
       const now = Date.now();
-      candidates.forEach((candidate, index) => {
-        const upload: LocalUpload = {
+      const nextUploads = candidates.map(
+        (candidate, index): LocalUpload => ({
           candidate,
           id: `local-upload-${now}-${index}`,
           parentId,
           progress: 0,
           state: 'queued',
-        };
-        setUploads((current) => [...current, upload]);
-        void runUpload(upload);
-      });
+        })
+      );
+      setUploads((current) => [...current, ...nextUploads]);
+      setUploadBatch((current) => [
+        ...current,
+        ...nextUploads.map((upload) => ({
+          id: upload.id,
+          progress: 0,
+          size: upload.candidate.size,
+          state: 'active' as const,
+        })),
+      ]);
+      nextUploads.forEach((upload) => void runUpload(upload));
     },
     [runUpload]
   );
 
   const cancelUpload = useCallback(
     async (id: string) => {
-      cancelledRef.current.add(id);
+      const upload = uploads.find((candidate) => candidate.id === id);
+      const parsedEntryId = Number(id);
+      const serverEntryId =
+        upload?.serverEntryId ??
+        (Number.isSafeInteger(parsedEntryId) && parsedEntryId >= 0
+          ? parsedEntryId
+          : undefined);
+      const sessionId =
+        upload?.sessionId ??
+        snapshotRef.current?.state.sessions.find(
+          (session) =>
+            session.fileId === serverEntryId && session.status === 'pending'
+        )?.id;
+
+      if (upload) {
+        cancelledRef.current.add(id);
+      }
       await tasksRef.current
         .get(id)
         ?.cancel()
         .catch(() => undefined);
       tasksRef.current.delete(id);
-      const upload = uploads.find((candidate) => candidate.id === id);
-      if (upload?.sessionId) {
+
+      setUploads((current) =>
+        current.filter((candidate) => candidate.id !== id)
+      );
+      setUploadBatch((current) => removeBucketUploadFromBatch(current, id));
+      if (serverEntryId !== undefined && snapshotRef.current) {
+        commitSnapshot({
+          ...snapshotRef.current,
+          state: {
+            ...snapshotRef.current.state,
+            entries: snapshotRef.current.state.entries.filter(
+              (entry) => entry.id !== serverEntryId
+            ),
+            sessions: snapshotRef.current.state.sessions.filter(
+              (session) => session.fileId !== serverEntryId
+            ),
+          },
+        });
+      }
+
+      if (sessionId) {
         await sendBucketsAction({
           type: 'fail-upload',
           flag,
           reason: 'Cancelled',
-          sessionId: upload.sessionId,
+          sessionId,
         }).catch(() => undefined);
       }
       if (upload?.brokerReservationId) {
@@ -473,20 +551,17 @@ export function useLiveBucket(requestedFlag: BucketsFlag) {
           () => undefined
         );
       }
-      if (upload?.serverEntryId) {
+      if (serverEntryId !== undefined) {
         await sendBucketsAction({
           type: 'delete-entry',
           flag,
-          id: upload.serverEntryId,
+          id: serverEntryId,
           recursive: false,
         }).catch(() => undefined);
       }
-      setUploads((current) =>
-        current.filter((candidate) => candidate.id !== id)
-      );
       void refresh();
     },
-    [flag, refresh, uploads]
+    [commitSnapshot, flag, refresh, uploads]
   );
 
   const retryUpload = useCallback(
@@ -516,6 +591,7 @@ export function useLiveBucket(requestedFlag: BucketsFlag) {
           : undefined,
         capability: isPrivateRetry ? upload.capability : undefined,
         progress: 0,
+        priorSessionIds: isPrivateRetry ? upload.priorSessionIds : undefined,
         serverEntryId: isPrivateRetry ? upload.serverEntryId : undefined,
         sessionId: isPrivateRetry ? upload.sessionId : undefined,
         state: 'queued' as const,
@@ -523,6 +599,13 @@ export function useLiveBucket(requestedFlag: BucketsFlag) {
       setUploads((current) =>
         current.map((candidate) => (candidate.id === id ? next : candidate))
       );
+      setUploadBatch((current) =>
+        current.map((item) =>
+          item.id === id
+            ? { ...item, progress: 0, state: 'active' as const }
+            : item
+        )
+      );
       void runUpload(next);
     },
     [flag, runUpload, uploads]
@@ -538,12 +621,20 @@ export function useLiveBucket(requestedFlag: BucketsFlag) {
         modifiedLabel: upload.state === 'failed' ? 'Failed' : 'Uploading',
         name: upload.candidate.name,
         sizeLabel: formatFileSize(upload.candidate.size),
+        uploadSize: upload.candidate.size,
         uploadError: upload.error,
         uploadProgress: upload.progress,
         uploadState: upload.state,
       })),
     [snapshot?.state.bucket.updatedBy, uploads]
   );
+  const uploadAggregateProgress = useMemo(
+    () =>
+      uploadBatch.length > 0
+        ? calculateBucketUploadProgress(uploadBatch)
+        : undefined,
+    [uploadBatch]
+  );
 
   return {
     addUploads,
@@ -613,6 +704,7 @@ export function useLiveBucket(requestedFlag: BucketsFlag) {
     refresh,
     retryUpload,
     snapshot,
+    uploadAggregateProgress,
     uploads,
   };
 }
diff --git a/packages/app/fixtures/BucketsChannel.fixture.tsx b/packages/app/fixtures/BucketsChannel.fixture.tsx
index d055a5a791..46cf012165 100644
--- a/packages/app/fixtures/BucketsChannel.fixture.tsx
+++ b/packages/app/fixtures/BucketsChannel.fixture.tsx
@@ -135,6 +135,7 @@ const sampleUploadQueue: BucketItem[] = [
       'image/jpeg'
     ),
     uploadProgress: 62,
+    uploadSize: 4.8 * 1024 * 1024,
     uploadState: 'uploading',
   },
   {
@@ -147,6 +148,7 @@ const sampleUploadQueue: BucketItem[] = [
       'application/zip'
     ),
     uploadProgress: 0,
+    uploadSize: 184 * 1024 * 1024,
     uploadState: 'queued',
   },
   {
@@ -159,6 +161,7 @@ const sampleUploadQueue: BucketItem[] = [
       'application/pdf'
     ),
     uploadError: 'Connection lost',
+    uploadSize: 8.1 * 1024 * 1024,
     uploadState: 'failed',
   },
 ];
@@ -359,6 +362,7 @@ function BucketsFixture({
         ),
         uploadError: uploadState === 'failed' ? 'Connection lost' : undefined,
         uploadProgress: uploadState === 'failed' ? undefined : index * 22 + 18,
+        uploadSize: candidate.size,
         uploadState,
       };
     });
diff --git a/packages/app/ui/components/BucketsChannel/BucketFileViewer.native.tsx b/packages/app/ui/components/BucketsChannel/BucketFileViewer.native.tsx
index f55bbf02dd..84de4650f7 100644
--- a/packages/app/ui/components/BucketsChannel/BucketFileViewer.native.tsx
+++ b/packages/app/ui/components/BucketsChannel/BucketFileViewer.native.tsx
@@ -2,7 +2,7 @@ import { FilePreview, Image, Pressable, Text } from '@tloncorp/ui';
 import { VideoView, useVideoPlayer } from 'expo-video';
 import { Platform } from 'react-native';
 import { WebView } from 'react-native-webview';
-import { ScrollView, View, YStack } from 'tamagui';
+import { ScrollView, Spinner, View, YStack } from 'tamagui';
 
 import { useWebView } from '../../../hooks/useWebview';
 import { ScreenHeader } from '../ScreenHeader';
@@ -12,13 +12,19 @@ import {
 } from './BucketFileViewer.shared';
 
 export function BucketFileViewer({
+  error,
   item,
+  loading = false,
   onClose,
   onOpenExternally,
+  onRetry,
 }: {
+  error?: string | null;
   item: BucketFileViewerItem;
+  loading?: boolean;
   onClose: () => void;
-  onOpenExternally: () => void;
+  onOpenExternally?: () => void;
+  onRetry?: () => void;
 }) {
   const previewKind = getBucketPreviewKind(item);
   const webview = useWebView();
@@ -29,16 +35,24 @@ export function BucketFileViewer({
         backAction={onClose}
         borderBottom
         rightControls={
-          <ScreenHeader.TextButton onPress={onOpenExternally}>
-            Open
-          </ScreenHeader.TextButton>
+          item.uri && onOpenExternally ? (
+            <ScreenHeader.TextButton onPress={onOpenExternally}>
+              Open
+            </ScreenHeader.TextButton>
+          ) : null
         }
         showSubtitle
         subtitle={item.sizeLabel ?? 'File'}
         title={item.name}
       />
       <View flex={1} minHeight={0} backgroundColor="$secondaryBackground">
-        {previewKind === 'image' ? (
+        {loading ? (
+          <LoadingPreview />
+        ) : error ? (
+          <FailedPreview onRetry={onRetry} />
+        ) : !item.uri ? (
+          <FailedPreview onRetry={onRetry} />
+        ) : previewKind === 'image' ? (
           <Image
             source={{ uri: item.uri }}
             width="100%"
@@ -50,7 +64,7 @@ export function BucketFileViewer({
           <NativeVideoPreview uri={item.uri} />
         ) : previewKind === 'pdf' && Platform.OS === 'ios' && webview ? (
           <WebView webview={webview} source={{ uri: item.uri }} />
-        ) : previewKind === 'text' && item.textContent ? (
+        ) : previewKind === 'text' && item.textContent !== undefined ? (
           <ScrollView flex={1}>
             <Text
               color="$primaryText"
@@ -75,6 +89,51 @@ export function BucketFileViewer({
   );
 }
 
+function LoadingPreview() {
+  return (
+    <YStack flex={1} alignItems="center" justifyContent="center" gap="$m">
+      <Spinner size="large" color="$secondaryText" />
+      <Text color="$secondaryText" size="$label/m">
+        Loading file…
+      </Text>
+    </YStack>
+  );
+}
+
+function FailedPreview({ onRetry }: { onRetry?: () => void }) {
+  return (
+    <YStack
+      flex={1}
+      alignItems="center"
+      justifyContent="center"
+      gap="$l"
+      padding="$2xl"
+    >
+      <YStack alignItems="center" gap="$xs">
+        <Text color="$primaryText" size="$label/l">
+          Couldn’t load this file
+        </Text>
+        <Text color="$tertiaryText" size="$label/m" textAlign="center">
+          Check your connection and try again.
+        </Text>
+      </YStack>
+      {onRetry ? (
+        <Pressable
+          backgroundColor="$primaryText"
+          borderRadius="$xl"
+          onPress={onRetry}
+          paddingHorizontal="$xl"
+          paddingVertical="$m"
+        >
+          <Text color="$background" size="$label/l">
+            Try again
+          </Text>
+        </Pressable>
+      ) : null}
+    </YStack>
+  );
+}
+
 function NativeVideoPreview({ uri }: { uri: string }) {
   const player = useVideoPlayer({ uri }, (videoPlayer) => {
     videoPlayer.play();
@@ -99,7 +158,7 @@ function UnsupportedPreview({
 }: {
   isAndroidPdf: boolean;
   item: BucketFileViewerItem;
-  onOpen: () => void;
+  onOpen?: () => void;
 }) {
   return (
     <YStack
@@ -128,17 +187,19 @@ function UnsupportedPreview({
             : 'Open this file in another app to view it.'}
         </Text>
       </YStack>
-      <Pressable
-        backgroundColor="$primaryText"
-        borderRadius="$xl"
-        onPress={onOpen}
-        paddingHorizontal="$xl"
-        paddingVertical="$m"
-      >
-        <Text color="$background" size="$label/l">
-          Open file
-        </Text>
-      </Pressable>
+      {onOpen ? (
+        <Pressable
+          backgroundColor="$primaryText"
+          borderRadius="$xl"
+          onPress={onOpen}
+          paddingHorizontal="$xl"
+          paddingVertical="$m"
+        >
+          <Text color="$background" size="$label/l">
+            Open file
+          </Text>
+        </Pressable>
+      ) : null}
     </YStack>
   );
 }
diff --git a/packages/app/ui/components/BucketsChannel/BucketFileViewer.shared.ts b/packages/app/ui/components/BucketsChannel/BucketFileViewer.shared.ts
index 9f5ed91d5e..2b40fca8d0 100644
--- a/packages/app/ui/components/BucketsChannel/BucketFileViewer.shared.ts
+++ b/packages/app/ui/components/BucketsChannel/BucketFileViewer.shared.ts
@@ -9,7 +9,7 @@ export type BucketFileViewerItem = {
   name: string;
   mimeType?: string;
   sizeLabel?: string;
-  uri: string;
+  uri?: string;
   textContent?: string;
 };
 
diff --git a/packages/app/ui/components/BucketsChannel/BucketFileViewer.tsx b/packages/app/ui/components/BucketsChannel/BucketFileViewer.tsx
index 7d6d44107b..fc56a8c9ff 100644
--- a/packages/app/ui/components/BucketsChannel/BucketFileViewer.tsx
+++ b/packages/app/ui/components/BucketsChannel/BucketFileViewer.tsx
@@ -1,5 +1,5 @@
 import { FilePreview, Image, Pressable, Text } from '@tloncorp/ui';
-import { ScrollView, View, YStack } from 'tamagui';
+import { ScrollView, Spinner, View, YStack } from 'tamagui';
 
 import { ScreenHeader } from '../ScreenHeader';
 import {
@@ -8,13 +8,19 @@ import {
 } from './BucketFileViewer.shared';
 
 export function BucketFileViewer({
+  error,
   item,
+  loading = false,
   onClose,
   onOpenExternally,
+  onRetry,
 }: {
+  error?: string | null;
   item: BucketFileViewerItem;
+  loading?: boolean;
   onClose: () => void;
-  onOpenExternally: () => void;
+  onOpenExternally?: () => void;
+  onRetry?: () => void;
 }) {
   const previewKind = getBucketPreviewKind(item);
 
@@ -24,9 +30,11 @@ export function BucketFileViewer({
         backAction={onClose}
         borderBottom
         rightControls={
-          <ScreenHeader.TextButton onPress={onOpenExternally}>
-            Open
-          </ScreenHeader.TextButton>
+          item.uri && onOpenExternally ? (
+            <ScreenHeader.TextButton onPress={onOpenExternally}>
+              Open
+            </ScreenHeader.TextButton>
+          ) : null
         }
         showSubtitle
         subtitle={item.sizeLabel ?? 'File'}
@@ -34,7 +42,13 @@ export function BucketFileViewer({
         useHorizontalTitleLayout
       />
       <View flex={1} minHeight={0} backgroundColor="$secondaryBackground">
-        {previewKind === 'image' ? (
+        {loading ? (
+          <LoadingPreview />
+        ) : error ? (
+          <FailedPreview onRetry={onRetry} />
+        ) : !item.uri ? (
+          <FailedPreview onRetry={onRetry} />
+        ) : previewKind === 'image' ? (
           <Image
             source={{ uri: item.uri }}
             width="100%"
@@ -62,7 +76,7 @@ export function BucketFileViewer({
             title={item.name}
             style={{ border: 0, height: '100%', width: '100%' }}
           />
-        ) : previewKind === 'text' && item.textContent ? (
+        ) : previewKind === 'text' && item.textContent !== undefined ? (
           <ScrollView flex={1}>
             <Text
               color="$primaryText"
@@ -83,12 +97,57 @@ export function BucketFileViewer({
   );
 }
 
+function LoadingPreview() {
+  return (
+    <YStack flex={1} alignItems="center" justifyContent="center" gap="$m">
+      <Spinner size="large" color="$secondaryText" />
+      <Text color="$secondaryText" size="$label/m">
+        Loading file…
+      </Text>
+    </YStack>
+  );
+}
+
+function FailedPreview({ onRetry }: { onRetry?: () => void }) {
+  return (
+    <YStack
+      flex={1}
+      alignItems="center"
+      justifyContent="center"
+      gap="$l"
+      padding="$2xl"
+    >
+      <YStack alignItems="center" gap="$xs">
+        <Text color="$primaryText" size="$label/l">
+          Couldn’t load this file
+        </Text>
+        <Text color="$tertiaryText" size="$label/m" textAlign="center">
+          Check your connection and try again.
+        </Text>
+      </YStack>
+      {onRetry ? (
+        <Pressable
+          backgroundColor="$primaryText"
+          borderRadius="$xl"
+          onPress={onRetry}
+          paddingHorizontal="$xl"
+          paddingVertical="$m"
+        >
+          <Text color="$background" size="$label/l">
+            Try again
+          </Text>
+        </Pressable>
+      ) : null}
+    </YStack>
+  );
+}
+
 function UnsupportedPreview({
   item,
   onOpen,
 }: {
   item: BucketFileViewerItem;
-  onOpen: () => void;
+  onOpen?: () => void;
 }) {
   return (
     <YStack
@@ -115,17 +174,19 @@ function UnsupportedPreview({
           Open this file in another app to view it.
         </Text>
       </YStack>
-      <Pressable
-        backgroundColor="$primaryText"
-        borderRadius="$xl"
-        onPress={onOpen}
-        paddingHorizontal="$xl"
-        paddingVertical="$m"
-      >
-        <Text color="$background" size="$label/l">
-          Open file
-        </Text>
-      </Pressable>
+      {onOpen ? (
+        <Pressable
+          backgroundColor="$primaryText"
+          borderRadius="$xl"
+          onPress={onOpen}
+          paddingHorizontal="$xl"
+          paddingVertical="$m"
+        >
+          <Text color="$background" size="$label/l">
+            Open file
+          </Text>
+        </Pressable>
+      ) : null}
     </YStack>
   );
 }
diff --git a/packages/app/ui/components/BucketsChannel/BucketsChannel.tsx b/packages/app/ui/components/BucketsChannel/BucketsChannel.tsx
index 189c80ea49..39643ea028 100644
--- a/packages/app/ui/components/BucketsChannel/BucketsChannel.tsx
+++ b/packages/app/ui/components/BucketsChannel/BucketsChannel.tsx
@@ -11,6 +11,7 @@ import { Platform } from 'react-native';
 import { useSafeAreaInsets } from 'react-native-safe-area-context';
 import { ScrollView, View, XStack, YStack } from 'tamagui';
 
+import { calculateBucketUploadProgress } from '../../../utils/bucketUploadProgress';
 import { ActionSheet, createActionGroups } from '../ActionSheet';
 import { Badge } from '../Badge';
 import { TextInput } from '../Form';
@@ -38,6 +39,7 @@ export type BucketItem = {
   textContent?: string;
   uploadError?: string;
   uploadProgress?: number;
+  uploadSize?: number;
   uploadState?: BucketUploadState;
 };
 
@@ -208,6 +210,8 @@ export function BucketsPane({
   rootLabel = 'Project Files',
   selectedItemId,
   state = 'populated',
+  uploadAggregateProgress,
+  uploadItems,
   onDeleteItem,
   onDownloadItem,
   onCancelUpload,
@@ -224,6 +228,8 @@ export function BucketsPane({
   rootLabel?: string;
   selectedItemId?: string | null;
   state?: BucketsPaneState;
+  uploadAggregateProgress?: number;
+  uploadItems?: BucketItem[];
   onDeleteItem?: (item: BucketItem) => void;
   onDownloadItem?: (item: BucketItem) => void;
   onCancelUpload?: (item: BucketItem) => void;
@@ -238,7 +244,7 @@ export function BucketsPane({
   const selectedIndex = selectedItemId
     ? items.findIndex((item) => item.id === selectedItemId)
     : -1;
-  const uploadItems = items.filter((item) => uploadStateFor(item));
+  const trayItems = uploadItems ?? items.filter((item) => uploadStateFor(item));
 
   useEffect(() => {
     if (selectedIndex < 0 || !viewportHeight) {
@@ -312,9 +318,10 @@ export function BucketsPane({
             {list}
           </YStack>
         </ScrollView>
-        {uploadItems.length > 0 ? (
+        {trayItems.length > 0 ? (
           <BucketsUploadTray
-            items={uploadItems}
+            aggregateProgress={uploadAggregateProgress}
+            items={trayItems}
             onRetryUpload={onRetryUpload}
           />
         ) : null}
@@ -826,9 +833,11 @@ function UploadProgress({ progress }: { progress: number }) {
 }
 
 function BucketsUploadTray({
+  aggregateProgress,
   items,
   onRetryUpload,
 }: {
+  aggregateProgress?: number;
   items: BucketItem[];
   onRetryUpload?: (item: BucketItem) => void;
 }) {
@@ -836,14 +845,13 @@ function BucketsUploadTray({
   const failedItems = items.filter((item) => uploadStateFor(item) === 'failed');
   const activeItems = items.filter((item) => uploadStateFor(item) !== 'failed');
   const activeProgress =
-    activeItems.length === 0
-      ? 0
-      : Math.round(
-          activeItems.reduce(
-            (sum, item) => sum + (item.uploadProgress ?? 0),
-            0
-          ) / activeItems.length
-        );
+    aggregateProgress ??
+    calculateBucketUploadProgress(
+      activeItems.map((item) => ({
+        progress: item.uploadProgress ?? 0,
+        size: item.uploadSize ?? 0,
+      }))
+    );
   const title =
     activeItems.length > 0
       ? `${activeItems.length} ${
diff --git a/packages/app/ui/components/Channel/ChannelHeader.tsx b/packages/app/ui/components/Channel/ChannelHeader.tsx
index 26d4afe24e..4f3f387c25 100644
--- a/packages/app/ui/components/Channel/ChannelHeader.tsx
+++ b/packages/app/ui/components/Channel/ChannelHeader.tsx
@@ -9,6 +9,7 @@ import {
   useCallback,
   useContext,
   useEffect,
+  useLayoutEffect,
   useMemo,
   useState,
 } from 'react';
@@ -27,7 +28,9 @@ import {
 } from './ChannelHeader.helpers';
 
 export interface ChannelHeaderItemsContextValue {
+  registerHeaderHider: () => { remove: () => void };
   registerItem: (options: { item: ReactElement }) => { remove: () => void };
+  headerHidden: boolean;
   setLoadingSubtitle: (subtitle: string | null) => void;
   items: readonly ReactElement[];
   loadingSubtitle: string | null;
@@ -52,6 +55,7 @@ export function ChannelHeaderItemsProvider({
   children: ReactElement;
 }) {
   const [items, setItems] = useState<ReactElement[]>([]);
+  const [headerHiderCount, setHeaderHiderCount] = useState(0);
   const [loadingSubtitle, setLoadingSubtitle] = useState<string | null>(null);
   const registerItem = useCallback(
     ({ item }: { item: ReactElement }) => {
@@ -64,15 +68,45 @@ export function ChannelHeaderItemsProvider({
     },
     [setItems]
   );
+  const registerHeaderHider = useCallback(() => {
+    let removed = false;
+    setHeaderHiderCount((count) => count + 1);
+    return {
+      remove: () => {
+        if (removed) return;
+        removed = true;
+        setHeaderHiderCount((count) => Math.max(0, count - 1));
+      },
+    };
+  }, []);
   return (
     <ChannelHeaderItemsContext.Provider
-      value={{ registerItem, setLoadingSubtitle, items, loadingSubtitle }}
+      value={{
+        registerHeaderHider,
+        registerItem,
+        headerHidden: headerHiderCount > 0,
+        setLoadingSubtitle,
+        items,
+        loadingSubtitle,
+      }}
     >
       {children}
     </ChannelHeaderItemsContext.Provider>
   );
 }
 
+export function useHideChannelHeader(hidden: boolean) {
+  const registerHeaderHider = useContext(
+    ChannelHeaderItemsContext
+  )?.registerHeaderHider;
+
+  useLayoutEffect(() => {
+    if (!hidden || !registerHeaderHider) return;
+    const { remove } = registerHeaderHider();
+    return remove;
+  }, [hidden, registerHeaderHider]);
+}
+
 export function useRegisterChannelHeaderItem(item: ReactElement | null) {
   const registerItem = useContext(ChannelHeaderItemsContext)?.registerItem;
 
@@ -372,6 +406,10 @@ export function ChannelHeader({
     return undefined;
   }, [channel.type, goToProfile, goToChatDetails]);
 
+  if (context?.headerHidden) {
+    return null;
+  }
+
   return (
     <ScreenHeader
       title={headerTitle}
diff --git a/packages/app/ui/components/ScreenHeader.tsx b/packages/app/ui/components/ScreenHeader.tsx
index 08ddee951c..68dc959300 100644
--- a/packages/app/ui/components/ScreenHeader.tsx
+++ b/packages/app/ui/components/ScreenHeader.tsx
@@ -48,6 +48,7 @@ export const ScreenHeaderComponent = ({
   borderBottom,
   onTitlePress,
   useHorizontalTitleLayout = false,
+  includeTopSafeArea = true,
   loadingSubtitle,
   testID,
 }: PropsWithChildren<{
@@ -62,6 +63,7 @@ export const ScreenHeaderComponent = ({
   borderBottom?: boolean;
   onTitlePress?: () => void;
   useHorizontalTitleLayout?: boolean;
+  includeTopSafeArea?: boolean;
   loadingSubtitle?: string | null;
   testID?: string;
 }>) => {
@@ -227,7 +229,7 @@ export const ScreenHeaderComponent = ({
 
   return (
     <View
-      paddingTop={top}
+      paddingTop={includeTopSafeArea ? top : 0}
       zIndex={50}
       backgroundColor={backgroundColor ?? '$background'}
       borderColor="$border"
diff --git a/packages/app/utils/bucketUploadProgress.test.ts b/packages/app/utils/bucketUploadProgress.test.ts
new file mode 100644
index 0000000000..1ab23152a4
--- /dev/null
+++ b/packages/app/utils/bucketUploadProgress.test.ts
@@ -0,0 +1,77 @@
+import { describe, expect, it } from 'vitest';
+
+import {
+  calculateBucketUploadProgress,
+  completeBucketUploadInBatch,
+  removeBucketUploadFromBatch,
+} from './bucketUploadProgress';
+
+describe('calculateBucketUploadProgress', () => {
+  it('weights each upload by its byte size', () => {
+    expect(
+      calculateBucketUploadProgress([
+        { progress: 60, size: 50 * 1024 * 1024 },
+        { progress: 100, size: 600 * 1024 },
+      ])
+    ).toBe(60);
+  });
+
+  it('falls back to an average when no item has a measurable size', () => {
+    expect(
+      calculateBucketUploadProgress([
+        { progress: 40, size: 0 },
+        { progress: 80, size: -1 },
+      ])
+    ).toBe(60);
+  });
+
+  it('clamps invalid progress values', () => {
+    expect(
+      calculateBucketUploadProgress([
+        { progress: -20, size: 1 },
+        { progress: 120, size: 1 },
+      ])
+    ).toBe(50);
+  });
+});
+
+describe('Bucket upload batch lifecycle', () => {
+  const activeBatch = [
+    { id: 'movie', progress: 60, size: 50_000_000, state: 'active' as const },
+    { id: 'photo', progress: 99, size: 600_000, state: 'active' as const },
+  ];
+
+  it('retains a completed upload while another upload is active', () => {
+    const withCompletedPhoto = completeBucketUploadInBatch(
+      activeBatch,
+      'photo'
+    );
+    expect(withCompletedPhoto).toEqual([
+      activeBatch[0],
+      { ...activeBatch[1], progress: 100, state: 'completed' },
+    ]);
+    expect(calculateBucketUploadProgress(withCompletedPhoto)).toBe(
+      calculateBucketUploadProgress(activeBatch)
+    );
+  });
+
+  it('clears the batch after its final upload completes', () => {
+    const withCompletedPhoto = completeBucketUploadInBatch(
+      activeBatch,
+      'photo'
+    );
+    expect(completeBucketUploadInBatch(withCompletedPhoto, 'movie')).toEqual(
+      []
+    );
+  });
+
+  it('clears completed history when the last active upload is cancelled', () => {
+    const withCompletedPhoto = completeBucketUploadInBatch(
+      activeBatch,
+      'photo'
+    );
+    expect(removeBucketUploadFromBatch(withCompletedPhoto, 'movie')).toEqual(
+      []
+    );
+  });
+});
diff --git a/packages/app/utils/bucketUploadProgress.ts b/packages/app/utils/bucketUploadProgress.ts
new file mode 100644
index 0000000000..f57ce3167f
--- /dev/null
+++ b/packages/app/utils/bucketUploadProgress.ts
@@ -0,0 +1,51 @@
+export type BucketUploadBatchItem = {
+  id: string;
+  progress: number;
+  size: number;
+  state: 'active' | 'completed' | 'failed';
+};
+
+function normalizedProgress(progress: number) {
+  return Math.max(0, Math.min(100, progress));
+}
+
+export function calculateBucketUploadProgress(
+  items: readonly Pick<BucketUploadBatchItem, 'progress' | 'size'>[]
+) {
+  if (items.length === 0) return 0;
+
+  const measurableItems = items.filter((item) => item.size > 0);
+  const totalBytes = measurableItems.reduce((sum, item) => sum + item.size, 0);
+  if (totalBytes > 0) {
+    const weightedProgress = measurableItems.reduce(
+      (sum, item) => sum + item.size * normalizedProgress(item.progress),
+      0
+    );
+    return Math.round(weightedProgress / totalBytes);
+  }
+
+  return Math.round(
+    items.reduce((sum, item) => sum + normalizedProgress(item.progress), 0) /
+      items.length
+  );
+}
+
+export function completeBucketUploadInBatch(
+  items: readonly BucketUploadBatchItem[],
+  id: string
+) {
+  const next = items.map((item) =>
+    item.id === id
+      ? { ...item, progress: 100, state: 'completed' as const }
+      : item
+  );
+  return next.every((item) => item.state === 'completed') ? [] : next;
+}
+
+export function removeBucketUploadFromBatch(
+  items: readonly BucketUploadBatchItem[],
+  id: string
+) {
+  const next = items.filter((item) => item.id !== id);
+  return next.every((item) => item.state === 'completed') ? [] : next;
+}

From b8b7c6d4568be70e5a85b286382e458277e68912 Mon Sep 17 00:00:00 2001
From: william arzt <bill@tlon.io>
Date: Tue, 11 Aug 2026 10:31:08 -0400
Subject: [PATCH 06/19] chore: scope Buckets product review

---
 apps/tlon-mobile/cosmos.imports.ts            | 393 ++++++++++--------
 .../screens/Onboarding/ShipLoginScreen.tsx    |   6 +-
 backend/click                                 |  15 +-
 scripts/buckets-live-check.mjs                |  48 ---
 scripts/buckets-live-e2e.mjs                  | 279 -------------
 scripts/buckets-live-upload-smoke.mjs         | 104 -----
 scripts/run-buckets-live-app.mjs              |  52 ---
 scripts/run-buckets-live-cosmos.mjs           |  54 ---
 8 files changed, 238 insertions(+), 713 deletions(-)
 delete mode 100644 scripts/buckets-live-check.mjs
 delete mode 100644 scripts/buckets-live-e2e.mjs
 delete mode 100644 scripts/buckets-live-upload-smoke.mjs
 delete mode 100644 scripts/run-buckets-live-app.mjs
 delete mode 100644 scripts/run-buckets-live-cosmos.mjs

diff --git a/apps/tlon-mobile/cosmos.imports.ts b/apps/tlon-mobile/cosmos.imports.ts
index d04f12b2a2..10dea07a5f 100644
--- a/apps/tlon-mobile/cosmos.imports.ts
+++ b/apps/tlon-mobile/cosmos.imports.ts
@@ -1,196 +1,265 @@
 // NOTE: This file is auto-generated by React Cosmos.
 // It imports all fixture and decorator modules, making them available to the
 // React Cosmos renderer along with the renderer config.
-
 import type { RendererConfig, UserModuleWrappers } from 'react-cosmos-core';
 
-import * as fixture0 from './../../packages/app/fixtures/A2UI.fixture';
-import * as fixture1 from './../../packages/app/fixtures/ActionSheet/AddGalleryPostSheet.fixture';
-import * as fixture2 from './../../packages/app/fixtures/ActionSheet/AttachmentSheet.fixture';
-import * as fixture3 from './../../packages/app/fixtures/ActionSheet/CreateChannelSheet.fixture';
-import * as fixture4 from './../../packages/app/fixtures/ActionSheet/EditSectionNameSheet.fixture';
-import * as fixture5 from './../../packages/app/fixtures/ActionSheet/GenericActionSheet.fixture';
-import * as fixture6 from './../../packages/app/fixtures/ActionSheet/GroupJoinRequestSheet.fixture';
-import * as fixture7 from './../../packages/app/fixtures/ActionSheet/GroupPreviewSheet.fixture';
-import * as fixture8 from './../../packages/app/fixtures/ActionSheet/ProfileSheet.fixture';
-import * as fixture9 from './../../packages/app/fixtures/Activity.fixture';
-import * as fixture10 from './../../packages/app/fixtures/AddContactsView.fixture';
-import * as fixture11 from './../../packages/app/fixtures/AttachmentPreviewList.fixture';
-import * as fixture12 from './../../packages/app/fixtures/AttestationPane.fixture';
+import * as fixture0 from './../../packages/app/fixtures/ActionSheet/AddGalleryPostSheet.fixture';
+import * as fixture1 from './../../packages/app/fixtures/ActionSheet/AttachmentSheet.fixture';
+import * as fixture2 from './../../packages/app/fixtures/ActionSheet/CreateChannelSheet.fixture';
+import * as fixture3 from './../../packages/app/fixtures/ActionSheet/EditSectionNameSheet.fixture';
+import * as fixture4 from './../../packages/app/fixtures/ActionSheet/GenericActionSheet.fixture';
+import * as fixture5 from './../../packages/app/fixtures/ActionSheet/GroupJoinRequestSheet.fixture';
+import * as fixture6 from './../../packages/app/fixtures/ActionSheet/GroupPreviewSheet.fixture';
+import * as fixture7 from './../../packages/app/fixtures/ActionSheet/ProfileSheet.fixture';
+import * as fixture8 from './../../packages/app/fixtures/Activity.fixture';
+import * as fixture9 from './../../packages/app/fixtures/AddContactsView.fixture';
+import * as fixture10 from './../../packages/app/fixtures/AttachmentPreviewList.fixture';
+import * as fixture11 from './../../packages/app/fixtures/AttestationPane.fixture';
 import * as fixture13 from './../../packages/app/fixtures/AudioRecorder.fixture';
 import * as fixture14 from './../../packages/app/fixtures/Avatar.fixture';
 import * as fixture15 from './../../packages/app/fixtures/BlockSectionList.fixture';
-import * as fixture16 from './../../packages/app/fixtures/BucketsChannel.fixture';
-import * as fixture17 from './../../packages/app/fixtures/BucketsChannel.live.fixture';
-import * as fixture18 from './../../packages/app/fixtures/Button.fixture';
-import * as fixture19 from './../../packages/app/fixtures/ButtonV2.fixture';
-import * as fixture20 from './../../packages/app/fixtures/Carousel.fixture';
-import * as fixture21 from './../../packages/app/fixtures/Channel.fixture';
-import * as fixture22 from './../../packages/app/fixtures/ChannelDivider.fixture';
-import * as fixture23 from './../../packages/app/fixtures/ChannelHeader.fixture';
-import * as fixture24 from './../../packages/app/fixtures/ChannelListItem.fixture';
-import * as fixture25 from './../../packages/app/fixtures/ChatMessage.fixture';
-import * as fixture26 from './../../packages/app/fixtures/ChatOptionsSheet.fixture';
-import * as fixture27 from './../../packages/app/fixtures/ConfirmDialog.fixture';
-import * as fixture28 from './../../packages/app/fixtures/ContactList.fixture';
-import * as fixture29 from './../../packages/app/fixtures/CreateChatSheet.fixture';
-import * as fixture30 from './../../packages/app/fixtures/DetailView/ChatDetailView.fixture';
-import * as fixture31 from './../../packages/app/fixtures/DetailView/GalleryDetailView.fixture';
-import * as fixture32 from './../../packages/app/fixtures/DetailView/NotebookDetailView.fixture';
-import * as fixture33 from './../../packages/app/fixtures/DmInviteOptions.fixture';
-import * as fixture34 from './../../packages/app/fixtures/EditProfileScreen.fixture';
+import * as fixture16 from './../../packages/app/fixtures/Button.fixture';
+import * as fixture17 from './../../packages/app/fixtures/ButtonV2.fixture';
+import * as fixture18 from './../../packages/app/fixtures/Carousel.fixture';
+import * as fixture19 from './../../packages/app/fixtures/Channel.fixture';
+import * as fixture21 from './../../packages/app/fixtures/ChannelDivider.fixture';
+import * as fixture22 from './../../packages/app/fixtures/ChannelHeader.fixture';
+import * as fixture23 from './../../packages/app/fixtures/ChannelListItem.fixture';
+import * as fixture24 from './../../packages/app/fixtures/ChatMessage.fixture';
+import * as fixture25 from './../../packages/app/fixtures/ChatOptionsSheet.fixture';
+import * as fixture26 from './../../packages/app/fixtures/ConfirmDialog.fixture';
+import * as fixture27 from './../../packages/app/fixtures/ContactList.fixture';
+import * as fixture28 from './../../packages/app/fixtures/CreateChatSheet.fixture';
+import * as fixture29 from './../../packages/app/fixtures/DetailView/ChatDetailView.fixture';
+import * as fixture30 from './../../packages/app/fixtures/DetailView/GalleryDetailView.fixture';
+import * as fixture31 from './../../packages/app/fixtures/DetailView/NotebookDetailView.fixture';
+import * as fixture32 from './../../packages/app/fixtures/DmInviteOptions.fixture';
+import * as fixture33 from './../../packages/app/fixtures/EditProfileScreen.fixture';
 import * as fixture35 from './../../packages/app/fixtures/EmptyChannelNotice.fixture';
 import * as fixture36 from './../../packages/app/fixtures/FacePile.fixture';
 import * as fixture37 from './../../packages/app/fixtures/Form.fixture';
 import * as fixture38 from './../../packages/app/fixtures/ForwardChannelListItem.fixture';
 import * as fixture39 from './../../packages/app/fixtures/GalleryPost.fixture';
-import * as fixture40 from './../../packages/app/fixtures/GestureMediaViewer.fixture';
-import * as fixture41 from './../../packages/app/fixtures/GroupListItem.fixture';
-import * as fixture42 from './../../packages/app/fixtures/Input.fixture';
-import * as fixture43 from './../../packages/app/fixtures/InviteFriendsToTlonButton.fixture';
-import * as fixture44 from './../../packages/app/fixtures/InviteUsersSheet.fixture';
-import * as fixture45 from './../../packages/app/fixtures/MediaImageViewer.fixture';
-import * as fixture46 from './../../packages/app/fixtures/MessageActions.fixture';
-import * as fixture47 from './../../packages/app/fixtures/MessageInput.fixture';
-import * as fixture48 from './../../packages/app/fixtures/MetaEditorScreen.fixture';
-import * as fixture49 from './../../packages/app/fixtures/NotebookPost.fixture';
-import * as fixture50 from './../../packages/app/fixtures/NotesChannel.fixture';
-import * as fixture51 from './../../packages/app/fixtures/Onboarding.fixture';
-import * as fixture52 from './../../packages/app/fixtures/ParentAgnosticKeyboardAvoidingView.fixture';
-import * as fixture53 from './../../packages/app/fixtures/PhoneNumberInput.fixture';
-import * as fixture54 from './../../packages/app/fixtures/PostErrorMessage.fixture';
-import * as fixture55 from './../../packages/app/fixtures/PostReference.fixture';
-import * as fixture56 from './../../packages/app/fixtures/PostScreen.fixture';
-import * as fixture57 from './../../packages/app/fixtures/Pressable.fixture';
-import * as fixture58 from './../../packages/app/fixtures/ProfileBlock.fixture';
-import * as fixture59 from './../../packages/app/fixtures/ProfileSheet.fixture';
-import * as fixture60 from './../../packages/app/fixtures/ProfileStatusSheet.fixture';
-import * as fixture61 from './../../packages/app/fixtures/ReactionsDisplay.fixture';
-import * as fixture62 from './../../packages/app/fixtures/ReferenceSkeleton.fixture';
-import * as fixture63 from './../../packages/app/fixtures/ScreenHeader.fixture';
-import * as fixture64 from './../../packages/app/fixtures/SearchBar.fixture';
-import * as fixture65 from './../../packages/app/fixtures/SplashSequence.fixture';
-import * as fixture66 from './../../packages/app/fixtures/StoppedNodePushSheet.fixture';
-import * as fixture67 from './../../packages/app/fixtures/StorageQuotaIndicator.fixture';
-import * as fixture68 from './../../packages/app/fixtures/SystemNotice.fixture';
-import * as fixture69 from './../../packages/app/fixtures/SystemNotices.fixture';
-import * as fixture70 from './../../packages/app/fixtures/Text.fixture';
-import * as fixture71 from './../../packages/app/fixtures/Toast.fixture';
-import * as fixture72 from './../../packages/app/fixtures/TwitterVerification.fixture';
-import * as fixture73 from './../../packages/app/fixtures/UserProfileScreen.fixture';
-import * as fixture74 from './../../packages/app/fixtures/VideoPreview.fixture';
-import * as fixture75 from './../../packages/app/fixtures/ViewReactionsSheet.fixture';
-import * as fixture76 from './../../packages/app/fixtures/Waveform.fixture';
-import * as fixture77 from './../../packages/app/fixtures/WayfindingNotices.fixture';
-import * as fixture78 from './../../packages/app/fixtures/WebAppSplashSheet.fixture';
-import * as fixture79 from './src/App.fixture';
-import * as fixture80 from './src/fixtures/InputToolbar.fixture';
-import * as fixture81 from './src/fixtures/Onboarding.fixture';
-import * as fixture82 from './src/fixtures/SetNicknameScreen.fixture';
-import * as fixture83 from './src/fixtures/TlonbotSetupScreen.fixture';
-
+import * as fixture40 from './../../packages/app/fixtures/GroupListItem.fixture';
+import * as fixture41 from './../../packages/app/fixtures/Input.fixture';
+import * as fixture42 from './../../packages/app/fixtures/InviteFriendsToTlonButton.fixture';
+import * as fixture43 from './../../packages/app/fixtures/InviteUsersSheet.fixture';
+import * as fixture44 from './../../packages/app/fixtures/MediaImageViewer.fixture';
+import * as fixture45 from './../../packages/app/fixtures/MessageActions.fixture';
+import * as fixture46 from './../../packages/app/fixtures/MessageInput.fixture';
+import * as fixture47 from './../../packages/app/fixtures/MetaEditorScreen.fixture';
+import * as fixture48 from './../../packages/app/fixtures/NotebookPost.fixture';
+import * as fixture49 from './../../packages/app/fixtures/Onboarding.fixture';
+import * as fixture50 from './../../packages/app/fixtures/ParentAgnosticKeyboardAvoidingView.fixture';
+import * as fixture51 from './../../packages/app/fixtures/PostErrorMessage.fixture';
+import * as fixture52 from './../../packages/app/fixtures/PostReference.fixture';
+import * as fixture53 from './../../packages/app/fixtures/PostScreen.fixture';
+import * as fixture54 from './../../packages/app/fixtures/Pressable.fixture';
+import * as fixture55 from './../../packages/app/fixtures/ProfileBlock.fixture';
+import * as fixture56 from './../../packages/app/fixtures/ProfileSheet.fixture';
+import * as fixture57 from './../../packages/app/fixtures/ProfileStatusSheet.fixture';
+import * as fixture58 from './../../packages/app/fixtures/ReferenceSkeleton.fixture';
+import * as fixture59 from './../../packages/app/fixtures/ScreenHeader.fixture';
+import * as fixture60 from './../../packages/app/fixtures/SearchBar.fixture';
+import * as fixture61 from './../../packages/app/fixtures/SplashSequence.fixture';
+import * as fixture62 from './../../packages/app/fixtures/StoppedNodePushSheet.fixture';
+import * as fixture63 from './../../packages/app/fixtures/StorageQuotaIndicator.fixture';
+import * as fixture65 from './../../packages/app/fixtures/SystemNotice.fixture';
+import * as fixture66 from './../../packages/app/fixtures/SystemNotices.fixture';
+import * as fixture67 from './../../packages/app/fixtures/Text.fixture';
+import * as fixture68 from './../../packages/app/fixtures/Toast.fixture';
+import * as fixture69 from './../../packages/app/fixtures/TwitterVerification.fixture';
+import * as fixture70 from './../../packages/app/fixtures/UserProfileScreen.fixture';
+import * as fixture71 from './../../packages/app/fixtures/VideoPreview.fixture';
+import * as fixture72 from './../../packages/app/fixtures/ViewReactionsSheet.fixture';
+import * as fixture73 from './../../packages/app/fixtures/Waveform.fixture';
+import * as fixture74 from './../../packages/app/fixtures/WayfindingNotices.fixture';
 import * as decorator0 from './../../packages/app/fixtures/cosmos.decorator';
+import * as fixture75 from './src/App.fixture';
+import * as fixture76 from './src/fixtures/InputToolbar.fixture';
+import * as fixture77 from './src/fixtures/Onboarding.fixture';
+import * as fixture78 from './src/fixtures/SetNicknameScreen.fixture';
 import * as decorator1 from './src/fixtures/cosmos.decorator';
 
 export const rendererConfig: RendererConfig = {
-  "webSocketUrl": "ws://192.168.1.61:5050",
-  "rendererUrl": null
+  webSocketUrl: 'ws://192.168.50.55:5003',
+  rendererUrl: null,
 };
 
 const fixtures = {
-  '../../packages/app/fixtures/A2UI.fixture.tsx': { module: fixture0 },
-  '../../packages/app/fixtures/ActionSheet/AddGalleryPostSheet.fixture.tsx': { module: fixture1 },
-  '../../packages/app/fixtures/ActionSheet/AttachmentSheet.fixture.tsx': { module: fixture2 },
-  '../../packages/app/fixtures/ActionSheet/CreateChannelSheet.fixture.tsx': { module: fixture3 },
-  '../../packages/app/fixtures/ActionSheet/EditSectionNameSheet.fixture.tsx': { module: fixture4 },
-  '../../packages/app/fixtures/ActionSheet/GenericActionSheet.fixture.tsx': { module: fixture5 },
-  '../../packages/app/fixtures/ActionSheet/GroupJoinRequestSheet.fixture.tsx': { module: fixture6 },
-  '../../packages/app/fixtures/ActionSheet/GroupPreviewSheet.fixture.tsx': { module: fixture7 },
-  '../../packages/app/fixtures/ActionSheet/ProfileSheet.fixture.tsx': { module: fixture8 },
-  '../../packages/app/fixtures/Activity.fixture.tsx': { module: fixture9 },
-  '../../packages/app/fixtures/AddContactsView.fixture.tsx': { module: fixture10 },
-  '../../packages/app/fixtures/AttachmentPreviewList.fixture.tsx': { module: fixture11 },
-  '../../packages/app/fixtures/AttestationPane.fixture.tsx': { module: fixture12 },
-  '../../packages/app/fixtures/AudioRecorder.fixture.tsx': { module: fixture13 },
+  '../../packages/app/fixtures/ActionSheet/AddGalleryPostSheet.fixture.tsx': {
+    module: fixture0,
+  },
+  '../../packages/app/fixtures/ActionSheet/AttachmentSheet.fixture.tsx': {
+    module: fixture1,
+  },
+  '../../packages/app/fixtures/ActionSheet/CreateChannelSheet.fixture.tsx': {
+    module: fixture2,
+  },
+  '../../packages/app/fixtures/ActionSheet/EditSectionNameSheet.fixture.tsx': {
+    module: fixture3,
+  },
+  '../../packages/app/fixtures/ActionSheet/GenericActionSheet.fixture.tsx': {
+    module: fixture4,
+  },
+  '../../packages/app/fixtures/ActionSheet/GroupJoinRequestSheet.fixture.tsx': {
+    module: fixture5,
+  },
+  '../../packages/app/fixtures/ActionSheet/GroupPreviewSheet.fixture.tsx': {
+    module: fixture6,
+  },
+  '../../packages/app/fixtures/ActionSheet/ProfileSheet.fixture.tsx': {
+    module: fixture7,
+  },
+  '../../packages/app/fixtures/Activity.fixture.tsx': { module: fixture8 },
+  '../../packages/app/fixtures/AddContactsView.fixture.tsx': {
+    module: fixture9,
+  },
+  '../../packages/app/fixtures/AttachmentPreviewList.fixture.tsx': {
+    module: fixture10,
+  },
+  '../../packages/app/fixtures/AttestationPane.fixture.tsx': {
+    module: fixture11,
+  },
+  '../../packages/app/fixtures/AudioRecorder.fixture.tsx': {
+    module: fixture13,
+  },
   '../../packages/app/fixtures/Avatar.fixture.tsx': { module: fixture14 },
-  '../../packages/app/fixtures/BlockSectionList.fixture.tsx': { module: fixture15 },
-  '../../packages/app/fixtures/BucketsChannel.fixture.tsx': { module: fixture16 },
-  '../../packages/app/fixtures/BucketsChannel.live.fixture.tsx': { module: fixture17 },
-  '../../packages/app/fixtures/Button.fixture.tsx': { module: fixture18 },
-  '../../packages/app/fixtures/ButtonV2.fixture.tsx': { module: fixture19 },
-  '../../packages/app/fixtures/Carousel.fixture.tsx': { module: fixture20 },
-  '../../packages/app/fixtures/Channel.fixture.tsx': { module: fixture21 },
-  '../../packages/app/fixtures/ChannelDivider.fixture.tsx': { module: fixture22 },
-  '../../packages/app/fixtures/ChannelHeader.fixture.tsx': { module: fixture23 },
-  '../../packages/app/fixtures/ChannelListItem.fixture.tsx': { module: fixture24 },
-  '../../packages/app/fixtures/ChatMessage.fixture.tsx': { module: fixture25 },
-  '../../packages/app/fixtures/ChatOptionsSheet.fixture.tsx': { module: fixture26 },
-  '../../packages/app/fixtures/ConfirmDialog.fixture.tsx': { module: fixture27 },
-  '../../packages/app/fixtures/ContactList.fixture.tsx': { module: fixture28 },
-  '../../packages/app/fixtures/CreateChatSheet.fixture.tsx': { module: fixture29 },
-  '../../packages/app/fixtures/DetailView/ChatDetailView.fixture.tsx': { module: fixture30 },
-  '../../packages/app/fixtures/DetailView/GalleryDetailView.fixture.tsx': { module: fixture31 },
-  '../../packages/app/fixtures/DetailView/NotebookDetailView.fixture.tsx': { module: fixture32 },
-  '../../packages/app/fixtures/DmInviteOptions.fixture.tsx': { module: fixture33 },
-  '../../packages/app/fixtures/EditProfileScreen.fixture.tsx': { module: fixture34 },
-  '../../packages/app/fixtures/EmptyChannelNotice.fixture.tsx': { module: fixture35 },
+  '../../packages/app/fixtures/BlockSectionList.fixture.tsx': {
+    module: fixture15,
+  },
+  '../../packages/app/fixtures/Button.fixture.tsx': { module: fixture16 },
+  '../../packages/app/fixtures/ButtonV2.fixture.tsx': { module: fixture17 },
+  '../../packages/app/fixtures/Carousel.fixture.tsx': { module: fixture18 },
+  '../../packages/app/fixtures/Channel.fixture.tsx': { module: fixture19 },
+  '../../packages/app/fixtures/ChannelDivider.fixture.tsx': {
+    module: fixture21,
+  },
+  '../../packages/app/fixtures/ChannelHeader.fixture.tsx': {
+    module: fixture22,
+  },
+  '../../packages/app/fixtures/ChannelListItem.fixture.tsx': {
+    module: fixture23,
+  },
+  '../../packages/app/fixtures/ChatMessage.fixture.tsx': { module: fixture24 },
+  '../../packages/app/fixtures/ChatOptionsSheet.fixture.tsx': {
+    module: fixture25,
+  },
+  '../../packages/app/fixtures/ConfirmDialog.fixture.tsx': {
+    module: fixture26,
+  },
+  '../../packages/app/fixtures/ContactList.fixture.tsx': { module: fixture27 },
+  '../../packages/app/fixtures/CreateChatSheet.fixture.tsx': {
+    module: fixture28,
+  },
+  '../../packages/app/fixtures/DetailView/ChatDetailView.fixture.tsx': {
+    module: fixture29,
+  },
+  '../../packages/app/fixtures/DetailView/GalleryDetailView.fixture.tsx': {
+    module: fixture30,
+  },
+  '../../packages/app/fixtures/DetailView/NotebookDetailView.fixture.tsx': {
+    module: fixture31,
+  },
+  '../../packages/app/fixtures/DmInviteOptions.fixture.tsx': {
+    module: fixture32,
+  },
+  '../../packages/app/fixtures/EditProfileScreen.fixture.tsx': {
+    module: fixture33,
+  },
+  '../../packages/app/fixtures/EmptyChannelNotice.fixture.tsx': {
+    module: fixture35,
+  },
   '../../packages/app/fixtures/FacePile.fixture.tsx': { module: fixture36 },
   '../../packages/app/fixtures/Form.fixture.tsx': { module: fixture37 },
-  '../../packages/app/fixtures/ForwardChannelListItem.fixture.tsx': { module: fixture38 },
+  '../../packages/app/fixtures/ForwardChannelListItem.fixture.tsx': {
+    module: fixture38,
+  },
   '../../packages/app/fixtures/GalleryPost.fixture.tsx': { module: fixture39 },
-  '../../packages/app/fixtures/GestureMediaViewer.fixture.tsx': { module: fixture40 },
-  '../../packages/app/fixtures/GroupListItem.fixture.tsx': { module: fixture41 },
-  '../../packages/app/fixtures/Input.fixture.tsx': { module: fixture42 },
-  '../../packages/app/fixtures/InviteFriendsToTlonButton.fixture.tsx': { module: fixture43 },
-  '../../packages/app/fixtures/InviteUsersSheet.fixture.tsx': { module: fixture44 },
-  '../../packages/app/fixtures/MediaImageViewer.fixture.tsx': { module: fixture45 },
-  '../../packages/app/fixtures/MessageActions.fixture.tsx': { module: fixture46 },
-  '../../packages/app/fixtures/MessageInput.fixture.tsx': { module: fixture47 },
-  '../../packages/app/fixtures/MetaEditorScreen.fixture.tsx': { module: fixture48 },
-  '../../packages/app/fixtures/NotebookPost.fixture.tsx': { module: fixture49 },
-  '../../packages/app/fixtures/NotesChannel.fixture.tsx': { module: fixture50 },
-  '../../packages/app/fixtures/Onboarding.fixture.tsx': { module: fixture51 },
-  '../../packages/app/fixtures/ParentAgnosticKeyboardAvoidingView.fixture.tsx': { module: fixture52 },
-  '../../packages/app/fixtures/PhoneNumberInput.fixture.tsx': { module: fixture53 },
-  '../../packages/app/fixtures/PostErrorMessage.fixture.tsx': { module: fixture54 },
-  '../../packages/app/fixtures/PostReference.fixture.tsx': { module: fixture55 },
-  '../../packages/app/fixtures/PostScreen.fixture.tsx': { module: fixture56 },
-  '../../packages/app/fixtures/Pressable.fixture.tsx': { module: fixture57 },
-  '../../packages/app/fixtures/ProfileBlock.fixture.tsx': { module: fixture58 },
-  '../../packages/app/fixtures/ProfileSheet.fixture.tsx': { module: fixture59 },
-  '../../packages/app/fixtures/ProfileStatusSheet.fixture.tsx': { module: fixture60 },
-  '../../packages/app/fixtures/ReactionsDisplay.fixture.tsx': { module: fixture61 },
-  '../../packages/app/fixtures/ReferenceSkeleton.fixture.tsx': { module: fixture62 },
-  '../../packages/app/fixtures/ScreenHeader.fixture.tsx': { module: fixture63 },
-  '../../packages/app/fixtures/SearchBar.fixture.tsx': { module: fixture64 },
-  '../../packages/app/fixtures/SplashSequence.fixture.tsx': { module: fixture65 },
-  '../../packages/app/fixtures/StoppedNodePushSheet.fixture.tsx': { module: fixture66 },
-  '../../packages/app/fixtures/StorageQuotaIndicator.fixture.tsx': { module: fixture67 },
-  '../../packages/app/fixtures/SystemNotice.fixture.tsx': { module: fixture68 },
-  '../../packages/app/fixtures/SystemNotices.fixture.tsx': { module: fixture69 },
-  '../../packages/app/fixtures/Text.fixture.tsx': { module: fixture70 },
-  '../../packages/app/fixtures/Toast.fixture.tsx': { module: fixture71 },
-  '../../packages/app/fixtures/TwitterVerification.fixture.tsx': { module: fixture72 },
-  '../../packages/app/fixtures/UserProfileScreen.fixture.tsx': { module: fixture73 },
-  '../../packages/app/fixtures/VideoPreview.fixture.tsx': { module: fixture74 },
-  '../../packages/app/fixtures/ViewReactionsSheet.fixture.tsx': { module: fixture75 },
-  '../../packages/app/fixtures/Waveform.fixture.tsx': { module: fixture76 },
-  '../../packages/app/fixtures/WayfindingNotices.fixture.tsx': { module: fixture77 },
-  '../../packages/app/fixtures/WebAppSplashSheet.fixture.tsx': { module: fixture78 },
-  'src/App.fixture.tsx': { module: fixture79 },
-  'src/fixtures/InputToolbar.fixture.tsx': { module: fixture80 },
-  'src/fixtures/Onboarding.fixture.tsx': { module: fixture81 },
-  'src/fixtures/SetNicknameScreen.fixture.tsx': { module: fixture82 },
-  'src/fixtures/TlonbotSetupScreen.fixture.tsx': { module: fixture83 }
+  '../../packages/app/fixtures/GroupListItem.fixture.tsx': {
+    module: fixture40,
+  },
+  '../../packages/app/fixtures/Input.fixture.tsx': { module: fixture41 },
+  '../../packages/app/fixtures/InviteFriendsToTlonButton.fixture.tsx': {
+    module: fixture42,
+  },
+  '../../packages/app/fixtures/InviteUsersSheet.fixture.tsx': {
+    module: fixture43,
+  },
+  '../../packages/app/fixtures/MediaImageViewer.fixture.tsx': {
+    module: fixture44,
+  },
+  '../../packages/app/fixtures/MessageActions.fixture.tsx': {
+    module: fixture45,
+  },
+  '../../packages/app/fixtures/MessageInput.fixture.tsx': { module: fixture46 },
+  '../../packages/app/fixtures/MetaEditorScreen.fixture.tsx': {
+    module: fixture47,
+  },
+  '../../packages/app/fixtures/NotebookPost.fixture.tsx': { module: fixture48 },
+  '../../packages/app/fixtures/Onboarding.fixture.tsx': { module: fixture49 },
+  '../../packages/app/fixtures/ParentAgnosticKeyboardAvoidingView.fixture.tsx':
+    { module: fixture50 },
+  '../../packages/app/fixtures/PostErrorMessage.fixture.tsx': {
+    module: fixture51,
+  },
+  '../../packages/app/fixtures/PostReference.fixture.tsx': {
+    module: fixture52,
+  },
+  '../../packages/app/fixtures/PostScreen.fixture.tsx': { module: fixture53 },
+  '../../packages/app/fixtures/Pressable.fixture.tsx': { module: fixture54 },
+  '../../packages/app/fixtures/ProfileBlock.fixture.tsx': { module: fixture55 },
+  '../../packages/app/fixtures/ProfileSheet.fixture.tsx': { module: fixture56 },
+  '../../packages/app/fixtures/ProfileStatusSheet.fixture.tsx': {
+    module: fixture57,
+  },
+  '../../packages/app/fixtures/ReferenceSkeleton.fixture.tsx': {
+    module: fixture58,
+  },
+  '../../packages/app/fixtures/ScreenHeader.fixture.tsx': { module: fixture59 },
+  '../../packages/app/fixtures/SearchBar.fixture.tsx': { module: fixture60 },
+  '../../packages/app/fixtures/SplashSequence.fixture.tsx': {
+    module: fixture61,
+  },
+  '../../packages/app/fixtures/StoppedNodePushSheet.fixture.tsx': {
+    module: fixture62,
+  },
+  '../../packages/app/fixtures/StorageQuotaIndicator.fixture.tsx': {
+    module: fixture63,
+  },
+  '../../packages/app/fixtures/SystemNotice.fixture.tsx': { module: fixture65 },
+  '../../packages/app/fixtures/SystemNotices.fixture.tsx': {
+    module: fixture66,
+  },
+  '../../packages/app/fixtures/Text.fixture.tsx': { module: fixture67 },
+  '../../packages/app/fixtures/Toast.fixture.tsx': { module: fixture68 },
+  '../../packages/app/fixtures/TwitterVerification.fixture.tsx': {
+    module: fixture69,
+  },
+  '../../packages/app/fixtures/UserProfileScreen.fixture.tsx': {
+    module: fixture70,
+  },
+  '../../packages/app/fixtures/VideoPreview.fixture.tsx': { module: fixture71 },
+  '../../packages/app/fixtures/ViewReactionsSheet.fixture.tsx': {
+    module: fixture72,
+  },
+  '../../packages/app/fixtures/Waveform.fixture.tsx': { module: fixture73 },
+  '../../packages/app/fixtures/WayfindingNotices.fixture.tsx': {
+    module: fixture74,
+  },
+  'src/App.fixture.tsx': { module: fixture75 },
+  'src/fixtures/InputToolbar.fixture.tsx': { module: fixture76 },
+  'src/fixtures/Onboarding.fixture.tsx': { module: fixture77 },
+  'src/fixtures/SetNicknameScreen.fixture.tsx': { module: fixture78 },
 };
 
 const decorators = {
   '../../packages/app/fixtures/cosmos.decorator.tsx': { module: decorator0 },
-  'src/fixtures/cosmos.decorator.tsx': { module: decorator1 }
+  'src/fixtures/cosmos.decorator.tsx': { module: decorator1 },
 };
 
 export const moduleWrappers: UserModuleWrappers = {
   lazy: false,
   fixtures,
-  decorators
+  decorators,
 };
diff --git a/apps/tlon-mobile/src/screens/Onboarding/ShipLoginScreen.tsx b/apps/tlon-mobile/src/screens/Onboarding/ShipLoginScreen.tsx
index 3aac3ab566..95e1e12e55 100644
--- a/apps/tlon-mobile/src/screens/Onboarding/ShipLoginScreen.tsx
+++ b/apps/tlon-mobile/src/screens/Onboarding/ShipLoginScreen.tsx
@@ -65,14 +65,10 @@ export const ShipLoginScreen = ({ navigation }: Props) => {
     const urlPattern =
       /^(https?:\/\/)?(localhost|(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})|[\w.-]+\.([a-z]{2,}))(:\d+)?$/i;
     const hostedPattern = /tlon\.network/i;
-    const isConfiguredDevelopmentShip =
-      __DEV__ &&
-      DEFAULT_SHIP_LOGIN_URL.length > 0 &&
-      url.replace(/\/$/, '') === DEFAULT_SHIP_LOGIN_URL.replace(/\/$/, '');
     if (!urlPattern.test(url)) {
       return false;
     }
-    if (hostedPattern.test(url) && !isConfiguredDevelopmentShip) {
+    if (hostedPattern.test(url)) {
       return 'hosted';
     }
     return true;
diff --git a/backend/click b/backend/click
index fa20e7d525..38c2514e57 100755
--- a/backend/click
+++ b/backend/click
@@ -21,7 +21,6 @@
 SCRIPT_DIR=$( cd -- "$( dirname -- "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )
 SCRIPT_NAME=$(basename "$0")
 CLICK_CMD="$SCRIPT_DIR/click-format"
-CLICK_OPTS=()
 
 # ==========================================================
 # PLATFORM DETECTION
@@ -91,7 +90,7 @@ EOF
 }
 
 full() {
-  "$CLICK_CMD" "${CLICK_OPTS[@]}" "$HOON" $DEPS |
+  $CLICK_CMD "$HOON" $DEPS |
   $EVAL_CMD eval --jam $JAM_OPTS |
   # 30m total inactivity timeout
   socat -T 1800 -t $TIMEOUT -,ignoreeof UNIX-CONNECT:"$PIER/.urb/conn.sock" |
@@ -103,7 +102,7 @@ jam() {
         JAM_OPTS=""
     fi
 
-    "$CLICK_CMD" "${CLICK_OPTS[@]}" "$HOON" $DEPS | $EVAL_CMD eval --jam $JAM_OPTS
+    $CLICK_CMD "$HOON" $DEPS | $EVAL_CMD eval --jam $JAM_OPTS
 }
 
 execute() {
@@ -233,11 +232,9 @@ if [[ -n $INPUT ]]; then
     shift
 
     if [[ $EXECUTE -eq 0 ]]; then
-        # Read from file, escape 's, and replace newlines with Hoon gaps.
-        # BSD paste treats the two spaces in -d as an alternating delimiter
-        # list and emits only one of them. Hoon needs a two-space gap, so join
-        # explicitly instead.
-        HOON="$(cat "$INPUT" | sed "s;';\\\\';g" | awk 'NR == 1 { printf "%s", $0; next } { printf "  %s", $0 } END { print "" }')"
+        # read from file, escape 's, replace newlines w/ gaps
+        # Use paste for portable line joining (works on both GNU and BSD systems)
+        HOON="$(cat $INPUT | sed "s;';\\\\';g" | paste -sd'  ' -)"
     fi
 else
     PIER=$1
@@ -248,7 +245,7 @@ DEPS=$*
 
 # setup shared variables
 if [[ $KHAN_TED -ne 0 ]]; then
-    CLICK_OPTS=(-k)
+    CLICK_CMD="$CLICK_CMD -k"
 elif [[ $CARD -ne 0 ]]; then
     CLICK_CMD="echo"
     DEPS=""
diff --git a/scripts/buckets-live-check.mjs b/scripts/buckets-live-check.mjs
deleted file mode 100644
index 7261415f0d..0000000000
--- a/scripts/buckets-live-check.mjs
+++ /dev/null
@@ -1,48 +0,0 @@
-#!/usr/bin/env node
-import fs from 'node:fs/promises';
-
-const credentialsPath =
-  process.env.BUCKETS_SHIP_CREDENTIALS ??
-  '/Users/williamarzt/Desktop/buckets.md';
-const source = await fs.readFile(credentialsPath, 'utf8');
-const shipUrl = source.match(/https?:\/\/[^\s)]+/)?.[0]?.replace(/\/$/, '');
-const accessCode =
-  source.match(/\b[a-z]{6}(?:-[a-z]{6}){3}\b/)?.[0] ?? undefined;
-
-if (!shipUrl || !accessCode) {
-  throw new Error('Could not parse the hosted ship URL and access code');
-}
-
-const login = await fetch(`${shipUrl}/~/login`, {
-  method: 'POST',
-  redirect: 'manual',
-  headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
-  body: new URLSearchParams({ password: accessCode }),
-});
-const cookie = login.headers.get('set-cookie')?.split(';', 1)[0];
-if (!login.ok || !cookie) {
-  throw new Error(`Ship login failed (${login.status})`);
-}
-
-const response = await fetch(`${shipUrl}/~/scry/buckets/v1/buckets.json`, {
-  headers: { Cookie: cookie },
-});
-if (!response.ok) {
-  throw new Error(`Buckets snapshot scry failed (${response.status})`);
-}
-
-const snapshots = await response.json();
-console.log(
-  JSON.stringify(
-    snapshots.map((snapshot) => ({
-      flag: snapshot.flag,
-      title: snapshot.state?.title,
-      readers: snapshot.state?.readers ?? [],
-      writers: snapshot.state?.writers ?? null,
-      revision: snapshot.state?.revision,
-      entryCount: snapshot.state?.entries?.length ?? 0,
-    })),
-    null,
-    2
-  )
-);
diff --git a/scripts/buckets-live-e2e.mjs b/scripts/buckets-live-e2e.mjs
deleted file mode 100644
index f08d184e32..0000000000
--- a/scripts/buckets-live-e2e.mjs
+++ /dev/null
@@ -1,279 +0,0 @@
-#!/usr/bin/env node
-
-import fs from 'node:fs/promises';
-
-const credentialsPath =
-  process.env.BUCKETS_SHIP_CREDENTIALS ?? '/Users/williamarzt/Desktop/buckets.md';
-const memexBaseUrl = process.env.MEMEX_BASE_URL ?? 'https://memex.tlon.network';
-const bucketName = process.env.BUCKETS_CANARY_NAME ?? 'live-canary';
-const groupName = process.env.BUCKETS_CANARY_GROUP ?? 'home-group';
-
-const source = await fs.readFile(credentialsPath, 'utf8');
-const shipUrl = source.match(/https?:\/\/[^\s)]+/)?.[0]?.replace(/\/$/, '');
-const ship =
-  source.match(/~[a-z]+(?:-[a-z]+)+/)?.[0] ??
-  (shipUrl ? `~${new URL(shipUrl).hostname.split('.')[0]}` : undefined);
-const accessCode =
-  source.match(/\b[a-z]{6}(?:-[a-z]{6}){3}\b/)?.[0] ?? undefined;
-
-if (!shipUrl || !ship || !accessCode) {
-  throw new Error('Could not parse ship URL, ship name, and access code');
-}
-
-const login = await fetch(`${shipUrl}/~/login`, {
-  method: 'POST',
-  redirect: 'manual',
-  headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
-  body: new URLSearchParams({ password: accessCode }),
-});
-const cookie = login.headers.get('set-cookie')?.split(';', 1)[0];
-if (!login.ok || !cookie) {
-  throw new Error(`Ship login failed (${login.status})`);
-}
-
-const headers = {
-  'Content-Type': 'application/json',
-  Cookie: cookie,
-};
-
-async function airlockPoke(json) {
-  const channelId = `${Math.floor(Date.now() / 1000)}-${crypto.randomUUID().slice(0, 8)}`;
-  const channelUrl = `${shipUrl}/~/channel/${channelId}`;
-  const request = {
-    id: 1,
-    action: 'poke',
-    ship: ship.slice(1),
-    app: 'buckets',
-    mark: 'buckets-action-1',
-    json,
-  };
-  const poke = await fetch(channelUrl, {
-    method: 'PUT',
-    headers,
-    body: JSON.stringify([request]),
-  });
-  if (!poke.ok) {
-    throw new Error(`Buckets poke HTTP request failed (${poke.status})`);
-  }
-
-  const controller = new AbortController();
-  const timeout = setTimeout(() => controller.abort(), 20_000);
-  try {
-    const stream = await fetch(channelUrl, {
-      headers: { ...headers, Accept: 'text/event-stream' },
-      signal: controller.signal,
-    });
-    if (!stream.ok || !stream.body) {
-      throw new Error(`Airlock response stream failed (${stream.status})`);
-    }
-    const reader = stream.body.getReader();
-    const decoder = new TextDecoder();
-    let buffer = '';
-    while (true) {
-      const { value, done } = await reader.read();
-      if (done) break;
-      buffer += decoder.decode(value, { stream: true });
-      let newline = buffer.indexOf('\n');
-      while (newline !== -1) {
-        const line = buffer.slice(0, newline).replace(/\r$/, '');
-        buffer = buffer.slice(newline + 1);
-        if (line.startsWith('data:')) {
-          const event = JSON.parse(line.slice(5).trim());
-          if (event.response === 'poke' && event.id === 1) {
-            if (event.err) {
-              throw new Error(`Buckets poke failed: ${event.err}`);
-            }
-            return;
-          }
-        }
-        newline = buffer.indexOf('\n');
-      }
-    }
-    throw new Error('Airlock closed before the Buckets poke response arrived');
-  } finally {
-    clearTimeout(timeout);
-    controller.abort();
-  }
-}
-
-async function snapshots() {
-  const response = await fetch(
-    `${shipUrl}/~/scry/buckets/v1/buckets.json`,
-    { headers: { Cookie: cookie } }
-  );
-  if (!response.ok) {
-    const body = (await response.text()).slice(0, 2_000);
-    const nounResponse = await fetch(
-      `${shipUrl}/~/scry/buckets/v1/buckets.noun`,
-      { headers: { Cookie: cookie } }
-    );
-    throw new Error(
-      `Buckets snapshot scry failed (${response.status}); noun=${nounResponse.status} ` +
-      `${nounResponse.headers.get('content-type') ?? 'unknown'}: ${body}`
-    );
-  }
-  return response.json();
-}
-
-const flag = { host: ship, name: bucketName };
-let allSnapshots = await snapshots();
-let snapshot = allSnapshots.find(
-  (item) => item.flag?.host === ship && item.flag?.name === bucketName
-);
-if (!snapshot) {
-  await airlockPoke({
-    type: 'create',
-    name: bucketName,
-    title: 'Live Canary',
-    group: { host: ship, name: groupName },
-    readers: [],
-  });
-  allSnapshots = await snapshots();
-  snapshot = allSnapshots.find(
-    (item) => item.flag?.host === ship && item.flag?.name === bucketName
-  );
-}
-if (!snapshot) {
-  throw new Error('Buckets agent accepted create but returned no snapshot');
-}
-
-const genuine = await fetch(`${shipUrl}/~/scry/genuine/secret.json`, {
-  headers: { Cookie: cookie },
-});
-if (!genuine.ok) {
-  throw new Error(`Could not read the ship's Memex token (${genuine.status})`);
-}
-const token = await genuine.json();
-if (typeof token !== 'string' || token.length === 0) {
-  throw new Error('The ship returned an invalid Memex token');
-}
-
-const bytes = Buffer.from(
-  'iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mNk+A8AAQUBAScY42YAAAAASUVORK5CYII=',
-  'base64'
-);
-const shipName = ship.slice(1);
-const canaryId = Date.now();
-const displayName = `buckets-live-${canaryId}.png`;
-const fileKey = `${shipName}/${displayName}`;
-const capability = crypto.randomUUID().replaceAll('-', '') + crypto.randomUUID().replaceAll('-', '');
-
-await airlockPoke({
-  type: 'begin-upload',
-  flag,
-  parentId: null,
-  name: displayName,
-  mime: 'image/png',
-  size: bytes.length,
-  checksum: null,
-  capability,
-});
-
-const brokerProbe = await fetch(
-  `${shipUrl}/~/scry/buckets/v1/broker/upload/${capability}/probe-reservation.json`,
-  { headers: { Cookie: cookie } }
-);
-if (!brokerProbe.ok) {
-  throw new Error(`Buckets private broker scry failed (${brokerProbe.status})`);
-}
-const brokerProbeBody = await brokerProbe.json();
-if (brokerProbeBody?.result !== 'denied') {
-  throw new Error(
-    `Buckets private broker returned an unexpected pre-authorization verdict: ${JSON.stringify(brokerProbeBody)}`
-  );
-}
-
-snapshot = (await snapshots()).find(
-  (item) => item.flag?.host === ship && item.flag?.name === bucketName
-);
-const pendingEntry = snapshot?.state?.entries?.find(
-  (entry) => entry.name === displayName && entry.kind === 'file'
-);
-const session = snapshot?.state?.sessions?.find(
-  (candidate) => candidate.fileId === pendingEntry?.id
-);
-if (!pendingEntry || !session) {
-  throw new Error('Buckets begin-upload did not produce a pending file session');
-}
-
-const grant = await fetch(`${memexBaseUrl}/v1/${shipName}/upload`, {
-  method: 'PUT',
-  headers: { 'Content-Type': 'application/json' },
-  body: JSON.stringify({
-    token,
-    contentLength: bytes.length,
-    contentType: 'image/png',
-    fileName: fileKey,
-  }),
-});
-if (!grant.ok) {
-  throw new Error(`Memex upload grant failed (${grant.status})`);
-}
-const grantBody = await grant.json();
-if (!grantBody?.url || !grantBody?.filePath) {
-  throw new Error('Memex returned an invalid upload grant');
-}
-
-const upload = await fetch(grantBody.url, {
-  method: 'PUT',
-  headers: {
-    'Cache-Control': 'public, max-age=3600',
-    'Content-Type': 'image/png',
-  },
-  body: bytes,
-});
-if (!upload.ok) {
-  throw new Error(`Signed object upload failed (${upload.status})`);
-}
-
-await airlockPoke({
-  type: 'finish-upload',
-  flag,
-  sessionId: session.id,
-  objectUrl: grantBody.filePath,
-});
-
-snapshot = (await snapshots()).find(
-  (item) => item.flag?.host === ship && item.flag?.name === bucketName
-);
-const completed = snapshot?.state?.entries?.find(
-  (entry) => entry.id === pendingEntry.id
-);
-if (
-  completed?.file?.status !== 'ready' ||
-  completed.file.objectUrl !== grantBody.filePath
-) {
-  throw new Error('Gall did not finalize the uploaded object in the manifest');
-}
-
-const download = await fetch(grantBody.filePath);
-const downloaded = download.ok
-  ? Buffer.from(await download.arrayBuffer())
-  : Buffer.alloc(0);
-if (!download.ok || !downloaded.equals(bytes)) {
-  throw new Error('The finalized manifest object did not download intact');
-}
-
-console.log(
-  JSON.stringify(
-    {
-      ship,
-      group: `${ship}/${groupName}`,
-      bucket: `${ship}/${bucketName}`,
-      gallSessionId: session.id,
-      gallObjectId: pendingEntry.id,
-      manifestRevision: snapshot.state.revision,
-      objectUrl: grantBody.filePath,
-      memexGrantStatus: grant.status,
-      uploadStatus: upload.status,
-      downloadStatus: download.status,
-      byteCount: bytes.length,
-      bytesMatch: true,
-      gallStatus: completed.file.status,
-      brokerProbeStatus: brokerProbe.status,
-      brokerProbeResult: brokerProbeBody.result,
-    },
-    null,
-    2
-  )
-);
diff --git a/scripts/buckets-live-upload-smoke.mjs b/scripts/buckets-live-upload-smoke.mjs
deleted file mode 100644
index 4b4ba7bbd1..0000000000
--- a/scripts/buckets-live-upload-smoke.mjs
+++ /dev/null
@@ -1,104 +0,0 @@
-#!/usr/bin/env node
-
-import fs from 'node:fs/promises';
-
-const credentialsPath =
-  process.env.BUCKETS_SHIP_CREDENTIALS ?? '/Users/williamarzt/Desktop/buckets.md';
-const memexBaseUrl = process.env.MEMEX_BASE_URL ?? 'https://memex.tlon.network';
-
-const source = await fs.readFile(credentialsPath, 'utf8');
-const shipUrl = source.match(/https?:\/\/[^\s)]+/)?.[0]?.replace(/\/$/, '');
-const ship =
-  source.match(/~[a-z]+(?:-[a-z]+)+/)?.[0] ??
-  (shipUrl ? `~${new URL(shipUrl).hostname.split('.')[0]}` : undefined);
-const accessCode =
-  source.match(/\b[a-z]{6}(?:-[a-z]{6}){3}\b/)?.[0] ?? undefined;
-
-if (!shipUrl || !ship || !accessCode) {
-  throw new Error('Could not parse ship URL, ship name, and access code');
-}
-
-const login = await fetch(`${shipUrl}/~/login`, {
-  method: 'POST',
-  redirect: 'manual',
-  headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
-  body: new URLSearchParams({ password: accessCode }),
-});
-const cookie = login.headers.get('set-cookie')?.split(';', 1)[0];
-if (!login.ok || !cookie) {
-  throw new Error(`Ship login failed (${login.status})`);
-}
-
-const genuine = await fetch(`${shipUrl}/~/scry/genuine/secret.json`, {
-  headers: { Cookie: cookie },
-});
-if (!genuine.ok) {
-  throw new Error(`Could not read the ship's Memex token (${genuine.status})`);
-}
-const token = await genuine.json();
-if (typeof token !== 'string' || token.length === 0) {
-  throw new Error('The ship returned an invalid Memex token');
-}
-
-// A valid 1x1 transparent PNG. Keeping the payload tiny makes this safe to run
-// against a real hosted-user bucket while still proving byte integrity.
-const bytes = Buffer.from(
-  'iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mNk+A8AAQUBAScY42YAAAAASUVORK5CYII=',
-  'base64'
-);
-const shipName = ship.slice(1);
-const filename = `${shipName}/buckets-canary-${Date.now()}.png`;
-const grant = await fetch(`${memexBaseUrl}/v1/${shipName}/upload`, {
-  method: 'PUT',
-  headers: { 'Content-Type': 'application/json' },
-  body: JSON.stringify({
-    token,
-    contentLength: bytes.length,
-    contentType: 'image/png',
-    fileName: filename,
-  }),
-});
-if (!grant.ok) {
-  throw new Error(`Memex upload grant failed (${grant.status})`);
-}
-const grantBody = await grant.json();
-if (!grantBody?.url || !grantBody?.filePath) {
-  throw new Error('Memex returned an invalid upload grant');
-}
-
-const upload = await fetch(grantBody.url, {
-  method: 'PUT',
-  headers: {
-    'Cache-Control': 'public, max-age=3600',
-    'Content-Type': 'image/png',
-  },
-  body: bytes,
-});
-if (!upload.ok) {
-  throw new Error(`Signed object upload failed (${upload.status})`);
-}
-
-const download = await fetch(grantBody.filePath);
-if (!download.ok) {
-  throw new Error(`Uploaded object was not readable (${download.status})`);
-}
-const downloaded = Buffer.from(await download.arrayBuffer());
-if (!downloaded.equals(bytes)) {
-  throw new Error('Downloaded bytes did not match the uploaded file');
-}
-
-console.log(
-  JSON.stringify(
-    {
-      ship,
-      memexGrantStatus: grant.status,
-      uploadStatus: upload.status,
-      downloadStatus: download.status,
-      byteCount: bytes.length,
-      bytesMatch: true,
-      objectUrl: grantBody.filePath,
-    },
-    null,
-    2
-  )
-);
diff --git a/scripts/run-buckets-live-app.mjs b/scripts/run-buckets-live-app.mjs
deleted file mode 100644
index 6fdda60dc5..0000000000
--- a/scripts/run-buckets-live-app.mjs
+++ /dev/null
@@ -1,52 +0,0 @@
-#!/usr/bin/env node
-import { spawn } from 'node:child_process';
-import fs from 'node:fs/promises';
-import path from 'node:path';
-import process from 'node:process';
-import { fileURLToPath } from 'node:url';
-
-const repoRoot = path.resolve(
-  path.dirname(fileURLToPath(import.meta.url)),
-  '..'
-);
-const mobileRoot = path.join(repoRoot, 'apps', 'tlon-mobile');
-const credentialsPath =
-  process.env.BUCKETS_SHIP_CREDENTIALS ??
-  '/Users/williamarzt/Desktop/buckets.md';
-const source = await fs.readFile(credentialsPath, 'utf8');
-const shipUrl = source.match(/https?:\/\/[^\s)]+/)?.[0]?.replace(/\/$/, '');
-const accessCode = source.match(/\b[a-z]{6}(?:-[a-z]{6}){3}\b/)?.[0];
-
-if (!shipUrl || !accessCode) {
-  throw new Error('Could not parse the hosted ship URL and access code');
-}
-
-const child = spawn(
-  'pnpm',
-  [
-    'exec',
-    'expo',
-    'start',
-    '--dev-client',
-    '--ios',
-    '--port',
-    process.env.BUCKETS_METRO_PORT ?? '8081',
-  ],
-  {
-    cwd: mobileRoot,
-    env: {
-      ...process.env,
-      DEFAULT_SHIP_LOGIN_ACCESS_CODE: accessCode,
-      DEFAULT_SHIP_LOGIN_URL: shipUrl,
-    },
-    stdio: 'inherit',
-  }
-);
-
-process.on('SIGINT', () => child.kill('SIGTERM'));
-process.on('SIGTERM', () => child.kill('SIGTERM'));
-
-await new Promise((resolve, reject) => {
-  child.once('error', reject);
-  child.once('exit', resolve);
-});
diff --git a/scripts/run-buckets-live-cosmos.mjs b/scripts/run-buckets-live-cosmos.mjs
deleted file mode 100644
index 9566c73342..0000000000
--- a/scripts/run-buckets-live-cosmos.mjs
+++ /dev/null
@@ -1,54 +0,0 @@
-#!/usr/bin/env node
-
-import fs from 'node:fs/promises';
-import path from 'node:path';
-import process from 'node:process';
-import { spawn } from 'node:child_process';
-import { fileURLToPath } from 'node:url';
-
-const repoRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
-const mobileRoot = path.join(repoRoot, 'apps', 'tlon-mobile');
-const credentialsPath =
-  process.env.BUCKETS_SHIP_CREDENTIALS ??
-  '/Users/williamarzt/Desktop/buckets.md';
-const source = await fs.readFile(credentialsPath, 'utf8');
-const shipUrl = source.match(/https?:\/\/[^\s)]+/)?.[0]?.replace(/\/$/, '');
-const accessCode = source.match(/\b[a-z]{6}(?:-[a-z]{6}){3}\b/)?.[0];
-
-if (!shipUrl || !accessCode) {
-  throw new Error('Could not parse the hosted ship URL and access code');
-}
-
-const env = {
-  ...process.env,
-  DEFAULT_SHIP_LOGIN_ACCESS_CODE: accessCode,
-  DEFAULT_SHIP_LOGIN_URL: shipUrl,
-};
-const children = [
-  spawn('pnpm', ['exec', 'cosmos-native', '--port', '5050'], {
-    cwd: mobileRoot,
-    env,
-    stdio: 'inherit',
-  }),
-  spawn('pnpm', ['exec', 'expo', 'start', '--port', '8082'], {
-    cwd: mobileRoot,
-    env,
-    stdio: 'inherit',
-  }),
-];
-
-function stop() {
-  children.forEach((child) => child.kill('SIGTERM'));
-}
-
-process.on('SIGINT', stop);
-process.on('SIGTERM', stop);
-await Promise.all(
-  children.map(
-    (child) =>
-      new Promise((resolve, reject) => {
-        child.once('error', reject);
-        child.once('exit', resolve);
-      })
-  )
-);

From d03b1fd82ed05b103a7a98c01aa585f5a7925bf7 Mon Sep 17 00:00:00 2001
From: william arzt <bill@tlon.io>
Date: Tue, 11 Aug 2026 11:21:10 -0400
Subject: [PATCH 07/19] fix: harden buckets lifecycle and recovery

---
 desk/app/buckets.hoon                         |  40 +-
 desk/lib/buckets/json.hoon                    |  23 +-
 desk/sur/buckets.hoon                         |   2 +
 desk/tests/app/buckets.hoon                   |  67 ++-
 docs/backend/desk/app/buckets.md              |  10 +-
 packages/api/src/__tests__/bucketsApi.test.ts |  18 +-
 packages/api/src/client/bucketsApi.ts         |  14 +-
 packages/api/src/client/urbit.ts              |  10 +-
 packages/api/src/http-api/Urbit.ts            |  22 +-
 packages/api/src/http-api/types.ts            |   5 +
 packages/api/src/urbit/buckets.ts             |   2 +
 .../features/buckets/BucketsLiveChannel.tsx   |  44 +-
 .../bucketUploadReconciliation.test.ts        |  55 ++-
 .../buckets/bucketUploadReconciliation.ts     |  26 +-
 .../app/features/buckets/useLiveBucket.ts     | 405 ++++++++++--------
 .../BucketsChannel/BucketsChannel.tsx         | 146 ++++---
 .../shared/src/store/channelActions.test.ts   |  70 +++
 packages/shared/src/store/channelActions.ts   |  15 +-
 packages/shared/src/store/dbHooks.ts          |   1 +
 packages/shared/src/store/sync/sync.ts        |  10 +-
 20 files changed, 686 insertions(+), 299 deletions(-)

diff --git a/desk/app/buckets.hoon b/desk/app/buckets.hoon
index 38f0110f50..2abe671d40 100644
--- a/desk/app/buckets.hoon
+++ b/desk/app/buckets.hoon
@@ -182,6 +182,7 @@
     %create          ~|(%create-has-no-flag !!)
     %delete-bucket   flag.act
     %set-title       flag.act
+    %set-readers     flag.act
     %set-writers     flag.act
     %create-folder   flag.act
     %begin-upload    flag.act
@@ -255,6 +256,7 @@
     %create          ~|(%cannot-forward-create !!)
     %delete-bucket   (delete-bucket flag.act)
     %set-title       (set-title flag.act title.act)
+    %set-readers     (set-readers flag.act readers.act)
     %set-writers     (set-writers flag.act writers.act)
     %create-folder   (create-folder flag.act parent.act name.act)
     %begin-upload    (begin-upload flag.act parent.act name.act mime.act size.act checksum.act capability.act)
@@ -309,6 +311,13 @@
   =.  writers.st  writers
   (commit-update flag st [%writers-updated writers])
 ::
+++  set-readers
+  |=  [=flag:b readers=(set @tas)]
+  ^+  cor
+  =/  st=bucket-state:b  (need-state flag)
+  =.  readers.st  readers
+  (commit-update flag st [%readers-updated readers])
+::
 ++  create-folder
   |=  [=flag:b parent=(unit @ud) name=@t]
   ^+  cor
@@ -360,6 +369,8 @@
   =/  ses=upload-session:b  (~(got by sessions.st) sid)
   ?>  =(%pending status.ses)
   ?>  =(requested-by.ses src.bowl)
+  ?>  (gth expires-at.ses now.bowl)
+  ?>  (valid-legacy-object-url object-url)
   =/  ent=entry:b  (~(got by entries.st) file-id.ses)
   =/  fil=file:b  (entry-file ent)
   =.  fil  fil(object-url `object-url, status %ready)
@@ -369,6 +380,15 @@
   =.  sessions.st  (~(put by sessions.st) sid ses)
   (commit-update flag st [%upload-ready ses ent])
 ::
+++  valid-legacy-object-url
+  |=  object-url=@t
+  ^-  ?
+  =/  url=tape  (trip object-url)
+  ?|  =(`0 (find "https://storage.googleapis.com/tlon-prod-memex-assets/" url))
+      =(`0 (find "https://storage.googleapis.com/tlon-staging-memex-assets/" url))
+      =(`0 (find "https://storage.googleapis.com/tlon-test-memex-assets/" url))
+  ==
+::
 ++  fail-upload
   |=  [=flag:b sid=@uv reason=@t]
   ^+  cor
@@ -436,7 +456,9 @@
   ?.  =(%upload broker-kind.aut)  cor
   ?.  (gth expires-at.aut now.bowl)  cor
   ?~  sid=session.aut  cor
-  =/  st=bucket-state:b  (need-state flag.aut)
+  ?~  sp=(~(get by spaces) flag.aut)  cor
+  ?~  st-unit=state.u.sp  cor
+  =/  st=bucket-state:b  u.st-unit
   ?~  ses=(~(get by sessions.st) u.sid)  cor
   ?.  =(%pending status.u.ses)  cor
   ?.  (group-can-write group.st flag.aut writers.st actor.aut)  cor
@@ -467,8 +489,11 @@
   ?~  got=(~(get by broker-capabilities) u.cap)  cor
   =/  aut=broker-capability:b  u.got
   ?.  =(%upload broker-kind.aut)  cor
+  ?.  (gth expires-at.aut now.bowl)  cor
   ?~  sid=session.aut  cor
-  =/  st=bucket-state:b  (need-state flag.aut)
+  ?~  sp=(~(get by spaces) flag.aut)  cor
+  ?~  st-unit=state.u.sp  cor
+  =/  st=bucket-state:b  u.st-unit
   ?.  (group-can-write group.st flag.aut writers.st actor.aut)  cor
   ?~  ses-unit=(~(get by sessions.st) u.sid)  cor
   =/  ses=upload-session:b  u.ses-unit
@@ -638,6 +663,7 @@
     %create          |
     %delete-bucket   (group-is-admin group.st flag who)
     %set-title       (group-is-admin group.st flag who)
+    %set-readers     (group-is-admin group.st flag who)
     %set-writers     (group-is-admin group.st flag who)
     %issue-read      (group-can-read group.st flag who)
     %create-folder   (group-can-write group.st flag writers.st who)
@@ -924,6 +950,13 @@
     ?>  =(%sub net.sp)
     ?~  state.sp  cor
     =/  st=bucket-state:b  u.state.sp
+    ::  Ignore duplicates and re-establish the subscription on a gap. The
+    ::  replacement watch begins with a full snapshot, so later deltas cannot
+    ::  be applied to a stale replica.
+    ?:  (lte revision.res revision.st)  cor
+    ?.  =(revision.res +(revision.st))
+      =.  cor  (stop-sub flag.res)
+      (start-sub flag.res group.st)
     ?:  =(%bucket-deleted -.update.res)
       =.  cor  (give [%fact ~[/v1] buckets-response-1+!>(res)])
       =.  cor  (emil (drop (report-active flag.res sp |)))
@@ -946,6 +979,9 @@
   ::
       %bucket-updated
     st(bucket bucket.upd)
+  ::
+      %readers-updated
+    st(readers readers.upd)
   ::
       %writers-updated
     st(writers writers.upd)
diff --git a/desk/lib/buckets/json.hoon b/desk/lib/buckets/json.hoon
index 243c7ff014..ecaa9ae49c 100644
--- a/desk/lib/buckets/json.hoon
+++ b/desk/lib/buckets/json.hoon
@@ -105,6 +105,12 @@
     ::
         %bucket-updated
       (pairs ~[['type' s+'bucket-updated'] ['bucket' (bucket bucket.upd)]])
+    ::
+        %readers-updated
+      =/  roles=(list json)
+        %+  turn  ~(tap in readers.upd)
+        |=(role=@tas s+(scot %tas role))
+      (pairs ~[['type' s+'readers-updated'] ['readers' [%a roles]]])
     ::
         %writers-updated
       =/  roles=(list json)
@@ -201,13 +207,20 @@
     ?~  val  ~
     ((mu ni) u.val)
   ::
+  ++  knot
+    |=  txt=@t
+    ^-  @tas
+    =/  parsed=(unit @tas)  (slaw %tas txt)
+    ?~  parsed  ~|(invalid-buckets-knot+txt !!)
+    u.parsed
+  ::
   ++  flag
     |=  jon=json
     ^-  flag:b
     =/  raw
       %.  jon
       (ot ~[['host' (su ;~(pfix sig fed:ag))] ['name' so]])
-    [-.raw `@tas`+.raw]
+    [-.raw (knot +.raw)]
   ::
   ++  readers
     |=  jon=json
@@ -222,7 +235,7 @@
     ?+  typ  ~|(unknown-buckets-action+typ !!)
         %'create'
       :*  %create
-          `@tas`(so (get 'name' jon))
+          (knot (so (get 'name' jon)))
           (so (get 'title' jon))
           (flag (get 'group' jon))
           (readers (get 'readers' jon))
@@ -237,6 +250,12 @@
           (flag (get 'flag' jon))
           (so (get 'title' jon))
       ==
+    ::
+        %'set-readers'
+      :*  %set-readers
+          (flag (get 'flag' jon))
+          (readers (get 'readers' jon))
+      ==
     ::
         %'set-writers'
       :*  %set-writers
diff --git a/desk/sur/buckets.hoon b/desk/sur/buckets.hoon
index 2042a1eb2a..3795cc04c7 100644
--- a/desk/sur/buckets.hoon
+++ b/desk/sur/buckets.hoon
@@ -117,6 +117,7 @@
   $%  [%create name=@tas title=@t group=flag readers=(set @tas) writers=(set @tas)]
       [%delete-bucket =flag]
       [%set-title =flag title=@t]
+      [%set-readers =flag readers=(set @tas)]
       [%set-writers =flag writers=(set @tas)]
       [%create-folder =flag parent=(unit @ud) name=@t]
       [%begin-upload =flag parent=(unit @ud) name=@t mime=@t size=@ud checksum=(unit @t) capability=@t]
@@ -166,6 +167,7 @@
   $%  [%bucket-created =bucket]
       [%bucket-deleted ~]
       [%bucket-updated =bucket]
+      [%readers-updated readers=(set @tas)]
       [%writers-updated writers=(set @tas)]
       [%folder-created =entry]
       [%upload-begun =upload-session =entry]
diff --git a/desk/tests/app/buckets.hoon b/desk/tests/app/buckets.hoon
index a33cec7ada..73ad610e09 100644
--- a/desk/tests/app/buckets.hoon
+++ b/desk/tests/app/buckets.hoon
@@ -208,14 +208,14 @@
   =/  session-list=(list upload-session:bu)  ~(val by sessions.bs)
   =/  ses=upload-session:bu  ?~(session-list !! i.session-list)
   ;<  *  b
-    (do-poke %buckets-action-1 !>(`action:bu`[%finish-upload flag id.ses 'https://objects.test/meadow.png']))
+    (do-poke %buckets-action-1 !>(`action:bu`[%finish-upload flag id.ses 'https://storage.googleapis.com/tlon-test-memex-assets/meadow.png']))
   ;<  sv2=vase  b  get-save
   =/  st2=state-2:bu  !<(state-2:bu sv2)
   =/  bs2=bucket-state:bu  (state-for st2 flag)
   =/  ent=entry:bu  (~(got by entries.bs2) 3)
   =/  fil=file:bu  (file-of ent)
   =/  ses2=upload-session:bu  (~(got by sessions.bs2) id.ses)
-  =/  expected-url=(unit @t)  (some 'https://objects.test/meadow.png')
+  =/  expected-url=(unit @t)  (some 'https://storage.googleapis.com/tlon-test-memex-assets/meadow.png')
   =/  expected-parent=(unit @ud)  (some 2)
   (ex-equal !>([revision.bs2 status.fil status.ses2 object-url.fil parent.ent]) !>([3 %ready %complete expected-url expected-parent]))
 ::
@@ -350,6 +350,69 @@
           &
       ==
 ::
+::  Legacy completion accepts only live sessions and Tlon-managed Memex URLs.
+::
+++  test-legacy-upload-completion-is-bounded
+  %-  eval-mare
+  =/  m  (mare ,~)
+  =*  b  bind:m
+  ^-  form:m
+  ;<  ~  b  setup
+  ;<  ~  b  create
+  ;<  *  b
+    (do-poke %buckets-action-1 !>(`action:bu`[%begin-upload flag ~ 'unsafe.txt' 'text/plain' 4 ~ 'legacy-security-capability-000000000000']))
+  ;<  sv=vase  b  get-save
+  =/  st=state-2:bu  !<(state-2:bu sv)
+  =/  bs=bucket-state:bu  (state-for st flag)
+  =/  sessions=(list upload-session:bu)  ~(val by sessions.bs)
+  =/  ses=upload-session:bu  ?~(sessions !! i.sessions)
+  ;<  *  b
+    %-  ex-fail
+    (do-poke %buckets-action-1 !>(`action:bu`[%finish-upload flag id.ses 'https://attacker.example/tracker']))
+  ;<  *  b
+    %-  ex-fail
+    (do-poke %buckets-action-1 !>(`action:bu`[%finish-upload flag id.ses 'https://storage.googleapis.com/tlon-attacker/path/-memex-assets/tracker']))
+  ;<  ~  b  (jab-bowl |=(bol=bowl bol(now ~2026.1.1..02.00.00)))
+  %-  ex-fail
+  (do-poke %buckets-action-1 !>(`action:bu`[%finish-upload flag id.ses 'https://storage.googleapis.com/tlon-test-memex-assets/expired.txt']))
+::
+::  Broker callbacks whose capability outlives a deleted Bucket deny softly
+::  instead of crashing the Pioneer thread.
+::
+++  test-broker-command-after-delete-is-soft-denied
+  %-  eval-mare
+  =/  m  (mare ,~)
+  =*  b  bind:m
+  ^-  form:m
+  =/  cap=@t  'delete-race-capability-0000000000000000'
+  =/  rid=@t  '00000000-0000-0000-0000-000000000009'
+  ;<  ~  b  setup
+  ;<  ~  b  create
+  ;<  *  b
+    (do-poke %buckets-action-1 !>(`action:bu`[%begin-upload flag ~ 'race.pdf' 'application/pdf' 42 ~ cap]))
+  ;<  *  b
+    (do-poke %buckets-action-1 !>(`action:bu`[%delete-bucket flag]))
+  ;<  caz=(list card)  b
+    (do-poke %buckets-broker-command-1 !>(`broker-command:bu`[%authorize-upload cap rid]))
+  (ex-cards caz ~)
+::
+::  Reader changes are revisioned into the Bucket replica as well as %groups.
+::
+++  test-set-readers-updates-bucket-state
+  %-  eval-mare
+  =/  m  (mare ,~)
+  =*  b  bind:m
+  ^-  form:m
+  =/  readers=(set @tas)  (silt `(list @tas)`~[%member %guest])
+  ;<  ~  b  setup
+  ;<  ~  b  create
+  ;<  *  b
+    (do-poke %buckets-action-1 !>(`action:bu`[%set-readers flag readers]))
+  ;<  sv=vase  b  get-save
+  =/  st=state-2:bu  !<(state-2:bu sv)
+  =/  bs=bucket-state:bu  (state-for st flag)
+  (ex-equal !>([readers.bs revision.bs]) !>([readers 1]))
+::
 ::  Folder parents must exist and must themselves be folders.
 ::
 ++  test-invalid-parent-rejected
diff --git a/docs/backend/desk/app/buckets.md b/docs/backend/desk/app/buckets.md
index 5aae3721cd..db521a90e0 100644
--- a/docs/backend/desk/app/buckets.md
+++ b/docs/backend/desk/app/buckets.md
@@ -14,7 +14,7 @@ The channel nest is `buckets/~host/name`. The Bucket host is authoritative, whil
 -   Gall persists only the manifest, bounded upload-session metadata, and opaque short-lived broker capabilities. Object bytes, storage credentials, and signed URLs must not travel over Ames or enter Gall state.
 -   Object keys are host-generated and independent of display names, so rename and move operations only change manifest metadata.
 
-Hosted clients use the private Ylem/Memex broker path described below. `%finish-upload` remains available for the legacy public Memex fallback while the private broker is rolled out by canary.
+Hosted clients use the private Ylem/Memex broker path described below. `%finish-upload` is retained only for compatibility with older clients; it accepts live sessions and Tlon-managed Memex object URLs, never arbitrary origins.
 
 ## State
 
@@ -41,10 +41,11 @@ Local clients poke `%buckets-action-1`. The mark accepts JSON and noun input.
 | `%create`        | Create a host-owned Bucket and register the channel with `%groups`                                                  |
 | `%delete-bucket` | Delete the Bucket and remove its `%groups` channel registration                                                     |
 | `%set-title`     | Update the Bucket's authoritative title; group metadata is updated separately through `%groups`                     |
+| `%set-readers`   | Mirror the group channel's reader-role set into Bucket snapshots                                                    |
 | `%set-writers`   | Replace the group-role writer set                                                                                   |
 | `%create-folder` | Add a folder beneath an existing folder or the root                                                                 |
 | `%begin-upload`  | Allocate a pending file, opaque object key, one-hour upload session, and bind the caller's opaque broker capability |
-| `%finish-upload` | Mark the requester's pending upload ready                                                                           |
+| `%finish-upload` | Legacy-only completion for a live session and a Tlon-managed Memex object URL                                       |
 | `%fail-upload`   | Mark the requester's pending upload failed                                                                          |
 | `%issue-read`    | Bind a ten-minute read capability to a ready file and the requesting ship                                           |
 | `%issue-delete`  | Bind a ten-minute delete capability to a ready file and the requesting ship                                         |
@@ -85,7 +86,7 @@ Completion is idempotent. Re-exchanging an upload capability with the same reser
 
 For a private read, the client sends `%issue-read`, exchanges the capability at Memex, and receives a short-lived read URL after `%pioneer-buckets-authorize-read` re-checks live group access. Delete follows the same pattern through `%issue-delete` and `%pioneer-buckets-authorize-delete` before the manifest entry is removed.
 
-The client falls back to the legacy public Memex upload only when the private endpoint reports that the feature is disabled, unavailable, or absent. Authorization failures do not fall back.
+Current clients require the private broker. Broker unavailability fails the upload cleanly and marks the Gall session failed; clients do not fall back to uploader-owned storage or ask for owner credentials.
 
 ## Pioneer thread contract
 
@@ -108,6 +109,9 @@ Authorization failures return `{result: "denied"}` and expired capabilities retu
 -   Private reservation binding and verified completion, including idempotent retries
 -   Exact upload/read/delete broker verdicts and denial for a mismatched object ID
 -   Lazy cleanup of expired capabilities and their reservation bindings
+-   Expiry and origin checks for legacy upload completion
+-   Soft broker denial after a Bucket is deleted
+-   Reader-role replica updates
 -   Rejection of nonexistent folder parents
 -   Rejection of a remote write after the live `%groups` permission gate denies access
 -   Acceptance of a remote write only when the member has a configured writer role
diff --git a/packages/api/src/__tests__/bucketsApi.test.ts b/packages/api/src/__tests__/bucketsApi.test.ts
index 034037a898..eb2aa21bf8 100644
--- a/packages/api/src/__tests__/bucketsApi.test.ts
+++ b/packages/api/src/__tests__/bucketsApi.test.ts
@@ -1,7 +1,7 @@
 import { beforeEach, expect, test, vi } from 'vitest';
 
 import { getBuckets, subscribeToBuckets } from '../client/bucketsApi';
-import { scry, subscribe } from '../client/urbit';
+import { scry, subscribe, unsubscribe } from '../client/urbit';
 import type { BucketsResponse, BucketsSnapshot } from '../urbit/buckets';
 
 vi.mock('../client/urbit', () => ({
@@ -33,6 +33,7 @@ const legacySnapshot = {
 beforeEach(() => {
   vi.mocked(scry).mockReset();
   vi.mocked(subscribe).mockReset();
+  vi.mocked(unsubscribe).mockReset();
 });
 
 test('getBuckets gives legacy snapshots their implicit writer roles', async () => {
@@ -58,3 +59,18 @@ test('subscribeToBuckets normalizes legacy snapshot events', async () => {
     })
   );
 });
+
+test('subscribeToBuckets unsubscribes the replacement id after a reset', async () => {
+  vi.mocked(subscribe).mockImplementationOnce(
+    async (_endpoint, _onUpdate, options) => {
+      options?.onSubscriptionId?.(7);
+      options?.onSubscriptionId?.(19);
+      return 7;
+    }
+  );
+
+  const stop = await subscribeToBuckets(vi.fn());
+  await stop();
+
+  expect(unsubscribe).toHaveBeenCalledWith(19);
+});
diff --git a/packages/api/src/client/bucketsApi.ts b/packages/api/src/client/bucketsApi.ts
index 92c1fce238..cc045ff641 100644
--- a/packages/api/src/client/bucketsApi.ts
+++ b/packages/api/src/client/bucketsApi.ts
@@ -59,6 +59,7 @@ export function sendBucketsAction(action: BucketsAction) {
 export async function subscribeToBuckets(
   handler: (response: BucketsResponse) => void
 ) {
+  let activeSubscriptionId: number | null = null;
   const subscriptionId = await subscribe<BucketsResponse>(
     { app: BUCKETS_APP, path: '/v1' },
     (response) =>
@@ -66,8 +67,17 @@ export async function subscribeToBuckets(
         response.type === 'snapshot'
           ? normalizeBucketsSnapshot(response)
           : response
-      )
+      ),
+    {
+      onSubscriptionId: (id) => {
+        activeSubscriptionId = id;
+      },
+    }
   );
+  activeSubscriptionId ??= subscriptionId;
 
-  return () => unsubscribe(subscriptionId);
+  return () =>
+    activeSubscriptionId === null
+      ? Promise.resolve()
+      : unsubscribe(activeSubscriptionId);
 }
diff --git a/packages/api/src/client/urbit.ts b/packages/api/src/client/urbit.ts
index c23c66fbf2..82a57d5e5f 100644
--- a/packages/api/src/client/urbit.ts
+++ b/packages/api/src/client/urbit.ts
@@ -91,6 +91,11 @@ interface UrbitEndpoint {
   path: string;
 }
 
+type SubscribeOptions = {
+  onSubscriptionId?: (id: number) => void;
+  resubOnQuit?: boolean;
+};
+
 export interface ClientParams {
   shipName: string;
   shipUrl: string;
@@ -316,7 +321,8 @@ function printEndpoint(endpoint: UrbitEndpoint) {
 
 export async function subscribe<T>(
   endpoint: UrbitEndpoint,
-  handler: (update: T, id?: number) => void
+  handler: (update: T, id?: number) => void,
+  options: SubscribeOptions = {}
 ): Promise<number> {
   const doSub = async (err?: (error: any, id: string) => void) => {
     if (!config.client) {
@@ -329,6 +335,8 @@ export async function subscribe<T>(
     return config.client.subscribe({
       app: endpoint.app,
       path: endpoint.path,
+      onSubscriptionId: options.onSubscriptionId,
+      resubOnQuit: options.resubOnQuit,
       event: (event: any, mark: string, id?: number) => {
         logger.debug(
           `got subscription event on ${printEndpoint(endpoint)}:`,
diff --git a/packages/api/src/http-api/Urbit.ts b/packages/api/src/http-api/Urbit.ts
index b931e901e0..8e0992bcf3 100644
--- a/packages/api/src/http-api/Urbit.ts
+++ b/packages/api/src/http-api/Urbit.ts
@@ -823,14 +823,15 @@ export class Urbit {
    * @param handlers Handlers to deal with various events of the subscription
    */
   async subscribe(params: SubscriptionRequestInterface): Promise<number> {
-    const { app, path, ship, resubOnQuit, err, event, quit } = {
-      err: () => {},
-      event: () => {},
-      quit: () => {},
-      resubOnQuit: true,
-      ...params,
-      ship: desig(params.ship ?? this.nodeId ?? ''),
-    };
+    const { app, path, ship, resubOnQuit, err, event, quit, onSubscriptionId } =
+      {
+        err: () => {},
+        event: () => {},
+        quit: () => {},
+        resubOnQuit: true,
+        ...params,
+        ship: desig(params.ship ?? this.nodeId ?? ''),
+      };
 
     if (this.lastEventId === 0) {
       this.emit('status-update', { status: 'opening' });
@@ -851,6 +852,7 @@ export class Urbit {
       err,
       event,
       quit,
+      onSubscriptionId,
     });
 
     this.emit('subscription', {
@@ -860,6 +862,10 @@ export class Urbit {
       status: 'open',
     });
 
+    // Publish the replacement id as soon as it is allocated. A consumer may
+    // unmount while the resubscribe request is still in flight and must still
+    // be able to unsubscribe the replacement rather than the obsolete id.
+    onSubscriptionId?.(message.id);
     await this.sendJSONtoChannel(message);
 
     return message.id;
diff --git a/packages/api/src/http-api/types.ts b/packages/api/src/http-api/types.ts
index c21ac9f2e4..3d4c787644 100644
--- a/packages/api/src/http-api/types.ts
+++ b/packages/api/src/http-api/types.ts
@@ -211,6 +211,11 @@ export interface SubscriptionRequestInterface extends SubscriptionInterface {
    * Whether to resubscribe this exact subscription on quit
    */
   resubOnQuit?: boolean;
+  /**
+   * Receives the active subscription id, including replacement ids allocated
+   * when Airlock automatically re-subscribes after an Eyre channel reset.
+   */
+  onSubscriptionId?(id: number): void;
   ship?: string;
 }
 
diff --git a/packages/api/src/urbit/buckets.ts b/packages/api/src/urbit/buckets.ts
index 4dceaa9517..d0649ad4f4 100644
--- a/packages/api/src/urbit/buckets.ts
+++ b/packages/api/src/urbit/buckets.ts
@@ -71,6 +71,7 @@ export type BucketsUpdate =
   | { type: 'bucket-created'; bucket: BucketsBucket }
   | { type: 'bucket-deleted' }
   | { type: 'bucket-updated'; bucket: BucketsBucket }
+  | { type: 'readers-updated'; readers: string[] }
   | { type: 'writers-updated'; writers: string[] }
   | { type: 'folder-created'; entry: BucketsFolderEntry }
   | {
@@ -112,6 +113,7 @@ export type BucketsAction =
     }
   | { type: 'delete-bucket'; flag: BucketsFlag }
   | { type: 'set-title'; flag: BucketsFlag; title: string }
+  | { type: 'set-readers'; flag: BucketsFlag; readers: string[] }
   | { type: 'set-writers'; flag: BucketsFlag; writers: string[] }
   | {
       type: 'create-folder';
diff --git a/packages/app/features/buckets/BucketsLiveChannel.tsx b/packages/app/features/buckets/BucketsLiveChannel.tsx
index a9d1748fa4..ec7050123a 100644
--- a/packages/app/features/buckets/BucketsLiveChannel.tsx
+++ b/packages/app/features/buckets/BucketsLiveChannel.tsx
@@ -39,13 +39,15 @@ type SearchOrigin = {
   selectedItemId: string | null;
 };
 
-function toItem(entry: BucketsEntry, entries: BucketsEntry[]): BucketItem {
+function toItem(
+  entry: BucketsEntry,
+  childCounts: ReadonlyMap<number, number>
+): BucketItem {
   if (entry.kind === 'folder') {
     return {
       author: entry.updatedBy,
       id: String(entry.id),
-      itemCount: entries.filter((candidate) => candidate.parentId === entry.id)
-        .length,
+      itemCount: childCounts.get(entry.id) ?? 0,
       kind: 'folder',
       modifiedLabel: formatBucketTimestamp(entry.updatedAt),
       name: entry.name,
@@ -88,13 +90,13 @@ function sortItems(items: BucketItem[]) {
 
 function pathLabelFor(
   entry: BucketsEntry,
-  entries: BucketsEntry[],
+  entriesById: ReadonlyMap<number, BucketsEntry>,
   rootLabel: string
 ) {
   const names: string[] = [];
   let parentId = entry.parentId;
   while (parentId !== null) {
-    const parent = entries.find((candidate) => candidate.id === parentId);
+    const parent = entriesById.get(parentId);
     if (!parent) break;
     names.unshift(parent.name);
     parentId = parent.parentId;
@@ -135,6 +137,19 @@ export function BucketsLiveChannel({
     () => live.snapshot?.state.entries ?? [],
     [live.snapshot?.state.entries]
   );
+  const entriesById = useMemo(
+    () => new Map(entries.map((entry) => [entry.id, entry])),
+    [entries]
+  );
+  const childCounts = useMemo(() => {
+    const counts = new Map<number, number>();
+    for (const entry of entries) {
+      if (entry.parentId !== null) {
+        counts.set(entry.parentId, (counts.get(entry.parentId) ?? 0) + 1);
+      }
+    }
+    return counts;
+  }, [entries]);
   const suppressedIds = useMemo(
     () =>
       new Set(
@@ -149,31 +164,34 @@ export function BucketsLiveChannel({
     [entries, suppressedIds]
   );
   const rootLabel = live.snapshot?.state.bucket.title ?? 'Bucket';
-  const activeFolder = entries.find(
-    (entry) => entry.kind === 'folder' && entry.id === activeFolderId
-  );
+  const activeFolderCandidate =
+    activeFolderId === null ? undefined : entriesById.get(activeFolderId);
+  const activeFolder =
+    activeFolderCandidate?.kind === 'folder'
+      ? activeFolderCandidate
+      : undefined;
   const rootFolders = serverEntries.filter(
     (entry) => entry.kind === 'folder' && entry.parentId === null
   );
   const visibleServerItems = serverEntries
     .filter((entry) => entry.parentId === activeFolderId)
-    .map((entry) => toItem(entry, entries));
+    .map((entry) => toItem(entry, childCounts));
   const visibleLocalItems = live.uploads
     .filter((upload) => upload.parentId === activeFolderId)
     .map((upload) => live.localItems.find((item) => item.id === upload.id))
     .filter((item): item is BucketItem => item !== undefined);
   const visibleItems = sortItems([...visibleLocalItems, ...visibleServerItems]);
   const sidebarItems = sortItems(
-    rootFolders.map((entry) => toItem(entry, entries))
+    rootFolders.map((entry) => toItem(entry, childCounts))
   );
   const allSearchResults = useMemo<BucketSearchResult[]>(
     () =>
       serverEntries.map((entry) => ({
-        ...toItem(entry, entries),
+        ...toItem(entry, childCounts),
         parentFolderId: entry.parentId === null ? null : String(entry.parentId),
-        pathLabel: pathLabelFor(entry, entries, rootLabel),
+        pathLabel: pathLabelFor(entry, entriesById, rootLabel),
       })),
-    [entries, rootLabel, serverEntries]
+    [childCounts, entriesById, rootLabel, serverEntries]
   );
   const normalizedQuery = query.trim().toLowerCase();
   const searchResults = normalizedQuery
diff --git a/packages/app/features/buckets/bucketUploadReconciliation.test.ts b/packages/app/features/buckets/bucketUploadReconciliation.test.ts
index c28e27c825..00e80e8399 100644
--- a/packages/app/features/buckets/bucketUploadReconciliation.test.ts
+++ b/packages/app/features/buckets/bucketUploadReconciliation.test.ts
@@ -1,7 +1,10 @@
 import type { BucketsSnapshot } from '@tloncorp/api';
 import { describe, expect, it } from 'vitest';
 
-import { reconcileUploadsWithSnapshot } from './bucketUploadReconciliation';
+import {
+  bucketResponseHasRevisionGap,
+  reconcileUploadsWithSnapshot,
+} from './bucketUploadReconciliation';
 
 const snapshot = {
   flag: { host: '~zod', name: 'project-files' },
@@ -164,4 +167,54 @@ describe('reconcileUploadsWithSnapshot', () => {
       { serverEntryId: 11, sessionId: 'second-session' },
     ]);
   });
+
+  it('does not reuse an entry already claimed by another waiter', () => {
+    const upload = {
+      candidate: {
+        mimeType: 'image/heic',
+        name: 'IMG_0111.heic',
+        size: 42,
+      },
+      id: 'second-local-upload',
+      parentId: null,
+      priorSessionIds: [] as string[],
+    };
+
+    expect(
+      reconcileUploadsWithSnapshot([upload], snapshot, '~zod', new Set([10]))[0]
+    ).toBe(upload);
+  });
+});
+
+describe('bucketResponseHasRevisionGap', () => {
+  it('requests a refresh when an update skips a revision', () => {
+    expect(
+      bucketResponseHasRevisionGap(snapshot, {
+        type: 'update',
+        actor: '~zod',
+        flag: snapshot.flag,
+        revision: snapshot.state.revision + 2,
+        update: { type: 'bucket-updated', bucket: snapshot.state.bucket },
+      })
+    ).toBe(true);
+  });
+
+  it('accepts the next revision and replacement snapshots', () => {
+    expect(
+      bucketResponseHasRevisionGap(snapshot, {
+        type: 'update',
+        actor: '~zod',
+        flag: snapshot.flag,
+        revision: snapshot.state.revision + 1,
+        update: { type: 'bucket-updated', bucket: snapshot.state.bucket },
+      })
+    ).toBe(false);
+    expect(
+      bucketResponseHasRevisionGap(snapshot, {
+        type: 'snapshot',
+        flag: snapshot.flag,
+        state: snapshot.state,
+      })
+    ).toBe(false);
+  });
 });
diff --git a/packages/app/features/buckets/bucketUploadReconciliation.ts b/packages/app/features/buckets/bucketUploadReconciliation.ts
index 25e487fa36..253c6c2a7a 100644
--- a/packages/app/features/buckets/bucketUploadReconciliation.ts
+++ b/packages/app/features/buckets/bucketUploadReconciliation.ts
@@ -1,4 +1,15 @@
-import type { BucketsSnapshot } from '@tloncorp/api';
+import type { BucketsResponse, BucketsSnapshot } from '@tloncorp/api';
+
+export function bucketResponseHasRevisionGap(
+  snapshot: BucketsSnapshot | null,
+  response: BucketsResponse
+) {
+  return (
+    response.type === 'update' &&
+    snapshot !== null &&
+    response.revision > snapshot.state.revision + 1
+  );
+}
 
 type ReconcileableUpload = {
   candidate: {
@@ -15,13 +26,14 @@ type ReconcileableUpload = {
 export function reconcileUploadsWithSnapshot<T extends ReconcileableUpload>(
   uploads: T[],
   snapshot: BucketsSnapshot,
-  requestedBy: string
+  requestedBy: string,
+  alreadyClaimedEntryIds: ReadonlySet<number> = new Set()
 ): T[] {
-  const usedEntryIds = new Set(
-    uploads
-      .map((upload) => upload.serverEntryId)
-      .filter((id): id is number => id !== undefined)
-  );
+  const usedEntryIds = new Set(alreadyClaimedEntryIds);
+  uploads
+    .map((upload) => upload.serverEntryId)
+    .filter((id): id is number => id !== undefined)
+    .forEach((id) => usedEntryIds.add(id));
   let changed = false;
 
   const reconciled = uploads.map((upload) => {
diff --git a/packages/app/features/buckets/useLiveBucket.ts b/packages/app/features/buckets/useLiveBucket.ts
index 6cd2af7aae..118c764b01 100644
--- a/packages/app/features/buckets/useLiveBucket.ts
+++ b/packages/app/features/buckets/useLiveBucket.ts
@@ -14,15 +14,12 @@ import {
 import {
   BucketsBrokerError,
   brokerRequiredHeaders,
-  canFallBackFromBucketsBroker,
   cancelBucketUpload,
   completeBucketUpload,
   createBucketCapability,
   deleteBucketObject,
-  getMemexUpload,
   grantBucketRead,
   grantBucketUpload,
-  retryBucketUpload,
 } from '@tloncorp/shared';
 import * as db from '@tloncorp/shared/db';
 import { useCallback, useEffect, useMemo, useRef, useState } from 'react';
@@ -34,12 +31,14 @@ import {
   removeBucketUploadFromBatch,
 } from '../../utils/bucketUploadProgress';
 import type { BucketUploadBatchItem } from '../../utils/bucketUploadProgress';
-import { reconcileUploadsWithSnapshot } from './bucketUploadReconciliation';
+import {
+  bucketResponseHasRevisionGap,
+  reconcileUploadsWithSnapshot,
+} from './bucketUploadReconciliation';
 import { createBucketUploadTask } from './bucketUploadTask';
 import type { BucketUploadTask } from './bucketUploadTask.types';
 
 type LocalUpload = {
-  brokerBytesUploaded?: boolean;
   brokerReservationId?: string;
   candidate: BucketUploadCandidate;
   capability?: string;
@@ -84,6 +83,7 @@ function reduceBucketResponse(
   let entries = current.state.entries;
   let sessions = current.state.sessions;
   let bucket = current.state.bucket;
+  let readers = current.state.readers;
   let writers = current.state.writers ?? current.state.readers;
 
   switch (update.type) {
@@ -94,6 +94,9 @@ function reduceBucketResponse(
     case 'writers-updated':
       writers = update.writers;
       break;
+    case 'readers-updated':
+      readers = update.readers;
+      break;
     case 'folder-created':
     case 'entry-updated':
       entries = upsertEntry(entries, update.entry);
@@ -122,6 +125,7 @@ function reduceBucketResponse(
       bucket,
       entries,
       revision: response.revision,
+      readers,
       sessions,
       writers,
     },
@@ -166,36 +170,60 @@ export function useLiveBucket(requestedFlag: BucketsFlag) {
   const [loading, setLoading] = useState(true);
   const [error, setError] = useState<string | null>(null);
   const [uploads, setUploads] = useState<LocalUpload[]>([]);
+  const uploadsRef = useRef<LocalUpload[]>([]);
   const [uploadBatch, setUploadBatch] = useState<BucketUploadBatchItem[]>([]);
   const snapshotRef = useRef<BucketsSnapshot | null>(null);
   const tasksRef = useRef(new Map<string, BucketUploadTask>());
   const cancelledRef = useRef(new Set<string>());
+  const claimedEntryIdsRef = useRef(new Set<number>());
+  const lastSessionRefreshAtRef = useRef(0);
+  const sessionRefreshRef = useRef<Promise<BucketsSnapshot | null> | null>(
+    null
+  );
 
-  const commitSnapshot = useCallback((next: BucketsSnapshot | null) => {
-    snapshotRef.current = next;
-    if (next) {
-      setUploads((current) =>
-        reconcileUploadsWithSnapshot(current, next, getCurrentUserId())
-      );
-    }
-    setSnapshot(next);
-    if (next) {
-      const channelId = formatBucketsChannelId(next.flag);
-      void db.updateChannel({
-        id: channelId,
-        readerRoles: next.state.readers.map((roleId) => ({
-          channelId,
-          roleId,
-        })),
-        writerRoles: (next.state.writers ?? next.state.readers).map(
-          (roleId) => ({
+  const setCurrentUploads = useCallback(
+    (update: (current: LocalUpload[]) => LocalUpload[]) => {
+      const next = update(uploadsRef.current);
+      uploadsRef.current = next;
+      setUploads(next);
+      return next;
+    },
+    []
+  );
+
+  const commitSnapshot = useCallback(
+    (next: BucketsSnapshot | null) => {
+      snapshotRef.current = next;
+      if (next) {
+        setCurrentUploads((current) =>
+          reconcileUploadsWithSnapshot(
+            current,
+            next,
+            getCurrentUserId(),
+            claimedEntryIdsRef.current
+          )
+        );
+      }
+      setSnapshot(next);
+      if (next) {
+        const channelId = formatBucketsChannelId(next.flag);
+        void db.updateChannel({
+          id: channelId,
+          readerRoles: next.state.readers.map((roleId) => ({
             channelId,
             roleId,
-          })
-        ),
-      });
-    }
-  }, []);
+          })),
+          writerRoles: (next.state.writers ?? next.state.readers).map(
+            (roleId) => ({
+              channelId,
+              roleId,
+            })
+          ),
+        });
+      }
+    },
+    [setCurrentUploads]
+  );
 
   const selectSnapshot = useCallback(
     (snapshots: BucketsSnapshot[]) =>
@@ -205,19 +233,49 @@ export function useLiveBucket(requestedFlag: BucketsFlag) {
 
   const refresh = useCallback(async () => {
     const next = selectSnapshot(await getBuckets());
+    const current = snapshotRef.current;
+    if (
+      next &&
+      current &&
+      matchesFlag(next.flag, current.flag) &&
+      next.state.revision <= current.state.revision
+    ) {
+      return current;
+    }
+    if (!next && !current) return null;
     commitSnapshot(next);
     return next;
   }, [commitSnapshot, selectSnapshot]);
 
+  const refreshUploadSessions = useCallback(() => {
+    if (sessionRefreshRef.current) return sessionRefreshRef.current;
+    const now = Date.now();
+    if (snapshotRef.current && now - lastSessionRefreshAtRef.current < 2_000) {
+      return Promise.resolve(snapshotRef.current);
+    }
+    lastSessionRefreshAtRef.current = now;
+    const request = refresh().finally(() => {
+      if (sessionRefreshRef.current === request) {
+        sessionRefreshRef.current = null;
+      }
+    });
+    sessionRefreshRef.current = request;
+    return request;
+  }, [refresh]);
+
   useEffect(() => {
     let active = true;
     let stopSubscription: (() => Promise<void>) | undefined;
-    const uploadTasks = tasksRef.current;
-
     const start = async () => {
       try {
         stopSubscription = await subscribeToBuckets((response) => {
           if (!active || !matchesFlag(response.flag, flag)) return;
+          if (bucketResponseHasRevisionGap(snapshotRef.current, response)) {
+            void refresh().catch((cause) => {
+              if (active) setError(errorMessage(cause));
+            });
+            return;
+          }
           const next = reduceBucketResponse(snapshotRef.current, response);
           commitSnapshot(next);
           setLoading(false);
@@ -243,14 +301,12 @@ export function useLiveBucket(requestedFlag: BucketsFlag) {
     return () => {
       active = false;
       if (stopSubscription) void stopSubscription();
-      uploadTasks.forEach((task) => void task.cancel());
-      uploadTasks.clear();
     };
   }, [commitSnapshot, flag, flagKey, refresh]);
 
   const updateLocalUpload = useCallback(
     (id: string, patch: Partial<LocalUpload>) => {
-      setUploads((current) =>
+      setCurrentUploads((current) =>
         current.map((upload) =>
           upload.id === id ? { ...upload, ...patch } : upload
         )
@@ -274,49 +330,75 @@ export function useLiveBucket(requestedFlag: BucketsFlag) {
         );
       }
     },
-    []
+    [setCurrentUploads]
   );
 
   const waitForSession = useCallback(
     async (
       candidate: BucketUploadCandidate,
+      localUploadId: string,
       parentId: number | null,
       priorSessionIds: Set<string>
     ) => {
-      for (let attempt = 0; attempt < 40; attempt += 1) {
-        const next = selectSnapshot(await getBuckets());
-        if (next) commitSnapshot(next);
-        const entry = next?.state.entries.find(
-          (candidateEntry): candidateEntry is BucketsFileEntry =>
-            candidateEntry.kind === 'file' &&
-            candidateEntry.name === candidate.name &&
-            candidateEntry.parentId === parentId &&
-            next.state.sessions.some(
-              (session) =>
-                session.fileId === candidateEntry.id &&
-                !priorSessionIds.has(session.id)
-            )
-        );
-        const session = next?.state.sessions.find(
-          (candidateSession) =>
-            candidateSession.fileId === entry?.id &&
-            !priorSessionIds.has(candidateSession.id)
-        );
-        if (entry && session) return { entry, session };
+      for (let attempt = 0; attempt < 80; attempt += 1) {
+        let next = snapshotRef.current;
+        // Subscription facts normally satisfy this immediately. A shared
+        // fallback scry every two seconds keeps uploads progressing while
+        // the channel screen is unmounted or a fact was missed, without one
+        // 250ms network loop per file.
+        if (!next || attempt % 8 === 7) {
+          next = await refreshUploadSessions();
+        }
+        if (next) {
+          const activeUploads = uploadsRef.current.map((upload) =>
+            upload.id === localUploadId
+              ? { ...upload, priorSessionIds: [...priorSessionIds] }
+              : upload
+          );
+          const reconciled = reconcileUploadsWithSnapshot(
+            activeUploads,
+            next,
+            getCurrentUserId(),
+            claimedEntryIdsRef.current
+          );
+          const matched = reconciled.find(
+            (upload) => upload.id === localUploadId
+          );
+          if (
+            matched &&
+            matched.serverEntryId !== undefined &&
+            matched.sessionId
+          ) {
+            const entry = next.state.entries.find(
+              (candidateEntry): candidateEntry is BucketsFileEntry =>
+                candidateEntry.kind === 'file' &&
+                candidateEntry.id === matched.serverEntryId
+            );
+            const session = next.state.sessions.find(
+              (candidateSession) =>
+                candidateSession.id === matched.sessionId &&
+                candidateSession.fileId === matched.serverEntryId
+            );
+            if (entry && session) {
+              claimedEntryIdsRef.current.add(entry.id);
+              setCurrentUploads(() => reconciled);
+              return { entry, session };
+            }
+          }
+        }
         await delay(250);
       }
       throw new Error('The ship did not start the upload in time');
     },
-    [commitSnapshot, selectSnapshot]
+    [refreshUploadSessions, setCurrentUploads]
   );
 
   const runUpload = useCallback(
     async (upload: LocalUpload) => {
       const { candidate, id, parentId } = upload;
-      let sessionId = upload.sessionId;
-      let serverEntryId = upload.serverEntryId;
-      let brokerReservationId = upload.brokerReservationId;
-      let brokerBytesUploaded = upload.brokerBytesUploaded ?? false;
+      let sessionId: string | undefined;
+      let serverEntryId: number | undefined;
+      let brokerReservationId: string | undefined;
       let brokerCompleted = false;
 
       try {
@@ -324,98 +406,62 @@ export function useLiveBucket(requestedFlag: BucketsFlag) {
           throw new Error('The file size could not be determined');
         }
         const mimeType = candidate.mimeType ?? 'application/octet-stream';
-        let privateGrant:
-          | Awaited<ReturnType<typeof grantBucketUpload>>
-          | undefined;
-        let legacyGrant: Awaited<ReturnType<typeof getMemexUpload>> | undefined;
-
-        if (brokerReservationId && sessionId && serverEntryId) {
-          updateLocalUpload(id, {
-            error: undefined,
-            progress: brokerBytesUploaded ? 96 : 5,
-            state: 'uploading',
-          });
-          if (!brokerBytesUploaded) {
-            privateGrant = await retryBucketUpload(brokerReservationId);
-          }
-        } else {
-          const current = snapshotRef.current ?? (await refresh());
-          if (!current) throw new Error(`Bucket ${flagKey} was not found`);
-          const priorSessionIds = new Set(
-            current.state.sessions.map((session) => session.id)
-          );
-          const capability = createBucketCapability();
-
-          updateLocalUpload(id, {
-            capability,
-            error: undefined,
-            progress: 1,
-            priorSessionIds: [...priorSessionIds],
-            state: 'uploading',
-          });
-          await sendBucketsAction({
-            type: 'begin-upload',
-            checksum: null,
-            capability,
-            flag,
-            mime: mimeType,
-            name: candidate.name,
-            parentId,
-            size: candidate.size,
-          });
-          const begun = await waitForSession(
-            candidate,
-            parentId,
-            priorSessionIds
-          );
-          sessionId = begun.session.id;
-          serverEntryId = begun.entry.id;
-          updateLocalUpload(id, { progress: 3, serverEntryId, sessionId });
-
-          if (cancelledRef.current.has(id)) {
-            throw new Error('Upload cancelled');
-          }
+        const current = snapshotRef.current ?? (await refresh());
+        if (!current) throw new Error(`Bucket ${flagKey} was not found`);
+        const priorSessionIds = new Set(
+          current.state.sessions.map((session) => session.id)
+        );
+        const capability = createBucketCapability();
 
-          try {
-            privateGrant = await waitForBrokerCapability(() =>
-              grantBucketUpload(capability, flag.host)
-            );
-          } catch (cause) {
-            if (!canFallBackFromBucketsBroker(cause)) throw cause;
-          }
+        updateLocalUpload(id, {
+          capability,
+          error: undefined,
+          progress: 1,
+          priorSessionIds: [...priorSessionIds],
+          state: 'uploading',
+        });
+        await sendBucketsAction({
+          type: 'begin-upload',
+          checksum: null,
+          capability,
+          flag,
+          mime: mimeType,
+          name: candidate.name,
+          parentId,
+          size: candidate.size,
+        });
+        const begun = await waitForSession(
+          candidate,
+          id,
+          parentId,
+          priorSessionIds
+        );
+        sessionId = begun.session.id;
+        serverEntryId = begun.entry.id;
+        updateLocalUpload(id, { progress: 3, serverEntryId, sessionId });
 
-          legacyGrant = privateGrant
-            ? undefined
-            : await getMemexUpload({
-                contentLength: candidate.size,
-                contentType: mimeType,
-                fileName: `${getCurrentUserId().replace(/^~/, '')}/buckets/${flag.name}/${Date.now()}-${candidate.name.replace(/[/\\]/g, '-')}`,
-              });
-          brokerReservationId = privateGrant?.reservationId;
-          updateLocalUpload(id, { brokerReservationId, progress: 5 });
+        if (cancelledRef.current.has(id)) {
+          throw new Error('Upload cancelled');
         }
 
-        if (!brokerBytesUploaded) {
-          const task = createBucketUploadTask(
-            privateGrant?.uploadUrl ?? legacyGrant!.uploadUrl,
-            candidate,
-            privateGrant
-              ? brokerRequiredHeaders(privateGrant)
-              : {
-                  'Cache-Control': 'public, max-age=3600',
-                  'Content-Type': mimeType,
-                },
-            (progress) =>
-              updateLocalUpload(id, {
-                progress: Math.max(5, Math.round(5 + progress * 0.9)),
-              })
-          );
-          tasksRef.current.set(id, task);
-          await task.upload;
-          tasksRef.current.delete(id);
-          brokerBytesUploaded = Boolean(brokerReservationId);
-          updateLocalUpload(id, { brokerBytesUploaded });
-        }
+        const privateGrant = await waitForBrokerCapability(() =>
+          grantBucketUpload(capability, flag.host)
+        );
+        brokerReservationId = privateGrant.reservationId;
+        updateLocalUpload(id, { brokerReservationId, progress: 5 });
+
+        const task = createBucketUploadTask(
+          privateGrant.uploadUrl,
+          candidate,
+          brokerRequiredHeaders(privateGrant),
+          (progress) =>
+            updateLocalUpload(id, {
+              progress: Math.max(5, Math.round(5 + progress * 0.9)),
+            })
+        );
+        tasksRef.current.set(id, task);
+        await task.upload;
+        tasksRef.current.delete(id);
 
         if (cancelledRef.current.has(id)) {
           throw new Error('Upload cancelled');
@@ -424,26 +470,17 @@ export function useLiveBucket(requestedFlag: BucketsFlag) {
           throw new Error('The upload session was lost');
         }
         updateLocalUpload(id, { progress: 96 });
-        if (brokerReservationId) {
-          await completeBucketUpload(brokerReservationId);
-          brokerCompleted = true;
-        } else {
-          await sendBucketsAction({
-            type: 'finish-upload',
-            flag,
-            objectUrl: legacyGrant!.hostedUrl,
-            sessionId,
-          });
-        }
+        await completeBucketUpload(brokerReservationId);
+        brokerCompleted = true;
         updateLocalUpload(id, { progress: 100 });
         await refresh();
         setUploadBatch((current) => completeBucketUploadInBatch(current, id));
-        setUploads((currentUploads) =>
+        setCurrentUploads((currentUploads) =>
           currentUploads.filter((candidateUpload) => candidateUpload.id !== id)
         );
       } catch (cause) {
         tasksRef.current.delete(id);
-        if (sessionId && !brokerReservationId && !brokerCompleted) {
+        if (sessionId && !brokerCompleted) {
           await sendBucketsAction({
             type: 'fail-upload',
             flag,
@@ -451,20 +488,28 @@ export function useLiveBucket(requestedFlag: BucketsFlag) {
             sessionId,
           }).catch(() => undefined);
         }
+        if (brokerReservationId && !brokerCompleted) {
+          await cancelBucketUpload(brokerReservationId).catch(() => undefined);
+        }
         if (!cancelledRef.current.has(id)) {
           updateLocalUpload(id, {
+            brokerReservationId: undefined,
             error: errorMessage(cause),
-            brokerBytesUploaded,
-            brokerReservationId,
             progress: 0,
             serverEntryId,
-            sessionId,
             state: 'failed',
           });
         }
       }
     },
-    [flag, flagKey, refresh, updateLocalUpload, waitForSession]
+    [
+      flag,
+      flagKey,
+      refresh,
+      setCurrentUploads,
+      updateLocalUpload,
+      waitForSession,
+    ]
   );
 
   const addUploads = useCallback(
@@ -479,7 +524,7 @@ export function useLiveBucket(requestedFlag: BucketsFlag) {
           state: 'queued',
         })
       );
-      setUploads((current) => [...current, ...nextUploads]);
+      setCurrentUploads((current) => [...current, ...nextUploads]);
       setUploadBatch((current) => [
         ...current,
         ...nextUploads.map((upload) => ({
@@ -491,7 +536,7 @@ export function useLiveBucket(requestedFlag: BucketsFlag) {
       ]);
       nextUploads.forEach((upload) => void runUpload(upload));
     },
-    [runUpload]
+    [runUpload, setCurrentUploads]
   );
 
   const cancelUpload = useCallback(
@@ -519,7 +564,7 @@ export function useLiveBucket(requestedFlag: BucketsFlag) {
         .catch(() => undefined);
       tasksRef.current.delete(id);
 
-      setUploads((current) =>
+      setCurrentUploads((current) =>
         current.filter((candidate) => candidate.id !== id)
       );
       setUploadBatch((current) => removeBucketUploadFromBatch(current, id));
@@ -561,7 +606,7 @@ export function useLiveBucket(requestedFlag: BucketsFlag) {
       }
       void refresh();
     },
-    [commitSnapshot, flag, refresh, uploads]
+    [commitSnapshot, flag, refresh, setCurrentUploads, uploads]
   );
 
   const retryUpload = useCallback(
@@ -569,10 +614,7 @@ export function useLiveBucket(requestedFlag: BucketsFlag) {
       const upload = uploads.find((candidate) => candidate.id === id);
       if (!upload) return;
       cancelledRef.current.delete(id);
-      const isPrivateRetry = Boolean(
-        upload.brokerReservationId && upload.sessionId && upload.serverEntryId
-      );
-      if (!isPrivateRetry && upload.serverEntryId) {
+      if (upload.serverEntryId) {
         await sendBucketsAction({
           type: 'delete-entry',
           flag,
@@ -583,20 +625,15 @@ export function useLiveBucket(requestedFlag: BucketsFlag) {
       const next = {
         ...upload,
         error: undefined,
-        brokerBytesUploaded: isPrivateRetry
-          ? upload.brokerBytesUploaded
-          : undefined,
-        brokerReservationId: isPrivateRetry
-          ? upload.brokerReservationId
-          : undefined,
-        capability: isPrivateRetry ? upload.capability : undefined,
+        capability: undefined,
+        brokerReservationId: undefined,
         progress: 0,
-        priorSessionIds: isPrivateRetry ? upload.priorSessionIds : undefined,
-        serverEntryId: isPrivateRetry ? upload.serverEntryId : undefined,
-        sessionId: isPrivateRetry ? upload.sessionId : undefined,
+        priorSessionIds: undefined,
+        serverEntryId: undefined,
+        sessionId: undefined,
         state: 'queued' as const,
       };
-      setUploads((current) =>
+      setCurrentUploads((current) =>
         current.map((candidate) => (candidate.id === id ? next : candidate))
       );
       setUploadBatch((current) =>
@@ -608,7 +645,7 @@ export function useLiveBucket(requestedFlag: BucketsFlag) {
       );
       void runUpload(next);
     },
-    [flag, runUpload, uploads]
+    [flag, runUpload, setCurrentUploads, uploads]
   );
 
   const localItems = useMemo<BucketItem[]>(
diff --git a/packages/app/ui/components/BucketsChannel/BucketsChannel.tsx b/packages/app/ui/components/BucketsChannel/BucketsChannel.tsx
index 39643ea028..6cc7ae0aa9 100644
--- a/packages/app/ui/components/BucketsChannel/BucketsChannel.tsx
+++ b/packages/app/ui/components/BucketsChannel/BucketsChannel.tsx
@@ -1,3 +1,4 @@
+import { FlashList, FlashListRef } from '@shopify/flash-list';
 import {
   Button,
   FilePreview,
@@ -9,7 +10,7 @@ import {
 import { useEffect, useRef, useState } from 'react';
 import { Platform } from 'react-native';
 import { useSafeAreaInsets } from 'react-native-safe-area-context';
-import { ScrollView, View, XStack, YStack } from 'tamagui';
+import { ScrollView, View, XStack, YStack, getTokenValue } from 'tamagui';
 
 import { calculateBucketUploadProgress } from '../../../utils/bucketUploadProgress';
 import { ActionSheet, createActionGroups } from '../ActionSheet';
@@ -184,17 +185,21 @@ export function BucketsSearchScreen({
                 Entire Bucket
               </Text>
             </XStack>
-            <ScrollView flex={1}>
-              <YStack gap="$xs" paddingBottom="$2xl">
-                {results.map((result) => (
-                  <BucketSearchRow
-                    key={`${result.parentFolderId ?? 'root'}-${result.id}`}
-                    result={result}
-                    onOpenResult={onOpenResult}
-                  />
-                ))}
-              </YStack>
-            </ScrollView>
+            <FlashList
+              data={results}
+              contentContainerStyle={{
+                paddingBottom: getTokenValue('$2xl', 'size'),
+              }}
+              ItemSeparatorComponent={() => (
+                <View height={getTokenValue('$xs', 'space')} />
+              )}
+              keyExtractor={(result) =>
+                `${result.parentFolderId ?? 'root'}-${result.id}`
+              }
+              renderItem={({ item: result }) => (
+                <BucketSearchRow result={result} onOpenResult={onOpenResult} />
+              )}
+            />
           </YStack>
         )}
       </YStack>
@@ -239,54 +244,28 @@ export function BucketsPane({
   onRenameItem?: (item: BucketItem) => void;
   onRetryUpload?: (item: BucketItem) => void;
 }) {
-  const scrollViewRef = useRef<ScrollView>(null);
-  const [viewportHeight, setViewportHeight] = useState(0);
+  const listRef = useRef<FlashListRef<BucketItem>>(null);
   const selectedIndex = selectedItemId
     ? items.findIndex((item) => item.id === selectedItemId)
     : -1;
   const trayItems = uploadItems ?? items.filter((item) => uploadStateFor(item));
 
   useEffect(() => {
-    if (selectedIndex < 0 || !viewportHeight) {
-      return;
-    }
-
-    const itemOffset = selectedIndex * (bucketRowHeight + bucketRowGap);
-    const targetY = Math.max(
-      0,
-      itemOffset - (viewportHeight - bucketRowHeight) / 2
-    );
+    if (selectedIndex < 0) return;
     const timer = setTimeout(() => {
-      scrollViewRef.current?.scrollTo({ animated: true, y: targetY });
+      listRef.current?.scrollToIndex({
+        animated: true,
+        index: selectedIndex,
+        viewPosition: 0.5,
+      });
     }, 0);
 
     return () => clearTimeout(timer);
-  }, [selectedIndex, viewportHeight]);
+  }, [selectedIndex]);
 
-  const list =
-    state === 'loading' ? (
-      <BucketsLoadingRows />
-    ) : state === 'empty' || items.length === 0 ? (
-      <BucketsEmptyState canEdit={canEdit} />
-    ) : (
-      <YStack gap="$xs">
-        {items.map((item) => (
-          <BucketRow
-            key={item.id}
-            canEdit={canEdit}
-            item={item}
-            selected={selectedItemId === item.id}
-            onDeleteItem={onDeleteItem}
-            onDownloadItem={onDownloadItem}
-            onCancelUpload={onCancelUpload}
-            onMoveItem={onMoveItem}
-            onOpenItem={onOpenItem}
-            onRenameItem={onRenameItem}
-            onRetryUpload={onRetryUpload}
-          />
-        ))}
-      </YStack>
-    );
+  const populated = state === 'populated' && items.length > 0;
+  const horizontalPadding = getTokenValue('$l', 'size');
+  const topPadding = getTokenValue(currentFolder ? '$xs' : '$m', 'size');
 
   return (
     <BucketsDropTarget
@@ -300,24 +279,57 @@ export function BucketsPane({
         {currentFolder ? (
           <BucketBreadcrumb rootLabel={rootLabel} folderLabel={currentFolder} />
         ) : null}
-        <ScrollView
-          ref={scrollViewRef}
-          flex={1}
-          onLayout={(event) =>
-            setViewportHeight(event.nativeEvent.layout.height)
-          }
-        >
-          <YStack
-            width="100%"
-            maxWidth={layout === 'takeover' ? 'unset' : 760}
-            marginHorizontal="auto"
-            paddingHorizontal="$l"
-            paddingTop={currentFolder ? '$xs' : '$m'}
-            paddingBottom="$2xl"
-          >
-            {list}
-          </YStack>
-        </ScrollView>
+        {populated ? (
+          <FlashList
+            ref={listRef}
+            data={items}
+            contentContainerStyle={{
+              paddingBottom: getTokenValue('$2xl', 'size'),
+              paddingTop: topPadding,
+            }}
+            extraData={selectedItemId}
+            ItemSeparatorComponent={() => <View height={bucketRowGap} />}
+            keyExtractor={(item) => item.id}
+            renderItem={({ item }) => (
+              <YStack
+                width="100%"
+                maxWidth={layout === 'takeover' ? 'unset' : 760}
+                marginHorizontal="auto"
+                paddingHorizontal={horizontalPadding}
+              >
+                <BucketRow
+                  canEdit={canEdit}
+                  item={item}
+                  selected={selectedItemId === item.id}
+                  onDeleteItem={onDeleteItem}
+                  onDownloadItem={onDownloadItem}
+                  onCancelUpload={onCancelUpload}
+                  onMoveItem={onMoveItem}
+                  onOpenItem={onOpenItem}
+                  onRenameItem={onRenameItem}
+                  onRetryUpload={onRetryUpload}
+                />
+              </YStack>
+            )}
+          />
+        ) : (
+          <ScrollView flex={1}>
+            <YStack
+              width="100%"
+              maxWidth={layout === 'takeover' ? 'unset' : 760}
+              marginHorizontal="auto"
+              paddingHorizontal="$l"
+              paddingTop={currentFolder ? '$xs' : '$m'}
+              paddingBottom="$2xl"
+            >
+              {state === 'loading' ? (
+                <BucketsLoadingRows />
+              ) : (
+                <BucketsEmptyState canEdit={canEdit} />
+              )}
+            </YStack>
+          </ScrollView>
+        )}
         {trayItems.length > 0 ? (
           <BucketsUploadTray
             aggregateProgress={uploadAggregateProgress}
diff --git a/packages/shared/src/store/channelActions.test.ts b/packages/shared/src/store/channelActions.test.ts
index f43f5d393b..d0cb870a51 100644
--- a/packages/shared/src/store/channelActions.test.ts
+++ b/packages/shared/src/store/channelActions.test.ts
@@ -468,6 +468,76 @@ test('createChannel lets a non-host admin create a group-hosted Bucket', async (
   });
 });
 
+test('createChannel preserves a created Bucket when its group listing is delayed', async () => {
+  vi.useFakeTimers();
+  await insertGroup();
+  vi.spyOn(api, 'getCurrentUserId').mockReturnValue('~zod');
+  const sendBucketsAction = vi
+    .spyOn(api, 'sendBucketsAction')
+    .mockResolvedValue(1);
+  vi.spyOn(api, 'getGroup').mockResolvedValue({
+    id: groupId,
+    channels: [],
+  } as unknown as db.Group);
+
+  const createPromise = createChannel({
+    customSlug: 'slow-project-files',
+    groupId,
+    title: 'Slow project files',
+    channelType: 'buckets',
+  });
+  const assertion = expect(createPromise).rejects.toThrow(
+    'Failed to add Buckets channel to group'
+  );
+  await vi.runAllTimersAsync();
+  await assertion;
+
+  expect(sendBucketsAction).toHaveBeenCalledTimes(1);
+  expect(sendBucketsAction).toHaveBeenCalledWith(
+    expect.objectContaining({ type: 'create', name: 'slow-project-files' })
+  );
+  expect(sendBucketsAction).not.toHaveBeenCalledWith(
+    expect.objectContaining({ type: 'delete-bucket' })
+  );
+});
+
+test('updateChannel mirrors Bucket reader and writer roles to %buckets', async () => {
+  const bucketsChannelId = 'buckets/~zod/project-files';
+  await insertGroupAndChannel({ id: bucketsChannelId, type: 'buckets' });
+  const channel = await db.getChannelWithRelations({ id: bucketsChannelId });
+  if (!channel) throw new Error('test channel not initialized');
+
+  vi.spyOn(api, 'updateChannel').mockResolvedValue(1);
+  const sendBucketsAction = vi
+    .spyOn(api, 'sendBucketsAction')
+    .mockResolvedValue(1);
+
+  await updateChannel({
+    groupId,
+    sectionId: 'default',
+    readers: ['member'],
+    writers: ['admin'],
+    join: true,
+    channel: { ...channel, title: 'Project files' },
+  });
+
+  expect(sendBucketsAction).toHaveBeenNthCalledWith(1, {
+    type: 'set-title',
+    flag: { host: '~zod', name: 'project-files' },
+    title: 'Project files',
+  });
+  expect(sendBucketsAction).toHaveBeenNthCalledWith(2, {
+    type: 'set-readers',
+    flag: { host: '~zod', name: 'project-files' },
+    readers: ['member'],
+  });
+  expect(sendBucketsAction).toHaveBeenNthCalledWith(3, {
+    type: 'set-writers',
+    flag: { host: '~zod', name: 'project-files' },
+    writers: ['admin'],
+  });
+});
+
 test('joinGroupChannel routes notes channels through the notes API', async () => {
   const notesChannelId = 'notes/~zod/native-notes';
   await insertGroupAndChannel({ id: notesChannelId, type: 'notes' });
diff --git a/packages/shared/src/store/channelActions.ts b/packages/shared/src/store/channelActions.ts
index 339d15e54b..670c616478 100644
--- a/packages/shared/src/store/channelActions.ts
+++ b/packages/shared/src/store/channelActions.ts
@@ -23,6 +23,7 @@ const BUCKETS_CHANNEL_LISTING_ATTEMPTS = 20;
 const BUCKETS_CHANNEL_LISTING_DELAY_MS = 250;
 
 class NotesChannelListingUnverifiedError extends Error {}
+class BucketsChannelListingUnverifiedError extends Error {}
 
 export async function createChannel({
   groupId,
@@ -189,7 +190,10 @@ async function createBucketsChannel({
     return newChannel;
   } catch (e) {
     await db.deleteChannels([channelId]).catch(() => undefined);
-    if (created) {
+    // A successful create followed by an inconclusive listing read is not
+    // evidence that creation failed. Keep the host-owned Bucket intact so a
+    // slow or temporarily unavailable %groups read cannot destroy live data.
+    if (created && !(e instanceof BucketsChannelListingUnverifiedError)) {
       await api
         .sendBucketsAction({ type: 'delete-bucket', flag })
         .catch((rollbackError) =>
@@ -219,7 +223,9 @@ async function waitForBucketsChannelListing(
       await wait(BUCKETS_CHANNEL_LISTING_DELAY_MS);
     }
   }
-  throw new Error(`Bucket channel listing did not appear: ${channelId}`);
+  throw new BucketsChannelListingUnverifiedError(
+    `Bucket channel listing did not appear: ${channelId}`
+  );
 }
 
 async function createNotesChannel({
@@ -545,6 +551,11 @@ export async function updateChannel({
         flag: bucketFlag,
         title: channel.title ?? '',
       });
+      await api.sendBucketsAction({
+        type: 'set-readers',
+        flag: bucketFlag,
+        readers,
+      });
       await api.sendBucketsAction({
         type: 'set-writers',
         flag: bucketFlag,
diff --git a/packages/shared/src/store/dbHooks.ts b/packages/shared/src/store/dbHooks.ts
index 9beec43df5..382d9ed945 100644
--- a/packages/shared/src/store/dbHooks.ts
+++ b/packages/shared/src/store/dbHooks.ts
@@ -76,6 +76,7 @@ export const useBucketsDeskAvailable = () => {
         return false;
       }
     },
+    retry: false,
     staleTime: 60_000,
   });
 };
diff --git a/packages/shared/src/store/sync/sync.ts b/packages/shared/src/store/sync/sync.ts
index 6a0ea149d1..70f2d76872 100644
--- a/packages/shared/src/store/sync/sync.ts
+++ b/packages/shared/src/store/sync/sync.ts
@@ -60,10 +60,12 @@ export const syncInitData = async (
   // the init endpoint version is capability-picked and this can run before
   // syncAppInfo on a fresh boot — apply the persisted capabilities first
   await syncReactionSupport();
-  const initData = await syncQueue.add('init', syncCtx, () =>
-    api.getInitData()
-  );
-  const bucketSnapshots = await api.getBuckets().catch(() => []);
+  // Buckets is optional on desk-less ships. Fetch it beside init so a slow or
+  // failing Bucket scry never extends the cold-start critical path.
+  const [initData, bucketSnapshots] = await Promise.all([
+    syncQueue.add('init', syncCtx, () => api.getInitData()),
+    api.getBuckets().catch(() => []),
+  ]);
   logger.crumb('got init data from api');
   initializeJoinedSet(initData.unreads);
   useLureState.getState().start();

From efd243ee3b8b8949ddb5dc3429c97d88be269f9c Mon Sep 17 00:00:00 2001
From: william arzt <bill@tlon.io>
Date: Tue, 11 Aug 2026 11:36:59 -0400
Subject: [PATCH 08/19] fix: stabilize parallel bucket sync tests

---
 .../app/features/buckets/useLiveBucket.ts     |  3 ++
 packages/shared/src/store/sync/sync.test.ts   | 29 +++++++++++++++++--
 packages/shared/src/test/helpers.ts           | 20 +++++++++++--
 3 files changed, 47 insertions(+), 5 deletions(-)

diff --git a/packages/app/features/buckets/useLiveBucket.ts b/packages/app/features/buckets/useLiveBucket.ts
index 118c764b01..078ad10f8c 100644
--- a/packages/app/features/buckets/useLiveBucket.ts
+++ b/packages/app/features/buckets/useLiveBucket.ts
@@ -234,10 +234,13 @@ export function useLiveBucket(requestedFlag: BucketsFlag) {
   const refresh = useCallback(async () => {
     const next = selectSnapshot(await getBuckets());
     const current = snapshotRef.current;
+    // Revisions are monotonic only within one Bucket incarnation. Deleting
+    // and recreating the same flag allocates a new bucket id at revision 0.
     if (
       next &&
       current &&
       matchesFlag(next.flag, current.flag) &&
+      next.state.bucket.id === current.state.bucket.id &&
       next.state.revision <= current.state.revision
     ) {
       return current;
diff --git a/packages/shared/src/store/sync/sync.test.ts b/packages/shared/src/store/sync/sync.test.ts
index 28c2811db6..4b77a8ebaf 100644
--- a/packages/shared/src/store/sync/sync.test.ts
+++ b/packages/shared/src/store/sync/sync.test.ts
@@ -1,5 +1,6 @@
 import {
   StructuredChannelDescriptionPayload,
+  scry,
   toClientGroupV7,
 } from '@tloncorp/api';
 import '@tloncorp/api';
@@ -65,6 +66,28 @@ const groupsInitData = rawGroupsInitData as unknown as GroupsInit6;
 const groupsInitData2 = rawGroupsInit2 as unknown as GroupsInit6;
 const headsData = rawHeadsData as unknown as CombinedHeads;
 
+function setInitSyncScryOutputs({
+  heads,
+  init,
+}: {
+  heads?: CombinedHeads;
+  init: GroupsInit6;
+}) {
+  vi.mocked(scry).mockImplementation(async ({ app, path }) => {
+    if (app === 'buckets' && path === '/v1/buckets') {
+      return [];
+    }
+    if (app === 'groups-ui' && /^\/v\d+\/init$/.test(path)) {
+      return init;
+    }
+    if (app === 'groups-ui' && path.startsWith('/v4/heads')) {
+      if (!heads) throw new Error(`Unexpected heads scry: ${app}${path}`);
+      return heads;
+    }
+    throw new Error(`Unexpected scry: ${app}${path}`);
+  });
+}
+
 setupDatabaseTestSuite();
 
 const inputData = [
@@ -554,7 +577,7 @@ const testGroupData: db.Group = {
 // });
 
 test('syncs init data', async () => {
-  setScryOutput(rawGroupsInitData);
+  setInitSyncScryOutputs({ init: groupsInitData });
   await syncInitData();
   const groups = await db.getGroups({});
   expect(groups.length).toEqual(Object.values(groupsInitData.groups).length);
@@ -576,7 +599,7 @@ test('syncs init data', async () => {
 });
 
 test('syncs last posts', async () => {
-  setScryOutputs([groupsInitData2, headsData]);
+  setInitSyncScryOutputs({ init: groupsInitData2, heads: headsData });
   await syncInitData();
   await syncLatestPosts();
   const chats = await db.getChats();
@@ -606,7 +629,7 @@ test('init data repairs latest posts that arrived before channel rows', async ()
   if (!client) throw new Error('test db not initialized');
 
   await db.headsSyncedAt.resetValue();
-  setScryOutputs([headsData, groupsInitData2]);
+  setInitSyncScryOutputs({ init: groupsInitData2, heads: headsData });
 
   await syncLatestPosts();
   await syncInitData();
diff --git a/packages/shared/src/test/helpers.ts b/packages/shared/src/test/helpers.ts
index 7819459b79..8577d02fa2 100644
--- a/packages/shared/src/test/helpers.ts
+++ b/packages/shared/src/test/helpers.ts
@@ -47,9 +47,25 @@ export function setupDatabaseTestSuite() {
 }
 
 export function setScryOutput<T>(output: T) {
-  vi.mocked(scry).mockImplementationOnce(async () => output);
+  let consumed = false;
+  vi.mocked(scry).mockImplementation(async ({ app, path }) => {
+    // syncInitData intentionally fetches this optional desk in parallel with
+    // the required init scry. Keep that independent request from consuming
+    // the ordered response used by older tests.
+    if (app === 'buckets' && path === '/v1/buckets') {
+      return [];
+    }
+    if (consumed) return undefined;
+    consumed = true;
+    return output;
+  });
 }
 
 export function setScryOutputs<T>(outputs: T[]) {
-  vi.mocked(scry).mockImplementation(async () => outputs.shift()!);
+  vi.mocked(scry).mockImplementation(async ({ app, path }) => {
+    if (app === 'buckets' && path === '/v1/buckets') {
+      return [];
+    }
+    return outputs.shift()!;
+  });
 }

From 83891fd524c8030a960ebab30c7d350f124e29d4 Mon Sep 17 00:00:00 2001
From: william arzt <bill@tlon.io>
Date: Wed, 12 Aug 2026 07:58:52 -0400
Subject: [PATCH 09/19] fix: keep Buckets out of activity thread scries

---
 docs/backend/desk/app/buckets.md            |  2 ++
 packages/api/src/client/activityApi.test.ts | 18 ++++++++++++++++--
 packages/api/src/client/activityApi.ts      |  6 ++++++
 packages/shared/src/store/sync/sync.test.ts | 17 +++++++++++++++++
 packages/shared/src/store/sync/sync.ts      |  5 +++++
 5 files changed, 46 insertions(+), 2 deletions(-)

diff --git a/docs/backend/desk/app/buckets.md b/docs/backend/desk/app/buckets.md
index db521a90e0..e2748deb7e 100644
--- a/docs/backend/desk/app/buckets.md
+++ b/docs/backend/desk/app/buckets.md
@@ -71,6 +71,8 @@ The Gall delete action removes the manifest and `%groups` registration, but stor
 
 Direct scries are self-only. Remote consumers subscribe to the host's update path, where the host can apply the live group authorization check. Subscriber agents report joined/left state to local `%groups` using `%group-channel-active`.
 
+Bucket snapshots are replica observations, not command acknowledgements. In particular, an uploader must present its capability to the private broker after `%begin-upload`; a successful broker grant proves that the host authorized and persisted the upload. Only then should the uploader wait for the corresponding session to appear in its local replica. A broker denial is a host-authorization failure, while a missing local session after a successful grant is replica lag. Bucket channels must never be sent through `%activity` post/thread scries because they do not contain posts or threads.
+
 ## Hosted private-broker flow
 
 1. The client generates an opaque capability and sends it with `%begin-upload` through its local `%buckets` agent.
diff --git a/packages/api/src/client/activityApi.test.ts b/packages/api/src/client/activityApi.test.ts
index b4d4011423..aa3b962a7e 100644
--- a/packages/api/src/client/activityApi.test.ts
+++ b/packages/api/src/client/activityApi.test.ts
@@ -1,14 +1,15 @@
 import { beforeEach, describe, expect, test, vi } from 'vitest';
 
 import type * as ub from '../urbit';
-import { subscribeToActivity } from './activityApi';
-import { subscribe } from './urbit';
+import { getThreadUnreadsByChannel, subscribeToActivity } from './activityApi';
+import { scry, subscribe } from './urbit';
 
 vi.mock('./urbit', async () => {
   const actual = await vi.importActual<typeof import('./urbit')>('./urbit');
 
   return {
     ...actual,
+    scry: vi.fn(),
     subscribe: vi.fn(),
   };
 });
@@ -38,9 +39,22 @@ function mockActivityAdd({
 }
 
 beforeEach(() => {
+  vi.mocked(scry).mockReset();
   vi.mocked(subscribe).mockReset();
 });
 
+test('does not request activity thread unreads for Buckets', async () => {
+  await expect(
+    getThreadUnreadsByChannel({
+      id: 'buckets/~zod/project-files',
+      type: 'buckets',
+      groupId: '~zod/test-group',
+    })
+  ).resolves.toBeNull();
+
+  expect(scry).not.toHaveBeenCalled();
+});
+
 describe('subscribeToActivity invite conversion', () => {
   test('converts DM invites for opt-in subscribers', async () => {
     mockActivityAdd({
diff --git a/packages/api/src/client/activityApi.ts b/packages/api/src/client/activityApi.ts
index a255ba4bca..a1b347aebe 100644
--- a/packages/api/src/client/activityApi.ts
+++ b/packages/api/src/client/activityApi.ts
@@ -38,6 +38,12 @@ export async function getGroupAndChannelUnreads() {
 export async function getThreadUnreadsByChannel(
   channel: db.Channel
 ): Promise<db.ThreadUnreadState[] | null> {
+  // Buckets are group channels for navigation and permissions, but they do
+  // not contain posts or threads. Keep them out of the chat-shaped activity
+  // scries even if a caller reaches this API without the screen-level guard.
+  if (channel.type === 'buckets') {
+    return null;
+  }
   if (channel.type === 'notes') {
     // notes channels track per-note unreads instead of thread unreads; the
     // chat-shaped threads scry below doesn't exist for them. Before the
diff --git a/packages/shared/src/store/sync/sync.test.ts b/packages/shared/src/store/sync/sync.test.ts
index 4b77a8ebaf..6d4da8229d 100644
--- a/packages/shared/src/store/sync/sync.test.ts
+++ b/packages/shared/src/store/sync/sync.test.ts
@@ -1,3 +1,4 @@
+import * as api from '@tloncorp/api';
 import {
   StructuredChannelDescriptionPayload,
   scry,
@@ -42,6 +43,7 @@ import {
 import rawGroupsInit2 from '../../test/init.json';
 import {
   ensureDmInviteChannel,
+  syncChannelThreadUnreads,
   syncChannelWithBackoff,
   syncDms,
   syncGroups,
@@ -90,6 +92,21 @@ function setInitSyncScryOutputs({
 
 setupDatabaseTestSuite();
 
+test('does not sync thread unreads for Buckets', async () => {
+  const getThreadUnreads = vi.spyOn(api, 'getThreadUnreadsByChannel');
+  await db.insertChannels([
+    {
+      id: 'buckets/~zod/project-files',
+      type: 'buckets',
+    },
+  ]);
+
+  await syncChannelThreadUnreads('buckets/~zod/project-files');
+
+  expect(getThreadUnreads).not.toHaveBeenCalled();
+  getThreadUnreads.mockRestore();
+});
+
 const inputData = [
   '0v4.00000.qd4mk.d4htu.er4b8.eao21',
   '~solfer-magfed',
diff --git a/packages/shared/src/store/sync/sync.ts b/packages/shared/src/store/sync/sync.ts
index 70f2d76872..1ccb473bc9 100644
--- a/packages/shared/src/store/sync/sync.ts
+++ b/packages/shared/src/store/sync/sync.ts
@@ -853,6 +853,11 @@ export const syncChannelThreadUnreads = async (
     );
     return;
   }
+  // Buckets are file manifests, not post collections. They have no activity
+  // thread endpoint, so never enqueue a thread-unread scry for them.
+  if (channel.type === 'buckets') {
+    return;
+  }
   const unreads = await syncQueue.add('thread unreads', ctx, () =>
     api.getThreadUnreadsByChannel(channel)
   );

From 9b83e021fa311e06493dabeded4b2deed960a3cb Mon Sep 17 00:00:00 2001
From: github-actions <github-actions@github.com>
Date: Wed, 12 Aug 2026 18:16:41 +0000
Subject: [PATCH 10/19] update glob:  [skip actions]

---
 desk/desk.docket-0 | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/desk/desk.docket-0 b/desk/desk.docket-0
index faa6b7e7a3..7f7771efbe 100644
--- a/desk/desk.docket-0
+++ b/desk/desk.docket-0
@@ -2,7 +2,7 @@
     info+'Start, host, and cultivate communities. Own your communications, organize your resources, and share documents. Tlon is a decentralized platform that offers a full, communal suite of tools for messaging, writing and sharing media with others.'
     color+0xde.dede
     image+'https://bootstrap.urbit.org/tlon.svg?v=1'
-    glob-http+['https://bootstrap.urbit.org/glob-0v5.8821i.spoml.i12a4.cufe1.00vbk.glob' 0v5.8821i.spoml.i12a4.cufe1.00vbk]
+    glob-http+['https://bootstrap.urbit.org/glob-0v1.fi1h1.mvmj1.jcekh.6nibg.f7k09.glob' 0v1.fi1h1.mvmj1.jcekh.6nibg.f7k09]
     base+'groups'
     version+[12 1 0]
     website+'https://tlon.io'

From c82a5036c6e881806c8677b811f6b9912aecc30a Mon Sep 17 00:00:00 2001
From: william arzt <bill@tlon.io>
Date: Wed, 12 Aug 2026 15:58:16 -0400
Subject: [PATCH 11/19] fix: decode nullable bucket write permissions

---
 desk/app/buckets.hoon       |  5 ++++-
 desk/tests/app/buckets.hoon | 26 +++++++++++++++++++++++++-
 2 files changed, 29 insertions(+), 2 deletions(-)

diff --git a/desk/app/buckets.hoon b/desk/app/buckets.hoon
index 2abe671d40..3d5d79fefa 100644
--- a/desk/app/buckets.hoon
+++ b/desk/app/buckets.hoon
@@ -636,7 +636,10 @@
   ?:  =(who ship.flag)  [& ~]
   =/  pax=path
     /(scot %p our.bowl)/groups/(scot %da now.bowl)/v2/groups/(scot %p ship.group)/[name.group]/channels/buckets/(scot %p ship.flag)/[name.flag]/can-write/(scot %p who)/noun
-  .^([admin=? roles=(set @tas)] %gx pax)
+  =/  permissions=(unit [admin=? roles=(set @tas)])
+    .^((unit [admin=? roles=(set @tas)]) %gx pax)
+  ?~  permissions  [| ~]
+  u.permissions
 ::
 ++  group-is-admin
   |=  [group=flag:b =flag:b who=ship]
diff --git a/desk/tests/app/buckets.hoon b/desk/tests/app/buckets.hoon
index 73ad610e09..e73de578ed 100644
--- a/desk/tests/app/buckets.hoon
+++ b/desk/tests/app/buckets.hoon
@@ -67,7 +67,15 @@
   ?:  ?=([%gx @ %groups @ %v2 %groups @ @ %channels %can-read %noun ~] pax)
     `!>(|=([who=ship =nest:bu] &))
   ?.  ?=([%gx @ %groups @ %v2 %groups @ @ %channels %buckets @ @ %can-write @ %noun ~] pax)  ~
-  `!>([admin=| roles=(silt ~[%editor])])
+  `!>(`(unit [admin=? roles=(set @tas)])`[~ [admin=| roles=(silt ~[%editor])]])
+::
+++  missing-group-permission-scries
+  |=  pax=path
+  ^-  (unit vase)
+  ?:  ?=([%gx @ %groups @ %v2 %groups @ @ %channels %can-read %noun ~] pax)
+    `!>(|=([who=ship =nest:bu] &))
+  ?.  ?=([%gx @ %groups @ %v2 %groups @ @ %channels %buckets @ @ %can-write @ %noun ~] pax)  ~
+  `!>(`(unit [admin=? roles=(set @tas)])`~)
 ::
 ++  allow-admin-create-scries
   |=  pax=path
@@ -441,6 +449,22 @@
   %+  do-poke  %buckets-command-1
   !>([[%create-folder flag ~ 'Denied']])
 ::
+::  %groups represents a missing/banned seat as a null permission record.
+::  Buckets must deny that write instead of crashing while decoding the scry.
+::
+++  test-remote-write-without-seat
+  %-  eval-mare
+  =/  m  (mare ,~)
+  =*  b  bind:m
+  ^-  form:m
+  ;<  ~  b  setup
+  ;<  ~  b  create
+  ;<  ~  b  (set-scry-gate missing-group-permission-scries)
+  %-  ex-fail
+  %-  (do-as ~bus)
+  %+  do-poke  %buckets-command-1
+  !>([[%create-folder flag ~ 'Denied']])
+::
 ::  A readable member still needs a matching writer role for mutations.
 ::
 ++  test-remote-writer-role

From 5f1d46a27ab47ef40422853731c016cb1997f797 Mon Sep 17 00:00:00 2001
From: github-actions <github-actions@github.com>
Date: Wed, 12 Aug 2026 20:06:19 +0000
Subject: [PATCH 12/19] update glob:  [skip actions]

---
 desk/desk.docket-0 | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/desk/desk.docket-0 b/desk/desk.docket-0
index 7f7771efbe..4652e543ac 100644
--- a/desk/desk.docket-0
+++ b/desk/desk.docket-0
@@ -2,7 +2,7 @@
     info+'Start, host, and cultivate communities. Own your communications, organize your resources, and share documents. Tlon is a decentralized platform that offers a full, communal suite of tools for messaging, writing and sharing media with others.'
     color+0xde.dede
     image+'https://bootstrap.urbit.org/tlon.svg?v=1'
-    glob-http+['https://bootstrap.urbit.org/glob-0v1.fi1h1.mvmj1.jcekh.6nibg.f7k09.glob' 0v1.fi1h1.mvmj1.jcekh.6nibg.f7k09]
+    glob-http+['https://bootstrap.urbit.org/glob-0vts9k3.3gdfq.bsqa7.sftr9.c6sce.glob' 0vts9k3.3gdfq.bsqa7.sftr9.c6sce]
     base+'groups'
     version+[12 1 0]
     website+'https://tlon.io'

From 92bf6f630449f14a32c992f950e5bcc6fef19ada Mon Sep 17 00:00:00 2001
From: github-actions <github-actions@github.com>
Date: Wed, 12 Aug 2026 20:51:11 +0000
Subject: [PATCH 13/19] update glob:  [skip actions]

---
 desk/desk.docket-0 | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/desk/desk.docket-0 b/desk/desk.docket-0
index 4652e543ac..03956163c7 100644
--- a/desk/desk.docket-0
+++ b/desk/desk.docket-0
@@ -2,7 +2,7 @@
     info+'Start, host, and cultivate communities. Own your communications, organize your resources, and share documents. Tlon is a decentralized platform that offers a full, communal suite of tools for messaging, writing and sharing media with others.'
     color+0xde.dede
     image+'https://bootstrap.urbit.org/tlon.svg?v=1'
-    glob-http+['https://bootstrap.urbit.org/glob-0vts9k3.3gdfq.bsqa7.sftr9.c6sce.glob' 0vts9k3.3gdfq.bsqa7.sftr9.c6sce]
+    glob-http+['https://bootstrap.urbit.org/glob-0v596sr.jsdhr.7hmnl.06ir5.rfp20.glob' 0v596sr.jsdhr.7hmnl.06ir5.rfp20]
     base+'groups'
     version+[12 1 0]
     website+'https://tlon.io'

From f8ba46c36a07640074627dc98455c7ad1028a39c Mon Sep 17 00:00:00 2001
From: william arzt <bill@tlon.io>
Date: Wed, 12 Aug 2026 19:23:42 -0400
Subject: [PATCH 14/19] fix: deny bucket writes without a group seat

---
 desk/app/buckets.hoon | 21 ++++++++++-----------
 desk/app/groups.hoon  |  4 ++--
 2 files changed, 12 insertions(+), 13 deletions(-)

diff --git a/desk/app/buckets.hoon b/desk/app/buckets.hoon
index 3d5d79fefa..416829bcbc 100644
--- a/desk/app/buckets.hoon
+++ b/desk/app/buckets.hoon
@@ -632,31 +632,30 @@
 ::
 ++  group-permissions
   |=  [group=flag:b =flag:b who=ship]
-  ^-  [admin=? roles=(set @tas)]
-  ?:  =(who ship.flag)  [& ~]
+  ^-  (unit [admin=? roles=(set @tas)])
+  ?:  =(who ship.flag)  `[& ~]
   =/  pax=path
     /(scot %p our.bowl)/groups/(scot %da now.bowl)/v2/groups/(scot %p ship.group)/[name.group]/channels/buckets/(scot %p ship.flag)/[name.flag]/can-write/(scot %p who)/noun
-  =/  permissions=(unit [admin=? roles=(set @tas)])
-    .^((unit [admin=? roles=(set @tas)]) %gx pax)
-  ?~  permissions  [| ~]
-  u.permissions
+  .^((unit [admin=? roles=(set @tas)]) %gx pax)
 ::
 ++  group-is-admin
   |=  [group=flag:b =flag:b who=ship]
   ^-  ?
-  =/  permissions=[admin=? roles=(set @tas)]
+  =/  permissions=(unit [admin=? roles=(set @tas)])
     (group-permissions group flag who)
-  admin.permissions
+  ?~  permissions  |
+  admin.u.permissions
 ::
 ++  group-can-write
   |=  [group=flag:b =flag:b writers=(set @tas) who=ship]
   ^-  ?
   ?.  (group-can-read group flag who)  |
-  =/  permissions=[admin=? roles=(set @tas)]
+  =/  permissions=(unit [admin=? roles=(set @tas)])
     (group-permissions group flag who)
-  ?|  admin.permissions
+  ?~  permissions  |
+  ?|  admin.u.permissions
       =(~ writers)
-      !=(~ (~(int in writers) roles.permissions))
+      !=(~ (~(int in writers) roles.u.permissions))
   ==
 ::
 ++  action-authorized
diff --git a/desk/app/groups.hoon b/desk/app/groups.hoon
index 87db36a34d..efd4500a36 100644
--- a/desk/app/groups.hoon
+++ b/desk/app/groups.hoon
@@ -4652,8 +4652,8 @@
           [%can-write ship=@ ~]
         =+  ship=(slav %p ship.rest.pole)
         ^-  (unit (unit rail))
-        ?~  seat=(~(get by seats.group) ship)  [~ ~]
-        ?:  (go-is-banned ship)  [~ ~]
+        ?~  seat=(~(get by seats.group) ship)  ``unsafe+noun+!>(~)
+        ?:  (go-is-banned ship)  ``unsafe+noun+!>(~)
         =-  ``unsafe+noun+!>(-)
         %-  some
         :-  admin=(go-is-admin ship)

From e46ff4dc148392b08c8ce316d19a6136da70fbea Mon Sep 17 00:00:00 2001
From: william arzt <bill@tlon.io>
Date: Thu, 13 Aug 2026 07:40:06 -0400
Subject: [PATCH 15/19] fix: address buckets review feedback

---
 docs/backend/desk/app/buckets.md              |   2 +-
 .../api/src/client/urbit.subscribe.test.ts    |  50 +++++++
 packages/api/src/client/urbit.ts              |   2 +-
 .../features/buckets/BucketsLiveChannel.tsx   |  41 +++++-
 .../features/buckets/bucketDeletion.test.ts   |  83 +++++++++++
 .../app/features/buckets/bucketDeletion.ts    |  36 +++++
 .../bucketUploadReconciliation.test.ts        | 101 +++++++++++++-
 .../buckets/bucketUploadReconciliation.ts     |  29 +++-
 .../app/features/buckets/useLiveBucket.ts     | 129 ++++++++++++++----
 .../src/store/storage/bucketsBroker.test.ts   |  34 +++++
 .../shared/src/store/storage/bucketsBroker.ts |   9 ++
 11 files changed, 479 insertions(+), 37 deletions(-)
 create mode 100644 packages/api/src/client/urbit.subscribe.test.ts
 create mode 100644 packages/app/features/buckets/bucketDeletion.test.ts
 create mode 100644 packages/app/features/buckets/bucketDeletion.ts

diff --git a/docs/backend/desk/app/buckets.md b/docs/backend/desk/app/buckets.md
index e2748deb7e..f7bc2cf2d4 100644
--- a/docs/backend/desk/app/buckets.md
+++ b/docs/backend/desk/app/buckets.md
@@ -86,7 +86,7 @@ Bucket snapshots are replica observations, not command acknowledgements. In part
 
 Completion is idempotent. Re-exchanging an upload capability with the same reservation is also idempotent; a different reservation is denied.
 
-For a private read, the client sends `%issue-read`, exchanges the capability at Memex, and receives a short-lived read URL after `%pioneer-buckets-authorize-read` re-checks live group access. Delete follows the same pattern through `%issue-delete` and `%pioneer-buckets-authorize-delete` before the manifest entry is removed.
+For a private read, the client sends `%issue-read`, exchanges the capability at Memex, and receives a short-lived read URL after `%pioneer-buckets-authorize-read` re-checks live group access. Delete follows the same pattern through `%issue-delete` and `%pioneer-buckets-authorize-delete` before the manifest entry is removed. Recursive client deletion commits each private file's manifest removal immediately after Memex confirms its object deletion and treats Memex's exact already-deleted response as idempotent success. This keeps retries safe and prevents later failures in the tree from leaving previously deleted objects advertised as ready. A host-authorized server-side bulk-delete operation remains the durable atomic implementation.
 
 Current clients require the private broker. Broker unavailability fails the upload cleanly and marks the Gall session failed; clients do not fall back to uploader-owned storage or ask for owner credentials.
 
diff --git a/packages/api/src/client/urbit.subscribe.test.ts b/packages/api/src/client/urbit.subscribe.test.ts
new file mode 100644
index 0000000000..cb17ee2280
--- /dev/null
+++ b/packages/api/src/client/urbit.subscribe.test.ts
@@ -0,0 +1,50 @@
+import { afterEach, describe, expect, test, vi } from 'vitest';
+
+import type { Urbit } from '../http-api';
+import {
+  internalConfigureClient,
+  internalRemoveClient,
+  subscribe,
+} from './urbit';
+
+function configureMockClient() {
+  const client = {
+    delete: vi.fn(),
+    on: vi.fn(),
+    subscribe: vi.fn().mockResolvedValue(42),
+  };
+  internalConfigureClient({
+    shipName: '~zod',
+    shipUrl: 'http://example.test',
+    client: client as unknown as Urbit,
+  });
+  return client;
+}
+
+afterEach(() => {
+  internalRemoveClient();
+});
+
+describe('client subscribe wrapper', () => {
+  test('preserves automatic resubscription when options are omitted', async () => {
+    const client = configureMockClient();
+
+    await subscribe({ app: 'groups', path: '/v1' }, vi.fn());
+
+    expect(client.subscribe).toHaveBeenCalledWith(
+      expect.objectContaining({ resubOnQuit: true })
+    );
+  });
+
+  test('allows callers to disable automatic resubscription explicitly', async () => {
+    const client = configureMockClient();
+
+    await subscribe({ app: 'groups', path: '/v1' }, vi.fn(), {
+      resubOnQuit: false,
+    });
+
+    expect(client.subscribe).toHaveBeenCalledWith(
+      expect.objectContaining({ resubOnQuit: false })
+    );
+  });
+});
diff --git a/packages/api/src/client/urbit.ts b/packages/api/src/client/urbit.ts
index 82a57d5e5f..9d453d3280 100644
--- a/packages/api/src/client/urbit.ts
+++ b/packages/api/src/client/urbit.ts
@@ -336,7 +336,7 @@ export async function subscribe<T>(
       app: endpoint.app,
       path: endpoint.path,
       onSubscriptionId: options.onSubscriptionId,
-      resubOnQuit: options.resubOnQuit,
+      resubOnQuit: options.resubOnQuit ?? true,
       event: (event: any, mark: string, id?: number) => {
         logger.debug(
           `got subscription event on ${printEndpoint(endpoint)}:`,
diff --git a/packages/app/features/buckets/BucketsLiveChannel.tsx b/packages/app/features/buckets/BucketsLiveChannel.tsx
index ec7050123a..53ae6dba37 100644
--- a/packages/app/features/buckets/BucketsLiveChannel.tsx
+++ b/packages/app/features/buckets/BucketsLiveChannel.tsx
@@ -1,6 +1,6 @@
 import type { BucketsEntry, BucketsFlag } from '@tloncorp/api';
 import * as db from '@tloncorp/shared/db';
-import { Text } from '@tloncorp/ui';
+import { ConfirmDialog, Text } from '@tloncorp/ui';
 import * as DocumentPicker from 'expo-document-picker';
 import * as ImagePicker from 'expo-image-picker';
 import { ReactElement, useCallback, useMemo, useRef, useState } from 'react';
@@ -130,6 +130,8 @@ export function BucketsLiveChannel({
   const [previewError, setPreviewError] = useState<string | null>(null);
   const previewRequestId = useRef(0);
   const [operationError, setOperationError] = useState<string | null>(null);
+  const [folderPendingDeletion, setFolderPendingDeletion] =
+    useState<BucketItem | null>(null);
   useHideChannelHeader(embedded && previewItem !== null);
   const [mediaLibraryPermissionStatus, requestMediaLibraryPermission] =
     ImagePicker.useMediaLibraryPermissions();
@@ -235,8 +237,12 @@ export function BucketsLiveChannel({
     setPreviewError(null);
 
     try {
-      const previewUri =
-        item.previewUri ?? (await live.readUrl(Number(item.id)));
+      const entry = entriesById.get(Number(item.id));
+      const isPrivateFile =
+        entry?.kind === 'file' && entry.file.objectUrl === null;
+      const previewUri = isPrivateFile
+        ? await live.readUrl(Number(item.id))
+        : item.previewUri ?? (await live.readUrl(Number(item.id)));
       if (previewRequestId.current !== requestId) return;
 
       const readableItem = { ...item, previewUri };
@@ -388,10 +394,13 @@ export function BucketsLiveChannel({
     uploadAggregateProgress: live.uploadAggregateProgress,
     uploadItems: live.localItems,
     onCancelUpload: (item: BucketItem) => void live.cancelUpload(item.id),
-    onDeleteItem: (item: BucketItem) =>
-      void reportOperation(
-        live.deleteEntry(Number(item.id), item.kind === 'folder')
-      ),
+    onDeleteItem: (item: BucketItem) => {
+      if (item.kind === 'folder') {
+        setFolderPendingDeletion(item);
+        return;
+      }
+      void reportOperation(live.deleteEntry(Number(item.id), false));
+    },
     onDownloadItem: (item: BucketItem) => {
       void live
         .readUrl(Number(item.id))
@@ -527,6 +536,24 @@ export function BucketsLiveChannel({
           </XStack>
         )}
       </MaybeChannelHeaderItemsProvider>
+      <ConfirmDialog
+        open={folderPendingDeletion !== null}
+        onOpenChange={(open) => {
+          if (!open) setFolderPendingDeletion(null);
+        }}
+        title={`Delete ${folderPendingDeletion?.name ?? 'folder'}?`}
+        description="This folder and everything inside it will be permanently deleted for everyone. This cannot be undone."
+        confirmText="Delete folder"
+        cancelText="Cancel"
+        destructive
+        onConfirm={() => {
+          const item = folderPendingDeletion;
+          setFolderPendingDeletion(null);
+          if (item) {
+            void reportOperation(live.deleteEntry(Number(item.id), true));
+          }
+        }}
+      />
     </YStack>
   );
 }
diff --git a/packages/app/features/buckets/bucketDeletion.test.ts b/packages/app/features/buckets/bucketDeletion.test.ts
new file mode 100644
index 0000000000..fa0cd369a7
--- /dev/null
+++ b/packages/app/features/buckets/bucketDeletion.test.ts
@@ -0,0 +1,83 @@
+import type { BucketsFileEntry } from '@tloncorp/api';
+import { describe, expect, it, vi } from 'vitest';
+
+import { deletePrivateBucketFiles } from './bucketDeletion';
+
+function file(id: number, objectKey: string): BucketsFileEntry {
+  return {
+    createdAt: 1,
+    createdBy: '~zod',
+    file: {
+      checksum: null,
+      mime: 'text/plain',
+      objectKey,
+      objectUrl: null,
+      size: 10,
+      status: 'ready',
+    },
+    id,
+    kind: 'file',
+    name: `${id}.txt`,
+    parentId: null,
+    updatedAt: 1,
+    updatedBy: '~zod',
+  };
+}
+
+describe('deletePrivateBucketFiles', () => {
+  it('removes each manifest entry before deleting the next object', async () => {
+    const calls: string[] = [];
+    const secondFailure = new Error('second object failed');
+
+    await expect(
+      deletePrivateBucketFiles(
+        [file(1, 'object-1'), file(2, 'object-2')],
+        { host: '~zod', name: 'files' },
+        {
+          createCapability: vi
+            .fn()
+            .mockReturnValueOnce('cap-1')
+            .mockReturnValueOnce('cap-2'),
+          issueDelete: async (_capability, id) => {
+            calls.push(`issue:${id}`);
+          },
+          deleteObject: async (_capability, _host, objectId) => {
+            calls.push(`object:${objectId}`);
+            if (objectId === 'object-2') throw secondFailure;
+          },
+          deleteManifestEntry: async (id) => {
+            calls.push(`manifest:${id}`);
+          },
+          isAlreadyDeleted: () => false,
+        }
+      )
+    ).rejects.toBe(secondFailure);
+
+    expect(calls).toEqual([
+      'issue:1',
+      'object:object-1',
+      'manifest:1',
+      'issue:2',
+      'object:object-2',
+    ]);
+  });
+
+  it('continues manifest cleanup when the object was already deleted', async () => {
+    const deleteManifestEntry = vi.fn().mockResolvedValue(undefined);
+    const missingObject = new Error('object was not found');
+
+    await deletePrivateBucketFiles(
+      [file(1, 'object-1')],
+      { host: '~zod', name: 'files' },
+      {
+        createCapability: () => 'cap-1',
+        issueDelete: vi.fn().mockResolvedValue(undefined),
+        deleteObject: vi.fn().mockRejectedValue(missingObject),
+        deleteManifestEntry,
+        isAlreadyDeleted: (cause) => cause === missingObject,
+      }
+    );
+
+    expect(deleteManifestEntry).toHaveBeenCalledWith(1);
+  });
+});
diff --git a/packages/app/features/buckets/bucketDeletion.ts b/packages/app/features/buckets/bucketDeletion.ts
new file mode 100644
index 0000000000..3fa261f141
--- /dev/null
+++ b/packages/app/features/buckets/bucketDeletion.ts
@@ -0,0 +1,36 @@
+import type { BucketsFileEntry, BucketsFlag } from '@tloncorp/api';
+
+export type PrivateFileDeletionOperations = {
+  createCapability: () => string;
+  deleteManifestEntry: (id: number) => Promise<unknown>;
+  deleteObject: (
+    capability: string,
+    host: string,
+    objectId: string
+  ) => Promise<unknown>;
+  isAlreadyDeleted: (cause: unknown) => boolean;
+  issueDelete: (capability: string, id: number) => Promise<unknown>;
+  onManifestDelete?: (id: number) => void;
+};
+
+export async function deletePrivateBucketFiles(
+  entries: BucketsFileEntry[],
+  flag: BucketsFlag,
+  operations: PrivateFileDeletionOperations
+) {
+  for (const entry of entries) {
+    const capability = operations.createCapability();
+    await operations.issueDelete(capability, entry.id);
+    try {
+      await operations.deleteObject(
+        capability,
+        flag.host,
+        entry.file.objectKey
+      );
+    } catch (cause) {
+      if (!operations.isAlreadyDeleted(cause)) throw cause;
+    }
+    await operations.deleteManifestEntry(entry.id);
+    operations.onManifestDelete?.(entry.id);
+  }
+}
diff --git a/packages/app/features/buckets/bucketUploadReconciliation.test.ts b/packages/app/features/buckets/bucketUploadReconciliation.test.ts
index 00e80e8399..8700b24c43 100644
--- a/packages/app/features/buckets/bucketUploadReconciliation.test.ts
+++ b/packages/app/features/buckets/bucketUploadReconciliation.test.ts
@@ -3,6 +3,7 @@ import { describe, expect, it } from 'vitest';
 
 import {
   bucketResponseHasRevisionGap,
+  includePendingUploadForReconciliation,
   reconcileUploadsWithSnapshot,
 } from './bucketUploadReconciliation';
 
@@ -58,6 +59,7 @@ const snapshot = {
 describe('reconcileUploadsWithSnapshot', () => {
   it('associates the optimistic upload with the matching ship entry', () => {
     const upload = {
+      allowMetadataFallback: true,
       candidate: {
         mimeType: 'image/heic',
         name: 'IMG_0111.heic',
@@ -79,6 +81,7 @@ describe('reconcileUploadsWithSnapshot', () => {
 
   it('does not associate an entry from a session that predates the upload', () => {
     const upload = {
+      allowMetadataFallback: true,
       candidate: {
         mimeType: 'image/heic',
         name: 'IMG_0111.heic',
@@ -96,6 +99,7 @@ describe('reconcileUploadsWithSnapshot', () => {
 
   it('does not associate an upload session requested by another member', () => {
     const upload = {
+      allowMetadataFallback: true,
       candidate: {
         mimeType: 'image/heic',
         name: 'IMG_0111.heic',
@@ -111,7 +115,24 @@ describe('reconcileUploadsWithSnapshot', () => {
     ).toBe(upload);
   });
 
-  it('matches identical concurrent uploads one-to-one', () => {
+  it('waits for the broker object ID before normal reconciliation', () => {
+    const upload = {
+      candidate: {
+        mimeType: 'image/heic',
+        name: 'IMG_0111.heic',
+        size: 42,
+      },
+      id: 'local-upload',
+      parentId: null,
+      priorSessionIds: [] as string[],
+    };
+
+    expect(reconcileUploadsWithSnapshot([upload], snapshot, '~zod')[0]).toBe(
+      upload
+    );
+  });
+
+  it('matches identical concurrent uploads by broker object ID', () => {
     const secondSnapshot: BucketsSnapshot = {
       ...snapshot,
       state: {
@@ -136,6 +157,7 @@ describe('reconcileUploadsWithSnapshot', () => {
     };
     const uploads = [
       {
+        brokerObjectId: 'second',
         candidate: {
           mimeType: 'image/heic',
           name: 'IMG_0111.heic',
@@ -146,6 +168,7 @@ describe('reconcileUploadsWithSnapshot', () => {
         priorSessionIds: [] as string[],
       },
       {
+        brokerObjectId: 'first',
         candidate: {
           mimeType: 'image/heic',
           name: 'IMG_0111.heic',
@@ -163,13 +186,54 @@ describe('reconcileUploadsWithSnapshot', () => {
       '~zod'
     );
     expect(reconciled).toMatchObject([
-      { serverEntryId: 10, sessionId: 'new-session' },
       { serverEntryId: 11, sessionId: 'second-session' },
+      { serverEntryId: 10, sessionId: 'new-session' },
     ]);
   });
 
+  it('does not guess when metadata-only reconciliation is ambiguous', () => {
+    const secondSnapshot: BucketsSnapshot = {
+      ...snapshot,
+      state: {
+        ...snapshot.state,
+        entries: [
+          ...snapshot.state.entries,
+          {
+            ...snapshot.state.entries[0],
+            id: 11,
+            file: { ...snapshot.state.entries[0].file, objectKey: 'second' },
+          },
+        ],
+        sessions: [
+          ...snapshot.state.sessions,
+          {
+            ...snapshot.state.sessions[0],
+            fileId: 11,
+            id: 'second-session',
+          },
+        ],
+      },
+    };
+    const upload = {
+      allowMetadataFallback: true,
+      candidate: {
+        mimeType: 'image/heic',
+        name: 'IMG_0111.heic',
+        size: 42,
+      },
+      id: 'local-upload',
+      parentId: null,
+      priorSessionIds: [] as string[],
+    };
+
+    expect(
+      reconcileUploadsWithSnapshot([upload], secondSnapshot, '~zod')[0]
+    ).toBe(upload);
+  });
+
   it('does not reuse an entry already claimed by another waiter', () => {
     const upload = {
+      allowMetadataFallback: true,
       candidate: {
         mimeType: 'image/heic',
         name: 'IMG_0111.heic',
@@ -186,6 +250,39 @@ describe('reconcileUploadsWithSnapshot', () => {
   });
 });
 
+describe('includePendingUploadForReconciliation', () => {
+  it('retains a canceled upload as a private reconciliation probe', () => {
+    const pending = {
+      id: 'local-upload',
+      priorSessionIds: undefined,
+      state: 'uploading' as const,
+    };
+
+    expect(
+      includePendingUploadForReconciliation([], pending, ['old-session'])
+    ).toEqual([{ ...pending, priorSessionIds: ['old-session'] }]);
+  });
+
+  it('updates the visible upload without duplicating it', () => {
+    const pending: {
+      id: string;
+      priorSessionIds: undefined;
+      progress: number;
+      state: 'queued' | 'uploading';
+    } = {
+      id: 'local-upload',
+      priorSessionIds: undefined,
+      progress: 0,
+      state: 'queued',
+    };
+    const visible = { ...pending, progress: 5, state: 'uploading' } as const;
+
+    expect(
+      includePendingUploadForReconciliation([visible], pending, ['old-session'])
+    ).toEqual([{ ...visible, priorSessionIds: ['old-session'] }]);
+  });
+});
+
 describe('bucketResponseHasRevisionGap', () => {
   it('requests a refresh when an update skips a revision', () => {
     expect(
diff --git a/packages/app/features/buckets/bucketUploadReconciliation.ts b/packages/app/features/buckets/bucketUploadReconciliation.ts
index 253c6c2a7a..6511c120c6 100644
--- a/packages/app/features/buckets/bucketUploadReconciliation.ts
+++ b/packages/app/features/buckets/bucketUploadReconciliation.ts
@@ -12,6 +12,8 @@ export function bucketResponseHasRevisionGap(
 }
 
 type ReconcileableUpload = {
+  allowMetadataFallback?: boolean;
+  brokerObjectId?: string;
   candidate: {
     mimeType?: string;
     name: string;
@@ -23,6 +25,17 @@ type ReconcileableUpload = {
   sessionId?: string;
 };
 
+export function includePendingUploadForReconciliation<
+  T extends { id: string; priorSessionIds?: readonly string[] },
+>(uploads: T[], pending: T, priorSessionIds: readonly string[]): T[] {
+  const withPriorSessions = { ...pending, priorSessionIds };
+  const index = uploads.findIndex((upload) => upload.id === pending.id);
+  if (index === -1) return [...uploads, withPriorSessions];
+  return uploads.map((upload, candidateIndex) =>
+    candidateIndex === index ? { ...upload, priorSessionIds } : upload
+  );
+}
+
 export function reconcileUploadsWithSnapshot<T extends ReconcileableUpload>(
   uploads: T[],
   snapshot: BucketsSnapshot,
@@ -37,15 +50,21 @@ export function reconcileUploadsWithSnapshot<T extends ReconcileableUpload>(
   let changed = false;
 
   const reconciled = uploads.map((upload) => {
-    if (upload.serverEntryId !== undefined || !upload.priorSessionIds) {
+    if (
+      upload.serverEntryId !== undefined ||
+      !upload.priorSessionIds ||
+      (!upload.brokerObjectId && !upload.allowMetadataFallback)
+    ) {
       return upload;
     }
 
     const priorSessionIds = new Set(upload.priorSessionIds);
-    const entry = snapshot.state.entries.find(
+    const entries = snapshot.state.entries.filter(
       (candidate) =>
         candidate.kind === 'file' &&
         !usedEntryIds.has(candidate.id) &&
+        (!upload.brokerObjectId ||
+          candidate.file.objectKey === upload.brokerObjectId) &&
         candidate.parentId === upload.parentId &&
         candidate.name === upload.candidate.name &&
         candidate.file.mime ===
@@ -58,6 +77,12 @@ export function reconcileUploadsWithSnapshot<T extends ReconcileableUpload>(
             !priorSessionIds.has(session.id)
         )
     );
+    // The broker object ID is the Gall object's opaque key and is the only
+    // safe discriminator for normal uploads. The metadata-only path is
+    // opt-in for cleanup after a failed grant and only succeeds when it
+    // identifies exactly one entry.
+    const entry =
+      entries.length === 1 || upload.brokerObjectId ? entries[0] : undefined;
     if (!entry) return upload;
 
     const session = snapshot.state.sessions.find(
diff --git a/packages/app/features/buckets/useLiveBucket.ts b/packages/app/features/buckets/useLiveBucket.ts
index 078ad10f8c..8a4d3cb8f7 100644
--- a/packages/app/features/buckets/useLiveBucket.ts
+++ b/packages/app/features/buckets/useLiveBucket.ts
@@ -20,6 +20,7 @@ import {
   deleteBucketObject,
   grantBucketRead,
   grantBucketUpload,
+  isBucketObjectAlreadyDeleted,
 } from '@tloncorp/shared';
 import * as db from '@tloncorp/shared/db';
 import { useCallback, useEffect, useMemo, useRef, useState } from 'react';
@@ -31,14 +32,17 @@ import {
   removeBucketUploadFromBatch,
 } from '../../utils/bucketUploadProgress';
 import type { BucketUploadBatchItem } from '../../utils/bucketUploadProgress';
+import { deletePrivateBucketFiles } from './bucketDeletion';
 import {
   bucketResponseHasRevisionGap,
+  includePendingUploadForReconciliation,
   reconcileUploadsWithSnapshot,
 } from './bucketUploadReconciliation';
 import { createBucketUploadTask } from './bucketUploadTask';
 import type { BucketUploadTask } from './bucketUploadTask.types';
 
 type LocalUpload = {
+  brokerObjectId?: string;
   brokerReservationId?: string;
   candidate: BucketUploadCandidate;
   capability?: string;
@@ -338,10 +342,13 @@ export function useLiveBucket(requestedFlag: BucketsFlag) {
 
   const waitForSession = useCallback(
     async (
+      pendingUpload: LocalUpload,
       candidate: BucketUploadCandidate,
       localUploadId: string,
       parentId: number | null,
-      priorSessionIds: Set<string>
+      priorSessionIds: Set<string>,
+      brokerObjectId?: string,
+      allowMetadataFallback = false
     ) => {
       for (let attempt = 0; attempt < 80; attempt += 1) {
         let next = snapshotRef.current;
@@ -353,9 +360,13 @@ export function useLiveBucket(requestedFlag: BucketsFlag) {
           next = await refreshUploadSessions();
         }
         if (next) {
-          const activeUploads = uploadsRef.current.map((upload) =>
+          const activeUploads = includePendingUploadForReconciliation(
+            uploadsRef.current,
+            pendingUpload,
+            [...priorSessionIds]
+          ).map((upload) =>
             upload.id === localUploadId
-              ? { ...upload, priorSessionIds: [...priorSessionIds] }
+              ? { ...upload, allowMetadataFallback, brokerObjectId }
               : upload
           );
           const reconciled = reconcileUploadsWithSnapshot(
@@ -384,7 +395,9 @@ export function useLiveBucket(requestedFlag: BucketsFlag) {
             );
             if (entry && session) {
               claimedEntryIdsRef.current.add(entry.id);
-              setCurrentUploads(() => reconciled);
+              if (!cancelledRef.current.has(localUploadId)) {
+                setCurrentUploads(() => reconciled);
+              }
               return { entry, session };
             }
           }
@@ -401,6 +414,7 @@ export function useLiveBucket(requestedFlag: BucketsFlag) {
       const { candidate, id, parentId } = upload;
       let sessionId: string | undefined;
       let serverEntryId: number | undefined;
+      let brokerObjectId: string | undefined;
       let brokerReservationId: string | undefined;
       let brokerCompleted = false;
 
@@ -433,26 +447,51 @@ export function useLiveBucket(requestedFlag: BucketsFlag) {
           parentId,
           size: candidate.size,
         });
+        let privateGrant: Awaited<ReturnType<typeof grantBucketUpload>>;
+        try {
+          privateGrant = await waitForBrokerCapability(() =>
+            grantBucketUpload(capability, flag.host)
+          );
+        } catch (grantCause) {
+          // A failed grant can still leave a pending Gall entry. Metadata is
+          // only used here when it identifies one unambiguous entry, so this
+          // cleanup cannot fail another identical upload from the same ship.
+          const begun = await waitForSession(
+            upload,
+            candidate,
+            id,
+            parentId,
+            priorSessionIds,
+            undefined,
+            true
+          ).catch(() => undefined);
+          sessionId = begun?.session.id;
+          serverEntryId = begun?.entry.id;
+          throw grantCause;
+        }
+        brokerObjectId = privateGrant.objectId;
+        brokerReservationId = privateGrant.reservationId;
+        updateLocalUpload(id, {
+          brokerObjectId,
+          brokerReservationId,
+          progress: 3,
+        });
         const begun = await waitForSession(
+          { ...upload, brokerObjectId, brokerReservationId },
           candidate,
           id,
           parentId,
-          priorSessionIds
+          priorSessionIds,
+          brokerObjectId
         );
         sessionId = begun.session.id;
         serverEntryId = begun.entry.id;
-        updateLocalUpload(id, { progress: 3, serverEntryId, sessionId });
+        updateLocalUpload(id, { progress: 5, serverEntryId, sessionId });
 
         if (cancelledRef.current.has(id)) {
           throw new Error('Upload cancelled');
         }
 
-        const privateGrant = await waitForBrokerCapability(() =>
-          grantBucketUpload(capability, flag.host)
-        );
-        brokerReservationId = privateGrant.reservationId;
-        updateLocalUpload(id, { brokerReservationId, progress: 5 });
-
         const task = createBucketUploadTask(
           privateGrant.uploadUrl,
           candidate,
@@ -483,6 +522,7 @@ export function useLiveBucket(requestedFlag: BucketsFlag) {
         );
       } catch (cause) {
         tasksRef.current.delete(id);
+        const cancelled = cancelledRef.current.has(id);
         if (sessionId && !brokerCompleted) {
           await sendBucketsAction({
             type: 'fail-upload',
@@ -494,7 +534,15 @@ export function useLiveBucket(requestedFlag: BucketsFlag) {
         if (brokerReservationId && !brokerCompleted) {
           await cancelBucketUpload(brokerReservationId).catch(() => undefined);
         }
-        if (!cancelledRef.current.has(id)) {
+        if (cancelled && serverEntryId !== undefined) {
+          await sendBucketsAction({
+            type: 'delete-entry',
+            flag,
+            id: serverEntryId,
+            recursive: false,
+          }).catch(() => undefined);
+        }
+        if (!cancelled) {
           updateLocalUpload(id, {
             brokerReservationId: undefined,
             error: errorMessage(cause),
@@ -630,6 +678,7 @@ export function useLiveBucket(requestedFlag: BucketsFlag) {
         error: undefined,
         capability: undefined,
         brokerReservationId: undefined,
+        brokerObjectId: undefined,
         progress: 0,
         priorSessionIds: undefined,
         serverEntryId: undefined,
@@ -704,17 +753,49 @@ export function useLiveBucket(requestedFlag: BucketsFlag) {
           entry.file.status === 'ready' &&
           !entry.file.objectUrl
       );
-      for (const entry of privateFiles ?? []) {
-        const capability = createBucketCapability();
-        await sendBucketsAction({
-          type: 'issue-delete',
-          capability,
-          flag,
-          id: entry.id,
-        });
-        await waitForBrokerCapability(() =>
-          deleteBucketObject(capability, flag.host, entry.file.objectKey)
-        );
+      await deletePrivateBucketFiles(privateFiles ?? [], flag, {
+        createCapability: createBucketCapability,
+        deleteManifestEntry: (deletedId) =>
+          sendBucketsAction({
+            type: 'delete-entry',
+            flag,
+            id: deletedId,
+            recursive: false,
+          }),
+        deleteObject: (capability, host, objectId) =>
+          waitForBrokerCapability(() =>
+            deleteBucketObject(capability, host, objectId)
+          ),
+        isAlreadyDeleted: isBucketObjectAlreadyDeleted,
+        issueDelete: (capability, entryId) =>
+          sendBucketsAction({
+            type: 'issue-delete',
+            capability,
+            flag,
+            id: entryId,
+          }),
+        onManifestDelete: (deletedId) => {
+          const latest = snapshotRef.current;
+          if (!latest) return;
+          commitSnapshot({
+            ...latest,
+            state: {
+              ...latest.state,
+              entries: latest.state.entries.filter(
+                (entry) => entry.id !== deletedId
+              ),
+              sessions: latest.state.sessions.filter(
+                (session) => session.fileId !== deletedId
+              ),
+            },
+          });
+        },
+      });
+      if (
+        root?.kind === 'file' &&
+        privateFiles?.some((entry) => entry.id === id)
+      ) {
+        return;
       }
       return sendBucketsAction({ type: 'delete-entry', flag, id, recursive });
     },
diff --git a/packages/shared/src/store/storage/bucketsBroker.test.ts b/packages/shared/src/store/storage/bucketsBroker.test.ts
index 6171dba2ab..3a1e32238a 100644
--- a/packages/shared/src/store/storage/bucketsBroker.test.ts
+++ b/packages/shared/src/store/storage/bucketsBroker.test.ts
@@ -5,6 +5,7 @@ import {
   canFallBackFromBucketsBroker,
   completeBucketUpload,
   grantBucketUpload,
+  isBucketObjectAlreadyDeleted,
 } from './bucketsBroker';
 
 afterEach(() => {
@@ -93,4 +94,37 @@ describe('Buckets broker client', () => {
       )
     ).toBe(false);
   });
+
+  test('only treats the broker missing-object response as an idempotent delete', () => {
+    expect(
+      isBucketObjectAlreadyDeleted(
+        new BucketsBrokerError(
+          'object was not found',
+          409,
+          'invalid_state',
+          false
+        )
+      )
+    ).toBe(true);
+    expect(
+      isBucketObjectAlreadyDeleted(
+        new BucketsBrokerError(
+          'the capability conflicts with an existing exchange',
+          409,
+          'invalid_state',
+          false
+        )
+      )
+    ).toBe(false);
+    expect(
+      isBucketObjectAlreadyDeleted(
+        new BucketsBrokerError(
+          'object was not found',
+          403,
+          'capability_denied',
+          false
+        )
+      )
+    ).toBe(false);
+  });
 });
diff --git a/packages/shared/src/store/storage/bucketsBroker.ts b/packages/shared/src/store/storage/bucketsBroker.ts
index 153484c4e8..1231662b8a 100644
--- a/packages/shared/src/store/storage/bucketsBroker.ts
+++ b/packages/shared/src/store/storage/bucketsBroker.ts
@@ -143,6 +143,15 @@ export function deleteBucketObject(
   );
 }
 
+export function isBucketObjectAlreadyDeleted(cause: unknown) {
+  return (
+    cause instanceof BucketsBrokerError &&
+    cause.status === 409 &&
+    cause.code === 'invalid_state' &&
+    cause.message.toLowerCase().includes('object was not found')
+  );
+}
+
 export function brokerRequiredHeaders(grant: BucketUploadGrant) {
   return Object.fromEntries(grant.requiredHeaders);
 }

From 7eb145f15daf1a6c5841447f816d41987e0a3512 Mon Sep 17 00:00:00 2001
From: github-actions <github-actions@github.com>
Date: Thu, 13 Aug 2026 16:52:50 +0000
Subject: [PATCH 16/19] update glob:  [skip actions]

---
 desk/desk.docket-0 | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/desk/desk.docket-0 b/desk/desk.docket-0
index 86fc08c232..4cf4b41e58 100644
--- a/desk/desk.docket-0
+++ b/desk/desk.docket-0
@@ -2,7 +2,7 @@
     info+'Start, host, and cultivate communities. Own your communications, organize your resources, and share documents. Tlon is a decentralized platform that offers a full, communal suite of tools for messaging, writing and sharing media with others.'
     color+0xde.dede
     image+'https://bootstrap.urbit.org/tlon.svg?v=1'
-    glob-http+['https://bootstrap.urbit.org/glob-0v2.1u7il.6a5ru.uoe74.guefk.pjs4v.glob' 0v2.1u7il.6a5ru.uoe74.guefk.pjs4v]
+    glob-http+['https://bootstrap.urbit.org/glob-0v5.cg9ib.piljd.fj0ca.ktvq6.3rb89.glob' 0v5.cg9ib.piljd.fj0ca.ktvq6.3rb89]
     base+'groups'
     version+[12 1 0]
     website+'https://tlon.io'

From 8da7f9ea8082d3e57fc3523153b411f3e9e54da9 Mon Sep 17 00:00:00 2001
From: william arzt <bill@tlon.io>
Date: Thu, 13 Aug 2026 17:33:27 -0400
Subject: [PATCH 17/19] fix: deduplicate bucket upload rows

---
 .../features/buckets/BucketsLiveChannel.tsx   | 12 ++--
 .../bucketUploadReconciliation.test.ts        | 67 +++++++++++++++++++
 .../buckets/bucketUploadReconciliation.ts     | 47 +++++++++++++
 .../app/features/buckets/useLiveBucket.ts     | 28 ++++----
 4 files changed, 132 insertions(+), 22 deletions(-)

diff --git a/packages/app/features/buckets/BucketsLiveChannel.tsx b/packages/app/features/buckets/BucketsLiveChannel.tsx
index 53ae6dba37..bb7394d0dd 100644
--- a/packages/app/features/buckets/BucketsLiveChannel.tsx
+++ b/packages/app/features/buckets/BucketsLiveChannel.tsx
@@ -28,6 +28,7 @@ import {
   useRegisterChannelHeaderItem,
 } from '../../ui';
 import { imagePickerAssetsToBucketUploadCandidates } from './bucketMediaPicker';
+import { findUploadShadowEntryIds } from './bucketUploadReconciliation';
 import {
   formatBucketTimestamp,
   formatFileSize,
@@ -132,6 +133,7 @@ export function BucketsLiveChannel({
   const [operationError, setOperationError] = useState<string | null>(null);
   const [folderPendingDeletion, setFolderPendingDeletion] =
     useState<BucketItem | null>(null);
+  const currentUserId = useCurrentUserId();
   useHideChannelHeader(embedded && previewItem !== null);
   const [mediaLibraryPermissionStatus, requestMediaLibraryPermission] =
     ImagePicker.useMediaLibraryPermissions();
@@ -153,13 +155,8 @@ export function BucketsLiveChannel({
     return counts;
   }, [entries]);
   const suppressedIds = useMemo(
-    () =>
-      new Set(
-        live.uploads
-          .map((upload) => upload.serverEntryId)
-          .filter((id): id is number => id !== undefined)
-      ),
-    [live.uploads]
+    () => findUploadShadowEntryIds(live.uploads, live.snapshot, currentUserId),
+    [currentUserId, live.snapshot, live.uploads]
   );
   const serverEntries = useMemo(
     () => entries.filter((entry) => !suppressedIds.has(entry.id)),
@@ -217,7 +214,6 @@ export function BucketsLiveChannel({
     [flag.host, flag.name, rootLabel]
   );
   const channel = providedChannel ?? fallbackChannel;
-  const currentUserId = useCurrentUserId();
   const canEdit = useCanWrite(channel, currentUserId);
 
   const reportOperation = async (operation: Promise<unknown>) => {
diff --git a/packages/app/features/buckets/bucketUploadReconciliation.test.ts b/packages/app/features/buckets/bucketUploadReconciliation.test.ts
index 8700b24c43..92470fbb05 100644
--- a/packages/app/features/buckets/bucketUploadReconciliation.test.ts
+++ b/packages/app/features/buckets/bucketUploadReconciliation.test.ts
@@ -3,8 +3,10 @@ import { describe, expect, it } from 'vitest';
 
 import {
   bucketResponseHasRevisionGap,
+  findUploadShadowEntryIds,
   includePendingUploadForReconciliation,
   reconcileUploadsWithSnapshot,
+  removeEntryFromBucketSnapshot,
 } from './bucketUploadReconciliation';
 
 const snapshot = {
@@ -283,6 +285,71 @@ describe('includePendingUploadForReconciliation', () => {
   });
 });
 
+describe('findUploadShadowEntryIds', () => {
+  it('hides a unique pending server entry before the broker object ID arrives', () => {
+    const upload = {
+      candidate: {
+        mimeType: 'image/heic',
+        name: 'IMG_0111.heic',
+        size: 42,
+      },
+      id: 'local-upload',
+      parentId: null,
+      priorSessionIds: [] as string[],
+    };
+
+    expect(findUploadShadowEntryIds([upload], snapshot, '~zod')).toEqual(
+      new Set([10])
+    );
+    expect(upload).not.toHaveProperty('serverEntryId');
+  });
+
+  it('does not hide an ambiguous metadata-only match', () => {
+    const ambiguousSnapshot: BucketsSnapshot = {
+      ...snapshot,
+      state: {
+        ...snapshot.state,
+        entries: [
+          ...snapshot.state.entries,
+          { ...snapshot.state.entries[0], id: 11 },
+        ],
+        sessions: [
+          ...snapshot.state.sessions,
+          {
+            ...snapshot.state.sessions[0],
+            fileId: 11,
+            id: 'second-session',
+          },
+        ],
+      },
+    };
+    const upload = {
+      candidate: {
+        mimeType: 'image/heic',
+        name: 'IMG_0111.heic',
+        size: 42,
+      },
+      id: 'local-upload',
+      parentId: null,
+      priorSessionIds: [] as string[],
+    };
+
+    expect(
+      findUploadShadowEntryIds([upload], ambiguousSnapshot, '~zod')
+    ).toEqual(new Set());
+  });
+});
+
+describe('removeEntryFromBucketSnapshot', () => {
+  it('optimistically removes an entry and its upload session', () => {
+    const next = removeEntryFromBucketSnapshot(snapshot, 10);
+
+    expect(next.state.entries).toEqual([]);
+    expect(next.state.sessions).toEqual([]);
+    expect(next.state.bucket).toBe(snapshot.state.bucket);
+  });
+});
+
 describe('bucketResponseHasRevisionGap', () => {
   it('requests a refresh when an update skips a revision', () => {
     expect(
diff --git a/packages/app/features/buckets/bucketUploadReconciliation.ts b/packages/app/features/buckets/bucketUploadReconciliation.ts
index 6511c120c6..146c3444e6 100644
--- a/packages/app/features/buckets/bucketUploadReconciliation.ts
+++ b/packages/app/features/buckets/bucketUploadReconciliation.ts
@@ -104,3 +104,50 @@ export function reconcileUploadsWithSnapshot<T extends ReconcileableUpload>(
 
   return changed ? reconciled : uploads;
 }
+
+/**
+ * Finds server entries that are already represented by optimistic upload rows.
+ * Before Memex returns an object ID, a unique metadata/session match is safe for
+ * display deduplication only; permanent reconciliation still requires the
+ * broker object ID.
+ */
+export function findUploadShadowEntryIds<T extends ReconcileableUpload>(
+  uploads: T[],
+  snapshot: BucketsSnapshot | null,
+  requestedBy: string
+): Set<number> {
+  if (!snapshot) {
+    return new Set(
+      uploads
+        .map((upload) => upload.serverEntryId)
+        .filter((id): id is number => id !== undefined)
+    );
+  }
+
+  const displayUploads = uploads.map((upload) =>
+    upload.serverEntryId === undefined && !upload.brokerObjectId
+      ? { ...upload, allowMetadataFallback: true }
+      : upload
+  );
+  return new Set(
+    reconcileUploadsWithSnapshot(displayUploads, snapshot, requestedBy)
+      .map((upload) => upload.serverEntryId)
+      .filter((id): id is number => id !== undefined)
+  );
+}
+
+export function removeEntryFromBucketSnapshot(
+  snapshot: BucketsSnapshot,
+  entryId: number
+): BucketsSnapshot {
+  return {
+    ...snapshot,
+    state: {
+      ...snapshot.state,
+      entries: snapshot.state.entries.filter((entry) => entry.id !== entryId),
+      sessions: snapshot.state.sessions.filter(
+        (session) => session.fileId !== entryId
+      ),
+    },
+  };
+}
diff --git a/packages/app/features/buckets/useLiveBucket.ts b/packages/app/features/buckets/useLiveBucket.ts
index 8a4d3cb8f7..5b8eb0354a 100644
--- a/packages/app/features/buckets/useLiveBucket.ts
+++ b/packages/app/features/buckets/useLiveBucket.ts
@@ -37,6 +37,7 @@ import {
   bucketResponseHasRevisionGap,
   includePendingUploadForReconciliation,
   reconcileUploadsWithSnapshot,
+  removeEntryFromBucketSnapshot,
 } from './bucketUploadReconciliation';
 import { createBucketUploadTask } from './bucketUploadTask';
 import type { BucketUploadTask } from './bucketUploadTask.types';
@@ -620,18 +621,9 @@ export function useLiveBucket(requestedFlag: BucketsFlag) {
       );
       setUploadBatch((current) => removeBucketUploadFromBatch(current, id));
       if (serverEntryId !== undefined && snapshotRef.current) {
-        commitSnapshot({
-          ...snapshotRef.current,
-          state: {
-            ...snapshotRef.current.state,
-            entries: snapshotRef.current.state.entries.filter(
-              (entry) => entry.id !== serverEntryId
-            ),
-            sessions: snapshotRef.current.state.sessions.filter(
-              (session) => session.fileId !== serverEntryId
-            ),
-          },
-        });
+        commitSnapshot(
+          removeEntryFromBucketSnapshot(snapshotRef.current, serverEntryId)
+        );
       }
 
       if (sessionId) {
@@ -665,7 +657,15 @@ export function useLiveBucket(requestedFlag: BucketsFlag) {
       const upload = uploads.find((candidate) => candidate.id === id);
       if (!upload) return;
       cancelledRef.current.delete(id);
-      if (upload.serverEntryId) {
+      if (upload.serverEntryId !== undefined) {
+        if (snapshotRef.current) {
+          commitSnapshot(
+            removeEntryFromBucketSnapshot(
+              snapshotRef.current,
+              upload.serverEntryId
+            )
+          );
+        }
         await sendBucketsAction({
           type: 'delete-entry',
           flag,
@@ -697,7 +697,7 @@ export function useLiveBucket(requestedFlag: BucketsFlag) {
       );
       void runUpload(next);
     },
-    [flag, runUpload, setCurrentUploads, uploads]
+    [commitSnapshot, flag, runUpload, setCurrentUploads, uploads]
   );
 
   const localItems = useMemo<BucketItem[]>(

From 0fc84ffd07b051b064fc023cd39448f112a5abc4 Mon Sep 17 00:00:00 2001
From: william arzt <bill@tlon.io>
Date: Thu, 13 Aug 2026 17:33:35 -0400
Subject: [PATCH 18/19] fix: reject moon-hosted bucket creation

---
 desk/app/buckets.hoon                         |  2 +
 desk/tests/app/buckets.hoon                   | 30 +++++++---
 .../ManageChannels/CreateChannelSheet.tsx     | 15 ++++-
 .../shared/src/store/channelActions.test.ts   | 56 +++++++++++++------
 packages/shared/src/store/channelActions.ts   | 15 +++++
 5 files changed, 92 insertions(+), 26 deletions(-)

diff --git a/desk/app/buckets.hoon b/desk/app/buckets.hoon
index 416829bcbc..1777b86377 100644
--- a/desk/app/buckets.hoon
+++ b/desk/app/buckets.hoon
@@ -113,6 +113,7 @@
     =+  cmd=!<(command:b vase)
     =/  act=action:b  action.cmd
     ?:  ?=(%create -.act)
+      ?>  ?=(%duke (clan:title ship.group.act))
       ?>  =(ship.group.act our.bowl)
       ?>  (group-is-admin-for-create group.act src.bowl)
       (create-bucket name.act title.act group.act readers.act writers.act src.bowl)
@@ -148,6 +149,7 @@
   ^+  cor
   ?+  -.act  (dispatch-existing act)
     %create
+  ?>  ?=(%duke (clan:title ship.group.act))
   ?>  (group-is-admin-for-create group.act our.bowl)
   ?:  =(ship.group.act our.bowl)
     (create-bucket name.act title.act group.act readers.act writers.act our.bowl)
diff --git a/desk/tests/app/buckets.hoon b/desk/tests/app/buckets.hoon
index e73de578ed..1c6a2aa484 100644
--- a/desk/tests/app/buckets.hoon
+++ b/desk/tests/app/buckets.hoon
@@ -9,16 +9,16 @@
 ::
 ++  flag
   ^-  flag:bu
-  [~zod %project-files]
+  [~sampel-palnet %project-files]
 ::
 ++  group
   ^-  flag:bu
-  [~zod %test-group]
+  [~sampel-palnet %test-group]
 ::
 ++  setup
   =/  m  (mare ,~)
   ^-  form:m
-  ;<  ~  bind:m  (jab-bowl |=(b=bowl b(our ~zod, src ~zod)))
+  ;<  ~  bind:m  (jab-bowl |=(b=bowl b(our ~sampel-palnet, src ~sampel-palnet)))
   ;<  *  bind:m  (do-init dap buckets-agent)
   ;<  ~  bind:m
     (jab-bowl |=(b=bowl b(now ~2026.1.1, eny 0v1234)))
@@ -105,13 +105,29 @@
     (do-poke %buckets-action-1 !>(act))
   %+  ex-cards  caz
   :~  %-  ex-poke
-      :*  /buckets/cmd/create/~zod/project-files
-          [~zod %buckets]
+      :*  /buckets/cmd/create/~sampel-palnet/project-files
+          [~sampel-palnet %buckets]
           %buckets-command-1
           !>(`command:bu`[act])
       ==
   ==
 ::
+::  A Moon cannot own Bucket storage, even when it hosts the group and the
+::  caller is an admin. This fails before forwarding or allocating state.
+::
+++  test-moon-host-cannot-create
+  %-  eval-mare
+  =/  m  (mare ,~)
+  =*  b  bind:m
+  ^-  form:m
+  =/  moon=ship  ~pinser-botter-sampel-palnet
+  =/  moon-group=flag:bu  [moon %test-group]
+  ;<  ~  b  (setup-as moon)
+  ;<  ~  b  (set-scry-gate allow-admin-create-scries)
+  %-  ex-fail
+  %+  do-poke  %buckets-action-1
+  !>(`action:bu`[%create %project-files 'Project Files' moon-group ~ ~])
+::
 ::  The authoritative group host accepts a live remote admin, owns the Bucket,
 ::  and records the initiating admin as its creator.
 ::
@@ -132,7 +148,7 @@
   =/  bs=bucket-state:bu  (state-for st fl)
   %+  ex-equal
   !>([ship.fl created-by.bucket.bs updated-by.bucket.bs group.bs])
-  !>([~zod ~bus ~bus group])
+  !>([~sampel-palnet ~bus ~bus group])
 ::
 ::  A stale or forged admin request is rejected by the group host's own
 ::  authoritative group state.
@@ -179,7 +195,7 @@
   ^-  form:m
   ;<  ~  b  setup
   =/  legacy-bucket=bucket:bu
-    [41 'Legacy Files' ~zod ~2025.1.1 ~zod ~2025.1.2]
+    [41 'Legacy Files' ~sampel-palnet ~2025.1.1 ~sampel-palnet ~2025.1.2]
   =/  legacy-readers=(set @tas)
     (~(put in (~(put in *(set @tas)) %editor)) %member)
   =/  legacy-state=bucket-state-1:bu
diff --git a/packages/app/ui/components/ManageChannels/CreateChannelSheet.tsx b/packages/app/ui/components/ManageChannels/CreateChannelSheet.tsx
index dc8e1c66ca..b66510b25f 100644
--- a/packages/app/ui/components/ManageChannels/CreateChannelSheet.tsx
+++ b/packages/app/ui/components/ManageChannels/CreateChannelSheet.tsx
@@ -1,6 +1,7 @@
 import { useNavigation } from '@react-navigation/native';
 import { NativeStackNavigationProp } from '@react-navigation/native-stack';
 import {
+  canShipHostBuckets,
   createChannel,
   useBucketsDeskAvailable,
   useNotesDeskAvailable,
@@ -108,7 +109,9 @@ export function CreateChannelSheet({
   const isNonHostAdmin = isGroupAdmin && !group.currentUserIsHost;
   const { data: notesAvailable = false } = useNotesDeskAvailable();
   const { data: bucketsDeskAvailable = false } = useBucketsDeskAvailable();
-  const bucketsAvailable = bucketsDeskAvailable && isGroupAdmin;
+  const bucketsHostSupported = canShipHostBuckets(group.hostUserId);
+  const bucketsAvailable =
+    bucketsDeskAvailable && isGroupAdmin && bucketsHostSupported;
   const channelTypes = useMemo(
     () => buildChannelTypes(notesAvailable, bucketsAvailable),
     [bucketsAvailable, notesAvailable]
@@ -204,6 +207,16 @@ export function CreateChannelSheet({
               name={'channelType'}
             />
           </ActionSheet.FormBlock>
+          {bucketsDeskAvailable && isGroupAdmin && !bucketsHostSupported && (
+            <ActionSheet.FormBlock>
+              <SystemNotices.NoticeFrame>
+                <SystemNotices.NoticeBody>
+                  Buckets are currently available only in groups hosted by a
+                  planet.
+                </SystemNotices.NoticeBody>
+              </SystemNotices.NoticeFrame>
+            </ActionSheet.FormBlock>
+          )}
           {isNonHostAdmin && (
             <ActionSheet.FormBlock>
               <SystemNotices.NonHostAdminChannelNotice
diff --git a/packages/shared/src/store/channelActions.test.ts b/packages/shared/src/store/channelActions.test.ts
index d0cb870a51..25640f84da 100644
--- a/packages/shared/src/store/channelActions.test.ts
+++ b/packages/shared/src/store/channelActions.test.ts
@@ -18,6 +18,7 @@ import { markGroupRead } from './groupActions';
 setupDatabaseTestSuite();
 
 const groupId = '~zod/stale-notify';
+const bucketGroupId = '~sampel-palnet/stale-notify';
 const channelId = 'chat/~zod/stale-notify/general';
 
 async function insertGroupAndChannel({
@@ -372,24 +373,24 @@ test('updateChannel saves notes readers without sending writer actions', async (
 });
 
 test('createChannel creates a Bucket with independent reader and writer roles', async () => {
-  await insertGroup();
+  await insertGroup(bucketGroupId);
   vi.spyOn(api, 'getCurrentUserId').mockReturnValue('~zod');
   const sendBucketsAction = vi
     .spyOn(api, 'sendBucketsAction')
     .mockResolvedValue(1);
   vi.spyOn(api, 'getGroup').mockResolvedValue({
-    id: groupId,
+    id: bucketGroupId,
     channels: [
       {
-        id: 'buckets/~zod/project-files',
+        id: 'buckets/~sampel-palnet/project-files',
         title: 'Project files',
         type: 'buckets',
-        groupId,
+        groupId: bucketGroupId,
         currentUserIsMember: true,
         currentUserIsHost: true,
         readerRoles: [
           {
-            channelId: 'buckets/~zod/project-files',
+            channelId: 'buckets/~sampel-palnet/project-files',
             roleId: 'member',
           },
         ],
@@ -399,7 +400,7 @@ test('createChannel creates a Bucket with independent reader and writer roles',
 
   const channel = await createChannel({
     customSlug: 'project-files',
-    groupId,
+    groupId: bucketGroupId,
     title: 'Project files',
     channelType: 'buckets',
     readers: ['member'],
@@ -408,14 +409,14 @@ test('createChannel creates a Bucket with independent reader and writer roles',
 
   expect(sendBucketsAction).toHaveBeenCalledWith({
     type: 'create',
-    group: { host: '~zod', name: 'stale-notify' },
+    group: { host: '~sampel-palnet', name: 'stale-notify' },
     name: 'project-files',
     readers: ['member'],
     title: 'Project files',
     writers: ['editor'],
   });
   expect(channel).toMatchObject({
-    id: 'buckets/~zod/project-files',
+    id: 'buckets/~sampel-palnet/project-files',
     type: 'buckets',
   });
   await expect(
@@ -427,19 +428,19 @@ test('createChannel creates a Bucket with independent reader and writer roles',
 });
 
 test('createChannel lets a non-host admin create a group-hosted Bucket', async () => {
-  await insertGroup();
+  await insertGroup(bucketGroupId);
   vi.spyOn(api, 'getCurrentUserId').mockReturnValue('~solfer-magfed');
   const sendBucketsAction = vi
     .spyOn(api, 'sendBucketsAction')
     .mockResolvedValue(1);
   vi.spyOn(api, 'getGroup').mockResolvedValue({
-    id: groupId,
+    id: bucketGroupId,
     channels: [
       {
-        id: 'buckets/~zod/project-files',
+        id: 'buckets/~sampel-palnet/project-files',
         title: 'Project files',
         type: 'buckets',
-        groupId,
+        groupId: bucketGroupId,
         currentUserIsMember: true,
         currentUserIsHost: false,
       },
@@ -448,41 +449,60 @@ test('createChannel lets a non-host admin create a group-hosted Bucket', async (
 
   const channel = await createChannel({
     customSlug: 'project-files',
-    groupId,
+    groupId: bucketGroupId,
     title: 'Project files',
     channelType: 'buckets',
   });
 
   expect(sendBucketsAction).toHaveBeenCalledWith({
     type: 'create',
-    group: { host: '~zod', name: 'stale-notify' },
+    group: { host: '~sampel-palnet', name: 'stale-notify' },
     name: 'project-files',
     readers: [],
     title: 'Project files',
     writers: [],
   });
   expect(channel).toMatchObject({
-    id: 'buckets/~zod/project-files',
+    id: 'buckets/~sampel-palnet/project-files',
     currentUserIsHost: false,
     type: 'buckets',
   });
 });
 
+test('createChannel rejects a Bucket in a Moon-hosted group before poking Gall', async () => {
+  const moonGroupId = '~pinser-botter-sampel-palnet/files';
+  await insertGroup(moonGroupId);
+  const sendBucketsAction = vi.spyOn(api, 'sendBucketsAction');
+
+  await expect(
+    createChannel({
+      customSlug: 'project-files',
+      groupId: moonGroupId,
+      title: 'Project files',
+      channelType: 'buckets',
+    })
+  ).rejects.toThrow(
+    'Buckets are currently available only in groups hosted by a planet.'
+  );
+
+  expect(sendBucketsAction).not.toHaveBeenCalled();
+});
+
 test('createChannel preserves a created Bucket when its group listing is delayed', async () => {
   vi.useFakeTimers();
-  await insertGroup();
+  await insertGroup(bucketGroupId);
   vi.spyOn(api, 'getCurrentUserId').mockReturnValue('~zod');
   const sendBucketsAction = vi
     .spyOn(api, 'sendBucketsAction')
     .mockResolvedValue(1);
   vi.spyOn(api, 'getGroup').mockResolvedValue({
-    id: groupId,
+    id: bucketGroupId,
     channels: [],
   } as unknown as db.Group);
 
   const createPromise = createChannel({
     customSlug: 'slow-project-files',
-    groupId,
+    groupId: bucketGroupId,
     title: 'Slow project files',
     channelType: 'buckets',
   });
diff --git a/packages/shared/src/store/channelActions.ts b/packages/shared/src/store/channelActions.ts
index 670c616478..49b904ea14 100644
--- a/packages/shared/src/store/channelActions.ts
+++ b/packages/shared/src/store/channelActions.ts
@@ -5,6 +5,7 @@ import {
 } from '@tloncorp/api';
 import { TimeoutError } from '@tloncorp/api';
 import { GroupChannelV7, getChannelKindFromType } from '@tloncorp/api/urbit';
+import { p } from '@urbit/aura';
 import { isEqual } from 'lodash';
 
 import { trackEvent } from '../analytics';
@@ -25,6 +26,17 @@ const BUCKETS_CHANNEL_LISTING_DELAY_MS = 250;
 class NotesChannelListingUnverifiedError extends Error {}
 class BucketsChannelListingUnverifiedError extends Error {}
 
+export const BUCKETS_PLANET_HOST_REQUIRED_MESSAGE =
+  'Buckets are currently available only in groups hosted by a planet.';
+
+export function canShipHostBuckets(ship: string) {
+  try {
+    return p.kind(ship) === 'planet';
+  } catch {
+    return false;
+  }
+}
+
 export async function createChannel({
   groupId,
   title,
@@ -146,6 +158,9 @@ async function createBucketsChannel({
   if (!groupHost || !groupName || rest.length > 0) {
     throw new Error(`Invalid group id: ${groupId}`);
   }
+  if (!canShipHostBuckets(groupHost)) {
+    throw new Error(BUCKETS_PLANET_HOST_REQUIRED_MESSAGE);
+  }
 
   const name = customSlug || getRandomId();
   // Bucket storage belongs to the group host even when another group admin

From 06744d820c90ebd3aeffad0dcf074dc060d58b69 Mon Sep 17 00:00:00 2001
From: william arzt <bill@tlon.io>
Date: Thu, 13 Aug 2026 17:51:24 -0400
Subject: [PATCH 19/19] test: use planet host in broker receipt

---
 desk/tests/app/buckets.hoon | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/desk/tests/app/buckets.hoon b/desk/tests/app/buckets.hoon
index 1c6a2aa484..10e878434e 100644
--- a/desk/tests/app/buckets.hoon
+++ b/desk/tests/app/buckets.hoon
@@ -275,7 +275,7 @@
   ;<  ~  b
     (ex-equal !>(broker-reservation-id.aut) !>(`rid))
   =/  receipt=broker-receipt:bu
-    [rid object-key.fil 'zod' (scot %ud id.bucket.bs) 42 'application/pdf']
+    [rid object-key.fil 'sampel-palnet' (scot %ud id.bucket.bs) 42 'application/pdf']
   ;<  *  b
     (do-poke %buckets-broker-command-1 !>(`broker-command:bu`[%complete-upload receipt]))
   ::  Completion retries are idempotent.