Faster first scan. Cairn can match phone photos to the copies already in Immich (by filename and capture date) and trust the server's checksum instead of re-hashing — hours down to seconds on iCloud-Optimized libraries. Optional; turn it on under Settings → Library → "Trust server checksums." Stronger deletion safety. A run of fixes ensures cairn never proposes trashing a server photo that's still on your phone — including edited photos, Live Photos, hidden and shared assets, and capture-time rounding. Fixes the case where a photo still on your device showed up "aging out" in Pending Review. Correctness and performance. A broad internal review hardened the deletion engine (restores, Live Photo pairs, delete-then-restore-offline), cut UI stutter, and sped up large-library syncs — including a long silent gap on the first scan of 100k+ photo libraries. Clearer sync progress. Long syncs now show the file downloading from iCloud, live server-fetch progress instead of a frozen counter, a time estimate that accounts for iCloud throttling, and a separate scan line so the bar no longer fills and snaps back. Reworked Settings. Clear categories with at-a-glance summaries, a quick-settings card for the knobs you revisit most, and search. Sign-in now lives under Connection. Smaller additions: - "Don't propagate old deletes" — clear old photos off your phone without mirroring those deletes to the server. - "Open in Immich" opens the Immich app when installed, the browser otherwise. - Diagnostic logging is now an opt-in toggle, off by default. - Backup/restore now includes the hash cache, plus faster connection readings, dark-mode toggle fixes, and a more reliable launch.

Sync detail: per-asset hashing visibility. When a sync stalls on a large iCloud video, the sync detail sheet now shows the asset being downloaded — filename, total bytes, elapsed time once it crosses ~3s, plus a 0–100% download progress bar while iCloud is fetching the bytes. Replaces the previous "N of M hashed" counter that gave no signal about what was actually slow. Reliability: photos you viewed in Photos.app no longer pile up in the deferred queue. PhotoKit bumps the modificationDate when iOS materializes an asset from iCloud for display, and cairn previously read any modDate change as needing a re-hash — a chain of view → re-hash → iCloud re-download → 60s timeout → defer with "timed out." Cairn now skips the re-hash when the asset's primary resource size hasn't changed; real edits still re-hash because the editor adds an adjustment resource that changes the size. Reliability: transient onboarding-screen flash on launch. iOS occasionally returns "item not found" for Keychain reads that should succeed during the brief post-launch window — most commonly after a force-quit + quick relaunch. Cairn previously routed straight to onboarding on the first "not found"; the retry now covers "not found" for ~400ms before treating it as truly missing. Fresh installs and sign-outs still route correctly, just after the brief retry.

Incremental sync. A new Settings → Advanced toggle streams only the server-side changes since the last sync rather than refetching the full library each time. Faster on large libraries. Off by default; flip it on after signing in with your Immich email + password (Settings → Advanced → Sign in to Immich), since the streaming endpoint doesn't accept API keys. If the session is ever invalidated from elsewhere, cairn detects it on the next sync, falls back to the paginated path, and offers one-tap re-sign-in. Time format. Settings → Appearance now has a System / 12-hour / 24-hour picker for clock times across the journal, run times, and sync timestamps. System follows iOS Settings → General → Date & Time and reacts to live toggles without a relaunch. Smarter network errors. A failed sync now distinguishes "no connection at all" from "connected but upstream is broken" from "Immich-only unreachable" instead of always blaming the server. Direct-LAN Immich. Cairn can now reach Immich servers exposed over plain HTTP on home-network addresses (RFC 1918 + .local) — the typical self-hosted setup. Background syncs are more reliable. Fixes a crash class in the background-refresh handler. Background runs now share the manual-sync code path and log a "trigger=bg" field so you can tell them apart in the journal. The background-slot label switched from "Overnight" to "Background" (the slot can fire any time of day). Manual syncs always log. Even a no-op manual sync writes to the journal so you have a record. Consecutive background-only no-op syncs collapse into a single journal row. Deleted photos always go through quarantine. An edge-case bug let some deletions skip the 14-day window and land straight in "ready to trash." A recovery pass on every sync now catches stragglers and starts their clock fresh. Sync detail timeline reads correctly. Earlier phases close as they complete; phases that legitimately skip (Hashing on an incremental sync with no new bytes) render as "skipped" instead of looking pending. Tap a journal row to inspect the full run. Opens a sheet with every event from that run in one place, JSON-forward. "Last sync details" also stays available after a sync wraps. Robust Keychain bootstrap. Transient Keychain errors at launch no longer bounce you back to onboarding when your credentials are actually saved. Help popovers and foreground popups. Help popovers got a full perimeter outline including the arrow tip plus more inner padding — they read as defined cards rather than blending into the screen. Two transient error alerts that briefly flashed on app activation are fixed. Accessibility. Dynamic Type works across the UI (text scales with the system text-size setting). VoiceOver announces sync phases and reads custom toggles, progress bars, and pickers properly. Destructive-action buttons meet Apple's 44pt tap-target minimum. Light-mode muted text now meets WCAG AA contrast.

Find missed deletions: a new Settings → Recovery scan that catches photos you deleted from your phone before cairn had a chance to record them. Configurable date range; "Stricter filter" requires positive evidence that cairn previously saw the photo on this device — eliminates false positives from server-side albums. Shortcuts integration: trigger cairn syncs from the Shortcuts app. Build personal automations like "after Camera closes, sync with cairn" to keep things in sync without opening the app. Background sync reliability: cairn was silently failing to schedule background slots due to an internal bug. Fixed — should now run consistently in the background between manual opens. Sync journal: every sync row now shows what triggered it (trigger=manual, trigger=background, trigger=shortcut, etc.) so you can verify background fires actually happened. Smaller fixes: cleaner Recovery sheet header, export picker no longer drifts on iOS 26, more robust handling of Keychain hiccups on app launch.

Offline - Sync fails fast when Immich is unreachable rather than spinning indefinitely. - The "Couldn't reach Immich" alert pops once per disconnected session, not on every retry. - Photos deleted on iPhone while offline are recorded locally and surfaced after the sync attempt; they propagate on the next successful sync. - Trash decisions made offline (from Pending Review or after a dry run) persist in a retry queue and execute automatically when the connection returns. Retry limit is tunable in Settings. Onboarding - The Continue button is no longer greyed at any step. With empty fields, tapping it focuses the first missing input; with fields filled but unverified, it runs Verify on your behalf and advances on success. - The server URL field auto-focuses on arrival and accepts bare hostnames (immich.example.com works — no https:// required). Other - New About cairn screen in Settings shows the marketing version, build number, and license. - Failed runs in the Runs tab show the actual reason instead of a generic "stopped by safety rail" label. - Brand header now reads the live system status bar height instead of using hardcoded per-device padding.