feat(hub): photo backup moves to its own Android Sync page

A Phone section of the side menu leads to it, on the Android application
only; Settings no longer holds it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

1 files changed, 8 insertions, 2 deletions

diff --git a/docs/MESHBAY_DESIGN.md b/docs/MESHBAY_DESIGN.md
index 8a75f5a..0714e7e 100644
--- a/docs/MESHBAY_DESIGN.md
+++ b/docs/MESHBAY_DESIGN.md
@@ -3343,6 +3343,12 @@ run that issued it and for the one photo it names. The page never receives a
 `content://` URI. A browser and the desktop have no camera roll and no such
 object — absent, not refusing (§11.3).
 
+**Where it lives.** Its controls are on a page of their own, **Android Sync**,
+under a **Phone** heading of the side menu (`android-sync-page.js`), shown only
+where `platform.photoSync` exists. Settings holds what the account prefers on
+every client; this page holds what one phone sends, and is where whatever else
+the phone sends will go.
+
 **When.** A run is due 24 hours after the last run that *finished*; an
 interrupted one is retried at the next chance, at most every fifteen minutes.
 Due-ness is checked at start, on return to the foreground, when the network
@@ -3396,8 +3402,8 @@ and nobody had to do anything for it.
 **Refusals.** A refusal that will hold tomorrow — `disk_full` (§6.4), a folder
 no longer writable, gone or on a drive that is not plugged, the member removed
 from the group, the photo permission withdrawn — stops the run, is said once in
-a notification and in Settings, and is retried a day later rather than at every
-opening. Anything else (the node offline, the network gone) is an interruption
+a notification and on the Android Sync page, and is retried a day later rather
+than at every opening. Anything else (the node offline, the network gone) is an interruption
 and is retried.
 
 **Screen off.** The sending lives in the page, so a run holds a `dataSync`