chore: backmerge

.github/workflows/auto-label.yml

@@ -16,7 +16,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 
       - name: Label PR based on changed files
         uses: actions/labeler@8558fd74291d67161a8a78ce36a881fa63b766a9 # v5

.github/workflows/ci.yml

@@ -37,7 +37,7 @@ jobs:
       synkronus-cli: ${{ steps.filter.outputs.synkronus-cli }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
         with:
           fetch-depth: 0
 
@@ -68,7 +68,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 
       - name: Setup pnpm
         uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4
@@ -111,7 +111,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 
       - name: Setup pnpm
         uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4
@@ -160,7 +160,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 
       - name: Setup Go
         uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
@@ -212,7 +212,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 
       - name: Setup Go
         uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5

.github/workflows/e2e-attachments.yml

@@ -32,7 +32,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 
       - name: Set up Go
         uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
@@ -73,7 +73,7 @@ jobs:
     timeout-minutes: 20
     needs: contract
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 
       - name: Setup pnpm
         uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4

.github/workflows/formulus-android.yml

@@ -39,7 +39,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 
       - name: Setup pnpm
         uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4
@@ -83,7 +83,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 
       - name: Download formplayer assets artifact
         uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
@@ -132,7 +132,7 @@ jobs:
         run: pnpm run generate
 
       - name: Set up Java
-        uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4
+        uses: actions/setup-java@cf277c60eb25467037889841efdb72551f06f6c3 # v4
         with:
           distribution: 'temurin'
           java-version: '17'

.github/workflows/ode-desktop.yml

@@ -45,7 +45,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 
       - name: Setup pnpm
         uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4
@@ -117,7 +117,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 
       - name: Setup pnpm
         uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4
@@ -194,7 +194,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 
       - name: Download embedded formplayer
         uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
@@ -355,7 +355,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 
       - name: Download embedded formplayer
         uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7

.github/workflows/sbom-release.yml

@@ -23,7 +23,7 @@ jobs:
       contents: write
     steps:
       - name: Checkout repository
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 
       - name: Setup pnpm
         # scripts/sbom/generate-sboms.mjs shells out to `pnpm list`; needs pnpm on PATH.

.github/workflows/synkronus-cli.yml

@@ -31,7 +31,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 
       - name: Set up Go
         uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
@@ -81,7 +81,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 
       - name: Set up Go
         uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5

.github/workflows/synkronus-docker.yml

@@ -41,7 +41,7 @@ jobs:
       version: ${{ steps.version.outputs.version }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
         with:
           fetch-depth: 0
 
@@ -78,7 +78,7 @@ jobs:
             packages/components/pnpm-lock.yaml
 
       - name: Set up Java (OpenAPI Generator)
-        uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4
+        uses: actions/setup-java@cf277c60eb25467037889841efdb72551f06f6c3 # v4
         with:
           distribution: temurin
           java-version: '21'
@@ -126,7 +126,7 @@ jobs:
       digest: ${{ steps.push.outputs.digest }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 
       - name: Download docker build context
         uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
@@ -192,7 +192,7 @@ jobs:
       digest: ${{ steps.push.outputs.digest }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 
       - name: Download docker build context
         uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4

PRIVACYPOLICY.md

@@ -0,0 +1,11 @@
+# Privacy Policy
+
+Your privacy is very important to us. Therefore we consider al your personal information yours and yours alone. No data is stored or transmitted and we do no include any advertising or analytics software that talks to third parties.
+
+## What information is collected?
+
+Formulus does not collect any personal information. All login information is only stored locally on your device.
+
+## Contact
+
+If you have questions or concerns about this Privacy Policy, please [contact us](https://forum.opendataensemble.org/).

desktop/AGENTS.md

@@ -1,6 +1,6 @@
 # ODE Desktop — AI and developer guide
 
-**ODE Desktop** (`desktop/`) is the Tauri + React + Rust app for **Data management** (observations, sync, import) and the **Forms / app workbench** (bundles, form preview, custom app embed). User-facing overview: [desktop/README.md](README.md).
+**ODE Desktop** (`desktop/`) is the Tauri + React + Rust app for **Data management** (observations, sync, import, **export**) and the **Forms / app workbench** (bundles, form preview, custom app embed). User-facing overview: [desktop/README.md](README.md).
 
 Published docs: [ODE Desktop developer mode](https://opendataensemble.org/docs/guides/ode-desktop-developer-mode) (local custom app iteration).
 

desktop/README.md

@@ -12,10 +12,23 @@ The internal Rust crate may still be named `custodian`; user-facing strings use
 ## Who it is for
 
 - **Field and data staff** managing observations and sync (Data management).
+- **Analysts** exporting local Parquet from Data → **Export** for offline analysis (R, Python, etc.).
 - **Form and app authors** testing bundles and custom apps against Synkronus before mobile deploy (Workbench).
 
 Relationship to other ODE components: **Synkronus** (API), **Formulus** + **formplayer** (runtime parity), **Portal** and **CLI** (same public API — no privileged desktop channel). Long-form prose here is intended to be **copy-friendly** for [opendataensemble.org](https://opendataensemble.org/) documentation; keep user-facing sections free of repo-only trivia (put contributor notes under **Development**).
 
+## Data management — Export
+
+From **Data → Export**, ODE Desktop writes analyst-oriented Parquet from the **active profile’s local workspace** (not from Synkronus over the network):
+
+1. Choose a destination parent folder (last location is remembered for the session, like Import).
+2. Desktop creates a leaf folder named **`YYYYMMDD`** under that parent (overwrite confirmation if it already exists).
+3. One **`<form_type>.parquet`** per form type, plus **`export_manifest.json`**, and **`snippets/`** load scripts (R, Python, Stata, Julia).
+4. Optional **Include pending observations** (local rows not yet synced).
+5. Optional **Include attachments** — copies referenced files into `attachments/` under the export folder. Observation data stores attachment **basenames**; prefix them with the workspace attachments path shown on Profiles / Export (or the export `attachments/` path when copied) to open files on disk.
+
+The Export page also shows copyable load snippets with variables named after each form type. Transforms and study-specific ETL stay **outside** Desktop. For a full **server** dump as a ZIP, use Portal or `synk data export`.
+
 ## Install
 
 Official builds are produced with **`pnpm tauri build`** (artifacts vary by OS: `.msi`, `.dmg`, `.app`, AppImage, `.deb`, etc.). When releases are published, attach those bundles to **GitHub Releases** and link them from project docs.

desktop/docs/UI_FEEDBACK.md

@@ -4,12 +4,13 @@ Single source of truth for how the shell surfaces status, errors, and confirmati
 
 ## Progress banner (full-width)
 
-**Use for:** long-running sync, import, and **app bundle download/apply** jobs.
+**Use for:** long-running sync, import, **export**, and **app bundle download/apply** jobs.
 
 - Renders below the mode switch / dev bar in `Shell`.
 - Shows spinner + status text; optional determinate progress bar when `bundleActivity.total > 0`.
 - Dismissible but reappears on next activity.
 - Bundle apply: Rust emits `bundle/apply-progress` and `bundle/index-rebuild`; `bundleActivity` in `useCustodianStore` drives the banner.
+- Sync completion: keep the banner for short **summary** lines when a downloadable `syncDetailReport` is attached (e.g. missing-attachment push details). Offer **Save report** instead of dumping long ID lists into the banner.
 - Do not use for quick actions (save, auth, dev mirror refresh).
 
 ## Toasts (bottom-right stack)
@@ -32,7 +33,7 @@ Single source of truth for how the shell surfaces status, errors, and confirmati
 
 ## Native confirm (Tauri)
 
-**Use for:** destructive actions, import-with-issues, closing unsaved observation tabs.
+**Use for:** destructive actions, skip already-synced import rows, closing unsaved observation tabs.
 
 - `confirmDestructiveAction()` for destructive flows (clear, profile-scoped wording).
 - `confirm()` from `@tauri-apps/plugin-dialog` for save-anyway / import-anyway / tab discard (Save / Don't save / Cancel via separate flows).
@@ -41,7 +42,8 @@ Single source of truth for how the shell surfaces status, errors, and confirmati
 
 - `window.alert` — replace with toast or inline notice.
 - `window.confirm` — replace with Tauri `confirm`.
-- Duplicate sync success in both banner and toast — prefer toast for short messages; keep banner only for multi-line sync summaries.
+- Dumping long per-observation lists into the sync banner — use a short highlight + **Save report** (`syncDetailReport`).
+- Duplicate sync success in both banner and toast — prefer toast for short messages; keep banner when a detail report is available or the message is multi-line.
 
 ## Dev mode bar
 

desktop/docs/screens/import.md

@@ -11,9 +11,10 @@ Bring external JSON observation files into the active profile’s local reposito
 ## What to include
 
 - Drag-and-drop and multi-file picker for `.json`
-- Pre-flight summary (counts, form types, attachment hints)
-- Per-file parse/normalization issues
-- Import action and clear/reset
+- **Validate** then review results in-page (no “import anyway?” popup)
+- Import action on the validation results panel (available with or without errors)
+- Clear label when validation finds no errors
+- Optional skip of Formulus-export rows that already appear synced (`syncedAt` ≥ `updatedAt`) — confirm dialog at staging time
 
 ## What to exclude
 
@@ -23,17 +24,21 @@ Bring external JSON observation files into the active profile’s local reposito
 
 ## Key actions
 
-- Stage files, review summary, import, clear
+- Stage files → **Validate** → review results → **Import into local store** (or clear)
+- When import JSON carries Formulus `syncedAt` metadata, confirm whether to skip already-synced observations and write only unsynced ones
 
 ## Data dependencies
 
 - Store: `import` flow via `tauriClient.importObservations`, refresh `loadObservations` / `loadHealth` after import
 - Active profile determines target SQLite repository
+- Sync appearance: Formulus hail-mary export includes `syncedAt`; Desktop treats a row as already synced when `syncedAt` is meaningful and `updatedAt <= syncedAt` (same rule as Formulus pending detection)
 
 ## Observation indexes
 
-When the active app bundle declares `observationIndexes` in `app.config.json`:
+When the active app bundle declares `observationIndexes` in `app.config.json`, local file import updates indexes **incrementally** for the written rows (same as sync pull). A full background rebuild is reserved for bundle apply / empty index / explicit rebuild — not for import.
 
-1. Import writes observations in batches (default 2000 rows per IPC call); intermediate batches skip index work.
-2. After the final batch commits, Rust schedules **one** coalesced background full index rebuild (`bundle/index-rebuild` progress events). Overlapping rebuild requests while one is running are merged into a single follow-up pass.
-3. Sync pull uses incremental indexing per page instead (no full rebuild after each pull).
+## Large Formulus exports
+
+After staging JSON (folder / drop / Add JSON), Desktop runs a lightweight host scan of `syncedAt` / `updatedAt` and may offer to drop already-synced files **before** full parse + schema validation. Staging lists truncate after ~50 rows so tens of thousands of files do not freeze the UI.
+
+Import parse + JSON Schema validation + attachment reference checks run in **Rust (Rayon)** in one pass (`parse_and_validate_import_json_paths`), with form schemas loaded once from the active bundle.

desktop/docs/screens/profiles.md

@@ -14,6 +14,7 @@ Define units of custody: each profile has its own Synkronus server, credentials,
 - Edit: display name, server URL, username, password (OS keyring when available)
 - Local repository file picker, workspace folder, optional attachments folder
 - Reload, save profile, clear saved password
+- Authenticate button: auto-recovers session (refresh token / saved password) on load and profile switch; shows **Authenticated** only after a successful check, otherwise **Authenticate**
 - Warnings when secure storage is unavailable (password not persisted)
 
 ## What to exclude

desktop/docs/screens/sync.md

@@ -18,6 +18,7 @@ Operational console to authenticate with Synkronus and exchange data: pull into
 - Pull and push actions
 - Recent operation log (per-session, on this screen)
 - Store-level `syncMessage` / `error` after operations
+- Danger zone: reset local data (full, or **pending-only** so synced rows + sync offsets stay for a continued pull), re-create index, reset server repository
 
 ## What to exclude
 
@@ -28,6 +29,7 @@ Operational console to authenticate with Synkronus and exchange data: pull into
 ## Key actions
 
 - Login, pull, push
+- Reset local data (optional: pending observations only)
 
 ## Data dependencies
 

desktop/package.json

@@ -1,7 +1,7 @@
 {
   "name": "ode-desktop",
   "private": true,
-  "version": "1.2.0",
+  "version": "1.3.0",
   "packageManager": "pnpm@10.33.2",
   "type": "module",
   "scripts": {