increased security

app/lib/data/repositories/card_repository.dart

@@ -28,6 +28,14 @@ class CardRepository extends ChangeNotifier {
 
   ApiClient get api => _api;
 
+  /// Developer toggle (persisted): route new cards through the on-device model
+  /// instead of the server LLM. Callers still gate on the model being ready.
+  bool get preferLocalModel => _store.preferLocalModel;
+  Future<void> setPreferLocalModel(bool value) async {
+    await _store.setPreferLocalModel(value);
+    notifyListeners();
+  }
+
   void updateBaseUrl(String url) {
     _api.setBaseUrl(url);
     notifyListeners();
@@ -41,9 +49,9 @@ class CardRepository extends ChangeNotifier {
 
   /// Submit a shared URL. On network failure the URL is queued locally and the
   /// caller is told it is pending (offline share queue, docs/06).
-  Future<CreateCardResult> share(String url) async {
+  Future<CreateCardResult> share(String url, {bool preferLocal = false}) async {
     try {
-      final result = await _api.createCard(url);
+      final result = await _api.createCard(url, preferLocal: preferLocal);
       await flushPendingShares();
       notifyListeners();
       return result;

app/lib/data/services/api_client.dart

@@ -233,13 +233,31 @@ class ApiClient {
     return (_decodeMap(resp)['claimed'] as num?)?.toInt() ?? 0;
   }
 
+  /// Fold a guest (anonymous) account's data into the caller's account. The
+  /// request is authenticated as the destination (Google) uid; [guestToken] is
+  /// the guest's own ID token, captured before switching identities, and proves
+  /// ownership of the source. Returns the number of rows moved.
+  Future<int> mergeGuestLibrary(String guestToken) async {
+    final resp = await _send(
+      (h) => _client.post(_uri('/auth/merge'),
+          headers: h, body: jsonEncode({'guest_token': guestToken})),
+      extra: const {'content-type': 'application/json'},
+    );
+    return (_decodeMap(resp)['merged'] as num?)?.toInt() ?? 0;
+  }
+
   // ------------------------------------------------------------------------- //
   // Cards
   // ------------------------------------------------------------------------- //
 
-  Future<CreateCardResult> createCard(String url) async {
+  Future<CreateCardResult> createCard(String url, {bool preferLocal = false}) async {
     final resp = await _send(
-      (h) => _client.post(_uri('/cards'), headers: h, body: jsonEncode({'url': url})),
+      (h) => _client.post(_uri('/cards'),
+          headers: h,
+          body: jsonEncode({
+            'url': url,
+            if (preferLocal) 'prefer_local': true,
+          })),
       extra: const {'content-type': 'application/json'},
     );
     final json = _decodeMap(resp);

app/lib/data/services/auth_service.dart

@@ -24,7 +24,16 @@ abstract class AuthService {
   Stream<AuthUser?> get userChanges;
   AuthUser? get currentUser;
   Future<AuthUser> signInAnonymously();
-  Future<AuthUser> signInWithGoogle();
+
+  /// Sign in with Google. When the current session is an anonymous guest, the
+  /// uid is linked (data stays put). If that Google account already has its own
+  /// Cachy identity, linking is impossible, so we switch to it and — if
+  /// [mergeGuestData] is provided — hand back the guest's ID token so the
+  /// caller can fold the guest's server-side data into the account.
+  Future<AuthUser> signInWithGoogle({
+    Future<void> Function(String guestIdToken)? mergeGuestData,
+  });
+
   Future<String?> idToken({bool forceRefresh = false});
   Future<void> signOut();
 }
@@ -60,7 +69,9 @@ class FirebaseAuthService implements AuthService {
   }
 
   @override
-  Future<AuthUser> signInWithGoogle() async {
+  Future<AuthUser> signInWithGoogle({
+    Future<void> Function(String guestIdToken)? mergeGuestData,
+  }) async {
     final account = await _google.signIn();
     if (account == null) throw fb.FirebaseAuthException(code: 'canceled');
     final gAuth = await account.authentication;
@@ -75,8 +86,17 @@ class FirebaseAuthService implements AuthService {
         cred = await current.linkWithCredential(credential); // uid preserved
       } on fb.FirebaseAuthException catch (e) {
         if (e.code != 'credential-already-in-use') rethrow;
-        // Google account already has a Cachy identity — switch to it.
+        // Google account already has a Cachy identity — linking is impossible.
+        // Grab the guest's token before switching so its data can be merged,
+        // then sign into the existing account.
+        final guestToken = await current.getIdToken();
         cred = await _auth.signInWithCredential(credential);
+        if (guestToken != null && guestToken.isNotEmpty && mergeGuestData != null) {
+          // Best-effort: a failed merge must not block sign-in.
+          try {
+            await mergeGuestData(guestToken);
+          } catch (_) {}
+        }
       }
     } else {
       cred = await _auth.signInWithCredential(credential);

app/lib/data/services/local_ai/local_ai_service.dart

@@ -60,9 +60,20 @@ abstract class LocalAiService extends ChangeNotifier {
   });
 }
 
+/// Char cap on the bundle fed to the on-device model. The Gemma session runs
+/// with maxTokens: 2048 covering prompt + output; at ~4 chars/token the fixed
+/// scaffold plus a full JSON card leaves room for roughly this much input. A fat
+/// bundle (long transcript) would otherwise overflow the window and the model
+/// throws — silently keeping the paragraph card it was meant to upgrade.
+const kLocalAiBundleCharCap = 4000;
+
 /// Prompt tuned for 1B models: short instruction, one few-shot example,
 /// strict JSON-only suffix.
-String buildStructurePrompt(String bundle) => '''
+String buildStructurePrompt(String bundle) {
+  if (bundle.length > kLocalAiBundleCharCap) {
+    bundle = bundle.substring(0, kLocalAiBundleCharCap);
+  }
+  return '''
 You turn a video's raw text into one JSON knowledge card. Reply with JSON only, no prose, no markdown fences.
 
 Schema:
@@ -78,6 +89,7 @@ Input:
 $bundle
 
 Output (JSON only):''';
+}
 
 /// Parse + minimally validate model output into card JSON.
 ///

app/lib/data/services/local_store.dart

@@ -21,6 +21,7 @@ class LocalStore {
   static const _apiBaseUrlKey = 'api_base_url';
   static const _splitPaneFractionKey = 'split_pane_fraction';
   static const _localAiEnabledKey = 'local_ai_enabled';
+  static const _preferLocalModelKey = 'prefer_local_model';
 
   static Future<LocalStore> open() async =>
       LocalStore(await SharedPreferences.getInstance());
@@ -47,8 +48,16 @@ class LocalStore {
   bool get localAiEnabled => _prefs.getBool(_localAiEnabledKey) ?? false;
   Future<void> setLocalAiEnabled(bool v) => _prefs.setBool(_localAiEnabledKey, v);
 
+  /// Developer toggle: route new cards through the on-device model instead of
+  /// the server LLM (backend skips structuring, phone structures the bundle).
+  bool get preferLocalModel => _prefs.getBool(_preferLocalModelKey) ?? false;
+  Future<void> setPreferLocalModel(bool v) =>
+      _prefs.setBool(_preferLocalModelKey, v);
+
   /// Clears user identity and onboarding state, effectively signing the user
-  /// out and forcing them back through the name-entry gate on next launch.
+  /// out and forcing them back through onboarding + the login gate on next
+  /// launch. The legacy name key is cleared too (it only lingers for users
+  /// upgrading from the old name-based build).
   Future<void> clearUser() async {
     await _prefs.remove(_userNameKey);
     await _prefs.remove(_seenOnboardingKey);

app/lib/ui/core/app_controller.dart

@@ -31,11 +31,15 @@ class AppController extends ChangeNotifier {
   /// signed out. Drives the login gate and the profile account section.
   AuthUser? get authUser => _authUser;
 
-  /// True once the user has cleared onboarding + name but has no Firebase
-  /// identity yet — the one moment [RootGate] shows the login screen.
-  bool get needsLogin => seenOnboarding && hasUserName && _authUser == null;
-
-  Future<void> signInWithGoogle() => _auth.signInWithGoogle();
+  /// True once the user has cleared onboarding but has no Firebase identity
+  /// yet — the one moment [RootGate] shows the login screen. Identity is now
+  /// the Firebase uid (Google or anonymous); no name is collected up front.
+  bool get needsLogin => seenOnboarding && _authUser == null;
+
+  Future<void> signInWithGoogle({
+    Future<void> Function(String guestIdToken)? mergeGuestData,
+  }) =>
+      _auth.signInWithGoogle(mergeGuestData: mergeGuestData);
   Future<void> continueAnonymously() => _auth.signInAnonymously();
 
   ThemeMode _themeMode;

app/lib/ui/core/root_gate.dart

@@ -9,13 +9,12 @@ import 'package:provider/provider.dart';
 import '../../data/repositories/card_repository.dart';
 import '../../data/services/auth_service.dart';
 import '../features/onboarding/views/login_screen.dart';
-import '../features/onboarding/views/name_screen.dart';
 import '../features/onboarding/views/onboarding_screen.dart';
 import '../features/onboarding/views/splash_screen.dart';
 import 'app_controller.dart';
 import 'home_shell.dart';
 
-enum _Phase { splash, onboarding, nameEntry, login, shell }
+enum _Phase { splash, onboarding, login, shell }
 
 class RootGate extends StatefulWidget {
   const RootGate({super.key});
@@ -29,7 +28,6 @@ class _RootGateState extends State<RootGate> {
 
   _Phase _afterSplash(AppController app) {
     if (!app.seenOnboarding) return _Phase.onboarding;
-    if (!app.hasUserName) return _Phase.nameEntry;
     if (app.needsLogin) return _Phase.login;
     return _Phase.shell;
   }
@@ -48,14 +46,6 @@ class _RootGateState extends State<RootGate> {
 
   Future<void> _finishOnboarding() async {
     await context.read<AppController>().completeOnboarding();
-    if (!mounted) return;
-    final app = context.read<AppController>();
-    setState(() => _phase = app.hasUserName
-        ? (app.needsLogin ? _Phase.login : _Phase.shell)
-        : _Phase.nameEntry);
-  }
-
-  void _finishNameEntry() {
     if (!mounted) return;
     final app = context.read<AppController>();
     setState(() => _phase = app.needsLogin ? _Phase.login : _Phase.shell);
@@ -90,8 +80,6 @@ class _RootGateState extends State<RootGate> {
           SplashScreen(key: const ValueKey('splash'), onDone: _finishSplash),
         _Phase.onboarding =>
           OnboardingScreen(key: const ValueKey('onboarding'), onDone: _finishOnboarding),
-        _Phase.nameEntry =>
-          NameScreen(key: const ValueKey('nameEntry'), onDone: _finishNameEntry),
         _Phase.login =>
           LoginScreen(key: const ValueKey('login'), onDone: _finishLogin),
         _Phase.shell => const HomeShell(key: ValueKey('shell')),

app/lib/ui/features/onboarding/views/login_screen.dart

@@ -1,11 +1,13 @@
-/// Login gate, shown after onboarding + name. Google is primary; anonymous is
-/// a quiet escape hatch with an honest data-loss caveat.
+/// Login gate, shown right after onboarding. Google is primary; "use without
+/// login" runs anonymous auth and can be upgraded to Google later (the uid is
+/// preserved via account linking, so guest data carries over).
 library;
 
 import 'package:flutter/material.dart';
 import 'package:phosphor_flutter/phosphor_flutter.dart';
 import 'package:provider/provider.dart';
 
+import '../../../../data/repositories/card_repository.dart';
 import '../../../../data/services/auth_service.dart';
 import '../../../core/brand.dart';
 import '../../../core/widgets/responsive_center.dart';
@@ -85,7 +87,10 @@ class _LoginScreenState extends State<LoginScreen> {
                     onPressed: _busy
                         ? null
                         : () => _run(() async {
-                              await auth.signInWithGoogle();
+                              final api = context.read<CardRepository>().api;
+                              await auth.signInWithGoogle(
+                                mergeGuestData: api.mergeGuestLibrary,
+                              );
                             }),
                     icon: const PhosphorIcon(PhosphorIconsRegular.googleLogo,
                         size: 20),

app/lib/ui/features/onboarding/views/name_screen.dart

@@ -1,192 +0,0 @@
-/// Name entry gate — shown once on first launch so the backend can isolate
-/// each user's cards. The entered name becomes the X-Owner-Id header on every
-/// API request (stored in LocalStore, read by ApiClient).
-library;
-
-import 'package:flutter/material.dart';
-import 'package:phosphor_flutter/phosphor_flutter.dart';
-import 'package:provider/provider.dart';
-
-import '../../../core/app_controller.dart';
-import '../../../core/brand.dart';
-import '../../../core/widgets/responsive_center.dart';
-
-class NameScreen extends StatefulWidget {
-  const NameScreen({super.key, required this.onDone});
-  final VoidCallback onDone;
-
-  @override
-  State<NameScreen> createState() => _NameScreenState();
-}
-
-class _NameScreenState extends State<NameScreen> {
-  final _controller = TextEditingController();
-  bool _submitting = false;
-
-  @override
-  void dispose() {
-    _controller.dispose();
-    super.dispose();
-  }
-
-  Future<void> _submit() async {
-    final name = _controller.text.trim();
-    if (name.isEmpty) return;
-    setState(() => _submitting = true);
-    await context.read<AppController>().setUserName(name);
-    if (mounted) widget.onDone();
-  }
-
-  @override
-  Widget build(BuildContext context) {
-    final theme = Theme.of(context);
-    final scheme = theme.colorScheme;
-
-    return Scaffold(
-      backgroundColor: scheme.surface,
-      body: Container(
-        decoration: BoxDecoration(
-          gradient: RadialGradient(
-            center: const Alignment(0, -0.45),
-            radius: 1.3,
-            colors: [
-              scheme.primary.withValues(alpha: 0.12),
-              Colors.transparent,
-            ],
-          ),
-        ),
-        child: SafeArea(
-          child: ResponsiveCenter(
-            child: Padding(
-              padding: const EdgeInsets.symmetric(horizontal: 28),
-              child: Column(
-                crossAxisAlignment: CrossAxisAlignment.start,
-                children: [
-                  const SizedBox(height: 48),
-                  Container(
-                    width: 56,
-                    height: 56,
-                    decoration: BoxDecoration(
-                      color: scheme.primary,
-                      borderRadius: BorderRadius.circular(16),
-                      boxShadow: [
-                        BoxShadow(
-                          color: scheme.primary.withValues(alpha: 0.4),
-                          blurRadius: 16,
-                          offset: const Offset(0, 4),
-                        ),
-                      ],
-                    ),
-                    child: PhosphorIcon(
-                      PhosphorIconsRegular.user,
-                      color: scheme.onPrimary,
-                      size: 28,
-                    ),
-                  ),
-                  const SizedBox(height: 32),
-                  RichText(
-                    text: TextSpan(
-                      style: theme.textTheme.displaySmall
-                          ?.copyWith(color: scheme.onSurface),
-                      children: [
-                        const TextSpan(text: "What's\nyour "),
-                        TextSpan(
-                          text: 'name?',
-                          style: TextStyle(color: scheme.primary),
-                        ),
-                      ],
-                    ),
-                  ),
-                  const SizedBox(height: 16),
-                  Text(
-                    'Your library stays private. Only you see your cards.',
-                    style: theme.textTheme.bodyLarge?.copyWith(
-                      color: scheme.onSurfaceVariant,
-                      height: 1.5,
-                    ),
-                  ),
-                  const SizedBox(height: 40),
-                  TextField(
-                    controller: _controller,
-                    autofocus: true,
-                    textCapitalization: TextCapitalization.words,
-                    textInputAction: TextInputAction.done,
-                    onSubmitted: (_) => _submit(),
-                    style: theme.textTheme.titleLarge?.copyWith(
-                      fontWeight: FontWeight.w600,
-                    ),
-                    decoration: InputDecoration(
-                      hintText: 'Your name',
-                      filled: true,
-                      fillColor: scheme.surfaceContainerLow,
-                      border: OutlineInputBorder(
-                        borderRadius: BorderRadius.circular(16),
-                        borderSide: BorderSide(color: scheme.outlineVariant),
-                      ),
-                      enabledBorder: OutlineInputBorder(
-                        borderRadius: BorderRadius.circular(16),
-                        borderSide: BorderSide(color: scheme.outlineVariant),
-                      ),
-                      focusedBorder: OutlineInputBorder(
-                        borderRadius: BorderRadius.circular(16),
-                        borderSide: BorderSide(color: scheme.primary, width: 2),
-                      ),
-                      contentPadding: const EdgeInsets.symmetric(
-                        horizontal: 20,
-                        vertical: 18,
-                      ),
-                    ),
-                  ),
-                  const Spacer(),
-                  ListenableBuilder(
-                    listenable: _controller,
-                    builder: (context, _) {
-                      final ready = _controller.text.trim().isNotEmpty;
-                      return FilledButton(
-                        onPressed: (ready && !_submitting) ? _submit : null,
-                        style: FilledButton.styleFrom(
-                          minimumSize: const Size.fromHeight(56),
-                          shape: RoundedRectangleBorder(
-                            borderRadius: BorderRadius.circular(16),
-                          ),
-                        ),
-                        child: _submitting
-                            ? const SizedBox(
-                                width: 22,
-                                height: 22,
-                                child: CircularProgressIndicator(
-                                  strokeWidth: 2.5,
-                                ),
-                              )
-                            : Row(
-                                mainAxisAlignment: MainAxisAlignment.center,
-                                children: [
-                                  Text(
-                                    'Enter Cachy',
-                                    style: Brand.label(
-                                      size: 16,
-                                      color: scheme.onPrimary,
-                                      weight: FontWeight.w700,
-                                    ),
-                                  ),
-                                  const SizedBox(width: 8),
-                                  PhosphorIcon(
-                                    PhosphorIconsRegular.arrowRight,
-                                    size: 18,
-                                    color: scheme.onPrimary,
-                                  ),
-                                ],
-                              ),
-                      );
-                    },
-                  ),
-                  const SizedBox(height: 32),
-                ],
-              ),
-            ),
-          ),
-        ),
-      ),
-    );
-  }
-}

app/lib/ui/features/profile/views/profile_screen.dart

@@ -326,14 +326,12 @@ class _ProfileScreenState extends State<ProfileScreen> {
           _accountRow(theme, user)
         else
           _backupBanner(theme),
-        if (signedIn &&
-            (context.read<AppController>().userName ?? '').isNotEmpty)
+        if (signedIn)
           _Tile(
             icon: PhosphorIconsRegular.clockCounterClockwise,
             title: 'Restore old library',
-            subtitle: 'Bring in cards saved under your name before sign-in.',
-            onTap: () =>
-                _offerClaim(context.read<AppController>().userName!),
+            subtitle: 'Used Cachy before with a name? Bring those cards in.',
+            onTap: _promptRestoreByName,
           ),
         _Tile(
           icon: PhosphorIconsRegular.signOut,
@@ -434,9 +432,10 @@ class _ProfileScreenState extends State<ProfileScreen> {
   Future<void> _signInAndMaybeClaim() async {
     setState(() => _signingIn = true);
     final app = context.read<AppController>();
+    final api = context.read<CardRepository>().api;
     final messenger = ScaffoldMessenger.of(context);
     try {
-      await app.signInWithGoogle();
+      await app.signInWithGoogle(mergeGuestData: api.mergeGuestLibrary);
     } catch (_) {
       messenger.showSnackBar(
           const SnackBar(content: Text("Couldn't sign in. Try again.")));
@@ -466,6 +465,54 @@ class _ProfileScreenState extends State<ProfileScreen> {
       ),
     );
     if (restore != true || !mounted) return;
+    await _runClaim(name);
+  }
+
+  /// Legacy rescue for the old name-keyed build: the user types the name they
+  /// saved under and those rows re-point onto this account. First claim wins.
+  Future<void> _promptRestoreByName() async {
+    final controller = TextEditingController();
+    final name = await showDialog<String>(
+      context: context,
+      builder: (ctx) => AlertDialog(
+        title: const Text('Restore old library'),
+        content: Column(
+          mainAxisSize: MainAxisSize.min,
+          crossAxisAlignment: CrossAxisAlignment.start,
+          children: [
+            const Text(
+                'Enter the name you used in the old version of Cachy. The cards '
+                'saved under it will move into this account.'),
+            const SizedBox(height: 16),
+            TextField(
+              controller: controller,
+              autofocus: true,
+              textCapitalization: TextCapitalization.words,
+              textInputAction: TextInputAction.done,
+              decoration: const InputDecoration(
+                hintText: 'Your old name',
+                border: OutlineInputBorder(),
+              ),
+              onSubmitted: (v) => Navigator.pop(ctx, v.trim()),
+            ),
+          ],
+        ),
+        actions: [
+          TextButton(
+              onPressed: () => Navigator.pop(ctx),
+              child: const Text('Cancel')),
+          FilledButton(
+              onPressed: () => Navigator.pop(ctx, controller.text.trim()),
+              child: const Text('Restore')),
+        ],
+      ),
+    );
+    controller.dispose();
+    if (name == null || name.isEmpty || !mounted) return;
+    await _runClaim(name);
+  }
+
+  Future<void> _runClaim(String name) async {
     final api = context.read<CardRepository>().api;
     final messenger = ScaffoldMessenger.of(context);
     try {
@@ -755,6 +802,10 @@ class _DeveloperScreenState extends State<_DeveloperScreen> {
             subtitle: 'Clear the override and reconnect to the hosted Space.',
             onTap: () => _setUrl(repo, ApiClient.defaultBaseUrl),
           ),
+          const SizedBox(height: 20),
+          Text('AI model', style: theme.textTheme.titleSmall),
+          const SizedBox(height: 8),
+          _localModelToggle(theme, repo),
           const SizedBox(height: 12),
           Text(
             'Changes take effect immediately and persist across launches.',
@@ -766,6 +817,56 @@ class _DeveloperScreenState extends State<_DeveloperScreen> {
     );
   }
 
+  Widget _localModelToggle(ThemeData theme, CardRepository repo) {
+    final scheme = theme.colorScheme;
+    LocalAiService? ai;
+    try {
+      ai = context.watch<LocalAiService>();
+    } catch (_) {
+      ai = null;
+    }
+    final ready = ai?.canStructure ?? false;
+    final on = repo.preferLocalModel;
+    return Material(
+      color: scheme.surfaceContainerLow,
+      borderRadius: BorderRadius.circular(14),
+      child: Column(
+        children: [
+          SwitchListTile(
+            shape:
+                RoundedRectangleBorder(borderRadius: BorderRadius.circular(14)),
+            secondary: const PhosphorIcon(PhosphorIconsRegular.cpu),
+            title: const Text('Use on-device model'),
+            subtitle: const Text(
+                'Structure new cards with the local model instead of the '
+                'server LLM.'),
+            value: on,
+            onChanged: (v) => repo.setPreferLocalModel(v),
+          ),
+          if (on && !ready)
+            Padding(
+              padding: const EdgeInsets.fromLTRB(16, 0, 16, 12),
+              child: Row(
+                children: [
+                  PhosphorIcon(PhosphorIconsRegular.warning,
+                      size: 16, color: scheme.error),
+                  const SizedBox(width: 8),
+                  Expanded(
+                    child: Text(
+                      'On-device model not ready — download and enable it in '
+                      'Settings first. New cards use the server until then.',
+                      style: theme.textTheme.bodySmall
+                          ?.copyWith(color: scheme.error),
+                    ),
+                  ),
+                ],
+              ),
+            ),
+        ],
+      ),
+    );
+  }
+
   void _setUrl(CardRepository repo, String url) {
     repo.updateBaseUrl(url);
     if (!mounted) return;

app/lib/ui/features/share/view_models/share_view_model.dart

@@ -65,7 +65,12 @@ class ShareViewModel extends ChangeNotifier {
     notifyListeners();
 
     try {
-      final result = await _repository.share(cleaned);
+      // Dev toggle: route through the on-device model, but only when it can
+      // actually structure — otherwise fall back to the server LLM so we never
+      // strand a card as a paragraph with no upgrade path.
+      final preferLocal =
+          _repository.preferLocalModel && (_localAi?.canStructure ?? false);
+      final result = await _repository.share(cleaned, preferLocal: preferLocal);
       _cardId = result.cardId;
       _quotaDegraded = result.quotaDegraded;
       if (result.cached) {

app/test/fakes.dart

@@ -21,7 +21,9 @@ class FakeAuthService implements AuthService {
   }
 
   @override
-  Future<AuthUser> signInWithGoogle() async {
+  Future<AuthUser> signInWithGoogle({
+    Future<void> Function(String guestIdToken)? mergeGuestData,
+  }) async {
     // Linking keeps the uid when the current user is anonymous.
     final uid = _user?.isAnonymous == true ? _user!.uid : 'google-1';
     _user = AuthUser(uid: uid, isAnonymous: false, email: 'a@b.c', displayName: 'A');

backend/app/api/auth_routes.py

@@ -5,7 +5,7 @@ from __future__ import annotations
 from fastapi import APIRouter, HTTPException
 from pydantic import BaseModel
 
-from app.auth import OwnerDep
+from app.auth import OwnerDep, _verify
 from app.store import db
 
 router = APIRouter(prefix="/auth", tags=["auth"])
@@ -15,6 +15,10 @@ class ClaimRequest(BaseModel):
     name: str
 
 
+class MergeRequest(BaseModel):
+    guest_token: str
+
+
 @router.post("/claim")
 async def claim(req: ClaimRequest, owner_id: OwnerDep) -> dict:
     """Adopt legacy rows keyed by the pre-auth display name. First claim wins."""
@@ -26,3 +30,26 @@ async def claim(req: ClaimRequest, owner_id: OwnerDep) -> dict:
     if claimed is None:
         raise HTTPException(status_code=409, detail="name already claimed")
     return {"claimed": claimed}
+
+
+@router.post("/merge")
+async def merge(req: MergeRequest, owner_id: OwnerDep) -> dict:
+    """Fold a guest (anonymous) account's data into the caller's account.
+
+    The caller's Bearer token is the destination. `guest_token` is the guest's
+    own ID token, captured client-side just before it signed into an existing
+    Google identity — it proves ownership of the source account. Source must be
+    anonymous so this can't be used to siphon a real account's data."""
+    token = req.guest_token.strip()
+    if not token:
+        raise HTTPException(status_code=422, detail="guest_token required")
+    try:
+        decoded = _verify(token)
+    except Exception:
+        raise HTTPException(status_code=401, detail="invalid guest token")
+    if decoded.get("firebase", {}).get("sign_in_provider") != "anonymous":
+        raise HTTPException(status_code=403, detail="source must be a guest account")
+    from_uid = str(decoded["uid"])
+    async with db.session() as s:
+        moved = await db.merge_owner(s, from_uid=from_uid, to_uid=owner_id)
+    return {"merged": moved}

backend/app/api/cards.py

@@ -33,6 +33,10 @@ router = APIRouter(prefix="/cards", tags=["cards"])
 
 class CreateCardRequest(BaseModel):
     url: str
+    # Dev/testing: skip server-side LLM structuring and hand the raw bundle to
+    # the owner's device so the on-device model structures the card instead.
+    # Reuses the quota-degrade path (paragraph fallback + stored bundle).
+    prefer_local: bool = False
 
 
 class CreateCardResponse(BaseModel):
@@ -129,6 +133,9 @@ async def create_card(
             )
 
         within = await quota.card_budget(owner_id, request)
+        # Degrade (skip server LLM, keep the bundle for on-device structuring)
+        # when past quota OR when the client explicitly prefers the local model.
+        degraded = (not within) or req.prefer_local
         card = db.CardRow(
             source_url=url,
             platform=_platform_for(url),
@@ -138,11 +145,11 @@ async def create_card(
         )
         session.add(card)
         await session.flush()  # assign card.id
-        job = db.JobRow(card_id=card.id, state=JobState.QUEUED.value, degraded=not within)
+        job = db.JobRow(card_id=card.id, state=JobState.QUEUED.value, degraded=degraded)
         session.add(job)
         await session.commit()
         return CreateCardResponse(
-            card_id=card.id, state=CardState.QUEUED, quota_degraded=not within
+            card_id=card.id, state=CardState.QUEUED, quota_degraded=degraded
         )
 
 
@@ -226,9 +233,9 @@ async def import_cards(
 
 
 @router.get("/{card_id}", response_model=Card)
-async def get_card(card_id: str) -> Card:
+async def get_card(card_id: str, owner_id: OwnerDep) -> Card:
     async with db.session() as session:
-        row = await db.get_card_row(session, card_id)
+        row = await db.get_card_row(session, card_id, owner_id=owner_id)
         if row is None:
             raise HTTPException(status_code=404, detail="card not found")
         return row.to_card()
@@ -258,9 +265,11 @@ async def list_cards(
 
 
 @router.patch("/{card_id}", response_model=Card)
-async def patch_card(card_id: str, req: PatchCardRequest) -> Card:
+async def patch_card(
+    card_id: str, req: PatchCardRequest, owner_id: OwnerDep
+) -> Card:
     async with db.session() as session:
-        row = await db.get_card_row(session, card_id)
+        row = await db.get_card_row(session, card_id, owner_id=owner_id)
         if row is None:
             raise HTTPException(status_code=404, detail="card not found")
         if req.blocks is not None:
@@ -268,6 +277,9 @@ async def patch_card(card_id: str, req: PatchCardRequest) -> Card:
         if req.action_items is not None:
             row.action_items = req.action_items  # follow toggle + per-item done state
         if req.collection_id is not None:
+            dest = await db.get_collection_row(session, req.collection_id)
+            if dest is None or dest.owner_id != owner_id:
+                raise HTTPException(status_code=404, detail="collection not found")
             row.collection_id = req.collection_id
         await session.commit()
         await session.refresh(row)
@@ -289,7 +301,7 @@ async def chat_card(
         raise HTTPException(status_code=422, detail="last message must be from user")
 
     async with db.session() as session:
-        row = await db.get_card_row(session, card_id)
+        row = await db.get_card_row(session, card_id, owner_id=owner_id)
         if row is None:
             raise HTTPException(status_code=404, detail="card not found")
         if row.state != CardState.READY.value:
@@ -350,7 +362,7 @@ async def explore_rabbithole(
     root = (req.root or topic).strip()
 
     async with db.session() as session:
-        row = await db.get_card_row(session, card_id)
+        row = await db.get_card_row(session, card_id, owner_id=owner_id)
         if row is None:
             raise HTTPException(status_code=404, detail="card not found")
         if row.state != CardState.READY.value:
@@ -492,9 +504,9 @@ async def upload_structure(card_id: str, payload: dict, owner_id: OwnerDep) -> C
 
 
 @router.delete("/{card_id}")
-async def delete_card(card_id: str) -> dict:
+async def delete_card(card_id: str, owner_id: OwnerDep) -> dict:
     async with db.session() as session:
-        row = await db.get_card_row(session, card_id)
+        row = await db.get_card_row(session, card_id, owner_id=owner_id)
         if row is None:
             raise HTTPException(status_code=404, detail="card not found")
         thumb = row.thumbnail

backend/app/api/catalog.py

@@ -36,48 +36,64 @@ async def list_catalog(
         stmt = select(db.ArtifactRow).order_by(db.ArtifactRow.created_at.desc())
         if type is not None:
             stmt = stmt.where(db.ArtifactRow.type == type.value)
-        if card_id is None:
-            stmt = stmt.where(db.ArtifactRow.saved.is_(True))
         rows = (await session.execute(stmt)).scalars().all()
-        entries = [r.to_entry() for r in rows]
         owner_cards = set(
             (await session.execute(
                 select(db.CardRow.id).where(db.CardRow.owner_id == owner_id)
             )).scalars().all()
         )
-        entries = [e for e in entries if bool(set(e.source_card_ids) & owner_cards)]
-    if card_id is not None:
-        entries = [e for e in entries if card_id in e.source_card_ids]
+        saved_ids = await db.owner_saved_artifact_ids(session, owner_id)
+        entries: list[CatalogEntry] = []
+        for r in rows:
+            source = set(r.source_card_ids or [])
+            if not (source & owner_cards):
+                continue  # not the caller's artifact
+            if card_id is None and r.id not in saved_ids:
+                continue  # catalog tab shows only what this owner saved
+            if card_id is not None and card_id not in source:
+                continue  # reference view for a specific card
+            entry = r.to_entry()
+            entry.saved = r.id in saved_ids
+            entries.append(entry)
     return entries[offset : offset + limit]
 
 
 @router.get("/{artifact_id}", response_model=CatalogDetail)
-async def get_catalog_entry(artifact_id: str) -> CatalogDetail:
+async def get_catalog_entry(artifact_id: str, owner_id: OwnerDep) -> CatalogDetail:
     async with db.session() as session:
         row = await session.get(db.ArtifactRow, artifact_id)
-        if row is None or not row.saved:
+        # Membership implies ownership (it's only created after an ownership check),
+        # and the detail view is for catalog items — so gate on the saved membership.
+        if row is None or not await db.is_artifact_saved_by(
+            session, artifact_id, owner_id
+        ):
             raise HTTPException(status_code=404, detail="artifact not found")
         entry = row.to_entry()
+        entry.saved = True
         return CatalogDetail(entry=entry, source_card_ids=entry.source_card_ids)
 
 
 @router.post("/{artifact_id}/save", response_model=CatalogEntry)
-async def save_catalog_entry(artifact_id: str) -> CatalogEntry:
+async def save_catalog_entry(artifact_id: str, owner_id: OwnerDep) -> CatalogEntry:
     """Add a referenced artifact to the catalog tab (long-press to save)."""
     async with db.session() as session:
-        row = await db.set_artifact_saved(session, artifact_id, True)
+        row = await db.set_artifact_saved(session, artifact_id, True, owner_id=owner_id)
         if row is None:
             raise HTTPException(status_code=404, detail="artifact not found")
         invalidate_graph_cache()
-        return row.to_entry()
+        entry = row.to_entry()
+        entry.saved = True
+        return entry
 
 
 @router.post("/{artifact_id}/fetch-info", response_model=CatalogEntry)
-async def fetch_catalog_info(artifact_id: str) -> CatalogEntry:
+async def fetch_catalog_info(artifact_id: str, owner_id: OwnerDep) -> CatalogEntry:
     """Generate + persist an LLM detail for the artifact (Fetch info button)."""
     async with db.session() as session:
         row = await session.get(db.ArtifactRow, artifact_id)
-        if row is None:
+        if row is None or not await db.owner_owns_any_card(
+            session, owner_id, row.source_card_ids or []
+        ):
             raise HTTPException(status_code=404, detail="artifact not found")
         type_ = ArtifactType(row.type) if row.type else ArtifactType.OTHER
         desc = await llm_catalog.describe_async(
@@ -87,16 +103,20 @@ async def fetch_catalog_info(artifact_id: str) -> CatalogEntry:
             raise HTTPException(
                 status_code=502, detail="could not generate details right now"
             )
-        row = await db.set_artifact_description(session, artifact_id, desc)
-        return row.to_entry()
+        row = await db.set_artifact_description(
+            session, artifact_id, desc, owner_id=owner_id
+        )
+        entry = row.to_entry()
+        entry.saved = await db.is_artifact_saved_by(session, artifact_id, owner_id)
+        return entry
 
 
 @router.delete("/{artifact_id}")
-async def delete_catalog_entry(artifact_id: str) -> dict:
+async def delete_catalog_entry(artifact_id: str, owner_id: OwnerDep) -> dict:
     """Remove an item from the catalog. Soft by default: the row stays so it still
     backs per-card references — it just leaves the catalog tab (saved=False)."""
     async with db.session() as session:
-        row = await db.set_artifact_saved(session, artifact_id, False)
+        row = await db.set_artifact_saved(session, artifact_id, False, owner_id=owner_id)
         if row is None:
             raise HTTPException(status_code=404, detail="artifact not found")
         await session.commit()

backend/app/api/collections.py

@@ -69,13 +69,13 @@ async def create_collection(
 
 @router.patch("/{collection_id}", response_model=CollectionOut)
 async def rename_collection(
-    collection_id: str, req: RenameCollectionRequest
+    collection_id: str, req: RenameCollectionRequest, owner_id: OwnerDep
 ) -> CollectionOut:
     name = req.name.strip()
     if not name:
         raise HTTPException(status_code=422, detail="name is required")
     async with db.session() as session:
-        row = await db.rename_collection(session, collection_id, name)
+        row = await db.rename_collection(session, collection_id, name, owner_id=owner_id)
         if row is None:
             raise HTTPException(status_code=404, detail="collection not found")
         pairs = await db.list_collections(session, owner_id=row.owner_id)
@@ -84,9 +84,9 @@ async def rename_collection(
 
 
 @router.delete("/{collection_id}", response_class=Response, status_code=204)
-async def delete_collection(collection_id: str) -> Response:
+async def delete_collection(collection_id: str, owner_id: OwnerDep) -> Response:
     async with db.session() as session:
-        ok = await db.delete_collection(session, collection_id)
+        ok = await db.delete_collection(session, collection_id, owner_id=owner_id)
         if not ok:
             raise HTTPException(
                 status_code=404,
@@ -96,9 +96,13 @@ async def delete_collection(collection_id: str) -> Response:
 
 
 @router.post("/cards/{card_id}/move", response_model=dict)
-async def move_card(card_id: str, req: MoveCardRequest) -> dict:
+async def move_card(
+    card_id: str, req: MoveCardRequest, owner_id: OwnerDep
+) -> dict:
     async with db.session() as session:
-        row = await db.move_card_to_collection(session, card_id, req.collection_id)
+        row = await db.move_card_to_collection(
+            session, card_id, req.collection_id, owner_id=owner_id
+        )
         if row is None:
             raise HTTPException(status_code=404, detail="card not found")
         return {"card_id": card_id, "collection_id": row.collection_id}

backend/app/api/concepts.py

@@ -77,11 +77,13 @@ async def get_concept(
 
 
 @router.post("/{concept_id}/define", response_model=ConceptEntry)
-async def define_concept(concept_id: str) -> ConceptEntry:
+async def define_concept(concept_id: str, owner_id: OwnerDep) -> ConceptEntry:
     """Generate + persist an LLM definition for a concept."""
     async with db.session() as session:
         row = await session.get(db.ConceptRow, concept_id)
-        if row is None:
+        if row is None or not await db.owner_owns_any_card(
+            session, owner_id, row.source_card_ids or []
+        ):
             raise HTTPException(status_code=404, detail="concept not found")
         definition = await llm_concept.define_async(row.name)
         if not definition:
@@ -94,12 +96,10 @@ async def define_concept(concept_id: str) -> ConceptEntry:
 
 
 @router.delete("/{concept_id}")
-async def delete_concept(concept_id: str) -> dict:
+async def delete_concept(concept_id: str, owner_id: OwnerDep) -> dict:
     async with db.session() as session:
-        row = await session.get(db.ConceptRow, concept_id)
-        if row is None:
+        ok = await db.remove_owner_from_concept(session, concept_id, owner_id)
+        if not ok:
             raise HTTPException(status_code=404, detail="concept not found")
-        await session.delete(row)
-        await session.commit()
     invalidate_graph_cache()
     return {"removed": concept_id}

backend/app/api/graph.py

@@ -128,9 +128,9 @@ async def _data_fingerprint(owner_id: str | None) -> str:
         card_agg = (await session.execute(card_stmt)).one()
         art_agg = (
             await session.execute(
-                select(func.count(), func.max(db.ArtifactRow.updated_at)).where(
-                    db.ArtifactRow.saved.is_(True)
-                )
+                select(
+                    func.count(), func.max(db.ArtifactSaveRow.created_at)
+                ).where(db.ArtifactSaveRow.owner_id == owner_id)
             )
         ).one()
         col_count = (
@@ -324,15 +324,13 @@ async def get_graph(
 
         user_card_ids = {r.id for r in card_rows}
 
-        all_artifact_rows = (
-            await session.execute(
-                select(db.ArtifactRow).where(db.ArtifactRow.saved.is_(True))
-            )
-        ).scalars().all()
-        artifact_rows = [
-            a for a in all_artifact_rows
-            if bool(set(a.source_card_ids or []) & user_card_ids)
-        ]
+        saved_ids = await db.owner_saved_artifact_ids(session, owner_id)
+        artifact_rows = (
+            (await session.execute(
+                select(db.ArtifactRow).where(db.ArtifactRow.id.in_(saved_ids))
+            )).scalars().all()
+            if saved_ids else []
+        )
 
         all_concept_rows = (await session.execute(select(db.ConceptRow))).scalars().all()
         concept_rows = [

backend/app/api/library_chat.py

@@ -56,7 +56,7 @@ async def library_chat(
         raise HTTPException(status_code=422, detail="last message must be from user")
 
     history = [m.model_dump() for m in req.messages]
-    result = await llm_library_chat.answer(history)
+    result = await llm_library_chat.answer(history, owner_id)
     if result is None:
         raise HTTPException(
             status_code=503, detail="chat is unavailable (no LLM backend configured)"

backend/app/services/llm_library_chat.py

@@ -42,23 +42,26 @@ Use it sparingly. No other markdown (no headers, no links).
 --- END CARDS ---"""
 
 
-async def retrieve(question: str, limit: int = _TOP_K) -> list[Card]:
-    """Top cards for a question: semantic when embeddings are on, else full-text."""
+async def retrieve(question: str, owner_id: str, limit: int = _TOP_K) -> list[Card]:
+    """Top cards for a question, scoped to this owner: semantic when embeddings
+    are on, else full-text."""
     if embeddings.embeddings_enabled():
-        semantic = await _retrieve_semantic(question, limit)
+        semantic = await _retrieve_semantic(question, owner_id, limit)
         if semantic:
             return semantic
-    return await _retrieve_text(question, limit)
+    return await _retrieve_text(question, owner_id, limit)
 
 
-async def _retrieve_semantic(question: str, limit: int) -> list[Card]:
+async def _retrieve_semantic(question: str, owner_id: str, limit: int) -> list[Card]:
     query_vec = embeddings.embed(question)
     if not query_vec:
         return []
     async with db.session() as session:
         rows = (
             await session.execute(
-                select(db.CardRow).where(db.CardRow.state == CardState.READY.value)
+                select(db.CardRow)
+                .where(db.CardRow.state == CardState.READY.value)
+                .where(db.CardRow.owner_id == owner_id)
             )
         ).scalars().all()
     scored = [
@@ -71,13 +74,14 @@ async def _retrieve_semantic(question: str, limit: int) -> list[Card]:
     return [r.to_card() for _, r in scored[:limit]]
 
 
-async def _retrieve_text(question: str, limit: int) -> list[Card]:
+async def _retrieve_text(question: str, owner_id: str, limit: int) -> list[Card]:
     needle = f"%{question.lower()}%"
     async with db.session() as session:
         rows = (
             await session.execute(
                 select(db.CardRow)
                 .where(db.CardRow.state == CardState.READY.value)
+                .where(db.CardRow.owner_id == owner_id)
                 .where(
                     or_(
                         db.CardRow.one_liner.ilike(needle),
@@ -98,6 +102,7 @@ async def _retrieve_text(question: str, limit: int) -> list[Card]:
             await session.execute(
                 select(db.CardRow)
                 .where(db.CardRow.state == CardState.READY.value)
+                .where(db.CardRow.owner_id == owner_id)
                 .order_by(db.CardRow.created_at.desc())
                 .limit(limit)
             )
@@ -126,10 +131,12 @@ def _latest_question(history: list[dict]) -> str:
     return ""
 
 
-async def answer(history: list[dict]) -> tuple[str, list[Card]] | None:
+async def answer(
+    history: list[dict], owner_id: str
+) -> tuple[str, list[Card]] | None:
     """Return (reply, source_cards) or None if no LLM backend is configured.
-    Retrieval is grounded on the latest user question."""
-    cards = await retrieve(_latest_question(history))
+    Retrieval is grounded on the latest user question, scoped to this owner."""
+    cards = await retrieve(_latest_question(history), owner_id)
     reply = await _generate(_context(cards), history)
     if reply is None:
         return None

backend/app/store/db.py

@@ -16,6 +16,7 @@ from sqlalchemy import (
     Integer,
     String,
     Text,
+    delete,
     func,
     inspect as sa_inspect,
     select,
@@ -191,7 +192,9 @@ class ArtifactRow(Base):
     year: Mapped[int | None] = mapped_column(Integer, nullable=True)
     thumbnail: Mapped[str | None] = mapped_column(Text, nullable=True)
     source_card_ids: Mapped[list] = mapped_column(JSON, default=list)
-    # Only saved rows show in the catalog tab; unsaved rows are card references only.
+    # Deprecated: catalog-tab membership is now per-owner (see [ArtifactSaveRow]).
+    # Kept so old rows/DBs still load; no longer read for filtering. Always False.
+    # ponytail: leave the dead column, drop it in a later real migration.
     saved: Mapped[bool] = mapped_column(Boolean, default=False, index=True)
     # On-demand LLM detail ("what is this"), filled via the Fetch info action.
     description: Mapped[str | None] = mapped_column(Text, nullable=True)
@@ -215,6 +218,18 @@ class ArtifactRow(Base):
         )
 
 
+class ArtifactSaveRow(Base):
+    """Per-owner catalog membership: one row = this owner saved this artifact into
+    their catalog tab. Replaces the shared artifacts.saved flag so one user
+    saving/removing a catalog item never touches another user's catalog."""
+
+    __tablename__ = "artifact_saves"
+
+    owner_id: Mapped[str] = mapped_column(String, primary_key=True)
+    artifact_id: Mapped[str] = mapped_column(String, primary_key=True, index=True)
+    created_at: Mapped[datetime] = mapped_column(DateTime(timezone=True), default=_utcnow)
+
+
 class ConceptRow(Base):
     """A deduplicated concept node: one evergreen idea, many source cards.
     Dedupe key is name_norm (no type axis). Mirrors ArtifactRow."""
@@ -373,6 +388,23 @@ async def claim_owner(db_session: AsyncSession, *, name: str, uid: str) -> int |
     return total
 
 
+async def merge_owner(db_session: AsyncSession, *, from_uid: str, to_uid: str) -> int:
+    """Fold a guest account's rows into another account: re-point everything
+    owned by `from_uid` to `to_uid`. Used when a guest signs into a Google
+    account that already has a Cachy identity, so linking isn't possible and the
+    guest's data would otherwise be orphaned. Returns rows moved."""
+    if from_uid == to_uid:
+        return 0
+    total = 0
+    for model in (CardRow, CollectionRow, ConversationRow, ConnectionRow):
+        res = await db_session.execute(
+            update(model).where(model.owner_id == from_uid).values(owner_id=to_uid)
+        )
+        total += res.rowcount or 0
+    await db_session.commit()
+    return total
+
+
 # --------------------------------------------------------------------------- #
 # Engine / session lifecycle
 # --------------------------------------------------------------------------- #
@@ -509,8 +541,33 @@ def session() -> AsyncSession:
 # Convenience queries used across the app
 # --------------------------------------------------------------------------- #
 
-async def get_card_row(db: AsyncSession, card_id: str) -> CardRow | None:
-    return await db.get(CardRow, card_id)
+async def get_card_row(
+    db: AsyncSession, card_id: str, owner_id: str | None = None
+) -> CardRow | None:
+    """Fetch a card by id. When `owner_id` is given, a card owned by anyone else
+    reads as absent (None) — so callers can 404 without leaking existence."""
+    row = await db.get(CardRow, card_id)
+    if row is None:
+        return None
+    if owner_id is not None and row.owner_id != owner_id:
+        return None
+    return row
+
+
+async def owner_owns_any_card(
+    db: AsyncSession, owner_id: str, card_ids: list[str] | set[str]
+) -> bool:
+    """True when `owner_id` owns at least one of `card_ids`. Used to gate access
+    to shared artifact/concept rows, which are owned only through their source
+    cards (no owner_id column of their own)."""
+    if not card_ids:
+        return False
+    res = await db.execute(
+        select(CardRow.id)
+        .where(CardRow.owner_id == owner_id, CardRow.id.in_(list(card_ids)))
+        .limit(1)
+    )
+    return res.scalar_one_or_none() is not None
 
 
 async def find_card_by_url(
@@ -536,10 +593,12 @@ async def upsert_artifact(
     creator: str | None,
     year: int | None,
     thumbnail: str | None,
-    saved: bool = False,
 ) -> ArtifactRow:
     """Insert a catalog item or merge into the existing one (dedupe by type+title).
-    Appends card_id to source_card_ids and backfills a missing thumbnail."""
+    Appends card_id to source_card_ids and backfills a missing thumbnail.
+
+    Catalog-tab membership is per-owner (see [ArtifactSaveRow]); this only records
+    the shared reference, never who saved it."""
     norm = _norm_title(title)
     res = await db.execute(
         select(ArtifactRow).where(
@@ -556,12 +615,9 @@ async def upsert_artifact(
             year=year,
             thumbnail=thumbnail,
             source_card_ids=[card_id],
-            saved=saved,
         )
         db.add(row)
     else:
-        if saved:
-            row.saved = True
         if card_id not in (row.source_card_ids or []):
             row.source_card_ids = [*(row.source_card_ids or []), card_id]
             flag_modified(row, "source_card_ids")
@@ -576,25 +632,53 @@ async def upsert_artifact(
 
 
 async def set_artifact_saved(
-    db: AsyncSession, artifact_id: str, saved: bool
+    db: AsyncSession, artifact_id: str, saved: bool, owner_id: str
 ) -> ArtifactRow | None:
-    """Toggle whether an artifact appears in the catalog tab. Unsaving keeps the
-    row (it still backs per-card references); it just leaves the catalog."""
+    """Add/remove this owner's catalog membership for an artifact. The caller must
+    own one of the artifact's source cards, else the row reads as absent (None).
+    Unsaving keeps the shared row (it still backs per-card references)."""
     row = await db.get(ArtifactRow, artifact_id)
-    if row is None:
+    if row is None or not await owner_owns_any_card(
+        db, owner_id, row.source_card_ids or []
+    ):
         return None
-    row.saved = saved
+    membership = await db.get(ArtifactSaveRow, (owner_id, artifact_id))
+    if saved and membership is None:
+        db.add(ArtifactSaveRow(owner_id=owner_id, artifact_id=artifact_id))
+    elif not saved and membership is not None:
+        await db.delete(membership)
     await db.commit()
     return row
 
 
+async def owner_saved_artifact_ids(db: AsyncSession, owner_id: str) -> set[str]:
+    """Artifact ids this owner has saved into their catalog tab."""
+    res = await db.execute(
+        select(ArtifactSaveRow.artifact_id).where(
+            ArtifactSaveRow.owner_id == owner_id
+        )
+    )
+    return set(res.scalars().all())
+
+
+async def is_artifact_saved_by(
+    db: AsyncSession, artifact_id: str, owner_id: str
+) -> bool:
+    return await db.get(ArtifactSaveRow, (owner_id, artifact_id)) is not None
+
+
 async def set_artifact_description(
-    db: AsyncSession, artifact_id: str, description: str
+    db: AsyncSession, artifact_id: str, description: str,
+    owner_id: str | None = None,
 ) -> ArtifactRow | None:
     """Persist the on-demand LLM detail for an artifact (Fetch info)."""
     row = await db.get(ArtifactRow, artifact_id)
     if row is None:
         return None
+    if owner_id is not None and not await owner_owns_any_card(
+        db, owner_id, row.source_card_ids or []
+    ):
+        return None
     row.description = description
     await db.commit()
     return row
@@ -631,6 +715,12 @@ async def get_or_create_collection(
     return row
 
 
+async def get_collection_row(
+    db_session: AsyncSession, collection_id: str
+) -> CollectionRow | None:
+    return await db_session.get(CollectionRow, collection_id)
+
+
 async def list_collections(
     db_session: AsyncSession, owner_id: str | None
 ) -> list[tuple[CollectionRow, int]]:
@@ -668,10 +758,11 @@ async def create_custom_collection(
 
 
 async def rename_collection(
-    db_session: AsyncSession, collection_id: str, name: str
+    db_session: AsyncSession, collection_id: str, name: str,
+    owner_id: str | None = None,
 ) -> CollectionRow | None:
     row = await db_session.get(CollectionRow, collection_id)
-    if row is None:
+    if row is None or (owner_id is not None and row.owner_id != owner_id):
         return None
     row.name = name.strip()
     await db_session.commit()
@@ -679,12 +770,15 @@ async def rename_collection(
 
 
 async def delete_collection(
-    db_session: AsyncSession, collection_id: str
+    db_session: AsyncSession, collection_id: str, owner_id: str | None = None
 ) -> bool:
-    """Delete a custom collection; returns False if not found or not custom."""
+    """Delete a custom collection; returns False if not found, not custom, or not
+    owned by `owner_id`."""
     row = await db_session.get(CollectionRow, collection_id)
     if row is None or not row.is_custom:
         return False
+    if owner_id is not None and row.owner_id != owner_id:
+        return False
     # Detach cards from this collection before deleting.
     from sqlalchemy import update as sa_update
     await db_session.execute(
@@ -698,11 +792,16 @@ async def delete_collection(
 
 
 async def move_card_to_collection(
-    db_session: AsyncSession, card_id: str, collection_id: str | None
+    db_session: AsyncSession, card_id: str, collection_id: str | None,
+    owner_id: str | None = None,
 ) -> CardRow | None:
     row = await db_session.get(CardRow, card_id)
-    if row is None:
+    if row is None or (owner_id is not None and row.owner_id != owner_id):
         return None
+    if collection_id is not None and owner_id is not None:
+        dest = await db_session.get(CollectionRow, collection_id)
+        if dest is None or dest.owner_id != owner_id:
+            return None
     row.collection_id = collection_id
     await db_session.commit()
     return row
@@ -778,6 +877,35 @@ async def set_concept_definition(
     return row
 
 
+async def remove_owner_from_concept(
+    db: AsyncSession, concept_id: str, owner_id: str
+) -> bool:
+    """Detach `owner_id`'s cards from a shared concept. If no source cards remain
+    (from anyone), delete the row. Returns False when the concept doesn't exist
+    or the caller owns none of its source cards (so nothing was removed)."""
+    row = await db.get(ConceptRow, concept_id)
+    if row is None:
+        return False
+    current = list(row.source_card_ids or [])
+    if not await owner_owns_any_card(db, owner_id, current):
+        return False
+    mine = set(
+        (await db.execute(
+            select(CardRow.id).where(
+                CardRow.owner_id == owner_id, CardRow.id.in_(current)
+            )
+        )).scalars().all()
+    )
+    remaining = [c for c in current if c not in mine]
+    if remaining:
+        row.source_card_ids = remaining
+        flag_modified(row, "source_card_ids")
+    else:
+        await db.delete(row)
+    await db.commit()
+    return True
+
+
 async def cleanup_after_card_deletion(
     db: AsyncSession, card_id: str
 ) -> None:
@@ -805,6 +933,11 @@ async def cleanup_after_card_deletion(
         if card_id in current_ids:
             new_ids = [c for c in current_ids if c != card_id]
             if not new_ids:
+                await db.execute(
+                    delete(ArtifactSaveRow).where(
+                        ArtifactSaveRow.artifact_id == art.id
+                    )
+                )
                 await db.delete(art)
             else:
                 art.source_card_ids = new_ids

backend/tests/test_api.py

@@ -89,18 +89,20 @@ async def test_catalog_upsert_dedupes_and_lists(client, database):
             for cid in ("c1", "c2", "c3")
         ])
         await s.commit()
-        await database.upsert_artifact(
+        a1 = await database.upsert_artifact(
             s, card_id="c1", type_="book", title="Atomic Habits",
-            creator="James Clear", year=2018, thumbnail="http://x/a.jpg", saved=True,
+            creator="James Clear", year=2018, thumbnail="http://x/a.jpg",
         )
-        await database.upsert_artifact(
+        a2 = await database.upsert_artifact(
             s, card_id="c2", type_="book", title="atomic   habits",
-            creator=None, year=None, thumbnail=None, saved=True,
+            creator=None, year=None, thumbnail=None,
         )
-        await database.upsert_artifact(
+        a3 = await database.upsert_artifact(
             s, card_id="c3", type_="movie", title="Inception",
-            creator="Nolan", year=2010, thumbnail=None, saved=True,
+            creator="Nolan", year=2010, thumbnail=None,
         )
+        for aid in {a1.id, a2.id, a3.id}:
+            await database.set_artifact_saved(s, aid, True, "test-user")
 
     r = await client.get("/catalog")
     entries = r.json()
@@ -114,11 +116,12 @@ async def test_catalog_upsert_dedupes_and_lists(client, database):
     assert [e["title"] for e in r2.json()] == ["Inception"]
 
 
-async def _make_ready_card(database) -> str:
+async def _make_ready_card(database, owner_id: str = "test-user") -> str:
     async with database.session() as s:
         row = database.CardRow(
             source_url="https://instagram.com/reel/chat",
             state="ready",
+            owner_id=owner_id,
             content_type="recipe",
             one_liner="Easy pancakes",
             tldr="Mix, pour, flip.",
@@ -188,7 +191,7 @@ async def test_chat_returns_reply_when_backend_answers(client, database, monkeyp
 async def test_chat_persists_and_restores_per_owner(client, database, monkeypatch):
     """A chat turn is saved for the owner that made it, restorable via GET, and
     invisible to a different owner."""
-    card_id = await _make_ready_card(database)
+    card_id = await _make_ready_card(database, owner_id="alice")
     monkeypatch.setattr(
         "app.api.cards.llm_chat.answer", lambda card, history: "Use 1 cup."
     )
@@ -217,7 +220,7 @@ async def test_chat_persists_and_restores_per_owner(client, database, monkeypatc
 async def test_rabbithole_persists_trail_and_restores(client, database, monkeypatch):
     """Successive dives build a persisted trail keyed by the root topic, and a
     branch taken after jumping back replaces the abandoned deeper steps."""
-    card_id = await _make_ready_card(database)
+    card_id = await _make_ready_card(database, owner_id="alice")
 
     async def fake_explore(card, topic, trail):
         return {"explanation": f"About {topic}.", "threads": [f"{topic} deeper"]}
@@ -273,7 +276,7 @@ async def test_rabbithole_persists_trail_and_restores(client, database, monkeypa
 
 
 async def test_library_chat_persists_and_restores_per_owner(client, monkeypatch):
-    async def fake_answer(history):
+    async def fake_answer(history, owner_id):
         return ("You saved 2 recipes.", [])
 
     monkeypatch.setattr(
@@ -298,11 +301,16 @@ async def test_library_chat_persists_and_restores_per_owner(client, monkeypatch)
 
 async def test_catalog_detail_and_delete(client, database):
     async with database.session() as s:
+        s.add(database.CardRow(
+            id="c1", source_url="http://cat/c1", state="ready", owner_id="test-user",
+        ))
+        await s.commit()
         row = await database.upsert_artifact(
             s, card_id="c1", type_="podcast", title="Lex Fridman",
-            creator=None, year=None, thumbnail=None, saved=True,
+            creator=None, year=None, thumbnail=None,
         )
         artifact_id = row.id
+        await database.set_artifact_saved(s, artifact_id, True, "test-user")
 
     g = await client.get(f"/catalog/{artifact_id}")
     assert g.status_code == 200
@@ -374,7 +382,7 @@ async def test_library_chat_503_without_llm_backend(client):
 
 
 async def test_library_chat_returns_reply(client, monkeypatch):
-    async def fake_answer(history):
+    async def fake_answer(history, owner_id):
         return ("You saved 3 recipes.", [])
 
     monkeypatch.setattr("app.api.library_chat.llm_library_chat.answer", fake_answer)
@@ -417,8 +425,8 @@ async def test_search_mode_text_works(client):
 async def test_delete_card_cascades_cleanup(client, database):
     from sqlalchemy import select
     async with database.session() as s:
-        c1 = database.CardRow(id="del-1", source_url="http://x/1", state="ready")
-        c2 = database.CardRow(id="del-2", source_url="http://x/2", state="ready")
+        c1 = database.CardRow(id="del-1", source_url="http://x/1", state="ready", owner_id="test-user")
+        c2 = database.CardRow(id="del-2", source_url="http://x/2", state="ready", owner_id="test-user")
         s.add_all([c1, c2])
         await s.commit()
 
@@ -429,9 +437,9 @@ async def test_delete_card_cascades_cleanup(client, database):
         await database.upsert_concept(s, name="Idea Shared", card_id="del-1")
         await database.upsert_concept(s, name="Idea Shared", card_id="del-2")
 
-        await database.upsert_artifact(s, card_id="del-1", type_="book", title="Book Solo", creator=None, year=None, thumbnail=None, saved=True)
-        await database.upsert_artifact(s, card_id="del-1", type_="book", title="Book Shared", creator=None, year=None, thumbnail=None, saved=True)
-        await database.upsert_artifact(s, card_id="del-2", type_="book", title="Book Shared", creator=None, year=None, thumbnail=None, saved=True)
+        await database.upsert_artifact(s, card_id="del-1", type_="book", title="Book Solo", creator=None, year=None, thumbnail=None)
+        await database.upsert_artifact(s, card_id="del-1", type_="book", title="Book Shared", creator=None, year=None, thumbnail=None)
+        await database.upsert_artifact(s, card_id="del-2", type_="book", title="Book Shared", creator=None, year=None, thumbnail=None)
 
     res = await client.delete("/cards/del-1")
     assert res.status_code == 200

backend/tests/test_isolation.py

@@ -0,0 +1,123 @@
+"""Cross-owner isolation: a card/collection/artifact/concept owned by one user
+is invisible and immutable to another. Locks the owner-scoping guards on the
+by-id routes (get/patch/delete card, collections, catalog, concepts)."""
+
+from app.store import db
+
+
+async def _card(database, cid: str, owner: str) -> None:
+    async with database.session() as s:
+        s.add(database.CardRow(
+            id=cid, source_url=f"http://iso/{cid}", state="ready", owner_id=owner,
+            one_liner="secret", tldr="secret body",
+        ))
+        await s.commit()
+
+
+def _h(owner: str) -> dict:
+    return {"x-owner-id": owner}
+
+
+async def test_get_patch_delete_card_denied_to_other_owner(client, database):
+    await _card(database, "iso-1", "alice")
+
+    assert (await client.get("/cards/iso-1", headers=_h("bob"))).status_code == 404
+    assert (await client.patch(
+        "/cards/iso-1", headers=_h("bob"), json={"blocks": []}
+    )).status_code == 404
+    assert (await client.delete("/cards/iso-1", headers=_h("bob"))).status_code == 404
+
+    # Owner still gets it, and it survived bob's delete attempt.
+    assert (await client.get("/cards/iso-1", headers=_h("alice"))).status_code == 200
+
+
+async def test_collection_mutations_denied_to_other_owner(client, database):
+    await _card(database, "iso-2", "alice")
+    created = await client.post(
+        "/collections", headers=_h("alice"), json={"name": "Alice folder"}
+    )
+    col_id = created.json()["id"]
+
+    assert (await client.patch(
+        f"/collections/{col_id}", headers=_h("bob"), json={"name": "hijack"}
+    )).status_code == 404
+    assert (await client.delete(
+        f"/collections/{col_id}", headers=_h("bob")
+    )).status_code == 404
+    # Bob can't move alice's card either.
+    assert (await client.post(
+        "/collections/cards/iso-2/move", headers=_h("bob"),
+        json={"collection_id": col_id},
+    )).status_code == 404
+
+
+async def test_catalog_and_concept_by_id_denied_to_other_owner(client, database):
+    await _card(database, "iso-3", "alice")
+    async with database.session() as s:
+        art = await db.upsert_artifact(
+            s, card_id="iso-3", type_="book", title="Alice Book",
+            creator=None, year=None, thumbnail=None,
+        )
+        await db.set_artifact_saved(s, art.id, True, "alice")
+        con = await db.upsert_concept(s, card_id="iso-3", name="alice concept")
+        art_id, con_id = art.id, con.id
+
+    assert (await client.get(
+        f"/catalog/{art_id}", headers=_h("bob")
+    )).status_code == 404
+    assert (await client.delete(
+        f"/catalog/{art_id}", headers=_h("bob")
+    )).status_code == 404
+    assert (await client.post(
+        f"/concepts/{con_id}/define", headers=_h("bob")
+    )).status_code == 404
+    assert (await client.delete(
+        f"/concepts/{con_id}", headers=_h("bob")
+    )).status_code == 404
+
+    # Owner still reaches the catalog entry.
+    assert (await client.get(
+        f"/catalog/{art_id}", headers=_h("alice")
+    )).status_code == 200
+
+
+async def test_catalog_saved_state_is_per_owner(client, database):
+    """A single shared artifact (referenced by two owners' cards) has independent
+    catalog membership per owner — one saving/removing never affects the other."""
+    await _card(database, "shared-a", "alice")
+    await _card(database, "shared-b", "bob")
+    async with database.session() as s:
+        # Same title+type from both cards dedupes into ONE shared artifact row.
+        await db.upsert_artifact(
+            s, card_id="shared-a", type_="book", title="Shared Book",
+            creator=None, year=None, thumbnail=None,
+        )
+        art = await db.upsert_artifact(
+            s, card_id="shared-b", type_="book", title="Shared Book",
+            creator=None, year=None, thumbnail=None,
+        )
+        art_id = art.id
+
+    # Alice saves it; her catalog shows it, bob's does not.
+    assert (await client.post(
+        f"/catalog/{art_id}/save", headers=_h("alice")
+    )).status_code == 200
+    alice_titles = [e["title"] for e in (
+        await client.get("/catalog", headers=_h("alice"))).json()]
+    bob_titles = [e["title"] for e in (
+        await client.get("/catalog", headers=_h("bob"))).json()]
+    assert alice_titles == ["Shared Book"]
+    assert bob_titles == []
+
+    # Bob saves it too — independent membership.
+    assert (await client.post(
+        f"/catalog/{art_id}/save", headers=_h("bob")
+    )).status_code == 200
+
+    # Alice removes it; bob's catalog is untouched.
+    assert (await client.delete(
+        f"/catalog/{art_id}", headers=_h("alice")
+    )).status_code == 200
+    assert (await client.get("/catalog", headers=_h("alice"))).json() == []
+    assert [e["title"] for e in (
+        await client.get("/catalog", headers=_h("bob"))).json()] == ["Shared Book"]

backend/tests/test_merge.py

@@ -0,0 +1,45 @@
+"""Guest (anonymous) account data folding into an existing account."""
+
+from sqlalchemy import select
+
+from app.api import auth_routes
+from app.auth import get_owner
+from app.main import app
+from app.store import db
+
+
+async def _seed_card(owner_id: str) -> None:
+    async with db.session() as s:
+        s.add(db.CardRow(owner_id=owner_id, source_url=f"https://x/{owner_id}", state="ready"))
+        await s.commit()
+
+
+async def test_merge_folds_guest_rows_into_account(client, monkeypatch) -> None:
+    await _seed_card("guest-uid")
+
+    # Caller (Bearer) is the destination Google account.
+    app.dependency_overrides[get_owner] = lambda: "google-uid"
+    # guest_token verifies to an anonymous guest uid.
+    monkeypatch.setattr(
+        auth_routes,
+        "_verify",
+        lambda _t: {"uid": "guest-uid", "firebase": {"sign_in_provider": "anonymous"}},
+    )
+
+    resp = await client.post("/auth/merge", json={"guest_token": "guest-jwt"})
+    assert resp.status_code == 200 and resp.json()["merged"] >= 1
+
+    async with db.session() as s:
+        cards = (await s.execute(select(db.CardRow))).scalars().all()
+    assert cards and all(c.owner_id == "google-uid" for c in cards)
+
+
+async def test_merge_rejects_non_anonymous_source(client, monkeypatch) -> None:
+    app.dependency_overrides[get_owner] = lambda: "google-uid"
+    monkeypatch.setattr(
+        auth_routes,
+        "_verify",
+        lambda _t: {"uid": "other-real-uid", "firebase": {"sign_in_provider": "google.com"}},
+    )
+    resp = await client.post("/auth/merge", json={"guest_token": "real-jwt"})
+    assert resp.status_code == 403

backend/tests/test_prefer_local.py

@@ -0,0 +1,28 @@
+"""Dev toggle: prefer_local forces on-device structuring by degrading the job
+(skip server LLM, keep the bundle for the phone) even when within quota."""
+
+from sqlalchemy import select
+
+from app.store import db
+
+
+async def test_prefer_local_degrades_job_within_quota(client) -> None:
+    r = await client.post(
+        "/cards", json={"url": "https://example.com/local", "prefer_local": True}
+    )
+    assert r.status_code == 200
+    assert r.json()["quota_degraded"] is True
+
+    async with db.session() as s:
+        jobs = (await s.execute(select(db.JobRow))).scalars().all()
+    assert len(jobs) == 1 and jobs[0].degraded is True
+
+
+async def test_default_uses_server_llm(client) -> None:
+    r = await client.post("/cards", json={"url": "https://example.com/server"})
+    assert r.status_code == 200
+    assert r.json()["quota_degraded"] is False
+
+    async with db.session() as s:
+        jobs = (await s.execute(select(db.JobRow))).scalars().all()
+    assert len(jobs) == 1 and jobs[0].degraded is False