[elementalvoid]

Closes #96.

Summary

Sync only on known networks is a Sync setting, off by default, with a list of names you type. On, uploads and scans wait unless the OS names the current wireless network in the list; a wired link always syncs, and an unprovable network holds.

 crates/sync-core/
 ├── network.rs        # decide() · NetworkSource · NetworkStatus
 ├── engine.rs         # second hold; check at start, OS event, 30s poll, upload network error
 ├── upload.rs         # is_held() = user pause OR network hold
 └── status.rs         # PauseReason · Status.network

 crates/app/
 ├── network.rs        # Linux D-Bus · Windows NLM + IP helper · macOS CoreWLAN/CaptiveNetwork
 ├── settings.rs       # sync_only_on_known_networks · known_networks
 ├── settings_view.rs  # switch · current network · add/remove rows · macOS Location row
 ├── status.rs         # reason on the card
 └── shell.rs          # reason in the tray tooltip

check_network
  if list off            → allowed
  if wired (no SSID)     → allowed
  if listed name         → allowed
  if unlisted name       → Paused — not on a known network
  if unknown / error / timeout / empty name / no link
                         → Paused — network unknown

The hold is separate from the user's pause, so Resume cannot override the list; Status.pause carries the reason to the dashboard and the tray.

Evidence

• cargo nextest run --locked --workspace: 941 passed, 2 skipped. cargo clippy --workspace --all-targets -D warnings and cargo fmt --check clean.
• The check's table and the fake-backend cases (crates/sync-core/tests/it/network.rs): listed, not listed, list off, wired, empty name, OS error and recovery, leaving a listed network (queue kept), returning (resumes without a click), the poll noticing a missed event, an upload network error re-checking, a hung OS call timing out and holding, a closed event channel not spinning.
• Release workflow dispatched on this branch — all three platform jobs green (compiles the Windows COM sink and the macOS backends that only target-probe locally): https://github.com/elementalvoid/immich-sync/actions/runs/43332924214
• Hand-checked on real hardware by the reporter: macOS (Location prompt, current network name, paused/resumed, wrapping row) and Windows (profile name, event pause/resume, wired syncs). Linux was built and tested in a dev container only — the NetworkManager name, wired type mapping and D-Bus events still need a desktop run (docs/network-hand-checks.md).

Merge Danger

Door: two-way. The setting defaults off (existing behaviour), the settings file gains two fields with defaults, and nothing is deleted or migrated.

Blast Radius: contained — one new setting; the only always-on paths are the engine's network check (platform syscall per 30s while the engine runs) and one startup read.

Docs: SPEC R8.8, GLOSSARY, ADR 0008 (Location prompt), README, docs/network-hand-checks.md.