Lifecycle

Installation states

Install ──▶ pending_destination ──connect──▶ active ──uninstall──▶ retired
                                    │
                                    └─ destination revoked ─▶ active + error
                                            (reconnect to resume)

pending_destination — installed, no destination yet. The store card shows “Finish setup”; nothing syncs.
active — destination connected. Syncing runs; UI contributions mount.
active with a last error — e.g. the provider revoked the grant. Surfaces show “disconnected — reconnect to resume”; syncs skip (revoked) instead of failing repeatedly.
Retired — uninstalled (soft-deleted). Re-installing starts a fresh installation and re-syncs from the beginning.

The sync queue

One pending job per installation, whatever asks:

Reason	Enqueued by
`event`	Workspace data changing (e.g. a photo added or removed)
`reconcile`	The periodic reconcile schedule — and the automatic first sync when a destination connects
`manual`	The customer’s “Sync now”

Duplicate requests are absorbed into the existing pending job. The runner claims jobs, runs the pass, ledgers deliveries idempotently, and reclaims orphaned running jobs on boot — a crash mid-pass means a retry, not a stuck installation. Surfaces poll while a sync is pending, so delivered/to-go counts move live without a reload.

Uninstall

Uninstall runs a deliberate choreography, in this order:

Revoke at the provider — the destination’s token is revoked with Google/Dropbox first (best-effort: an unreachable provider logs one line and never blocks the uninstall).
Soft-mark locally — the destination is marked revoked, legacy credentials die, and the installation gets uninstalled_at.

Revoke-then-retire, not the reverse: if the process crashes partway, a retry still finds the installation and re-attempts the revoke — a live grant is never stranded with no path back.

What the customer is told, verbatim from the confirm dialog: the mirror stops, already-delivered files stay in their folder, and installing again re-syncs from the beginning. Design your sync to make that promise true — deliveries must be idempotent and destination files must be safe to leave behind.

UI kill switch

Separate from uninstall, workspace owners can toggle “Show in dashboard” per app — the platform simply stops mounting your slots. Sync keeps running; only the UI hides. Session-local crash-loop disabling (Concepts) is a third, independent mechanism.