feat(app): scan a printed seed label back into its record

Closes the physical↔digital loop the labels opened: the QR on a printed
envelope (tane://seed, already encoded by seed_label_codec) can now be
scanned from the inventory bar. A known label opens its variety; an
unknown one asks before adding anything, then creates the variety (species
linked by exact scientific name when bundled) with a lot carrying the
label's year and origin. Scanner is pure ZXing (zxing_barcode_scanner,
MIT) — no ML Kit, no Play Services, F-Droid-safe, the stack Ğ1nkgo ships.
Mobile-only; other platforms don't show the button (OCR precedent).
The post-scan flow is a plain function (handleScannedPayload) so it's
widget-tested without a camera.

docs/notes/ngi-fediversity-application.md

@@ -0,0 +1,292 @@
+# Tane — NGI Fediversity (NLnet) application draft
+
+> **Working document, NOT tracked in git.** Ready-to-submit draft for the NLnet
+> NGI Fediversity call (nlnet.nl/propose). Deadline **1 Aug 2026, 12:00 CEST** (confirmed on the site).
+> Derived from `VISION.md`, `PLAN.md`, `docs/design/*` and `docs/notes/modelos-financiacion.md`.
+> Written in English (the proposal must be in English; VISION.md is the Spanish source).
+> **Updated 2026-07-17** to reflect the shipped state: app live on Google Play (v0.1.1), site at
+> tane.comunes.org, most of the social layer already built. The ask now funds the *remaining*
+> federated-infrastructure work, not a from-scratch build.
+
+---
+
+## Part A — Strategy & framing (for us, NOT for the form)
+
+### The new, stronger story: we shipped, now we complete the federated infrastructure
+Since the first draft, the project advanced a lot. This is now a **track-record application**, not a
+promise:
+- **Live on Google Play** (v0.1.1, `org.comunes.tane`), **GMS-free build** ready for F-Droid.
+- **Public site** at **tane.comunes.org**, translated via Weblate (translate.comunes.org).
+- **Block 1 (inventory) shipped**, and **most of Block 2 (the social layer) already shipped**: offers
+  (NIP-99), private metadata-hiding messaging (NIP-17), a Duniter-style egocentric web of trust
+  (kind 30777), ratings (kind 30778), profiles + multi-account identity, Plantaré pledges, saved-search
+  alerts. All transports live in the reusable `commons_core` engine, with ~131 test files and CI.
+
+NLnet weighs **technical feasibility (30%)** and **value for money (30%)**: a shipped, tested,
+in-store app de-risks both. Lead with that.
+
+### Fit with Fediversity — now genuine, not a stretch
+The Fediversity fund leans to the *hosting stack / self-hosting* side. The **work that remains is
+exactly that side**, which is why the fit is now real:
+1. **Self-hostable community relay** — `relay.comunes.org` is **already deployed and running**. The
+   remaining Fediversity-shaped work is turning it into a **reproducible, documented recipe any seed
+   network can self-host**, plus moderation tooling (NIP-56 reports, key-blocking) and operational
+   hardening — so the network is owned by communities, not a single instance.
+2. **Multi-device sync** — the encrypted `SyncTransport` landed (NIP-78, relay sees only ciphertext);
+   the app-level `SyncService` that replicates your inventory across your own devices is **pending**.
+   This is data portability + self-custody, a Fediversity theme.
+3. **Interoperability & portability** — open, versioned export/import already exists; add opt-in
+   **Darwin Core / GBIF** export so agrobiodiversity data can flow to open biodiversity atlases.
+4. **`commons_core` as reusable federated infrastructure** — Tane is a seed app wrapped around a generic
+   Nostr + CRDT + web-of-trust + messaging engine; seeds are the first app, others can follow.
+
+Framing in one line: **bringing federation beyond social media, into the physical commons — and we
+already have a working app to prove it.**
+
+### Plan B — don't bet everything on this call
+Honest odds: the fit is now decent (the remaining work IS hosting/portability-shaped) but Fediversity
+reviewers may still read "mobile app on Nostr" as adjacent to their ActivityPub/NixOS hosting focus.
+Mitigation, at near-zero extra cost:
+- **Submit to Fediversity anyway** (short form, strong track record, real infra milestones) — worst case
+  is a rejection with feedback.
+- **Reuse this same dossier for NGI Zero Commons / Core when regular calls reopen after summer 2026** —
+  Tane as commons infrastructure is arguably a *better* fit there (`commons_core`, open protocols,
+  community-run relays). Keep this file as the master; only the fund-specific framing paragraph changes.
+- Meanwhile, keep the **Goteo matchfunding** (Red de Semillas) track as the community-round complement.
+
+### NLnet requirements checklist
+- [x] **FOSS licence** — code AGPL-3.0; docs/assets CC-BY-SA.
+- [x] **Open standards** — Nostr NIPs (99/17/44/78/56), Duniter-style WoT, open data formats, Darwin Core.
+- [x] **European dimension** — EC-LLD (23 European seed networks), Red de Semillas, EU seed-law (PRM) context.
+- [x] **Milestone-based, verifiable deliverables** — see Part C.
+- [x] **Sustainability after funding** — local-first, open data/code, cheap community relays; never per-transaction fees.
+- [ ] **Generative-AI disclosure** — declared honestly and minimally (see §13 + the log template below).
+- [ ] **Privacy statement** — tick the acknowledgement of NLnet's privacy statement on the form.
+
+### The AI concern (read before submitting)
+NLnet has a formal **Generative AI policy** (nlnet.nl/foundation/policies/generativeAI/). It does **not**
+forbid AI, but imposes real obligations, and reviewers value **substance over marketing**. Three things,
+don't conflate them:
+1. **Prompt provenance log (required):** if GenAI is used in the application process, you must keep a
+   log of prompts/outputs. → the Appendix table below.
+2. **Public disclosure (required for substantive use):** any GenAI use that materially affects the
+   output must be disclosed so evaluators understand how the proposal was produced. → §13.
+3. **Purely-AI outcomes are NOT payable, and must be FLOSS-clean:** "Outcomes purely generated by AI are
+   not allowed to be submitted as work eligible for payment." → this hits the **milestones (M1–M5)**, not
+   just the application: the delivered code/docs must be **human-authored** (AI-assisted is fine; you must
+   also verify outputs don't reproduce copyrighted/licence-incompatible material). **Non-compliance can
+   mean rejection of the proposal or termination of a running grant.**
+
+Plus the softer risk: an application that *reads* as AI slop scores worse. Fix for all of it = make the
+text genuinely yours.
+
+**Action for vjrj — rewrite §3, §4, §5 in your own voice** (that's what a reviewer reads first; the rest
+is technical scaffolding). Add first-person specifics only you can write: Kokopelli, the 2009 paper
+Plantare you originated, why the whole seed sector refuses per-transaction fees, your Ğ1nkgo/Duniter
+background, and the fact the app is already in people's hands.
+
+**De-"slop" pass:** cut the tells — em-dashes everywhere, rule-of-three lists, heavy bold,
+"not X but Y" constructions, brochure cadence. Rougher, more technical, more personal = better here.
+
+### Process notes
+- Submit several days early — "deadlines are hard". Draft offline (this file), paste at the end.
+- Plain text is preferred; keep formatting light. Attachments ≤ 50 MB total.
+- You may submit multiple independent proposals in one round; do not double-submit via FundingBox + NLnet.
+
+---
+
+## Part B — Form answers (the actual draft, English)
+
+### Current status (facts to weave in — all verifiable)
+- **Live:** Google Play v0.1.1 (`org.comunes.tane`); site **tane.comunes.org**; community Nostr relay
+  **relay.comunes.org running**; source public (AGPL-3.0).
+- **F-Droid:** GMS-free build + recipe ready (awaiting registry upload).
+- **Languages:** 7 (en, es, pt, fr, ast, de, ja); RTL + CJK fonts bundled; translated on Weblate.
+- **Engine:** `commons_core` (pure Dart) — identity derivation, HLC, CRDT, geohash, all Nostr transports.
+- **Tests/CI:** ~131 test files; Forgejo Actions runs analyze + test on both packages.
+
+### 1. Contact / Organisation / Country
+- **Applicant organisation:** Comunes (registered non-profit association), Spain / EU.
+- **Project lead:** Vicente J. Ruiz Jurado (vjrj) — technical lead.
+- **Package id / namespace:** `org.comunes.tane`.
+- **Contact:** vjrj@comunes.org.
+- **Project page:** https://tane.comunes.org · source repository public (AGPL-3.0) · live on Google Play.
+
+### 2. Project name
+**Tane — self-hostable, local-first infrastructure for seed-sharing communities.** (種, "seed"; from
+*tanemaki*, "to sow".)
+
+### 3. Abstract (a few sentences)
+> ✍️ **vjrj: rewrite in your own voice.** Scaffolding below — keep the meaning, drop the polished cadence.
+
+Tane lets communities run their own seed-sharing network end to end: a local-first mobile app, a
+self-hostable relay, and identity and data the user fully owns and can take anywhere — no account, no
+central server, no company in the middle. The app is already live on Google Play in seven languages;
+offers, private messaging, reputation and encrypted device sync ride on open federated protocols
+(Nostr NIPs) and a Duniter-style web of trust, implemented in a reusable engine (`commons_core`) where
+seeds are only the first application. What remains — and what this grant funds — is the hosting and
+portability side: a **reproducible relay recipe any collective can self-host** (our reference instance
+already runs), **completion of encrypted multi-device sync**, **open-standards data portability**
+(Darwin Core / GBIF export), and production hardening — so a seed network can operate the whole stack
+without depending on us, or on anyone.
+
+### 4. Can you explain the whole project and its expected outcome?
+> ✍️ **vjrj: rewrite in your own voice.** Add first-person specifics (Kokopelli, the 2009 paper Plantare,
+> Ğ1nkgo). Scaffolding below.
+
+A handful of corporations control most of the world's seed supply, and traditional varieties — and the
+knowledge to grow them — are being lost. Sharing seeds has even become legally suspect (e.g. Kokopelli
+fined in France). Seed networks resist with notebooks and spreadsheets; there was no friendly, free,
+decentralised tool for them.
+
+Tane is built in **layers, each useful alone**, and most are **already shipped**:
+1. **Inventory (local-first) — shipped.** Encrypted seed bank on your phone (SQLite + SQLCipher), fully
+   offline, no account; backup + printed recovery; 7 languages.
+2. **Offer status — shipped.** Per item: private / gift / exchange / sale.
+3. **Local sharing (federated) — shipped.** Offers as signed Nostr events (NIP-99), discovered by
+   **coarse geohash** (~2.4 km, never your address); private DMs (NIP-17); ratings; Plantaré pledges;
+   saved-search alerts. No central operator can censor, sell data, or charge a fee.
+4. **Trust — shipped.** Egocentric Duniter-style web of trust (you vouch for people you've met); spam
+   from unknown keys is filtered with no central moderator.
+
+A de-risking spike proved the whole social happy-path on vetted pure-Dart libraries, and it is now
+**production code in people's hands**. **What this grant funds is the hosting and portability layer that
+makes the network genuinely community-owned** (see Part C): turning our running relay into a
+**reproducible, self-hostable recipe with moderation tooling**; completing **encrypted multi-device
+sync** (the transport already landed; the relay only ever sees ciphertext); **open-standards data
+portability** (opt-in Darwin Core / GBIF export toward public biodiversity atlases); plus trust
+cold-start for real seed fairs, optional Ğ1 price tags, and messaging/offers hardening.
+
+**Expected outcome:** any seed collective in Europe can **self-host the entire stack from a documented
+recipe** — relay, moderation, app, data — with identity and data fully portable and **zero dependency on
+Comunes or any single operator**. And because the hard parts live in the generic `commons_core` engine,
+the same infrastructure is reusable for other physical-commons networks (tool libraries are the next
+candidate).
+
+### 5. Compare your own project with existing or historical efforts
+> ✍️ **vjrj: rewrite in your own voice.** You know this sector first-hand — say why it refuses
+> per-transaction fees, and tell the Plantare story as its originator. Scaffolding below.
+
+- **Seed Savers Exchange, Graines de Troc, Arche Noah, Red de Semillas** — valuable, but each is a
+  **centralised web platform**: single operator, an account, a server that can go dark, no local-first
+  offline app, not federated, not self-hostable.
+- **Garden/inventory apps** — mostly **proprietary and extractive**; none do decentralised sharing or trust.
+- **Marketplaces (Wallapop-style)** — a central intermediary that takes a commission and can censor.
+  Tellingly, **no seed-exchange platform anywhere charges per-transaction fees** — the whole sector uses
+  gift/exchange/membership. We follow that, by design.
+- **Historical precedent — the Plantare (2009).** A paper "seed promissory note" already solved
+  decentralised trust and reciprocity *socially* (a bearer instrument, both parties hold a copy, the
+  ledger distributed across drawers). We digitise it without a central register.
+
+**Why it's needed / why existing solutions don't answer it:** none combines local-first, federation over
+open standards, self-hostability, identity/data portability, and a spam-resistant web of trust — while
+staying free and non-extractive. Tane already does, in production; the engine is reusable for other
+physical-commons networks.
+
+### 6. Significant technical challenges (the remaining work)
+- **Self-hostable relay + moderation** — `relay.comunes.org` already runs; the challenge is making it a
+  reproducible recipe others can run, with NIP-56 report handling and key-blocking, so moderation is
+  "with a response" but not centralised.
+- **Multi-device sync at the app level** — wire `SyncService` onto the landed encrypted `SyncTransport`:
+  serialise inventory, push on mutation, idempotent LWW import on receipt, stable per-install device id,
+  rare-conflict UI. Relay only ever sees ciphertext.
+- **Interoperability / portability** — opt-in Darwin Core / GBIF export of agrobiodiversity (blurred
+  location, collective-bank level, one-way) — exactly the data those atlases lack.
+- **Messaging/offers hardening** — NIP-44 interop-exact test vectors, offline DM delivery/retry, offer
+  expiry & revocation on already-replicated relays.
+- **Trust cold-start** — bootstrap the web of trust at real fairs / Ğ1 seed groups (QR, no network).
+- **Portable derived identity** — one root seed, one-way HKDF secp256k1 subkey for Nostr, one printable
+  QR backs up everything (already implemented; polish + docs).
+
+### 7. Project ecosystem & stakeholder engagement
+- **Seed networks:** Red de Semillas (Spain), **EC-LLD / Let's Liberate Diversity** (23 European seed
+  networks) for European reach; Arche Noah as a policy ally.
+- **Free-money communities (Ğ1/Duniter):** first pilots — existing identity, existing web of trust,
+  aligned values.
+- **Seed fairs and markets:** where trust bootstraps face to face.
+- **Translators & contributors:** already active via Weblate; code and docs public.
+
+### 8. Relevant prior experience & track record
+- **Shipped, in production:** Tane is **live on Google Play** (v0.1.1), GMS-free build ready for F-Droid,
+  site at tane.comunes.org, 7 languages via Weblate, RTL+CJK support, a full legal package, automated
+  store publishing (Fastlane) and CI (Forgejo Actions, ~131 test files). Block 1 + most of Block 2 done.
+- **vjrj** authored **Ğ1nkgo**, a Duniter/Ğ1 wallet in Flutter/Dart; Tane reuses its cryptographic
+  primitives (secp256k1, HKDF, Duniter identity) — no reinvention.
+- **vjrj originated the Plantare concept** (BAH-Semillero, 2009, CC-BY-SA) and wrote *"Las semillas del
+  conocimiento libre"* (2005) — a decade of domain authority in seed commons.
+- **Comunes** — registered association, stable legal counterpart for milestone accountability.
+
+### 9. Requested amount
+**€32,000.**
+
+### 10. Budget usage / task breakdown
+See Part C. Milestone-based; each milestone is an independent, verifiable deliverable with a CI-gated
+test suite where applicable. NLnet pays on verification of each milestone.
+
+### 11. Other funding sources (past and present)
+- Built so far with **volunteer work**; **no prior grant funding**; no overlapping funding for this scope.
+- Complementary community funding (e.g. Goteo matchfunding with Red de Semillas) is a *future*
+  sustainability avenue, not a duplicate of this request.
+
+### 12. Sustainability after the grant
+- **Local-first:** useful even with no servers and no maintainer — utility does not expire.
+- **Open code & data (AGPL-3.0, open export):** anyone can continue, fork, or **self-host the relay**.
+- **Cheap, community-run relays** (collectives / Comunes), plus opportunistic app-as-relay and
+  physical-proximity exchange at fairs.
+- **Non-extractive revenue only, never on the seed:** voluntary association membership (Seed Savers
+  model), optional managed services for institutional seed banks. No per-transaction commission — legally
+  prudent (EU PRM in trilogue) and coherent with the commons.
+
+### 13. Compliance & disclosure
+- **Licence:** AGPL-3.0 (code); CC-BY-SA (docs/assets). Compatible with the reused Duniter/Ğ1nkgo stack.
+- **Privacy statement:** acknowledged.
+- **Generative-AI disclosure (honest & minimal — paste into the form):**
+  > An AI assistant was used only as a drafting aid for this application text: to translate and structure
+  > an initial English outline from our pre-existing Spanish design documents (VISION.md, PLAN.md,
+  > docs/design/*), which predate and are independent of this application. All technical claims,
+  > architecture, milestones and budget are the applicant's own; the project lead rewrote and verified
+  > the text, and no AI output was submitted unedited. A prompt provenance log is available on request.
+  > The funded deliverables (M1–M5) will be human-authored (AI-assisted at most), released under
+  > AGPL-3.0, with no purely-AI-generated outcomes submitted for payment.
+
+  *Adjust to match what you actually did before sending. If you rewrite §3–§5 yourself (recommended),
+  this statement stays true and strong.*
+
+---
+
+## Part C — Milestones & budget (€32,000)
+
+Milestones reflect the **real remaining work** (Block 1 + most of Block 2 are already shipped). They are
+ordered by theme: **M1–M3 are the federated-hosting core** (self-hosting, sync, portability); **M4–M5
+harden and bootstrap it**. Each is an independent, verifiable deliverable; NLnet pays on verification.
+
+| # | Milestone | Verifiable deliverable | € |
+|---|-----------|------------------------|---|
+| **M1** | **Self-hostable relay recipe + moderation** | `relay.comunes.org` already runs; deliver a **reproducible, documented recipe** any seed network can self-host, plus NIP-56 report handling + key-blocking moderation tooling and an operator manual | 6,000 |
+| **M2** | **Multi-device sync (app `SyncService`)** | Inventory replication across a user's own devices over the landed encrypted `SyncTransport` (NIP-78): serialise + push on mutation, idempotent LWW import, stable per-install device id, conflict UI; tests (relay sees only ciphertext) | 8,000 |
+| **M3** | **Interoperability & data portability** | Opt-in Darwin Core / GBIF export of agrobiodiversity (blurred location, collective-bank level, one-way); polished open export/import + identity portability docs | 5,000 |
+| **M4** | **Messaging & offers hardening** | NIP-44 interop-exact test vectors, offline DM delivery/retry queue, offer expiry + revocation on replicated relays, spam-filter polish; CI-gated | 7,000 |
+| **M5** | **Trust cold-start + Ğ1 price integration + docs/release** | WoT cold-start flows for fairs / Ğ1 groups (QR, offline); Ğ1 price tag + deep-link to wallets (no in-app payment); contributor architecture guide + multilingual user guide; F-Droid release | 6,000 |
+| | **Total** | | **32,000** |
+
+---
+
+## Submission checklist (before nlnet.nl/propose)
+1. Cross-check every field above against the live form + Guide for Applicants.
+2. Fit test: does the abstract + §4 opening read "federation / portability / self-hosting" *before* "seeds"?
+3. Budget: milestones independent & verifiable, effort realistic, sum = €32,000.
+4. Compliance: FOSS licence stated, privacy statement acknowledged, **AI-disclosure + provenance log ready**.
+5. Confirm the 1 Aug 2026 deadline on the site; submit with several days' margin.
+6. Language pass: rewrite §3–§5 in vjrj's voice; clear, technical English throughout.
+
+---
+
+## Appendix — AI-use log (keep, attach or provide on request)
+Fill as you go so the disclosure is accurate and verifiable.
+
+| Date | Tool / model | Prompt (verbatim) | What the output was used for | Kept unedited? |
+|------|--------------|-------------------|------------------------------|----------------|
+| 2026-07-10 | Claude Code (Opus 4.8) | "Me ayudas a presentar tane a esta convocatoria? qué pedirías…" | Initial English draft/outline from repo docs | No — to be rewritten & verified by lead |
+| 2026-07-17 | Claude Code (Opus 4.8) | "He avanzado mucho en el desarrollo, puedes actualizar la application?…" | Updated draft to reflect shipped status + new milestones | No — to be rewritten & verified by lead |
+
+> Keep the raw session transcript alongside this table. If §3–§5 are rewritten by hand, note that here too.