feat(android): back up the files of folders the person chooses

A Files section takes folders through the system picker (no storage
permission), refuses DCIM, Pictures and Movies, skips what the photo backup
sends, and runs on the photo backup's own runner into <folder>/<account>-drive.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

1 files changed, 17 insertions, 1 deletions

diff --git a/docs/MESHBAY_DESIGN.md b/docs/MESHBAY_DESIGN.md
index 4c376ea..bc6e20a 100644
--- a/docs/MESHBAY_DESIGN.md
+++ b/docs/MESHBAY_DESIGN.md
@@ -3454,7 +3454,7 @@ foreground service (`BackupService`) and the WebView reported visible, like a
 cast (§11.3). Android 15 limits that type to six hours a day; the service stops
 when told and the run carries on at the next opening.
 
-### 9.13 Contacts, calendar and messages backup (Android)
+### 9.13 Contacts, calendar, messages and files backup (Android)
 
 The Android application sends a copy of the phone's **contacts**, its
 **calendars** and its **text messages** to a folder of a group, on the photo backup's terms (§9.12): a client
@@ -3497,6 +3497,22 @@ character references and leaving out the characters XML 1.0 cannot carry.
 A contact name is filled in only when the person also allowed contacts. MMS
 are not included.
 
+**Files.** `<folder>/<account>-drive/<chosen folder>/…`: the files of the
+folders the person chose through the system's picker
+(`ACTION_OPEN_DOCUMENT_TREE`, a persisted read grant per folder, no storage
+permission, which Play keeps for a few kinds of application). It runs as
+photos do, and is in fact the same runner (`createBackup` in `photo-sync.js`,
+`drive-sync.js`): once a day, on an unmetered network, a file at a time under
+a slot, read from the phone a range at a time (`/drivesync/<token>`), a ledger
+by document id (`DriveLedger.kt`), additive. A file changed on the phone goes
+beside the copy sent, named `-modified-<date>`; nothing is replaced. Nothing
+is stored twice: `DCIM`, `Pictures` and `Movies` (or anything in them) and a
+whole volume cannot be chosen (`DrivePlan.refusal`), and a file the photo
+backup sends, wherever its album is, is left out by its path. Android 11 and
+later do not let an application choose the whole of `Download`, only folders
+in it; the section says so. Hidden files (`.x`) are skipped; a name the node
+would refuse is mended (`DrivePlan.safeName`), never dropped.
+
 **Two builds.** Play's policy gives `READ_SMS` to the default SMS application
 only, so the APK has a `store` dimension: `full`, distributed directly, and
 `play`, which has neither the permission (`src/full/AndroidManifest.xml`) nor