diff --git a/Cargo.lock b/Cargo.lock
index 8c04871..a0f3355 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1497,6 +1497,7 @@ checksum = "1e0e367e4e7da84520dedcac1901e4da967309406d1e51017ae1abfb97adbd38"
 dependencies = [
  "bitflags 2.13.2",
  "block2 0.6.2",
+ "libc",
  "objc2 0.6.5",
 ]
 
@@ -3743,14 +3744,23 @@ dependencies = [
  "anyhow",
  "apple-native-keyring-store",
  "async-channel",
+ "dbus",
  "dbus-secret-service-keyring-store",
  "directories",
+ "dispatch2",
  "embed-resource",
  "gpui-kit",
  "gpui-tray",
  "interprocess",
  "keyring-core",
+ "libc",
  "mock-immich",
+ "objc2 0.6.5",
+ "objc2-core-foundation",
+ "objc2-core-location",
+ "objc2-core-wlan",
+ "objc2-foundation 0.3.2",
+ "objc2-system-configuration",
  "rusqlite",
  "serde",
  "smappservice-rs",
@@ -3762,6 +3772,8 @@ dependencies = [
  "tracing",
  "tracing-appender",
  "tracing-subscriber",
+ "windows 0.62.2",
+ "windows-core 0.62.2",
  "windows-native-keyring-store",
  "windows-registry 0.6.1",
  "zip",
@@ -4900,6 +4912,16 @@ dependencies = [
  "objc2-foundation 0.3.2",
 ]
 
+[[package]]
+name = "objc2-contacts"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b034b578389f89a85c055eacc8d8b368be5f04a6c1b07f672bf3aec21d0ef621"
+dependencies = [
+ "objc2 0.6.5",
+ "objc2-foundation 0.3.2",
+]
+
 [[package]]
 name = "objc2-core-data"
 version = "0.2.2"
@@ -4971,6 +4993,19 @@ dependencies = [
  "objc2-foundation 0.3.2",
 ]
 
+[[package]]
+name = "objc2-core-location"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ca347214e24bc973fc025fd0d36ebb179ff30536ed1f80252706db19ee452009"
+dependencies = [
+ "block2 0.6.2",
+ "dispatch2",
+ "objc2 0.6.5",
+ "objc2-contacts",
+ "objc2-foundation 0.3.2",
+]
+
 [[package]]
 name = "objc2-core-text"
 version = "0.3.2"
@@ -4997,6 +5032,20 @@ dependencies = [
  "objc2-metal 0.3.2",
 ]
 
+[[package]]
+name = "objc2-core-wlan"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c71e34919aba0d701380d911702455038a8a3587467fe0141d6a71501e7ffe48"
+dependencies = [
+ "bitflags 2.13.2",
+ "objc2 0.6.5",
+ "objc2-core-foundation",
+ "objc2-foundation 0.3.2",
+ "objc2-security",
+ "objc2-security-foundation",
+]
+
 [[package]]
 name = "objc2-encode"
 version = "4.1.0"
@@ -5101,6 +5150,16 @@ dependencies = [
  "objc2-core-foundation",
 ]
 
+[[package]]
+name = "objc2-security-foundation"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ef76382e9cedd18123099f17638715cc3d81dba3637d4c0d39ab69df2ef345a5"
+dependencies = [
+ "objc2 0.6.5",
+ "objc2-foundation 0.3.2",
+]
+
 [[package]]
 name = "objc2-service-management"
 version = "0.3.2"
@@ -5114,6 +5173,20 @@ dependencies = [
  "objc2-security",
 ]
 
+[[package]]
+name = "objc2-system-configuration"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7216bd11cbda54ccabcab84d523dc93b858ec75ecfb3a7d89513fa22464da396"
+dependencies = [
+ "bitflags 2.13.2",
+ "dispatch2",
+ "libc",
+ "objc2 0.6.5",
+ "objc2-core-foundation",
+ "objc2-security",
+]
+
 [[package]]
 name = "objc2-ui-kit"
 version = "0.3.2"
diff --git a/GLOSSARY.md b/GLOSSARY.md
index 9f0b7cd..2144aae 100644
--- a/GLOSSARY.md
+++ b/GLOSSARY.md
@@ -151,6 +151,10 @@ _Avoid_: settings dialog, preferences
 The status icon in the notification area. It shows sync state and it opens the config window.
 _Avoid_: system tray, notification icon
 
+**Pause**:
+The user's hold on new uploads, from the dashboard control or the tray menu. It is separate from the known-network hold, so resuming never overrides the list.
+_Avoid_: stop, disable sync
+
 **Folder status**:
 The sync state of one source folder. The dashboard shows one card per source folder, and the folder detail renders the same status in full.
 _Avoid_: folder state, folder progress
@@ -163,6 +167,22 @@ _Avoid_: add dialog, onboarding
 The enlarged view of one source folder: its full path, live state and counts, its own upload activity, settings, timestamps, and the list of the assets it has uploaded, with links into the Failed and Review views filtered to it. Its Remove needs a confirmation, because the folder's uploaded assets stay on the server.
 _Avoid_: folder modal, folder popup
 
+**Known networks**:
+The user's list of network names for the **Sync only on known networks** setting, compared against the name the OS reports for the current wireless network. A wired link always syncs, because it has no name to match. The list is off by default.
+_Avoid_: allowed networks, trusted networks, whitelist
+
+**Network check**:
+The client's one read of the OS's current network, through a **network source** per platform. It decides whether uploads are held, and its answer is what the Settings page shows as the current network.
+_Avoid_: SSID lookup, network probe, reachability check
+
+**Network source**:
+The platform backend that answers the network check: NetworkManager over D-Bus on Linux, the Network List Manager on Windows, and CoreWLAN with CaptiveNetwork on macOS. It also reports the OS's network-change events, which the client uses to re-check before the 30-second fallback poll.
+_Avoid_: provider, adapter, detector
+
+**Pause reason**:
+Why uploads are held: the user's own **pause**, or the known-network list. Both read as the paused activity state; the dashboard and the tray tooltip phrase the reason.
+_Avoid_: pause kind, pause cause, hold type
+
 ### Diagnostics
 
 **Client version**:
diff --git a/README.md b/README.md
index 1b0fcec..66b4e72 100644
--- a/README.md
+++ b/README.md
@@ -114,6 +114,14 @@ copy and its shortcuts.
    Drive, or on a removable or network volume, asks for access to files and
    folders. Allow it; without the grant the folder shows as unreadable, with the
    reason (see [Troubleshooting](#troubleshooting)).
+4. Turning **Sync only on known networks** on asks for Location permission,
+   because macOS reveals the Wi-Fi network name only to an app that has it. The
+   unsigned build cannot register for the permission the way a signed app does,
+   so if macOS refuses it the Settings page says the name is unknown, offers
+   **Open Location Settings**, and the list holds uploads; turning the list off
+   restores syncing on any network. The prompt only works from the installed
+   **Immich Sync** app: a build run out of `target/` is not an app bundle, so
+   macOS cannot show it and the page stays unknown.
 
 To uninstall, first turn **Autostart at login** off if macOS refused the
 unsigned login item: that removes the LaunchAgent at
@@ -254,8 +262,10 @@ its card instead of producing one error per file.
   **Trash** for it. A rename is recognized by content and is not a deletion.
 - **Settings.** Changes save immediately. General holds **Autostart at login**
   (off by default); Limits holds the bandwidth limit (0 means unlimited) and
-  concurrent uploads; Sync holds the reconciliation scan interval and the retry
-  attempt cap; Tagging holds **Tag uploaded assets** (on by default), which adds
+  concurrent uploads; Sync holds the reconciliation scan interval, the retry
+  attempt cap, and **Sync only on known networks** (off by default) with the
+  list of network names beside it; Tagging holds **Tag uploaded assets** (on by
+  default), which adds
   the fixed tag `immich-sync` to every asset the client uploads. With an API
   key, tagging needs the `tag.create`, `tag.asset`, and `asset.update`
   permissions. The same section shows the backfill's progress and **Tag existing
@@ -272,6 +282,12 @@ its card instead of producing one error per file.
   newest file while the view is open; scrolling up pauses it and shows the new
   line count with **Jump to latest**, and **Refresh** re-reads the tail once.
   The log never contains the password, API key, or session token.
+- **Known networks.** With **Sync only on known networks** on, the client
+  pauses unless the OS names the current Wi-Fi network in your list, and shows
+  the name the OS reports beside the list. Nothing fails and the queue is kept;
+  syncing resumes by itself when a listed network comes back. Ethernet always
+  syncs, and with the list off the client syncs on any network. The name is read
+  from the OS on this computer and is never sent anywhere.
 - The theme follows the system theme.
 
 ## Where everything lives
@@ -369,6 +385,20 @@ identity.
 After an update, the login-Keychain entry and the **Files & Folders** grant can
 ask again. Allow them again and syncing continues; nothing is lost.
 
+### Sync is paused and the reason names the network
+
+**Sync only on known networks** is on and the client cannot prove the current
+network is on your list. The Settings page shows the name the OS reports
+("unknown" with the reason when it cannot name it), and the dashboard and tray
+say why. Add the network to the list, connect to a listed network, or turn the
+setting off. Ethernet always syncs. On Linux the name comes from NetworkManager,
+so a machine using systemd-networkd or `iwd` reports no name and stays paused
+while the setting is on; on macOS the name needs the Location grant, and the
+Settings page has **Open Location Settings** when it is missing (the prompt
+appears only in the installed app bundle, not in a `cargo run` build). Full
+checks per platform are in
+[docs/network-hand-checks.md](docs/network-hand-checks.md).
+
 ### Sync does not pick up a new file
 
 Hidden files, symlinks, temporary files, and system files are skipped by
diff --git a/SPEC.md b/SPEC.md
index 7c29f57..3e22c45 100644
--- a/SPEC.md
+++ b/SPEC.md
@@ -117,8 +117,9 @@ Acceptance: a sync at a 1 MB/s limit produces near-limit observed throughput. Ra
 - R8.5 Autostart at login is a setting. The default is off. Windows uses its Run key, Linux an XDG autostart entry, and macOS a Login Item (`SMAppService.mainApp`), falling back to a LaunchAgent plist when an unsigned bundle is refused.
 - R8.6 The theme follows the system theme.
 - R8.7 Pause stops new uploads. In-flight uploads finish or stop at a safe point.
+- R8.8 **Sync only on known networks** is a setting, off by default, with a list of names the user types. While it is on, uploads and scans wait unless the OS names the current wireless network in the list: no new attempts, the queue is kept, nothing fails, and syncing resumes on its own when a listed network comes back. A wired connection always syncs, and the list's help text says so. It fails closed: an unknown name, a missing or empty OS answer, an OS call that errors or times out, and no network at all hold uploads, and the dashboard and tray say why ("Paused — not on a known network", "Paused — network unknown"). It checks at startup, on the OS's network-change events, on a 30-second fallback poll, and after any upload network error. The Settings page shows the name the OS reports beside the list.
 
-Acceptance: every tray action works from a cold start. A second launch does not start a second process. Pause stops new uploads within 5 seconds.
+Acceptance: every tray action works from a cold start. A second launch does not start a second process. Pause stops new uploads within 5 seconds. Leaving a listed network holds uploads within 5 seconds, the queue keeps every waiting file, and returning to a listed network resumes without a click.
 
 ### R9 — Settings and paths
 
diff --git a/crates/app/Cargo.toml b/crates/app/Cargo.toml
index d785740..651b8d2 100644
--- a/crates/app/Cargo.toml
+++ b/crates/app/Cargo.toml
@@ -148,6 +148,10 @@ embed-resource = "3"
 # (ADR 0006 research §3.2). `crypto-rust` keeps the D-Bus transport encryption
 # in Rust, so the build needs no OpenSSL.
 dbus-secret-service-keyring-store = { version = "=1.0.1", features = ["crypto-rust"] }
+# The known-network check (R8.8): NetworkManager's primary connection. The
+# crate is already in the tree through the keyring store, so this adds no
+# dependency, only a direct edge to it.
+dbus = "0.9"
 
 [target."cfg(target_os = \"macos\")".dependencies]
 # SMAppService (macOS 13+), the login-item API behind the autostart setting.
@@ -162,6 +166,39 @@ smappservice-rs = "=0.1.3"
 # (ADR 0008).
 apple-native-keyring-store = { version = "=1.0.2", features = ["keychain"] }
 
+# The known-network check (R8.8): the SSID through CaptiveNetwork, the Wi-Fi
+# interface through CoreWLAN, the Location grant that gates the SSID, and a
+# System Configuration store for change events. The objc2 family is already in
+# the tree through the login-item wrapper; every crate here is a safe binding,
+# so the backend's unsafe blocks are only the calls themselves.
+dispatch2 = "0.3"
+# `getifaddrs`, to tell "Wi-Fi off with Ethernet" from "no link at all".
+libc = "0.2"
+objc2 = "0.6"
+objc2-core-foundation = "0.3"
+objc2-core-location = "0.3"
+objc2-core-wlan = "0.3"
+objc2-foundation = "0.3"
+objc2-system-configuration = "0.3"
+
 [target."cfg(windows)".dependencies]
 windows-native-keyring-store = "=1.1.0"
 windows-registry = "0.6"
+# The known-network check (R8.8): the Network List Manager for the connected
+# profile's name and its change events, the COM plumbing for both, and the IP
+# helper's adapter list for the media type. The module paths changed in 0.62
+# from `NetworkManagement::NetworkConnector` to
+# `Networking::NetworkListManager`.
+# `#[implement]` expands to `windows_core::` paths, so the crate that defines
+# the COM sink must name it directly, not only through `windows::core`.
+windows-core = "0.62"
+windows = { version = "0.62", features = [
+    "Win32_Foundation",
+    "Win32_NetworkManagement_IpHelper",
+    "Win32_NetworkManagement_Ndis",
+    "Win32_Networking_NetworkListManager",
+    "Win32_Networking_WinSock",
+    "Win32_System_Com",
+    "Win32_System_Ole",
+    "Win32_System_Variant",
+] }
diff --git a/crates/app/macos/Info.plist b/crates/app/macos/Info.plist
index 9a2c554..f48588e 100644
--- a/crates/app/macos/Info.plist
+++ b/crates/app/macos/Info.plist
@@ -2,8 +2,9 @@
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <!--
   Merged over the Info.plist cargo-packager generates, with a last-writer-wins
-  insert per key, so it carries only the file-access usage strings macOS shows in
-  its privacy prompt. Every other key — CFBundleIdentifier, the version keys,
+  insert per key, so it carries only the usage strings macOS shows in its privacy
+  prompts: the file-access ones, and the Location grant the Wi-Fi network name
+  needs (SPEC R8.8). Every other key — CFBundleIdentifier, the version keys,
   LSMinimumSystemVersion, NSHighResolutionCapable, LSUIElement — comes from
   crates/app/Cargo.toml and the packager's own generator. Repeating one here
   would silently override the manifest instead of being ignored.
@@ -16,6 +17,10 @@
 	<string>Immich Sync uploads photos and videos from the source folders you add, including folders in your Documents folder.</string>
 	<key>NSDownloadsFolderUsageDescription</key>
 	<string>Immich Sync uploads photos and videos from the source folders you add, including folders in your Downloads folder.</string>
+	<key>NSLocationUsageDescription</key>
+	<string>Immich Sync reads the current Wi-Fi network name, so it can sync only on the networks you list.</string>
+	<key>NSLocationWhenInUseUsageDescription</key>
+	<string>Immich Sync reads the current Wi-Fi network name, so it can sync only on the networks you list.</string>
 	<key>NSNetworkVolumesUsageDescription</key>
 	<string>Immich Sync uploads photos and videos from the source folders you add on mounted network volumes.</string>
 	<key>NSRemovableVolumesUsageDescription</key>
diff --git a/crates/app/src/diagnostics.rs b/crates/app/src/diagnostics.rs
index f9ce600..7b9edd4 100644
--- a/crates/app/src/diagnostics.rs
+++ b/crates/app/src/diagnostics.rs
@@ -114,6 +114,8 @@ impl DiagnosticsModel {
             server: ServerInfo::default(),
             status: Status {
                 activity: sync_core::status::Activity::Idle,
+                pause: None,
+                network: sync_core::network::NetworkStatus::default(),
                 folders: Vec::new(),
                 counts: sync_core::store::FolderCounts::default(),
                 last_error: None,
diff --git a/crates/app/src/engine.rs b/crates/app/src/engine.rs
index 3c3d359..f5897b5 100644
--- a/crates/app/src/engine.rs
+++ b/crates/app/src/engine.rs
@@ -12,7 +12,10 @@ use std::time::Duration;
 use gpui_kit::*;
 use sync_core::engine::{Engine, EngineConfig, Limits};
 use sync_core::meter::UploadTraffic;
-use sync_core::status::{Activity, ConnectionHealth, FolderStatus, Status, StatusInputs};
+use sync_core::network::{KnownNetworks, NetworkSource, NetworkStatus};
+use sync_core::status::{
+    Activity, ConnectionHealth, FolderStatus, PauseReason, Status, StatusInputs,
+};
 use sync_core::store::{
     AlbumPath, AlbumScope, FailedItem, FolderCounts, ReviewItem, SourceFolder, StateStore,
 };
@@ -40,14 +43,17 @@ const STATUS_POLL: Duration = Duration::from_millis(250);
 /// this only decides how soon a parked item or a missing file shows up.
 const FAILED_POLL_TICKS: u32 = 4;
 
-/// The live settings the app pushes to a running engine (R7.1, R7.2, R3.7).
+/// The live settings the app pushes to a running engine (R7.1, R7.2, R3.7,
+/// R8.8).
 ///
-/// One channel carries both, so a change to either reaches the engine in the
+/// One channel carries them, so a change to any reaches the engine in the
 /// order the view made it.
-#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+#[derive(Clone, Debug, PartialEq, Eq)]
 struct LiveSettings {
     limits: Limits,
     tag_uploaded_assets: bool,
+    /// The known-network list (R8.8).
+    known: KnownNetworks,
 }
 
 /// The app-scoped engine and the status the views render.
@@ -55,6 +61,12 @@ pub struct EngineModel {
     connection: Entity<ConnectionModel>,
     store_model: Entity<StoreModel>,
     paths: AppPaths,
+    /// The platform's network names, handed to every engine this model starts
+    /// (R8.8).
+    network_source: Arc<dyn NetworkSource>,
+    /// The network the startup check read, so the Settings page can name it
+    /// before an engine runs (R8.8).
+    network: NetworkStatus,
     engine: Option<Arc<Engine>>,
     /// The newest live-settings change for the running engine. One applier task
     /// per engine drains it, so two quick edits cannot land out of order.
@@ -198,6 +210,7 @@ impl EngineModel {
         paths: &AppPaths,
         cx: &mut Context<Self>,
     ) -> Self {
+        let network_source = crate::network::platform_network();
         let subscriptions = vec![
             // The status, the review list and the parked list are refreshed
             // when the store opens, so a review that already waits in the
@@ -218,6 +231,21 @@ impl EngineModel {
                 this.try_start_engine(cx);
             }),
         ];
+        // R8.8: one check at startup, off the UI thread, so the Settings page
+        // can name the network while the client is signed out. Once an engine
+        // runs, its own check and its status own the answer.
+        let source = Arc::clone(&network_source);
+        cx.spawn(async move |this, cx| {
+            let answer = cx
+                .background_executor()
+                .spawn(async move { source.current() })
+                .await;
+            let _ = this.update(cx, |model, cx| {
+                model.network = NetworkStatus::from_result(&answer);
+                model.refresh_status(cx);
+            });
+        })
+        .detach();
         let poll = cx.spawn(async move |this, cx| {
             let mut ticks = 0_u32;
             loop {
@@ -248,6 +276,8 @@ impl EngineModel {
             connection,
             store_model,
             paths: paths.clone(),
+            network_source,
+            network: NetworkStatus::default(),
             engine: None,
             live: None,
             status: empty_status(),
@@ -696,7 +726,7 @@ impl EngineModel {
         // The applier task wakes on the newest value, so a change that
         // overtakes this one cannot be overwritten by it.
         if let Some(live) = &self.live {
-            let mut next = *live.borrow();
+            let mut next = live.borrow().clone();
             next.limits = Limits {
                 bandwidth_bytes_per_second,
                 concurrency: concurrency.max(1),
@@ -714,12 +744,23 @@ impl EngineModel {
         &self.tag
     }
 
+    /// Moves the running engine to the user's newest known-network list
+    /// (R8.8). Before it starts this is a no-op: the settings file it reads at
+    /// start already holds the value the view wrote.
+    pub fn set_known_networks(&mut self, known: KnownNetworks) {
+        if let Some(live) = &self.live {
+            let mut next = live.borrow().clone();
+            next.known = known;
+            live.send_replace(next);
+        }
+    }
+
     /// Turns the sync tag on or off on the running engine without a restart
     /// (R3.7). Before it starts this is a no-op: the settings file it reads at
     /// start already holds the value the view wrote.
     pub fn set_tag_uploads(&mut self, enabled: bool) {
         if let Some(live) = &self.live {
-            let mut next = *live.borrow();
+            let mut next = live.borrow().clone();
             next.tag_uploaded_assets = enabled;
             live.send_replace(next);
         }
@@ -1069,6 +1110,7 @@ impl EngineModel {
             return false;
         };
         let config_file = self.paths.config_file.clone();
+        let network = Arc::clone(&self.network_source);
         let paused = self.paused;
         self.start_generation = self.start_generation.wrapping_add(1);
         let start_generation = self.start_generation;
@@ -1078,6 +1120,9 @@ impl EngineModel {
                 // The settings file is small; reading it here keeps the UI
                 // thread out of the file system (N2).
                 let settings = SettingsStore::open(config_file).settings().clone();
+                // R8.8: the known-network list is the settings file's, read
+                // where the rest of the engine's settings are read.
+                let known = settings.known_networks();
                 let config = EngineConfig {
                     concurrency: usize::try_from(settings.concurrency.max(1)).unwrap_or(4),
                     bandwidth_bytes_per_second: settings.bandwidth_bytes_per_second,
@@ -1098,6 +1143,7 @@ impl EngineModel {
                         if paused {
                             engine.pause();
                         }
+                        engine.watch_network(network, known);
                         engine.start();
                         Ok(engine)
                     }
@@ -1133,15 +1179,17 @@ impl EngineModel {
                                 tokio::sync::watch::channel(LiveSettings {
                                     limits: engine.limits(),
                                     tag_uploaded_assets: engine.tag_status().enabled,
+                                    known: engine.known_networks(),
                                 });
                             let applier = Arc::clone(&engine);
                             runtime.spawn(async move {
                                 while incoming.changed().await.is_ok() {
                                     // Copy first: the borrow is not `Send`, so
                                     // it must not live across the await.
-                                    let live = *incoming.borrow_and_update();
+                                    let live = incoming.borrow_and_update().clone();
                                     applier.set_limits(live.limits).await;
                                     applier.set_tag_uploads(live.tag_uploaded_assets).await;
+                                    applier.set_known_networks(live.known);
                                 }
                             });
                             model.live = Some(changes);
@@ -1210,7 +1258,10 @@ impl EngineModel {
                     .collect::<Vec<_>>();
                 Status::derive(StatusInputs {
                     folders,
-                    paused: self.paused,
+                    pause: self.paused.then_some(PauseReason::User),
+                    // The startup check's answer; an engine's own check
+                    // takes over when it runs (R8.8).
+                    network: self.network.clone(),
                     connection: ConnectionHealth::from_state(self.connection.read(cx).state()),
                     // R5.4: the cached list is the store's whole review,
                     // including items under a removed source folder, so it is
@@ -1270,6 +1321,8 @@ impl EngineModel {
 fn empty_status() -> Status {
     Status {
         activity: Activity::Idle,
+        pause: None,
+        network: NetworkStatus::default(),
         folders: Vec::new(),
         counts: FolderCounts::default(),
         last_error: None,
diff --git a/crates/app/src/folder_panel.rs b/crates/app/src/folder_panel.rs
index 7018b83..9622291 100644
--- a/crates/app/src/folder_panel.rs
+++ b/crates/app/src/folder_panel.rs
@@ -1742,6 +1742,8 @@ mod tests {
         };
         let status = Status {
             activity: Activity::NeedsAttention,
+            pause: None,
+            network: sync_core::network::NetworkStatus::default(),
             folders: vec![FolderStatus {
                 path: "/photos".to_string(),
                 recursive: true,
@@ -1855,6 +1857,8 @@ mod tests {
         };
         let status = Status {
             activity: Activity::Syncing,
+            pause: None,
+            network: sync_core::network::NetworkStatus::default(),
             folders: vec![FolderStatus {
                 path: "/photos".to_string(),
                 recursive: true,
@@ -2053,6 +2057,8 @@ mod tests {
         };
         let status = Status {
             activity: Activity::Idle,
+            pause: None,
+            network: sync_core::network::NetworkStatus::default(),
             folders: vec![FolderStatus {
                 path: "/photos".to_string(),
                 recursive: true,
diff --git a/crates/app/src/lib.rs b/crates/app/src/lib.rs
index fdbbac9..187c921 100644
--- a/crates/app/src/lib.rs
+++ b/crates/app/src/lib.rs
@@ -22,6 +22,7 @@ mod git_revision;
 pub mod instance;
 pub mod logging;
 pub mod logs_view;
+pub mod network;
 mod notice;
 pub mod notify;
 pub mod path_picker;
diff --git a/crates/app/src/network.rs b/crates/app/src/network.rs
new file mode 100644
index 0000000..3e432d4
--- /dev/null
+++ b/crates/app/src/network.rs
@@ -0,0 +1,650 @@
+//! The platform's current network name (SPEC R8.8).
+//!
+//! One backend per platform, behind [`NetworkSource`]. The backends only answer
+//! "which network is this"; the decision, the holds and the fallback poll live
+//! in `sync_core::network` and the engine, so nothing here decides anything.
+//!
+//! Each backend fails closed by returning a [`NetworkProblem`] rather than an
+//! invented name: an OS that cannot be asked pauses the sync while the list is
+//! on (R8.8).
+
+use std::sync::Arc;
+
+use sync_core::network::{CurrentNetwork, NetworkProblem, NetworkSource};
+
+/// The backend for this platform (R8.8).
+#[must_use]
+pub fn platform_network() -> Arc<dyn NetworkSource> {
+    #[cfg(target_os = "linux")]
+    {
+        Arc::new(linux::LinuxNetwork)
+    }
+    #[cfg(windows)]
+    {
+        Arc::new(windows_backend::WindowsNetwork)
+    }
+    #[cfg(target_os = "macos")]
+    {
+        Arc::new(macos::MacNetwork)
+    }
+    #[cfg(not(any(target_os = "linux", target_os = "macos", windows)))]
+    {
+        Arc::new(Unavailable::new(
+            "this platform has no network check".to_string(),
+        ))
+    }
+}
+
+/// Asks for the Location permission the macOS SSID needs (R8.8).
+///
+/// The Settings switch calls this on the UI thread when the user turns the
+/// known-network list on. It is a no-op everywhere else, and a no-op on a
+/// machine that already answered the prompt.
+#[cfg(target_os = "macos")]
+pub fn request_location_permission() {
+    macos::request_location_permission();
+}
+
+/// Asks for the Location permission the macOS SSID needs (R8.8).
+///
+/// Every other platform has no permission to ask for, so this is a no-op.
+#[cfg(not(target_os = "macos"))]
+pub fn request_location_permission() {}
+
+/// Whether macOS has granted the Location access the Wi-Fi name needs (R8.8).
+#[cfg(target_os = "macos")]
+#[must_use]
+pub fn location_permission_granted() -> bool {
+    macos::location_permission_granted()
+}
+
+/// A backend that cannot answer on this machine, with the reason the Settings
+/// page shows.
+#[derive(Debug)]
+pub struct Unavailable {
+    reason: String,
+}
+
+impl Unavailable {
+    /// A backend that always reports `reason` (R8.8).
+    #[must_use]
+    pub fn new(reason: String) -> Self {
+        Self { reason }
+    }
+}
+
+impl NetworkSource for Unavailable {
+    fn current(&self) -> Result<CurrentNetwork, NetworkProblem> {
+        Err(NetworkProblem::new(self.reason.clone()))
+    }
+}
+
+/// NetworkManager's primary connection, the access point's SSID, and the
+/// connection's id (R8.8).
+#[cfg(target_os = "linux")]
+mod linux {
+    use std::time::Duration;
+
+    use dbus::blocking::Connection;
+    use dbus::message::MatchRule;
+    use sync_core::network::{CurrentNetwork, NetworkProblem, NetworkSource};
+    use tokio::sync::mpsc::Receiver;
+
+    const MANAGER: &str = "org.freedesktop.NetworkManager";
+    const MANAGER_PATH: &str = "/org/freedesktop/NetworkManager";
+    const ACTIVE: &str = "org.freedesktop.NetworkManager.Connection.Active";
+    const ACCESS_POINT: &str = "org.freedesktop.NetworkManager.AccessPoint";
+    const PROPERTIES: &str = "org.freedesktop.DBus.Properties";
+    const TIMEOUT: Duration = Duration::from_secs(2);
+
+    /// The NetworkManager backend.
+    pub struct LinuxNetwork;
+
+    /// One property, through `org.freedesktop.DBus.Properties.Get`.
+    fn property<T>(
+        connection: &Connection,
+        path: &str,
+        interface: &str,
+        name: &str,
+    ) -> Result<T, NetworkProblem>
+    where
+        T: for<'z> dbus::arg::Get<'z>,
+    {
+        let proxy = connection.with_proxy(MANAGER, path, TIMEOUT);
+        let (value,): (dbus::arg::Variant<T>,) = proxy
+            .method_call(PROPERTIES, "Get", (interface, name))
+            .map_err(|error| {
+                NetworkProblem::new(format!("NetworkManager did not answer: {error}"))
+            })?;
+        Ok(value.0)
+    }
+
+    impl NetworkSource for LinuxNetwork {
+        fn current(&self) -> Result<CurrentNetwork, NetworkProblem> {
+            // A connection per check: the blocking connection is not shared
+            // between threads, and one check runs every 30 seconds.
+            let connection = Connection::new_system().map_err(|error| {
+                NetworkProblem::new(format!("NetworkManager not found: {error}"))
+            })?;
+            // The primary connection is the one carrying the default route, so
+            // a VPN or a second interface cannot be mistaken for it.
+            let primary: dbus::Path<'static> =
+                property(&connection, MANAGER_PATH, MANAGER, "PrimaryConnection")?;
+            let active = primary.to_string();
+            if active == "/" {
+                return Err(NetworkProblem::new("no active network connection"));
+            }
+            let kind: String = property(&connection, &active, ACTIVE, "Type")?;
+            match kind.as_str() {
+                "802-11-wireless" => {}
+                // A link with no SSID to match: Ethernet, or a compound of it.
+                // It always syncs (R8.8).
+                "802-3-ethernet" | "802-3-wire" | "bond" | "bridge" | "vlan" => {
+                    return Ok(CurrentNetwork::Wired);
+                }
+                // Mobile broadband, Bluetooth tethering, a VPN or a tunnel:
+                // metered, or carried over a network this check cannot name, so
+                // it must not be mistaken for a wired link.
+                other => {
+                    return Err(NetworkProblem::new(format!(
+                        "the connection type {other} has no network name to match"
+                    )));
+                }
+            }
+            // The access point's SSID is the name the OS shows. A profile with
+            // no access point (connecting, or a hidden network) falls back to
+            // the connection id, which NetworkManager sets from the SSID.
+            let ssid =
+                property::<dbus::Path<'static>>(&connection, &active, ACTIVE, "SpecificObject")
+                    .ok()
+                    .map(|ap| ap.to_string())
+                    .filter(|ap| ap != "/")
+                    .and_then(|ap| property::<Vec<u8>>(&connection, &ap, ACCESS_POINT, "Ssid").ok())
+                    .and_then(|bytes| String::from_utf8(bytes).ok())
+                    .filter(|name| !name.is_empty());
+            let name = match ssid {
+                Some(name) => name,
+                None => property::<String>(&connection, &active, ACTIVE, "Id")?,
+            };
+            Ok(CurrentNetwork::Wireless(name))
+        }
+
+        fn changes(&self) -> Option<Receiver<()>> {
+            // A second connection on its own thread: the blocking connection's
+            // message processing must not run beside its calls (dbus crate).
+            let (sender, receiver) = tokio::sync::mpsc::channel(4);
+            std::thread::spawn(move || {
+                let Ok(connection) = Connection::new_system() else {
+                    return;
+                };
+                let state = sender.clone();
+                let mut rule = MatchRule::new_signal(MANAGER, "StateChanged");
+                rule.sender = Some(MANAGER.into());
+                let added = connection.add_match(
+                    rule,
+                    move |_: (u32,), _: &Connection, _: &dbus::Message| {
+                        let _ = state.try_send(());
+                        true
+                    },
+                );
+                if added.is_err() {
+                    return;
+                }
+                let properties = sender.clone();
+                // Every NetworkManager property change, from its own sender:
+                // the manager's primary connection, a device's link state and
+                // an access point's SSID all move with it, and no other
+                // application's property changes wake the check.
+                let mut rule =
+                    MatchRule::new_signal("org.freedesktop.DBus.Properties", "PropertiesChanged");
+                rule.sender = Some(MANAGER.into());
+                let added =
+                    connection.add_match(rule, move |_: (), _: &Connection, _: &dbus::Message| {
+                        let _ = properties.try_send(());
+                        true
+                    });
+                if added.is_err() {
+                    return;
+                }
+                while !sender.is_closed() {
+                    if connection.process(Duration::from_secs(1)).is_err() {
+                        break;
+                    }
+                }
+            });
+            Some(receiver)
+        }
+    }
+}
+
+/// The Network List Manager's connected profile name, and the adapter list's
+/// media type (R8.8).
+#[cfg(windows)]
+mod windows_backend {
+    use std::time::Duration;
+
+    use sync_core::network::{CurrentNetwork, NetworkProblem, NetworkSource};
+    use tokio::sync::mpsc::Receiver;
+    use windows::Win32::Foundation::ERROR_BUFFER_OVERFLOW;
+    use windows::Win32::NetworkManagement::IpHelper::{
+        GAA_FLAG_INCLUDE_GATEWAYS, GetAdaptersAddresses, IF_TYPE_ETHERNET_CSMACD,
+        IF_TYPE_IEEE80211, IP_ADAPTER_ADDRESSES_LH,
+    };
+    use windows::Win32::NetworkManagement::Ndis::IfOperStatusUp;
+    use windows::Win32::Networking::NetworkListManager::{
+        INetworkListManager, INetworkListManagerEvents, INetworkListManagerEvents_Impl,
+        NLM_CONNECTIVITY, NLM_ENUM_NETWORK_CONNECTED, NetworkListManager,
+    };
+    use windows::Win32::System::Com::{
+        CLSCTX_ALL, COINIT_MULTITHREADED, CoCreateInstance, CoInitializeEx, CoUninitialize,
+        IConnectionPoint, IConnectionPointContainer,
+    };
+    use windows::core::{Interface, implement};
+
+    /// The Windows backend.
+    pub struct WindowsNetwork;
+
+    impl NetworkSource for WindowsNetwork {
+        fn current(&self) -> Result<CurrentNetwork, NetworkProblem> {
+            match adapter_kind()? {
+                Adapter::Wired => Ok(CurrentNetwork::Wired),
+                Adapter::Wireless => wireless_name().map(CurrentNetwork::Wireless),
+            }
+        }
+
+        fn changes(&self) -> Option<Receiver<()>> {
+            let (sender, receiver) = tokio::sync::mpsc::channel(4);
+            std::thread::spawn(move || watch(sender));
+            Some(receiver)
+        }
+    }
+
+    /// The media type of the adapter carrying a default route (R8.8).
+    enum Adapter {
+        Wired,
+        Wireless,
+    }
+
+    /// Which adapter type is up with a gateway, preferring wired so an
+    /// Ethernet connection always syncs (R8.8).
+    fn adapter_kind() -> Result<Adapter, NetworkProblem> {
+        let _com = Com::init();
+        let mut size = 16 * 1024_u32;
+        loop {
+            let mut buffer = vec![0_u8; size as usize];
+            // SAFETY: the buffer is `size` bytes and the layout of
+            // `IP_ADAPTER_ADDRESSES_LH` is the C struct the API fills; the
+            // pointer comes from a suitably sized, aligned `Vec<u8>`.
+            let status = unsafe {
+                GetAdaptersAddresses(
+                    0, // AF_UNSPEC: every family.
+                    GAA_FLAG_INCLUDE_GATEWAYS,
+                    None,
+                    Some(buffer.as_mut_ptr().cast::<IP_ADAPTER_ADDRESSES_LH>()),
+                    &mut size,
+                )
+            };
+            if status == ERROR_BUFFER_OVERFLOW.0 {
+                continue;
+            }
+            if status != 0 {
+                return Err(NetworkProblem::new(format!(
+                    "the Windows adapter list failed ({status})"
+                )));
+            }
+            let mut wired = false;
+            let mut wireless = false;
+            let mut adapter = buffer.as_ptr().cast::<IP_ADAPTER_ADDRESSES_LH>();
+            while let Some(current) = unsafe { adapter.as_ref() } {
+                let up = current.OperStatus == IfOperStatusUp;
+                let routed = !current.FirstGatewayAddress.is_null();
+                if up && routed {
+                    if current.IfType == IF_TYPE_IEEE80211 {
+                        wireless = true;
+                    } else if current.IfType == IF_TYPE_ETHERNET_CSMACD {
+                        wired = true;
+                    }
+                }
+                adapter = current.Next;
+            }
+            if wired {
+                return Ok(Adapter::Wired);
+            }
+            if wireless {
+                return Ok(Adapter::Wireless);
+            }
+            return Err(NetworkProblem::new("no active network connection"));
+        }
+    }
+
+    /// The connected profile's name, which is the SSID on Wi-Fi (R8.8).
+    fn wireless_name() -> Result<String, NetworkProblem> {
+        let _com = Com::init();
+        // SAFETY: `NetworkListManager` is the registered coclass, and the
+        // manager keeps its COM apartment for the duration of the call.
+        unsafe {
+            let manager: INetworkListManager =
+                CoCreateInstance(&NetworkListManager, None, CLSCTX_ALL).map_err(|error| {
+                    NetworkProblem::new(format!("the Network List Manager failed: {error}"))
+                })?;
+            let networks = manager
+                .GetNetworks(NLM_ENUM_NETWORK_CONNECTED)
+                .map_err(|error| {
+                    NetworkProblem::new(format!("the connected networks failed: {error}"))
+                })?;
+            // The connected enum is a linked list read in pages; the first
+            // connected profile is the network this machine is on.
+            let mut page: [Option<windows::Win32::Networking::NetworkListManager::INetwork>; 8] =
+                Default::default();
+            loop {
+                let mut fetched = 0;
+                networks
+                    .Next(&mut page, Some(&mut fetched))
+                    .map_err(|error| {
+                        NetworkProblem::new(format!("a network could not be read: {error}"))
+                    })?;
+                if fetched == 0 {
+                    return Err(NetworkProblem::new("no connected network profile"));
+                }
+                for network in page.iter_mut().take(fetched as usize) {
+                    let Some(network) = network.as_ref() else {
+                        continue;
+                    };
+                    if network
+                        .IsConnected()
+                        .is_ok_and(|connected| connected.as_bool())
+                    {
+                        let name = network.GetName().map_err(|error| {
+                            NetworkProblem::new(format!("the network name failed: {error}"))
+                        })?;
+                        return Ok(name.to_string());
+                    }
+                }
+            }
+        }
+    }
+
+    /// COM for the length of one call, abandoned when another initialisation
+    /// already owns the thread.
+    struct Com {
+        initialized: bool,
+    }
+
+    impl Com {
+        fn init() -> Self {
+            // SAFETY: COM initialisation has no memory contract; an already
+            // initialised thread answers with an error, which is not ours to
+            // uninitialise.
+            let initialized = unsafe { CoInitializeEx(None, COINIT_MULTITHREADED).is_ok() };
+            Self { initialized }
+        }
+    }
+
+    impl Drop for Com {
+        fn drop(&mut self) {
+            if self.initialized {
+                // SAFETY: this thread initialised COM above.
+                unsafe { CoUninitialize() };
+            }
+        }
+    }
+
+    /// The connectivity sink the Network List Manager calls (R8.8).
+    ///
+    /// It only wakes the engine's check: the next check reads the real name.
+    #[implement(INetworkListManagerEvents)]
+    struct ConnectivitySink {
+        wake: tokio::sync::mpsc::Sender<()>,
+    }
+
+    impl INetworkListManagerEvents_Impl for ConnectivitySink_Impl {
+        fn ConnectivityChanged(&self, _: NLM_CONNECTIVITY) -> windows::core::Result<()> {
+            let _ = self.wake.try_send(());
+            Ok(())
+        }
+    }
+
+    /// Keeps a COM subscription alive for as long as the channel is open.
+    fn watch(wake: tokio::sync::mpsc::Sender<()>) {
+        let _com = Com::init();
+        let advised = unsafe { subscribe(&wake) };
+        let Some((_manager, _point, _cookie)) = advised else {
+            return;
+        };
+        while !wake.is_closed() {
+            std::thread::sleep(Duration::from_secs(1));
+        }
+    }
+
+    /// The manager, the sink, and the advice cookie, kept alive together.
+    type Advised = (INetworkListManager, IConnectionPoint, u32);
+
+    unsafe fn subscribe(wake: &tokio::sync::mpsc::Sender<()>) -> Option<Advised> {
+        unsafe {
+            let manager: INetworkListManager =
+                CoCreateInstance(&NetworkListManager, None, CLSCTX_ALL).ok()?;
+            let container: IConnectionPointContainer = manager.cast().ok()?;
+            let point: IConnectionPoint = container
+                .FindConnectionPoint(&INetworkListManagerEvents::IID)
+                .ok()?;
+            let sink: INetworkListManagerEvents = ConnectivitySink { wake: wake.clone() }.into();
+            let cookie = point.Advise(&sink).ok()?;
+            Some((manager, point, cookie))
+        }
+    }
+}
+
+/// The Wi-Fi SSID through CoreWLAN and CaptiveNetwork, and Location Services
+/// for its permission (R8.8).
+// Two bindings macOS itself has deprecated, kept on purpose: the class
+// `authorizationStatus` is the only form that can be read off the main thread,
+// and CaptiveNetwork's `CNCopyCurrentNetworkInfo` is the API R8.8 names. The
+// newer instance method would need a run-loop thread for the check, which the
+// engine's blocking pool is not.
+#[cfg(target_os = "macos")]
+#[allow(deprecated)]
+mod macos {
+    use std::ffi::c_void;
+    use std::ptr::NonNull;
+    use std::time::Duration;
+
+    use dispatch2::{DispatchQueue, GlobalQueueIdentifier};
+    use objc2_core_foundation::{CFArray, CFRetained, CFString};
+    use objc2_core_location::{CLAuthorizationStatus, CLLocationManager};
+    use objc2_core_wlan::{CWInterface, CWWiFiClient};
+    use objc2_system_configuration::{CNCopyCurrentNetworkInfo, SCDynamicStore};
+    use sync_core::network::{CurrentNetwork, NetworkProblem, NetworkSource};
+    use tokio::sync::mpsc::Receiver;
+
+    /// The macOS backend.
+    pub struct MacNetwork;
+
+    /// The authorization statuses that let `CNCopyCurrentNetworkInfo` answer.
+    fn location_granted(status: CLAuthorizationStatus) -> bool {
+        status == CLAuthorizationStatus::AuthorizedWhenInUse
+            || status == CLAuthorizationStatus::AuthorizedAlways
+    }
+
+    impl NetworkSource for MacNetwork {
+        fn current(&self) -> Result<CurrentNetwork, NetworkProblem> {
+            // SAFETY: every call below is a read of the shared Wi-Fi client's
+            // state; no pointer outlives the frame.
+            unsafe {
+                let client = CWWiFiClient::sharedWiFiClient();
+                let interface = client
+                    .interface()
+                    .filter(|interface| interface.powerOn() && interface.serviceActive());
+                let Some(interface) = interface else {
+                    // No Wi-Fi network in use. A link that carries something
+                    // else (Ethernet) always syncs; with no link at all,
+                    // nothing is provable and uploads wait (R8.8).
+                    return if link_up() {
+                        Ok(CurrentNetwork::Wired)
+                    } else {
+                        Err(NetworkProblem::new("no active network connection"))
+                    };
+                };
+                let status = CLLocationManager::authorizationStatus_class();
+                if !location_granted(status) {
+                    return Err(NetworkProblem::new(
+                        "Location permission is not granted, so macOS hides the Wi-Fi name",
+                    ));
+                }
+                let name = ssid(&interface)?;
+                Ok(CurrentNetwork::Wireless(name))
+            }
+        }
+
+        fn changes(&self) -> Option<Receiver<()>> {
+            let (sender, receiver) = tokio::sync::mpsc::channel(4);
+            std::thread::spawn(move || watch(sender));
+            Some(receiver)
+        }
+    }
+
+    /// Whether any non-loopback interface is up, so a Mac with Wi-Fi off is
+    /// only treated as wired when a link actually carries traffic (R8.8).
+    fn link_up() -> bool {
+        use std::ffi::CStr;
+        let mut head: *mut libc::ifaddrs = std::ptr::null_mut();
+        // SAFETY: `getifaddrs` fills a list this function frees, and every
+        // entry is read while the list is alive.
+        unsafe {
+            if libc::getifaddrs(&mut head) != 0 {
+                return false;
+            }
+            let mut up = false;
+            let mut cursor = head;
+            while let Some(entry) = cursor.as_ref() {
+                let is_link = entry
+                    .ifa_addr
+                    .as_ref()
+                    .is_some_and(|address| i32::from(address.sa_family) == libc::AF_LINK);
+                // `ifa_flags` is `u32` on macOS; the libc constants are `c_int`.
+                let flags = entry.ifa_flags;
+                let loopback = flags & (libc::IFF_LOOPBACK as u32) != 0;
+                let running = flags & (libc::IFF_UP as u32) != 0;
+                let name = CStr::from_ptr(entry.ifa_name);
+                if is_link && running && !loopback && !name.to_bytes().is_empty() {
+                    up = true;
+                    break;
+                }
+                cursor = entry.ifa_next;
+            }
+            libc::freeifaddrs(head);
+            up
+        }
+    }
+
+    /// The Wi-Fi service's SSID, through CaptiveNetwork (R8.8).
+    ///
+    /// SAFETY: the interface name is a live NSString from the Wi-Fi client.
+    unsafe fn ssid(interface: &CWInterface) -> Result<String, NetworkProblem> {
+        unsafe {
+            let Some(interface_name) = interface.interfaceName() else {
+                return Err(NetworkProblem::new(
+                    "macOS reported no Wi-Fi interface name",
+                ));
+            };
+            // NSString and CFString are toll-free bridged.
+            let interface_name: &CFString = interface_name.as_ref();
+            let info = CNCopyCurrentNetworkInfo(interface_name)
+                .ok_or_else(|| NetworkProblem::new("macOS reported no network information"))?;
+            let key = CFString::from_str("SSID");
+            let info = info.cast_unchecked::<CFString, CFString>();
+            let name = info
+                .get(&key)
+                .ok_or_else(|| NetworkProblem::new("macOS hid the Wi-Fi network name"))?;
+            let name = name.to_string();
+            if name.is_empty() {
+                return Err(NetworkProblem::new("macOS reported an empty Wi-Fi name"));
+            }
+            Ok(name)
+        }
+    }
+
+    /// The address the dynamic store hands back to its callback.
+    struct WatchInfo {
+        wake: tokio::sync::mpsc::Sender<()>,
+    }
+
+    /// The System Configuration store fires on any interface change, which is
+    /// what the SSID and the link state both move with (R8.8).
+    fn watch(wake: tokio::sync::mpsc::Sender<()>) {
+        let name = CFString::from_str("com.elementalvoid.immich-sync");
+        let info = Box::into_raw(Box::new(WatchInfo { wake: wake.clone() }));
+        let mut context = objc2_system_configuration::SCDynamicStoreContext {
+            version: 0,
+            info: info.cast(),
+            retain: None,
+            release: None,
+            copyDescription: None,
+        };
+        // SAFETY: the context and its info live until this thread drops them
+        // below; the callback only reads the leaked `WatchInfo`.
+        let store = unsafe { SCDynamicStore::new(None, &name, Some(store_changed), &mut context) };
+        let Some(store) = store else {
+            unsafe { drop(Box::from_raw(info)) };
+            return;
+        };
+        let pattern = CFString::from_str("State:/Network/Interface/.*");
+        let patterns: CFRetained<CFArray> =
+            unsafe { CFRetained::cast_unchecked(CFArray::from_retained_objects(&[pattern])) };
+        // SAFETY: the patterns array is a CFArray of CFStrings.
+        let keys_set = unsafe { store.set_notification_keys(None, Some(&patterns)) };
+        let queue = DispatchQueue::global_queue(GlobalQueueIdentifier::Priority(
+            dispatch2::DispatchQueueGlobalPriority::Default,
+        ));
+        // SAFETY: the queue outlives the store subscription, which is why this
+        // thread keeps the store alive.
+        let queued = keys_set && unsafe { store.set_dispatch_queue(Some(&queue)) };
+        if queued {
+            while !wake.is_closed() {
+                std::thread::sleep(Duration::from_secs(1));
+            }
+        }
+        drop(store);
+        drop(queue);
+        // SAFETY: this thread allocated `info` and the store is gone.
+        unsafe { drop(Box::from_raw(info)) };
+    }
+
+    /// The dynamic store's change callback: wakes the engine's check (R8.8).
+    unsafe extern "C-unwind" fn store_changed(
+        _store: NonNull<SCDynamicStore>,
+        _keys: NonNull<CFArray>,
+        info: *mut c_void,
+    ) {
+        if info.is_null() {
+            return;
+        }
+        // SAFETY: `watch` leaks a `WatchInfo` for exactly the store's lifetime.
+        let info = unsafe { &*(info as *const WatchInfo) };
+        let _ = info.wake.try_send(());
+    }
+
+    /// Whether the Location grant that gates the SSID is in place (R8.8).
+    pub fn location_permission_granted() -> bool {
+        // SAFETY: reading the authorization status has no pointer contract.
+        unsafe { location_granted(CLLocationManager::authorizationStatus_class()) }
+    }
+
+    /// Asks macOS for Location permission, which the SSID needs (R8.8).
+    pub fn request_location_permission() {
+        // SAFETY: the manager is created and dropped on the caller's (UI)
+        // thread, which is where CoreLocation wants it.
+        unsafe {
+            if !matches!(
+                CLLocationManager::authorizationStatus_class(),
+                CLAuthorizationStatus::NotDetermined
+            ) {
+                return;
+            }
+            let manager = CLLocationManager::new();
+            manager.requestWhenInUseAuthorization();
+            // The manager must outlive the prompt, so it is leaked on purpose:
+            // one authorization request per process.
+            std::mem::forget(manager);
+        }
+    }
+}
diff --git a/crates/app/src/notify.rs b/crates/app/src/notify.rs
index 1a2ca79..190b515 100644
--- a/crates/app/src/notify.rs
+++ b/crates/app/src/notify.rs
@@ -189,6 +189,8 @@ mod tests {
     fn status(activity: Activity, review: u32, failed: u32) -> Status {
         Status {
             activity,
+            pause: None,
+            network: sync_core::network::NetworkStatus::default(),
             folders: Vec::new(),
             counts: FolderCounts {
                 pending: 0,
diff --git a/crates/app/src/settings.rs b/crates/app/src/settings.rs
index 0a40bce..86d0c5f 100644
--- a/crates/app/src/settings.rs
+++ b/crates/app/src/settings.rs
@@ -14,6 +14,7 @@ use std::path::{Path, PathBuf};
 use anyhow::Context as _;
 use serde::{Deserialize, Serialize};
 use sync_core::connection::AuthMethod;
+use sync_core::network::KnownNetworks;
 
 use crate::logging::LogLevel;
 
@@ -33,6 +34,11 @@ pub struct Settings {
     pub attempt_cap: u32,
     /// Whether uploaded assets get the sync tag (SPEC R3.7). On by default.
     pub tag_uploaded_assets: bool,
+    /// Whether uploads wait unless the current network is in the list
+    /// (SPEC R8.8). Off by default.
+    pub sync_only_on_known_networks: bool,
+    /// The network names that list allows (SPEC R8.8).
+    pub known_networks: Vec<String>,
     /// The Immich server URL (SPEC R1.1).
     pub server_url: String,
     /// The account's email address (SPEC R1.1).
@@ -43,6 +49,20 @@ pub struct Settings {
     pub log_level: LogLevel,
 }
 
+impl Settings {
+    /// The known-network list this file holds (R8.8).
+    ///
+    /// One mapping, so the engine's start and the Settings page cannot read the
+    /// two fields differently.
+    #[must_use]
+    pub fn known_networks(&self) -> KnownNetworks {
+        KnownNetworks {
+            enabled: self.sync_only_on_known_networks,
+            names: self.known_networks.clone(),
+        }
+    }
+}
+
 impl Default for Settings {
     fn default() -> Self {
         Self {
@@ -52,6 +72,8 @@ impl Default for Settings {
             scan_interval_minutes: 30,
             attempt_cap: 8,
             tag_uploaded_assets: true,
+            sync_only_on_known_networks: false,
+            known_networks: Vec::new(),
             server_url: String::new(),
             email: String::new(),
             auth_method: AuthMethod::Password,
diff --git a/crates/app/src/settings_view.rs b/crates/app/src/settings_view.rs
index 71bbf9e..88f9e8b 100644
--- a/crates/app/src/settings_view.rs
+++ b/crates/app/src/settings_view.rs
@@ -14,6 +14,7 @@ use crate::connection::{ConnectionModel, apply_profile, profile_from_settings};
 use crate::dashboard::CardPalette;
 use crate::engine::EngineModel;
 use crate::logging::LogLevel;
+use crate::network as platform_network;
 use crate::notice::{Notice, Severity};
 use crate::paths::AppPaths;
 use crate::rows::{Row, note};
@@ -33,6 +34,7 @@ use gpui_kit::prelude::FluentBuilder as _;
 use gpui_kit::*;
 use sync_core::connection::{AuthMethod, ConnectionState, ServerProfile, SignIn};
 use sync_core::credential::Secret;
+use sync_core::network::NetworkStatus;
 use sync_core::tags::{BackfillStatus, SYNC_TAG, TagStatus};
 
 /// The number of bytes in a displayed megabyte. The stored limit stays bytes
@@ -275,6 +277,12 @@ fn megabytes_per_second_text(bytes: u64) -> String {
     format!("{whole}.{fraction_text}")
 }
 
+/// The system pane macOS opens for the Location grant the Wi-Fi name needs
+/// (R8.8).
+#[cfg(target_os = "macos")]
+const LOCATION_SETTINGS: &str =
+    "x-apple.systempreferences:com.apple.preference.security?Privacy_LocationServices";
+
 /// The notice prefix for a settings file that could not be written.
 const SAVE_PROBLEM: &str = "Could not save the settings";
 /// The notice prefix for an autostart change that could not be applied.
@@ -320,6 +328,11 @@ pub struct SettingsView {
     /// It is cached here because the engine notifies on every status poll, and
     /// the section only changes when this value does.
     tag: TagStatus,
+    /// The network the engine last reported, for the known-network list
+    /// (R8.8). Cached for the same reason as the tag.
+    network: NetworkStatus,
+    /// The field a new network name is typed into (R8.8).
+    network_input: Entity<InputState>,
     /// The last failed save or autostart change, shown with the load problem.
     action_error: Option<String>,
     /// The approval hint the autostart backend last reported. It is read when the
@@ -392,6 +405,17 @@ impl SettingsView {
                 .placeholder("you@example.com")
                 .default_value(initial.email.clone())
         });
+        let network_input = cx
+            .new(|cx| InputState::new(window, cx).placeholder("Network name, as your OS shows it"));
+        subscriptions.push(cx.subscribe_in(
+            &network_input,
+            window,
+            |this, _, event: &InputEvent, window, cx| {
+                if matches!(event, InputEvent::PressEnter { .. }) {
+                    this.add_network(window, cx);
+                }
+            },
+        ));
         let secret_input = cx.new(|cx| {
             InputState::new(window, cx)
                 .placeholder(secret_placeholder_for(initial.auth_method))
@@ -439,6 +463,8 @@ impl SettingsView {
             fields,
             engine: None,
             tag: TagStatus::default(),
+            network: NetworkStatus::default(),
+            network_input,
             action_error: None,
             approval_hint: None,
             environment_problem: None,
@@ -448,6 +474,13 @@ impl SettingsView {
             in_flight_settings: None,
             _subscriptions: subscriptions,
         };
+        // macOS only: with the list already on, ask for the Location grant at
+        // startup as well as on the switch, so a client that was started with
+        // the setting on still prompts once (R8.8).
+        #[cfg(target_os = "macos")]
+        if view.store.settings().sync_only_on_known_networks {
+            platform_network::request_location_permission();
+        }
         view.reconcile_autostart(cx);
         // A saved profile logs in at startup with no user input (R1.3).
         // Reopening the window rebuilds this view, so the model's once guard
@@ -528,17 +561,78 @@ impl SettingsView {
     /// state it renders actually changes.
     pub fn set_engine(&mut self, engine: Entity<EngineModel>, cx: &mut Context<Self>) {
         self.tag = engine.read(cx).tag_status().clone();
+        self.network = engine.read(cx).status().network.clone();
         self._subscriptions
             .push(cx.observe(&engine, |this, engine, cx| {
                 let tag = engine.read(cx).tag_status().clone();
-                if tag != this.tag {
+                let network = engine.read(cx).status().network.clone();
+                if tag != this.tag || network != this.network {
                     this.tag = tag;
+                    this.network = network;
                     cx.notify();
                 }
             }));
         self.engine = Some(engine);
     }
 
+    /// Turns the known-network list on or off and moves the running engine to
+    /// it (R8.8).
+    ///
+    /// Turning it on is also where macOS asks for the Location permission the
+    /// SSID needs: the prompt is tied to the moment the user asks for the
+    /// feature, not to a sign-in or a restart.
+    fn toggle_known_networks(&mut self, enabled: bool, cx: &mut Context<Self>) {
+        if enabled {
+            platform_network::request_location_permission();
+        }
+        self.save_known_networks(cx, move |settings| {
+            settings.sync_only_on_known_networks = enabled;
+        });
+    }
+
+    /// Adds the typed network name to the list, ignoring a blank or a duplicate
+    /// (R8.8).
+    fn add_network(&mut self, window: &mut Window, cx: &mut Context<Self>) {
+        let name = self.network_input.read(cx).value().trim().to_string();
+        self.network_input
+            .update(cx, |input, cx| input.set_value("", window, cx));
+        if name.is_empty() || self.intended_settings().known_networks.contains(&name) {
+            return;
+        }
+        self.save_known_networks(cx, move |settings| settings.known_networks.push(name));
+    }
+
+    /// Removes one name from the list (R8.8).
+    fn remove_network(&mut self, name: String, cx: &mut Context<Self>) {
+        self.save_known_networks(cx, move |settings| {
+            settings.known_networks.retain(|kept| *kept != name);
+        });
+    }
+
+    /// Saves one change to the known-network list and moves the running engine
+    /// to it once the write landed (R8.8).
+    fn save_known_networks(
+        &mut self,
+        cx: &mut Context<Self>,
+        change: impl FnOnce(&mut Settings) + Send + 'static,
+    ) {
+        self.save_settings(cx, change, |view, result, cx| {
+            if result.is_ok() {
+                view.apply_known_networks(cx);
+            }
+            view.record(SAVE_PROBLEM, result, cx);
+        });
+    }
+
+    /// Moves the running engine to the saved list (R8.8).
+    fn apply_known_networks(&mut self, cx: &mut Context<Self>) {
+        let Some(engine) = self.engine.clone() else {
+            return;
+        };
+        let known = self.store.settings().known_networks();
+        engine.update(cx, |model, _| model.set_known_networks(known));
+    }
+
     /// The newest intended settings: what a pending write will hold, or the
     /// store's values when nothing is queued.
     fn intended_settings(&self) -> Settings {
@@ -1233,17 +1327,157 @@ impl SettingsView {
     }
 
     /// The Sync page: scan interval and attempt cap (SPEC R2.3, R6.1).
-    fn sync_page(&self, query: &str, cx: &App) -> Option<SettingPage> {
+    fn sync_page(&self, query: &str, cx: &mut Context<Self>) -> Option<SettingPage> {
+        let settings = self.intended_settings();
+        let enabled = settings.sync_only_on_known_networks;
+        let names = settings.known_networks.clone();
+        let network_value = self.network.value();
+
+        let toggle = Rc::new(cx.listener(|this, enabled: &bool, _, cx| {
+            this.toggle_known_networks(*enabled, cx);
+        }));
+        let add = Rc::new(cx.listener(|this, _: &(), window, cx| this.add_network(window, cx)));
+        let input = self.network_input.clone();
+        let focus = input.read(cx).focus_handle(cx);
+
+        let mut known = vec![
+            Row::wrapped(
+                "Sync only on known networks",
+                "Pauses uploads and scans unless the current network is in the list below. Off by \
+                 default. A wired connection always syncs, whatever the list says.",
+                "settings-known-networks-row",
+                move |_, _| {
+                    let toggle = Rc::clone(&toggle);
+                    Switch::new("settings-known-networks")
+                        .checked(enabled)
+                        .accessibility_label("Sync only on known networks")
+                        .on_change(move |enabled, window, cx| toggle(enabled, window, cx))
+                        .into_any_element()
+                },
+            ),
+            // A name or a reason can be long, so it wraps under the title
+            // rather than pushing the row past the page.
+            Row::stacked(
+                "Current network",
+                "The name the OS reports; the list is compared against it.",
+                move |_, _| {
+                    crate::a11y::named(
+                        Role::Label,
+                        "settings-current-network",
+                        network_value.clone(),
+                        None,
+                    )
+                    .min_w_0()
+                    .w_full()
+                    .text_sm()
+                    .child(network_value.clone())
+                    .into_any_element()
+                },
+            ),
+        ];
+        // macOS only reveals the Wi-Fi name to an app allowed under Location
+        // Services, and a refused grant cannot be re-prompted, so the page
+        // offers the settings pane the prompt would have opened.
+        #[cfg(target_os = "macos")]
+        if enabled && !crate::network::location_permission_granted() {
+            known.push(Row::wrapped(
+                "Location permission",
+                "macOS reveals the Wi-Fi network name only to an app allowed under Location \
+                 Services. Allow Immich Sync there, then return to this page.",
+                "settings-location-permission-row",
+                |_, _| {
+                    Button::new("settings-location-permission")
+                        .label("Open Location Settings")
+                        .accessibility_label("Open Location Services settings")
+                        .on_click(|_, _, cx| {
+                            cx.open_url(LOCATION_SETTINGS);
+                        })
+                        .into_any_element()
+                },
+            ));
+        }
+        for (index, name) in names.into_iter().enumerate() {
+            let label = name.clone();
+            let target = name.clone();
+            let remove = Rc::new(cx.listener(move |this, _: &(), _, cx| {
+                this.remove_network(target.clone(), cx);
+            }));
+            // The row's own label is the network name, so the control names
+            // only the action (docs/agents/ui.md, "announce once").
+            known.push(Row::setting(name.clone(), "", move |_, _| {
+                let remove = Rc::clone(&remove);
+                Button::new(format!("settings-known-network-remove-{index}"))
+                    .label("Remove")
+                    .accessibility_label(format!("Remove {label} from the known networks"))
+                    .on_click(move |_, window, cx| remove(&(), window, cx))
+                    .into_any_element()
+            }));
+        }
+        known.push(Row::stacked(
+            "Add a network",
+            "Type the network name exactly as your OS shows it, then press Enter or Add.",
+            move |_, _| {
+                crate::a11y::named(
+                    Role::Group,
+                    "settings-known-network-input",
+                    "Add a network",
+                    Some("Type the network name as your OS shows it.".into()),
+                )
+                .track_focus(&focus)
+                .min_w_0()
+                .w_full()
+                .flex()
+                .flex_row()
+                .items_center()
+                .gap_3()
+                .child(
+                    div()
+                        .flex_1()
+                        .child(Input::new(&input).aria_label("Network name")),
+                )
+                .child(
+                    Button::new("settings-known-network-add-button")
+                        .label("Add")
+                        .accessibility_label("Add the typed network name")
+                        .on_click({
+                            let add = Rc::clone(&add);
+                            move |_, window, cx| add(&(), window, cx)
+                        }),
+                )
+                .into_any_element()
+            },
+        ));
+        // Only macOS gates the Wi-Fi name behind a permission, so only there
+        // is there something to explain (R8.8).
+        #[cfg(target_os = "macos")]
+        if enabled {
+            let muted = cx.theme().muted_foreground;
+            known.push(note(move |_, _| {
+                div()
+                    .id("settings-known-networks-privacy")
+                    .test_support()
+                    .text_xs()
+                    .text_color(muted)
+                    .child(
+                        "macOS asks for Location permission the first time this is on, because \
+                         only that permission lets the app read the Wi-Fi name.",
+                    )
+                    .into_any_element()
+            }));
+        }
         page(
             PAGE_SYNC,
-            vec![group(
-                None,
-                [FieldKey::ScanInterval, FieldKey::AttemptCap]
-                    .into_iter()
-                    .filter_map(|key| self.numeric_row(key, cx))
-                    .collect(),
-                query,
-            )],
+            vec![
+                group(
+                    None,
+                    [FieldKey::ScanInterval, FieldKey::AttemptCap]
+                        .into_iter()
+                        .filter_map(|key| self.numeric_row(key, cx))
+                        .collect(),
+                    query,
+                ),
+                group(Some("Known networks"), known, query),
+            ],
         )
     }
 
diff --git a/crates/app/src/shell.rs b/crates/app/src/shell.rs
index b5fb044..955befb 100644
--- a/crates/app/src/shell.rs
+++ b/crates/app/src/shell.rs
@@ -22,7 +22,7 @@ use crate::tab::Tab;
 use crate::upload::UploadModel;
 use crate::upload_view::UploadView;
 use sync_core::connection::{ConnectionState, ServerProfile};
-use sync_core::status::Activity;
+use sync_core::status::{Activity, PauseReason};
 use sync_core::store::FolderCounts;
 
 use std::sync::Mutex;
@@ -1003,15 +1003,20 @@ pub fn tray_tooltip(state: &ConnectionState) -> String {
 
 /// The tray tooltip for the live activity, the connection, the review count,
 /// and the progress (R8.2, R5.4).
+///
+/// A held sync says why, so a pause the user did not click is never left
+/// without an explanation (R8.8).
 #[must_use]
 pub fn tray_status_tooltip(
     activity: Activity,
+    pause: Option<PauseReason>,
     state: &ConnectionState,
     counts: FolderCounts,
     last_error: Option<&str>,
 ) -> String {
     let total = counts.uploaded + counts.pending;
-    let mut text = format!("Immich Sync — {} — {}", activity.label(), state.message());
+    let activity = pause.map_or_else(|| activity.label(), PauseReason::line);
+    let mut text = format!("Immich Sync — {activity} — {}", state.message());
     if total > 0 {
         text.push_str(&format!(" — {}/{} uploaded", counts.uploaded, total));
     }
@@ -1054,6 +1059,7 @@ pub fn show_status_on_tray(cx: &mut App) {
     let status = engine.read(cx).status().clone();
     let tooltip = tray_status_tooltip(
         status.activity,
+        status.pause,
         &state,
         status.counts,
         status.last_error.as_deref(),
diff --git a/crates/app/src/status.rs b/crates/app/src/status.rs
index 20df2a9..f2ff0ad 100644
--- a/crates/app/src/status.rs
+++ b/crates/app/src/status.rs
@@ -8,7 +8,7 @@ use std::path::Path;
 
 use crate::diagnostics::format_rate;
 use sync_core::meter::UploadTraffic;
-use sync_core::status::{Activity, AlbumRename, Status};
+use sync_core::status::{Activity, AlbumRename, PauseReason, Status};
 use sync_core::store::{AlbumPath, AlbumScope, FolderCounts};
 
 /// The activity state of the client or one source folder (SPEC R8.2).
@@ -50,6 +50,9 @@ pub struct StatusCard {
     /// The source folder path; `None` on the global card.
     pub path: Option<String>,
     pub activity: ActivityState,
+    /// Why uploads are held, when the card says `Paused` (R8.7, R8.8). The
+    /// state line phrases the reason instead of a bare "Paused".
+    pub pause: Option<PauseReason>,
     /// Upload progress, 0.0 to 1.0.
     pub progress: f32,
     pub counts: Counts,
@@ -134,7 +137,12 @@ impl StatusCard {
         CardContent {
             title: self.title.clone(),
             path: self.path.clone(),
-            state: self.activity.label().to_string(),
+            // R8.8: a network hold says why, so a pause the user did not
+            // click is never left without an explanation.
+            state: self.pause.map_or_else(
+                || self.activity.label().to_string(),
+                |reason| reason.line().to_string(),
+            ),
             progress: self.progress.clamp(0.0, 1.0),
             progress_percent: format!(
                 "{}%",
@@ -285,6 +293,7 @@ impl DashboardModel {
             title: "All folders".to_string(),
             path: None,
             activity: status.activity.into(),
+            pause: status.pause,
             progress: status.progress(),
             counts: counts_from(status.counts),
             review_count: status.counts.review,
@@ -311,10 +320,8 @@ impl DashboardModel {
         let folders = status
             .folders
             .iter()
-            .map(|folder| StatusCard {
-                title: folder_name(&folder.path),
-                path: Some(folder.path.clone()),
-                activity: if !folder.available {
+            .map(|folder| {
+                let activity = if !folder.available {
                     ActivityState::NeedsAttention
                 } else if status.activity == Activity::Paused {
                     ActivityState::Paused
@@ -324,24 +331,36 @@ impl DashboardModel {
                     ActivityState::NeedsAttention
                 } else {
                     ActivityState::Idle
-                },
-                progress: folder_progress(folder.counts),
-                counts: counts_from(folder.counts),
-                review_count: folder.counts.review,
-                available: folder.available,
-                uploads: folder.uploads,
-                connection: None,
-                last_error: folder.last_error.clone(),
-                // #43: the folder detail shows both, relative and exact.
-                last_upload_ns: folder.last_upload_ns,
-                last_scan_ns: folder.last_scan_ns,
-                recursive: folder.recursive,
-                album_mapping: folder.album_mapping,
-                album_scope: folder.album_scope,
-                album_path: folder.album_path,
-                album_prefix: folder.album_prefix,
-                album_title: folder.album_title.clone(),
-                album_rename: folder.album_rename.clone(),
+                };
+                StatusCard {
+                    title: folder_name(&folder.path),
+                    path: Some(folder.path.clone()),
+                    activity,
+                    // The reason is the engine's, and a folder card shows it the
+                    // same way the global card does (R8.8). A card that is not
+                    // paused carries no reason, so the state line and the state
+                    // cannot disagree.
+                    pause: (activity == ActivityState::Paused)
+                        .then_some(status.pause)
+                        .flatten(),
+                    progress: folder_progress(folder.counts),
+                    counts: counts_from(folder.counts),
+                    review_count: folder.counts.review,
+                    available: folder.available,
+                    uploads: folder.uploads,
+                    connection: None,
+                    last_error: folder.last_error.clone(),
+                    // #43: the folder detail shows both, relative and exact.
+                    last_upload_ns: folder.last_upload_ns,
+                    last_scan_ns: folder.last_scan_ns,
+                    recursive: folder.recursive,
+                    album_mapping: folder.album_mapping,
+                    album_scope: folder.album_scope,
+                    album_path: folder.album_path,
+                    album_prefix: folder.album_prefix,
+                    album_title: folder.album_title.clone(),
+                    album_rename: folder.album_rename.clone(),
+                }
             })
             .collect();
         Self {
@@ -371,6 +390,7 @@ pub fn sample() -> DashboardModel {
             title: "All folders".to_string(),
             path: None,
             activity: ActivityState::Syncing,
+            pause: None,
             progress: 0.62,
             counts: Counts {
                 pending: 18,
@@ -401,6 +421,7 @@ pub fn sample() -> DashboardModel {
                 title: "Camera Roll".to_string(),
                 path: Some("Pictures\\Camera Roll".to_string()),
                 activity: ActivityState::Syncing,
+                pause: None,
                 progress: 0.74,
                 counts: Counts {
                     pending: 4,
@@ -430,6 +451,7 @@ pub fn sample() -> DashboardModel {
                 title: "DCIM".to_string(),
                 path: Some("Pictures\\DCIM".to_string()),
                 activity: ActivityState::Idle,
+                pause: None,
                 progress: 1.0,
                 counts: Counts {
                     pending: 0,
@@ -455,6 +477,7 @@ pub fn sample() -> DashboardModel {
                 title: "Videos".to_string(),
                 path: Some("Videos\\Projects".to_string()),
                 activity: ActivityState::NeedsAttention,
+                pause: None,
                 progress: 0.31,
                 counts: Counts {
                     pending: 7,
@@ -482,6 +505,7 @@ pub fn sample() -> DashboardModel {
                 title: "Archive".to_string(),
                 path: Some("Archive\\2024".to_string()),
                 activity: ActivityState::Paused,
+                pause: None,
                 progress: 0.0,
                 counts: Counts {
                     pending: 240,
@@ -509,10 +533,10 @@ pub fn sample() -> DashboardModel {
 
 #[cfg(test)]
 mod tests {
-    use super::{DashboardModel, sync_now_copy, upload_line};
+    use super::{ActivityState, DashboardModel, sync_now_copy, upload_line};
     use crate::times;
     use sync_core::meter::UploadTraffic;
-    use sync_core::status::{Activity, FolderStatus, Status};
+    use sync_core::status::{Activity, FolderStatus, PauseReason, Status};
     use sync_core::store::{AlbumPath, FolderCounts};
 
     /// One status with a folder per scan time, so a test reads the newest of
@@ -520,6 +544,8 @@ mod tests {
     fn status_with_scans(scans: &[Option<i64>]) -> Status {
         Status {
             activity: Activity::Idle,
+            pause: None,
+            network: sync_core::network::NetworkStatus::default(),
             folders: scans
                 .iter()
                 .enumerate()
@@ -665,4 +691,23 @@ mod tests {
             "512.0 KiB/s · 2 uploading"
         );
     }
+
+    /// R8.8: a hold the user did not click says why, on the dashboard card the
+    /// tray tooltip mirrors.
+    #[test]
+    fn a_network_hold_states_its_reason_on_the_card() {
+        let mut status = status_with_scans(&[]);
+        status.activity = Activity::Paused;
+        status.pause = Some(PauseReason::NotListed);
+        let model = DashboardModel::from_engine(&status, None);
+        assert_eq!(model.global.activity, ActivityState::Paused);
+        assert_eq!(
+            model.global.content().state,
+            "Paused — not on a known network"
+        );
+
+        status.pause = Some(PauseReason::Unknown);
+        let model = DashboardModel::from_engine(&status, None);
+        assert_eq!(model.global.content().state, "Paused — network unknown");
+    }
 }
diff --git a/crates/app/tests/it/dashboard.rs b/crates/app/tests/it/dashboard.rs
index 986e97f..37ff509 100644
--- a/crates/app/tests/it/dashboard.rs
+++ b/crates/app/tests/it/dashboard.rs
@@ -214,6 +214,8 @@ fn folder_progress_survives_counts_above_a_u16() {
     };
     let status = Status {
         activity: Activity::Syncing,
+        pause: None,
+        network: sync_core::network::NetworkStatus::default(),
         folders: vec![FolderStatus {
             path: "/photos".to_string(),
             recursive: true,
@@ -863,6 +865,8 @@ fn engine_status_maps_to_the_global_card_and_one_card_per_folder() {
 
     let status = Status {
         activity: Activity::Syncing,
+        pause: None,
+        network: sync_core::network::NetworkStatus::default(),
         folders: vec![
             FolderStatus {
                 path: "/home/you/Pictures".to_string(),
diff --git a/crates/app/tests/it/folder_detail.rs b/crates/app/tests/it/folder_detail.rs
index 6cce899..cf86753 100644
--- a/crates/app/tests/it/folder_detail.rs
+++ b/crates/app/tests/it/folder_detail.rs
@@ -1925,6 +1925,8 @@ async fn the_detail_renders_in_both_themes(cx: &mut TestAppContext) {
 fn a_folder_status_carries_its_times_into_the_detail_card() {
     let status = Status {
         activity: Activity::Idle,
+        pause: None,
+        network: sync_core::network::NetworkStatus::default(),
         folders: vec![FolderStatus {
             path: "/photos".to_string(),
             recursive: true,
diff --git a/crates/app/tests/it/packaging.rs b/crates/app/tests/it/packaging.rs
index d39a8ff..de9bd43 100644
--- a/crates/app/tests/it/packaging.rs
+++ b/crates/app/tests/it/packaging.rs
@@ -10,11 +10,16 @@
 use std::path::Path;
 
 /// The usage strings macOS shows a TCC prompt for: the three folders a source
-/// folder commonly lives in, and the two volume kinds it can be on.
-const USAGE_KEYS: [&str; 5] = [
+/// folder commonly lives in, the two volume kinds it can be on, and the
+/// Location grant the Wi-Fi network name needs (R8.8). macOS reads
+/// `NSLocationUsageDescription` while iOS reads the When-In-Use key, so the
+/// bundle carries both.
+const USAGE_KEYS: [&str; 7] = [
     "NSDesktopFolderUsageDescription",
     "NSDocumentsFolderUsageDescription",
     "NSDownloadsFolderUsageDescription",
+    "NSLocationUsageDescription",
+    "NSLocationWhenInUseUsageDescription",
     "NSNetworkVolumesUsageDescription",
     "NSRemovableVolumesUsageDescription",
 ];
@@ -43,7 +48,7 @@ fn macos_config_sets_the_support_floor_and_names_the_plist() {
 }
 
 #[test]
-fn info_plist_carries_only_the_five_file_access_usage_strings() {
+fn info_plist_carries_only_the_usage_strings() {
     let plist = read("macos/Info.plist");
     let mut keys = elements(&plist, "key");
     let values = elements(&plist, "string");
@@ -54,7 +59,7 @@ fn info_plist_carries_only_the_five_file_access_usage_strings() {
     // the other — and such a value would merge into the bundle unread here.
     assert_eq!(
         keys, USAGE_KEYS,
-        "the plist holds exactly the five file-access usage strings, and nothing else"
+        "the plist holds exactly the usage strings, and nothing else"
     );
     assert_eq!(
         keys.len(),
diff --git a/crates/app/tests/it/settings.rs b/crates/app/tests/it/settings.rs
index e1839fa..83dc796 100644
--- a/crates/app/tests/it/settings.rs
+++ b/crates/app/tests/it/settings.rs
@@ -402,6 +402,14 @@ fn a_settings_file_without_the_tag_setting_loads_it_on() {
         store.settings().tag_uploaded_assets,
         "R3.7: a missing setting takes the on default"
     );
+    assert!(
+        !store.settings().sync_only_on_known_networks,
+        "R8.8: a file written before the list existed keeps syncing on any network"
+    );
+    assert!(
+        store.settings().known_networks.is_empty(),
+        "R8.8: the list starts empty"
+    );
     assert!(store.problem().is_none());
 }
 
@@ -419,6 +427,8 @@ fn settings_round_trip_across_a_restart() {
             settings.scan_interval_minutes = 45;
             settings.attempt_cap = 3;
             settings.tag_uploaded_assets = true;
+            settings.sync_only_on_known_networks = true;
+            settings.known_networks = vec!["Home".to_string(), "Studio".to_string()];
             settings.server_url = "https://immich.example.com".to_string();
             settings.email = "sync@example.com".to_string();
             settings.auth_method = AuthMethod::ApiKey;
@@ -437,6 +447,15 @@ fn settings_round_trip_across_a_restart() {
         settings.tag_uploaded_assets,
         "R3.7: the tag setting persists"
     );
+    assert!(
+        settings.sync_only_on_known_networks,
+        "R8.8: the list switch persists"
+    );
+    assert_eq!(
+        settings.known_networks,
+        vec!["Home".to_string(), "Studio".to_string()],
+        "R8.8: the listed names persist"
+    );
     assert_eq!(settings.server_url, "https://immich.example.com");
     assert_eq!(settings.email, "sync@example.com");
     assert_eq!(settings.auth_method, AuthMethod::ApiKey);
@@ -453,6 +472,8 @@ fn settings_round_trip_across_a_restart() {
          scan_interval_minutes = 45\n\
          attempt_cap = 3\n\
          tag_uploaded_assets = true\n\
+         sync_only_on_known_networks = true\n\
+         known_networks = [\n    \"Home\",\n    \"Studio\",\n]\n\
          server_url = \"https://immich.example.com\"\n\
          email = \"sync@example.com\"\n\
          auth_method = \"api_key\"\n\
diff --git a/crates/app/tests/it/settings_ui.rs b/crates/app/tests/it/settings_ui.rs
index 3a75347..32a7f3f 100644
--- a/crates/app/tests/it/settings_ui.rs
+++ b/crates/app/tests/it/settings_ui.rs
@@ -2537,6 +2537,96 @@ async fn a_missing_tag_permission_is_named_in_the_tagging_section(cx: &mut TestA
 // its page, its element id, its accessible name, and its help sentence.
 // ---------------------------------------------------------------------------
 
+/// R8.8: the Sync page carries the known-network list: the switch (off by
+/// default), the current network, one Remove per saved name, and Add.
+#[gpui_kit::test]
+fn the_sync_page_shows_the_known_network_list(cx: &mut TestAppContext) {
+    let temp = tempfile::tempdir().expect("create a temp dir");
+    let paths = temporary_paths(temp.path());
+    let mut store = SettingsStore::open(paths.config_file.clone());
+    store
+        .update(|settings| settings.known_networks = vec!["Home".to_string()])
+        .expect("save the list");
+    let window = open_settings(cx, store, paths, FakeAutostart::new());
+
+    cx.update_window(window, |_, window, cx| {
+        draw(window, cx);
+        open_page(window, PAGE_SYNC, cx);
+        assert_eq!(
+            window.find("settings-known-networks").checked(),
+            Some(false),
+            "R8.8: the list is off on a fresh install"
+        );
+        assert_eq!(
+            window.find("settings-current-network").label(),
+            Some("unknown"),
+            "R8.8: with no engine the name is unknown, not invented"
+        );
+        assert!(
+            window.find("settings-known-network-remove-0").visible(),
+            "R8.8: a stored name has a Remove control"
+        );
+        assert!(
+            window.find("settings-known-network-add-button").visible(),
+            "R8.8: the page can add a name"
+        );
+    })
+    .expect("read the sync page");
+}
+
+/// R8.8: the switch, a typed name and Remove all reach the settings file, and
+/// the listed name gets its own row.
+#[gpui_kit::test]
+async fn a_known_network_is_added_and_removed(cx: &mut TestAppContext) {
+    let temp = tempfile::tempdir().expect("create a temp dir");
+    let paths = temporary_paths(temp.path());
+    let store = SettingsStore::open(paths.config_file.clone());
+    let window = open_settings(cx, store, paths.clone(), FakeAutostart::new());
+
+    cx.update_window(window, |_, window, cx| {
+        draw(window, cx);
+        open_page(window, PAGE_SYNC, cx);
+        tab_to(window, "settings-known-networks", cx);
+        window.press("space", cx);
+    })
+    .expect("turn the known-network list on");
+    let saved =
+        wait_for_settings(cx, &paths, |settings| settings.sync_only_on_known_networks).await;
+    assert!(
+        saved.sync_only_on_known_networks,
+        "R8.8: the switch persisted"
+    );
+
+    cx.update_window(window, |_, window, cx| {
+        draw(window, cx);
+        tab_to(window, "settings-known-network-input", cx);
+        window.input("Home Wi-Fi", cx);
+        window.press("enter", cx);
+    })
+    .expect("type a network name");
+    let saved = wait_for_settings(cx, &paths, |settings| !settings.known_networks.is_empty()).await;
+    assert_eq!(
+        saved.known_networks,
+        vec!["Home Wi-Fi".to_string()],
+        "R8.8: the typed name persisted"
+    );
+
+    cx.update_window(window, |_, window, cx| {
+        draw(window, cx);
+        assert!(
+            window.find("settings-known-network-remove-0").visible(),
+            "R8.8: the saved name gets its own row"
+        );
+        window.click("settings-known-network-remove-0", cx);
+    })
+    .expect("remove the network");
+    let saved = wait_for_settings(cx, &paths, |settings| settings.known_networks.is_empty()).await;
+    assert!(
+        saved.known_networks.is_empty(),
+        "R8.8: Remove deletes the name"
+    );
+}
+
 /// The six settings pages, in the order the sidebar lists them.
 const PAGE_CONNECTION: usize = 0;
 const PAGE_GENERAL: usize = 1;
diff --git a/crates/app/tests/it/shell.rs b/crates/app/tests/it/shell.rs
index 983961e..e029ad2 100644
--- a/crates/app/tests/it/shell.rs
+++ b/crates/app/tests/it/shell.rs
@@ -223,6 +223,7 @@ fn the_tray_tooltip_carries_the_activity_and_the_progress() {
     };
     let tooltip = shell::tray_status_tooltip(
         sync_core::status::Activity::Syncing,
+        None,
         &ConnectionState::Connected,
         counts,
         None,
@@ -237,6 +238,7 @@ fn the_tray_tooltip_carries_the_activity_and_the_progress() {
 
     let attention = shell::tray_status_tooltip(
         sync_core::status::Activity::NeedsAttention,
+        None,
         &ConnectionState::NeedsAttention(Attention::Rejected),
         sync_core::store::FolderCounts::default(),
         Some("unsupported_format"),
@@ -248,6 +250,34 @@ fn the_tray_tooltip_carries_the_activity_and_the_progress() {
     );
 }
 
+/// R8.8: the tray says why a sync is held, not just "Paused".
+#[test]
+fn the_tray_tooltip_carries_the_network_reason() {
+    let tooltip = shell::tray_status_tooltip(
+        sync_core::status::Activity::Paused,
+        Some(sync_core::status::PauseReason::NotListed),
+        &ConnectionState::Connected,
+        sync_core::store::FolderCounts::default(),
+        None,
+    );
+    assert!(
+        tooltip.contains("Paused — not on a known network"),
+        "R8.8: the tray names the network reason: {tooltip}"
+    );
+
+    let unknown = shell::tray_status_tooltip(
+        sync_core::status::Activity::Paused,
+        Some(sync_core::status::PauseReason::Unknown),
+        &ConnectionState::Connected,
+        sync_core::store::FolderCounts::default(),
+        None,
+    );
+    assert!(
+        unknown.contains("Paused — network unknown"),
+        "R8.8: an unprovable network is its own reason: {unknown}"
+    );
+}
+
 #[test]
 fn the_tray_tooltip_shows_every_connection_state() {
     let not_configured = shell::tray_tooltip(&ConnectionState::NotConfigured);
diff --git a/crates/sync-core/src/engine.rs b/crates/sync-core/src/engine.rs
index 589529d..dd9b453 100644
--- a/crates/sync-core/src/engine.rs
+++ b/crates/sync-core/src/engine.rs
@@ -41,11 +41,17 @@ use crate::failure::{FailureClass, FailureKind, classify};
 use crate::hash::{Sha1, sha1_file};
 use crate::meter::UploadMeter;
 use crate::missing::{Fate, Host, SizeIndex, fate, is_gone, rename_target};
+use crate::network::{
+    CurrentNetwork, KnownNetworks, NetworkDecision, NetworkProblem, NetworkSource, NetworkStatus,
+    decide,
+};
 use crate::pairing::FolderIndex;
 use crate::paths::{PathCase, is_within, key, key_is_within, path_key};
 use crate::scan::{ScanError, scan_folder};
 use crate::skip::{has_symlink_ancestor, skip_reason_below};
-use crate::status::{AlbumRename, ConnectionHealth, FolderStatus, Status, StatusInputs};
+use crate::status::{
+    AlbumRename, ConnectionHealth, FolderStatus, PauseReason, Status, StatusInputs,
+};
 use crate::store::{
     Album, AlbumPath, AlbumScope, AttemptOutcome, AttemptRecord, FailedItem, FolderCounts,
     ItemRecord, ItemState, ReviewDecision, ReviewItem, SourceFolder, StateStore, StoreError,
@@ -107,6 +113,15 @@ pub struct EngineConfig {
     /// [`BACKFILL_BATCH`]; a test lowers it so a small library needs more than
     /// one request.
     pub tag_batch_size: usize,
+    /// How often the fallback poll re-checks the network (R8.8). Default 30
+    /// seconds: change notifications are missed across sleep and VPN
+    /// transitions, so the poll is the net under them. A test lowers it so the
+    /// poll case needs no 30-second wait.
+    pub network_poll: Duration,
+    /// How long one network check may take before it reads as unknown
+    /// (R8.8). Default 5 seconds: an OS call that hangs must hold uploads
+    /// rather than leave the last answer in force.
+    pub network_check_timeout: Duration,
 }
 
 impl Default for EngineConfig {
@@ -125,6 +140,8 @@ impl Default for EngineConfig {
             breaker_cooldown: Duration::from_secs(10),
             tag_uploaded_assets: false,
             tag_batch_size: BACKFILL_BATCH,
+            network_poll: Duration::from_secs(30),
+            network_check_timeout: Duration::from_secs(5),
         }
     }
 }
@@ -283,6 +300,45 @@ struct EngineInner {
     rescan_hint: AtomicBool,
     /// Wakes the album retry, which sends the titles the user changed (#47).
     album_wake: Notify,
+    /// The known-network gate (R8.8): the platform's answer, the user's list,
+    /// and the last name read.
+    network: Mutex<NetworkWatch>,
+    /// Wakes the network check: the list changed, or an upload could not reach
+    /// the server (R8.8).
+    network_wake: Notify,
+    /// Whether a platform call is still running. A call that outlives its
+    /// timeout keeps this set until it returns, so a hung OS API cannot pile
+    /// up one blocked thread per check (R8.8).
+    network_check_running: AtomicBool,
+}
+
+/// The known-network gate's state (R8.8).
+#[derive(Default)]
+struct NetworkWatch {
+    /// The platform's answer. `None` in a build or test with no backend, where
+    /// the list being off is the only reachable state.
+    source: Option<Arc<dyn NetworkSource>>,
+    /// The user's list.
+    known: KnownNetworks,
+    /// The last OS answer, or `None` before the first check. With the list on,
+    /// `None` reads as unknown, which holds uploads (R8.8).
+    current: Option<Result<CurrentNetwork, NetworkProblem>>,
+}
+
+impl NetworkWatch {
+    fn decision(&self) -> NetworkDecision {
+        match &self.current {
+            Some(current) => decide(&self.known, current.as_ref()),
+            None if self.known.enabled => NetworkDecision::Unknown,
+            None => NetworkDecision::Allowed,
+        }
+    }
+
+    fn status(&self) -> NetworkStatus {
+        self.current
+            .as_ref()
+            .map_or_else(NetworkStatus::default, NetworkStatus::from_result)
+    }
 }
 
 /// The folder sync engine (R2, R3, R6.7, R8.7).
@@ -406,6 +462,9 @@ impl Engine {
             resume: Notify::new(),
             sync_now: Notify::new(),
             album_wake: Notify::new(),
+            network: Mutex::new(NetworkWatch::default()),
+            network_wake: Notify::new(),
+            network_check_running: AtomicBool::new(false),
             watcher: Mutex::new(None),
             tasks: Mutex::new(Vec::new()),
             stopped: AtomicBool::new(false),
@@ -449,6 +508,18 @@ impl Engine {
             .expect("the task list")
             .push(backfill);
         self.inner.tag_wake.notify_one();
+        // R8.8: the network check has one task of its own. The gate is already
+        // held from `watch_network`, so the list can never let an unchecked
+        // upload out while the first check runs.
+        let network = tokio::spawn({
+            let inner = Arc::clone(&self.inner);
+            async move { network_loop(inner).await }
+        });
+        self.inner
+            .tasks
+            .lock()
+            .expect("the task list")
+            .push(network);
         // #47: a title the user changed is sent by its own task, woken by the
         // edit and by the scan, so no status poll sends a request.
         let albums = tokio::spawn({
@@ -544,12 +615,62 @@ impl Engine {
         tracing::info!("the sync engine resumed");
     }
 
-    /// Whether new uploads are held.
+    /// Whether new uploads are held by the user's pause (R8.7).
+    ///
+    /// The network hold is not this: the dashboard's control and the tray's
+    /// Resume own the user's own pause, and the status carries the network
+    /// reason separately (R8.8).
     #[must_use]
     pub fn is_paused(&self) -> bool {
         self.inner.gate.is_paused()
     }
 
+    /// Points the engine at the platform's network names and the user's list
+    /// (R8.8). Call it before [`Self::start`].
+    ///
+    /// The gate is held at once when the list is on, so uploads wait for the
+    /// first check instead of running ahead of it.
+    pub fn watch_network(&self, source: Arc<dyn NetworkSource>, known: KnownNetworks) {
+        let mut network = self.inner.network.lock().expect("the network lock");
+        network.source = Some(source);
+        network.known = known;
+        network.current = None;
+        self.inner
+            .gate
+            .hold_network(network.decision() != NetworkDecision::Allowed);
+        drop(network);
+        self.inner.network_wake.notify_one();
+        tracing::info!("the network check is watching the current network");
+    }
+
+    /// The known-network list the engine is holding (R8.8).
+    #[must_use]
+    pub fn known_networks(&self) -> KnownNetworks {
+        self.inner
+            .network
+            .lock()
+            .expect("the network lock")
+            .known
+            .clone()
+    }
+
+    /// Moves the engine to the user's newest known-network list (R8.8).
+    ///
+    /// The last OS answer decides at once, so turning the list on does not
+    /// leave an upload window open while the next check runs. Nothing here
+    /// calls the platform: that call runs off the engine's async workers.
+    pub fn set_known_networks(&self, known: KnownNetworks) {
+        {
+            let mut network = self.inner.network.lock().expect("the network lock");
+            network.known = known;
+            self.inner
+                .gate
+                .hold_network(network.decision() != NetworkDecision::Allowed);
+        }
+        self.inner.network_wake.notify_one();
+        self.inner.resume.notify_waiters();
+    }
+
     /// Asks for a reconciliation scan now (R8.3).
     pub fn sync_now(&self) {
         self.inner.sync_now.notify_one();
@@ -834,9 +955,21 @@ impl Engine {
                 None
             }
         };
+        // One lock, so the reason and the status it reads cannot disagree.
+        let (pause, network) = {
+            let network = self.inner.network.lock().expect("the network lock");
+            // R8.7 first: a pause the user set is the reason they know.
+            let pause = if self.inner.gate.is_paused() {
+                Some(PauseReason::User)
+            } else {
+                PauseReason::from_decision(network.decision())
+            };
+            (pause, network.status())
+        };
         Status::derive(StatusInputs {
             folders,
-            paused: self.inner.gate.is_paused(),
+            pause,
+            network,
             connection: ConnectionHealth::from_state(&self.inner.session.state()),
             review_total,
             last_error: self
@@ -1407,11 +1540,12 @@ impl EngineInner {
         }
     }
 
-    /// Waits while the user holds uploads (R8.7).
+    /// Waits while uploads are held, by the pause or by the network (R8.7,
+    /// R8.8).
     async fn wait_while_paused(&self) {
-        while self.gate.is_paused() {
+        while self.gate.is_held() {
             let notified = self.resume.notified();
-            if !self.gate.is_paused() {
+            if !self.gate.is_held() {
                 break;
             }
             notified.await;
@@ -1752,6 +1886,101 @@ async fn wait_for_the_server(inner: &Arc<EngineInner>) -> Result<(), ClientError
     Ok(())
 }
 
+/// Wakes the network gate on the fallback poll, on an OS change event, on a
+/// settings change, and after a request that could not reach the server
+/// (R8.8).
+///
+/// The platform call runs on a blocking thread, because every backend is a
+/// synchronous OS API and one of them (NetworkManager over D-Bus) can wait.
+async fn network_loop(inner: Arc<EngineInner>) {
+    let mut changes = inner
+        .network
+        .lock()
+        .expect("the network lock")
+        .source
+        .as_ref()
+        .and_then(|source| source.changes());
+    loop {
+        check_network(&inner).await;
+        let poll = tokio::time::sleep(inner.config.network_poll);
+        tokio::select! {
+            () = poll => {}
+            () = inner.network_wake.notified() => {}
+            () = network_change(&mut changes) => {}
+        }
+    }
+}
+
+/// Resolves when the platform reports a network change, or never when it has
+/// no subscription.
+///
+/// A closed channel is a backend that stopped listening (no NetworkManager, a
+/// refused COM advice, a failed event thread). The receiver is dropped then,
+/// so the fallback poll alone drives the check: awaiting a closed channel
+/// returns at once and would otherwise spin this loop.
+async fn network_change(changes: &mut Option<mpsc::Receiver<()>>) {
+    let Some(channel) = changes.as_mut() else {
+        return std::future::pending().await;
+    };
+    if channel.recv().await.is_none() {
+        *changes = None;
+    }
+}
+
+/// Asks the platform once and moves the gate to its answer (R8.8).
+///
+/// A check that runs longer than the timeout reads as unknown, and a platform
+/// call still running after that blocks the next spawn until it returns, so a
+/// hung OS API cannot leave the last answer in force or accumulate threads.
+async fn check_network(inner: &Arc<EngineInner>) {
+    let Some(source) = inner
+        .network
+        .lock()
+        .expect("the network lock")
+        .source
+        .clone()
+    else {
+        return;
+    };
+    let current = if inner.network_check_running.swap(true, Ordering::SeqCst) {
+        Err(NetworkProblem::new("the network check is still running"))
+    } else {
+        let running = Arc::clone(inner);
+        let timeout = inner.config.network_check_timeout;
+        let answer = tokio::time::timeout(
+            timeout,
+            tokio::task::spawn_blocking(move || {
+                let answer = source.current();
+                // The blocked task clears the flag even when its answer
+                // arrived too late to be used.
+                running.network_check_running.store(false, Ordering::SeqCst);
+                answer
+            }),
+        )
+        .await;
+        match answer {
+            Ok(Ok(answer)) => answer,
+            Ok(Err(_)) => {
+                inner.network_check_running.store(false, Ordering::SeqCst);
+                Err(NetworkProblem::new("the network check did not finish"))
+            }
+            Err(_) => Err(NetworkProblem::new("the network check timed out")),
+        }
+    };
+    let hold = {
+        let mut network = inner.network.lock().expect("the network lock");
+        network.current = Some(current);
+        network.decision() != NetworkDecision::Allowed
+    };
+    inner.gate.hold_network(hold);
+    // A hold that lifts wakes the dispatcher and every worker waiting on the
+    // gate, so a returning known network resumes without a click (R8.8).
+    if !hold {
+        inner.resume.notify_waiters();
+    }
+    tracing::debug!(held = hold, "the network check ran");
+}
+
 /// The dispatcher: batches queued paths, hashes them, checks them in one
 /// request, and hands accepted files to the upload pool (R3.1, R3.2).
 async fn dispatch_loop(inner: Arc<EngineInner>, mut queue_rx: mpsc::UnboundedReceiver<PathBuf>) {
@@ -2235,7 +2464,7 @@ fn is_settled(state: ItemState) -> bool {
 /// attempt, so a worker sleeping its backoff holds no slot: lowering the
 /// concurrency limit drains the pool instead of waiting out the sleep.
 async fn spawn_upload(inner: &Arc<EngineInner>, item: PreparedItem) {
-    if inner.gate.is_paused() {
+    if inner.gate.is_held() {
         inner.finish_item(&item, &UploadOutcome::Deferred);
         return;
     }
@@ -2367,6 +2596,9 @@ async fn upload_with_retries(inner: &Arc<EngineInner>, item: &PreparedItem) -> U
             // R6.6: only a connection failure feeds the breaker; a 429 or a
             // 503 is the server answering, not the server being gone.
             inner.breaker.record_failure();
+            // R8.8: a request that could not reach the server re-checks the
+            // network, so a stale "allowed" cannot keep failing.
+            inner.network_wake.notify_one();
         }
         if failure.is_permanent() || attempts >= cap {
             if !failure.is_permanent() {
@@ -2508,6 +2740,10 @@ async fn scan_loop(inner: Arc<EngineInner>) {
         if !rescan && !absences.is_empty() && !tracked {
             continue;
         }
+        // R8.7 and R8.8: a held sync scans nothing, so a paused client does no
+        // work at all. The request that woke the loop is not lost: the scan
+        // runs as soon as the hold lifts.
+        inner.wait_while_paused().await;
         scan_once(&inner).await;
     }
 }
@@ -3787,6 +4023,8 @@ mod tests {
     fn progress_is_zero_with_no_items_and_one_when_uploaded() {
         let mut status = Status {
             activity: Activity::Idle,
+            pause: None,
+            network: NetworkStatus::default(),
             folders: Vec::new(),
             counts: FolderCounts::default(),
             last_error: None,
diff --git a/crates/sync-core/src/lib.rs b/crates/sync-core/src/lib.rs
index 80093d3..7466bf1 100644
--- a/crates/sync-core/src/lib.rs
+++ b/crates/sync-core/src/lib.rs
@@ -16,6 +16,7 @@ pub mod failure;
 pub mod hash;
 pub mod meter;
 pub mod missing;
+pub mod network;
 pub mod pairing;
 pub mod paths;
 pub mod scan;
diff --git a/crates/sync-core/src/network.rs b/crates/sync-core/src/network.rs
new file mode 100644
index 0000000..d305691
--- /dev/null
+++ b/crates/sync-core/src/network.rs
@@ -0,0 +1,203 @@
+//! The known-network gate (SPEC R8.8).
+//!
+//! The client pauses uploads unless it can prove the current network is one the
+//! user listed. The platform answers "which network is this" behind
+//! [`NetworkSource`]; the decision itself is pure, so every case runs without a
+//! platform.
+
+use std::fmt;
+
+use tokio::sync::mpsc::Receiver;
+
+/// What the OS reports about the current connection (R8.8).
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub enum CurrentNetwork {
+    /// A connection with no wireless name to match: Ethernet, or a machine
+    /// whose Wi-Fi is off while a link still carries traffic. It always syncs.
+    Wired,
+    /// A wireless network, under the name the OS reports.
+    Wireless(String),
+}
+
+/// Why the client cannot tell which network it is on (R8.8).
+///
+/// The reason reaches the Settings page, so it says what the user can fix.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct NetworkProblem(String);
+
+impl NetworkProblem {
+    /// A problem with the reason the user reads.
+    #[must_use]
+    pub fn new(reason: impl Into<String>) -> Self {
+        Self(reason.into())
+    }
+
+    /// The reason, without the surrounding sentence.
+    #[must_use]
+    pub fn reason(&self) -> &str {
+        &self.0
+    }
+}
+
+impl fmt::Display for NetworkProblem {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter.write_str(&self.0)
+    }
+}
+
+impl std::error::Error for NetworkProblem {}
+
+/// The user's known-network list (R8.8).
+#[derive(Clone, Debug, Default, PartialEq, Eq)]
+pub struct KnownNetworks {
+    /// Whether the list filters uploads at all. Off by default, which is the
+    /// behaviour every build had before the list existed.
+    pub enabled: bool,
+    /// The names the user typed.
+    pub names: Vec<String>,
+}
+
+impl KnownNetworks {
+    /// The names that can match, trimmed, so a stray space in the settings file
+    /// does not pause a network the user listed.
+    fn listed(&self) -> impl Iterator<Item = &str> {
+        self.names
+            .iter()
+            .map(|name| name.trim())
+            .filter(|name| !name.is_empty())
+    }
+}
+
+/// What the gate decided for the current network (R8.8).
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq)]
+pub enum NetworkDecision {
+    /// Uploads may run: the list is off, the connection is wired, or its name
+    /// is listed.
+    #[default]
+    Allowed,
+    /// The network has a name the user did not list, so uploads wait (R8.8).
+    NotListed,
+    /// The client cannot prove which network this is, so uploads wait (R8.8).
+    Unknown,
+}
+
+/// The pure check (R8.8): the current network, or the reason it is unknown,
+/// decides whether uploads may run under `known`.
+///
+/// It fails closed: only a wired connection, or a wireless name the user
+/// listed, allows uploads while the list is on.
+#[must_use]
+pub fn decide(
+    known: &KnownNetworks,
+    current: Result<&CurrentNetwork, &NetworkProblem>,
+) -> NetworkDecision {
+    if !known.enabled {
+        return NetworkDecision::Allowed;
+    }
+    match current {
+        Ok(CurrentNetwork::Wired) => NetworkDecision::Allowed,
+        // An empty name proves nothing, so it is unknown rather than an
+        // unlisted network the user could act on.
+        Ok(CurrentNetwork::Wireless(name)) if name.trim().is_empty() => NetworkDecision::Unknown,
+        Ok(CurrentNetwork::Wireless(name)) if known.listed().any(|listed| listed == name) => {
+            NetworkDecision::Allowed
+        }
+        Ok(CurrentNetwork::Wireless(_)) => NetworkDecision::NotListed,
+        Err(_) => NetworkDecision::Unknown,
+    }
+}
+
+/// One platform's answer to "which network is this" (R8.8).
+///
+/// The backends live in the shell; the engine only asks. Every call may block,
+/// so the engine runs it off its async workers.
+pub trait NetworkSource: Send + Sync {
+    /// The current connection, or why the client cannot name it.
+    fn current(&self) -> Result<CurrentNetwork, NetworkProblem>;
+
+    /// A channel that fires when the OS reports a network change, where the
+    /// platform has one. The 30-second fallback poll covers the rest (R8.8).
+    fn changes(&self) -> Option<Receiver<()>> {
+        None
+    }
+}
+
+/// What the shell shows about the current network (R8.8).
+#[derive(Clone, Debug, Default, PartialEq, Eq)]
+pub struct NetworkStatus {
+    /// The wireless network's name, when the OS reported one.
+    pub name: Option<String>,
+    /// Whether the connection has no wireless name to match.
+    pub wired: bool,
+    /// Why the name is unknown, when it is.
+    pub problem: Option<String>,
+}
+
+impl NetworkStatus {
+    /// The status for one OS answer, or for the reason it failed.
+    #[must_use]
+    pub fn from_result(result: &Result<CurrentNetwork, NetworkProblem>) -> Self {
+        match result {
+            Ok(CurrentNetwork::Wired) => Self {
+                wired: true,
+                ..Self::default()
+            },
+            Ok(CurrentNetwork::Wireless(name)) if !name.trim().is_empty() => Self {
+                name: Some(name.clone()),
+                ..Self::default()
+            },
+            Ok(CurrentNetwork::Wireless(_)) => Self {
+                problem: Some("the OS reported no network name".to_string()),
+                ..Self::default()
+            },
+            Err(problem) => Self {
+                problem: Some(problem.reason().to_string()),
+                ..Self::default()
+            },
+        }
+    }
+
+    /// The value the Settings page shows beside the list (R8.8). The row's own
+    /// title already says "Current network", so this is the name or the reason
+    /// alone, and a long reason wraps under that title.
+    #[must_use]
+    pub fn value(&self) -> String {
+        if self.wired {
+            return "wired".to_string();
+        }
+        match (&self.name, &self.problem) {
+            (Some(name), _) => name.clone(),
+            (None, Some(problem)) => format!("unknown — {problem}"),
+            (None, None) => "unknown".to_string(),
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::{CurrentNetwork, NetworkProblem, NetworkStatus};
+
+    /// R8.8: the Settings line names the network when it can, and says why
+    /// when it cannot.
+    #[test]
+    fn the_settings_value_is_the_name_or_the_reason() {
+        assert_eq!(
+            NetworkStatus::from_result(&Ok(CurrentNetwork::Wireless("Home".to_string()))).value(),
+            "Home"
+        );
+        assert_eq!(
+            NetworkStatus::from_result(&Ok(CurrentNetwork::Wired)).value(),
+            "wired"
+        );
+        assert_eq!(
+            NetworkStatus::from_result(&Err(NetworkProblem::new("NetworkManager not found")))
+                .value(),
+            "unknown — NetworkManager not found"
+        );
+        assert_eq!(NetworkStatus::default().value(), "unknown");
+        assert_eq!(
+            NetworkStatus::from_result(&Ok(CurrentNetwork::Wireless("  ".to_string()))).value(),
+            "unknown — the OS reported no network name"
+        );
+    }
+}
diff --git a/crates/sync-core/src/status.rs b/crates/sync-core/src/status.rs
index b685b9f..128c2fb 100644
--- a/crates/sync-core/src/status.rs
+++ b/crates/sync-core/src/status.rs
@@ -7,6 +7,7 @@
 
 use crate::connection::ConnectionState;
 use crate::meter::UploadTraffic;
+use crate::network::{NetworkDecision, NetworkStatus};
 use crate::store::{AlbumPath, AlbumScope, FolderCounts};
 
 /// The activity state the tray and the dashboard show (R8.2).
@@ -16,7 +17,8 @@ pub enum Activity {
     Idle,
     /// Files are queued or in flight.
     Syncing,
-    /// The user paused new uploads (R8.7).
+    /// The user paused new uploads (R8.7), or the known-network list holds
+    /// them (R8.8). [`Status::pause`] says which.
     Paused,
     /// A failure or a missing folder needs the user.
     NeedsAttention,
@@ -35,6 +37,39 @@ impl Activity {
     }
 }
 
+/// Why uploads are held (R8.7, R8.8).
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum PauseReason {
+    /// The user paused the sync (R8.7).
+    User,
+    /// The current network is not one the user listed (R8.8).
+    NotListed,
+    /// The client cannot prove which network it is on (R8.8).
+    Unknown,
+}
+
+impl PauseReason {
+    /// The reason the network gate gives, when it holds uploads (R8.8).
+    #[must_use]
+    pub fn from_decision(decision: NetworkDecision) -> Option<Self> {
+        match decision {
+            NetworkDecision::Allowed => None,
+            NetworkDecision::NotListed => Some(Self::NotListed),
+            NetworkDecision::Unknown => Some(Self::Unknown),
+        }
+    }
+
+    /// The activity line the dashboard and the tray show (R8.1, R8.2).
+    #[must_use]
+    pub fn line(self) -> &'static str {
+        match self {
+            Self::User => "Paused",
+            Self::NotListed => "Paused — not on a known network",
+            Self::Unknown => "Paused — network unknown",
+        }
+    }
+}
+
 /// Why a folder's album title is not on the server yet (#47).
 #[derive(Clone, Debug, PartialEq, Eq)]
 pub enum AlbumRename {
@@ -101,6 +136,12 @@ pub struct FolderStatus {
 pub struct Status {
     /// The global activity state.
     pub activity: Activity,
+    /// Why uploads are held, when they are (R8.7, R8.8). `Some` exactly when
+    /// the activity is [`Activity::Paused`], so the reason and the state
+    /// cannot disagree.
+    pub pause: Option<PauseReason>,
+    /// What the OS reports about the network, for the Settings page (R8.8).
+    pub network: NetworkStatus,
     /// One entry per source folder, in the stored order.
     pub folders: Vec<FolderStatus>,
     /// The summed counts across folders. The review count is the store's
@@ -125,7 +166,8 @@ impl Status {
     pub fn derive(inputs: StatusInputs) -> Self {
         let StatusInputs {
             folders,
-            paused,
+            pause,
+            network,
             connection,
             review_total,
             last_error,
@@ -149,7 +191,7 @@ impl Status {
         let needs_the_user = folders
             .iter()
             .any(|folder| !folder.available || folder.last_error.is_some());
-        let activity = if paused {
+        let activity = if pause.is_some() {
             Activity::Paused
         } else if needs_the_user || connection == ConnectionHealth::NeedsAttention {
             Activity::NeedsAttention
@@ -164,6 +206,8 @@ impl Status {
         };
         Self {
             activity,
+            pause,
+            network,
             folders,
             counts,
             last_error,
@@ -214,8 +258,10 @@ impl ConnectionHealth {
 pub struct StatusInputs {
     /// One entry per source folder, in the order the cards show them.
     pub folders: Vec<FolderStatus>,
-    /// Whether the user holds new uploads (R8.7).
-    pub paused: bool,
+    /// Why uploads are held, when they are (R8.7, R8.8).
+    pub pause: Option<PauseReason>,
+    /// What the OS reports about the network (R8.8).
+    pub network: NetworkStatus,
     /// The connection, as far as the status cares.
     pub connection: ConnectionHealth,
     /// The store's global review count, when the caller can supply it.
diff --git a/crates/sync-core/src/upload.rs b/crates/sync-core/src/upload.rs
index afc8966..d894445 100644
--- a/crates/sync-core/src/upload.rs
+++ b/crates/sync-core/src/upload.rs
@@ -60,19 +60,24 @@ pub enum UploadOutcome {
     /// The retry policy spent the attempt cap, so the item is parked until the
     /// user retries it by hand (R6.5).
     DeadLetter(UploadFailure),
-    /// New uploads are paused (R8.7). The item stays queued and uploads after
+    /// New uploads are held, by the pause or by the known-network list (R8.7,
+    /// R8.8). The item stays queued and uploads after
     /// [`UploadGate::resume`].
     Deferred,
 }
 
-/// Whether new uploads may start (R8.7).
+/// Whether new uploads may start (R8.7, R8.8).
 ///
-/// Pause stops new upload requests inside the acceptance window; an upload
-/// already on the wire finishes. The flag is shared with the engine's worker
-/// pool, so a resume takes effect without a restart.
+/// A hold stops new upload requests inside the acceptance window; an upload
+/// already on the wire finishes. The flags are shared with the engine's worker
+/// pool, so a resume takes effect without a restart. Two independent holds
+/// exist: the user's pause (R8.7) and the known-network gate (R8.8). The UI's
+/// Pause control owns only the first, so Resume cannot override the network
+/// rule.
 #[derive(Clone, Debug, Default)]
 pub struct UploadGate {
     paused: Arc<AtomicBool>,
+    network_held: Arc<AtomicBool>,
 }
 
 impl UploadGate {
@@ -92,11 +97,23 @@ impl UploadGate {
         self.paused.store(false, Ordering::SeqCst);
     }
 
-    /// Whether new uploads are held right now.
+    /// Holds new uploads unless the current network is allowed (R8.8).
+    pub fn hold_network(&self, hold: bool) {
+        self.network_held.store(hold, Ordering::SeqCst);
+    }
+
+    /// Whether the user paused (R8.7). The pause control and the status read
+    /// this, so the network hold is never mistaken for the user's own.
     #[must_use]
     pub fn is_paused(&self) -> bool {
         self.paused.load(Ordering::SeqCst)
     }
+
+    /// Whether new uploads are held right now, by either hold (R8.7, R8.8).
+    #[must_use]
+    pub fn is_held(&self) -> bool {
+        self.is_paused() || self.network_held.load(Ordering::SeqCst)
+    }
 }
 
 /// The XMP sidecar that rides along with one upload (R3.3).
@@ -407,8 +424,9 @@ impl Uploader {
     /// accepted, marking the row `uploading` first so a crash mid-request
     /// leaves it re-queueable (R6.7).
     ///
-    /// The gate is checked immediately before the request, so a pause stops
-    /// the next upload even inside an already-dispatched worker (R8.7). The
+    /// The gate is checked immediately before the request, so a pause or a
+    /// network hold stops the next upload even inside an already-dispatched
+    /// worker (R8.7, R8.8). The
     /// bandwidth limit is live, so the request streams under whatever limit is
     /// set when its bytes are read (R7.1). `meter` is the folder's: the body
     /// counts its bytes there and the request counts itself in flight while it
@@ -444,10 +462,10 @@ impl Uploader {
             attempts: 0,
             sidecar: recorded,
         };
-        if gate.is_paused() {
+        if gate.is_held() {
             item.state = ItemState::Pending;
             self.record(&item);
-            tracing::debug!(path = %item.path, "the upload was deferred while paused");
+            tracing::debug!(path = %item.path, "the upload was deferred by a hold");
             return UploadOutcome::Deferred;
         }
         self.record(&item);
diff --git a/crates/sync-core/tests/it/main.rs b/crates/sync-core/tests/it/main.rs
index 2b18784..fcafedf 100644
--- a/crates/sync-core/tests/it/main.rs
+++ b/crates/sync-core/tests/it/main.rs
@@ -14,6 +14,7 @@ mod limits;
 mod log_redaction;
 mod meter;
 mod missing;
+mod network;
 mod pairing;
 mod status;
 mod store;
diff --git a/crates/sync-core/tests/it/network.rs b/crates/sync-core/tests/it/network.rs
new file mode 100644
index 0000000..c0265c7
--- /dev/null
+++ b/crates/sync-core/tests/it/network.rs
@@ -0,0 +1,612 @@
+//! The known-network gate (SPEC R8.8): the pure check, and the engine pausing
+//! and resuming over a fake backend.
+//!
+//! Every case the ticket names runs here without a platform: the check's own
+//! table, startup, an OS change event, the fallback poll, an OS that errors,
+//! and an upload that could not reach the server.
+
+use super::common::wait_until;
+
+use std::path::{Path, PathBuf};
+use std::sync::{Arc, Mutex};
+use std::time::Duration;
+
+use mock_immich::{Fault, MockImmich, Operation};
+use sync_core::connection::{AuthMethod, Connection, Secret, SharedSession, SignIn};
+use sync_core::credential::MemoryCredentialStore;
+use sync_core::engine::{Engine, EngineConfig};
+use sync_core::network::{
+    CurrentNetwork, KnownNetworks, NetworkDecision, NetworkProblem, NetworkSource, decide,
+};
+use sync_core::status::{Activity, PauseReason};
+use sync_core::store::{SourceFolder, StateStore};
+use sync_core::tracking::Tracking;
+use tokio::sync::mpsc;
+
+/// A backend a test sets by hand, with the change channel a platform would
+/// own.
+struct FakeNetwork {
+    current: Mutex<Result<CurrentNetwork, NetworkProblem>>,
+    /// The sender the test announces with. `None` when the backend's event
+    /// channel is closed, which is what a backend that stops listening looks
+    /// like.
+    announce: Option<mpsc::Sender<()>>,
+    events: Mutex<Option<mpsc::Receiver<()>>>,
+    /// How many times the engine asked for the network.
+    calls: std::sync::atomic::AtomicUsize,
+    /// Whether the first answer takes a long time, for the timeout case.
+    slow_first: std::sync::atomic::AtomicBool,
+}
+
+impl FakeNetwork {
+    fn new(current: Result<CurrentNetwork, NetworkProblem>) -> Arc<Self> {
+        Self::build(current, true, false)
+    }
+
+    /// A backend whose event channel is already closed, as when its listener
+    /// thread bailed out.
+    fn with_closed_events(current: Result<CurrentNetwork, NetworkProblem>) -> Arc<Self> {
+        Self::build(current, false, false)
+    }
+
+    /// A backend whose first answer arrives after the check's timeout.
+    fn answering_after_the_first_check(
+        current: Result<CurrentNetwork, NetworkProblem>,
+    ) -> Arc<Self> {
+        Self::build(current, true, true)
+    }
+
+    fn build(
+        current: Result<CurrentNetwork, NetworkProblem>,
+        events_open: bool,
+        slow_first: bool,
+    ) -> Arc<Self> {
+        use std::sync::atomic::AtomicBool;
+        let (sender, events) = mpsc::channel(8);
+        let announce = if events_open {
+            Some(sender)
+        } else {
+            drop(sender);
+            None
+        };
+        Arc::new(Self {
+            current: Mutex::new(current),
+            announce,
+            events: Mutex::new(Some(events)),
+            calls: std::sync::atomic::AtomicUsize::new(0),
+            slow_first: AtomicBool::new(slow_first),
+        })
+    }
+
+    fn set(&self, current: Result<CurrentNetwork, NetworkProblem>) {
+        *self.current.lock().expect("the fake network") = current;
+    }
+
+    fn announce(&self) {
+        if let Some(announce) = &self.announce {
+            let _ = announce.try_send(());
+        }
+    }
+
+    fn calls(&self) -> usize {
+        self.calls.load(std::sync::atomic::Ordering::SeqCst)
+    }
+}
+
+impl NetworkSource for FakeNetwork {
+    fn current(&self) -> Result<CurrentNetwork, NetworkProblem> {
+        self.calls.fetch_add(1, std::sync::atomic::Ordering::SeqCst);
+        if self
+            .slow_first
+            .swap(false, std::sync::atomic::Ordering::SeqCst)
+        {
+            std::thread::sleep(Duration::from_millis(300));
+        }
+        self.current.lock().expect("the fake network").clone()
+    }
+
+    fn changes(&self) -> Option<mpsc::Receiver<()>> {
+        self.events.lock().expect("the fake events").take()
+    }
+}
+
+fn wireless(name: &str) -> Result<CurrentNetwork, NetworkProblem> {
+    Ok(CurrentNetwork::Wireless(name.to_string()))
+}
+
+fn listed(name: &str) -> KnownNetworks {
+    KnownNetworks {
+        enabled: true,
+        names: vec![name.to_string()],
+    }
+}
+
+#[test]
+fn the_check_fails_closed() {
+    let off = KnownNetworks::default();
+    let home = listed("Home");
+    let wired = Ok(CurrentNetwork::Wired);
+    let unknown = Err(NetworkProblem::new("NetworkManager not found"));
+    let cases = [
+        // R8.8: the list off keeps the old behaviour on any network.
+        (&off, &wired, NetworkDecision::Allowed),
+        (&off, &wireless("Cafe"), NetworkDecision::Allowed),
+        (&off, &unknown, NetworkDecision::Allowed),
+        // A listed wireless name, and a wired connection, always sync.
+        (&home, &wireless("Home"), NetworkDecision::Allowed),
+        (&home, &wired, NetworkDecision::Allowed),
+        // A name the user did not list waits.
+        (&home, &wireless("Cafe"), NetworkDecision::NotListed),
+        // Nothing proves the network: an OS that errors pauses.
+        (&home, &unknown, NetworkDecision::Unknown),
+        // An empty name proves nothing either, so it reads as unknown.
+        (&home, &wireless(""), NetworkDecision::Unknown),
+        // A listed name with stray space still matches.
+        (
+            &KnownNetworks {
+                enabled: true,
+                names: vec![" Home ".to_string()],
+            },
+            &wireless("Home"),
+            NetworkDecision::Allowed,
+        ),
+        // An empty list allows nothing but a wired connection.
+        (
+            &KnownNetworks {
+                enabled: true,
+                names: Vec::new(),
+            },
+            &wireless("Home"),
+            NetworkDecision::NotListed,
+        ),
+    ];
+    for (known, current, expected) in cases {
+        assert_eq!(
+            decide(known, current.as_ref()),
+            expected,
+            "known {known:?} on {current:?}"
+        );
+    }
+}
+
+async fn signed_in(server: &MockImmich) -> SharedSession {
+    let mut connection = Connection::new(server.base_url(), Arc::new(MemoryCredentialStore::new()))
+        .expect("a valid URL");
+    connection
+        .sign_in(SignIn {
+            email: "sync@example.com".to_string(),
+            secret: Secret::new("correct horse"),
+            method: AuthMethod::Password,
+        })
+        .await;
+    connection.shared()
+}
+
+fn store_in(temp: &tempfile::TempDir) -> Arc<StateStore> {
+    Arc::new(StateStore::open(temp.path().join("data").join("state.db")).expect("open the store"))
+}
+
+fn add_folder(store: &StateStore, path: &Path) {
+    store
+        .add_folder(&SourceFolder {
+            path: path.display().to_string(),
+            recursive: true,
+            ..Default::default()
+        })
+        .expect("add the source folder");
+}
+
+fn write_file(root: &Path, name: &str, bytes: &[u8]) -> PathBuf {
+    let path = root.join(name);
+    std::fs::create_dir_all(root).expect("create the fixture directory");
+    std::fs::write(&path, bytes).expect("write the fixture");
+    path
+}
+
+/// Starts an engine that watches the fake backend, with the watcher on so a
+/// new file reaches the queue without a manual scan.
+async fn start_engine(
+    server: &MockImmich,
+    store: &Arc<StateStore>,
+    fake: &Arc<FakeNetwork>,
+    known: KnownNetworks,
+    poll: Duration,
+) -> Arc<Engine> {
+    start_engine_with(server, store, fake, known, poll, Duration::from_secs(5)).await
+}
+
+/// [`start_engine`], with the check's own timeout.
+async fn start_engine_with(
+    server: &MockImmich,
+    store: &Arc<StateStore>,
+    fake: &Arc<FakeNetwork>,
+    known: KnownNetworks,
+    poll: Duration,
+    check_timeout: Duration,
+) -> Arc<Engine> {
+    let session = signed_in(server).await;
+    let engine = Arc::new(
+        Engine::new(
+            Arc::new(Tracking::new(store.clone())),
+            session,
+            EngineConfig {
+                network_poll: poll,
+                network_check_timeout: check_timeout,
+                watch_debounce: Duration::from_millis(50),
+                ..EngineConfig::default()
+            },
+        )
+        .expect("build the engine"),
+    );
+    engine.watch_network(Arc::clone(fake) as Arc<dyn NetworkSource>, known);
+    engine.start();
+    engine
+}
+
+fn uploaded(store: &StateStore, path: &Path) -> bool {
+    matches!(
+        store.item(&path.display().to_string()),
+        Ok(Some(row)) if row.state.is_terminal_success()
+    )
+}
+
+/// R8.8: the engine never uploads on a network the user did not list.
+#[tokio::test]
+async fn a_start_on_an_unlisted_network_waits() {
+    let server = MockImmich::start().await;
+    let temp = tempfile::tempdir().expect("create a temp dir");
+    let store = store_in(&temp);
+    let photos = temp.path().join("photos");
+    let file = write_file(&photos, "first.jpg", b"first");
+    add_folder(&store, &photos);
+    let fake = FakeNetwork::new(wireless("Cafe"));
+    let engine = start_engine(
+        &server,
+        &store,
+        &fake,
+        listed("Home"),
+        Duration::from_secs(60),
+    )
+    .await;
+
+    assert!(
+        wait_until(
+            || engine.status().pause == Some(PauseReason::NotListed),
+            Duration::from_secs(5)
+        )
+        .await,
+        "the engine did not report the unlisted network"
+    );
+    assert_eq!(engine.status().activity, Activity::Paused);
+    tokio::time::sleep(Duration::from_millis(300)).await;
+    assert_eq!(
+        server.upload_requests(),
+        0,
+        "R8.8: no upload may start on an unlisted network"
+    );
+    assert!(!uploaded(&store, &file));
+    engine.stop();
+}
+
+/// R8.8: leaving a listed network pauses, and returning resumes with the
+/// queue kept, so nothing failed and nothing was lost.
+#[tokio::test]
+async fn leaving_a_listed_network_pauses_and_returning_resumes_with_the_queue() {
+    let server = MockImmich::start().await;
+    let temp = tempfile::tempdir().expect("create a temp dir");
+    let store = store_in(&temp);
+    let photos = temp.path().join("photos");
+    std::fs::create_dir_all(&photos).expect("create the folder");
+    add_folder(&store, &photos);
+    let fake = FakeNetwork::new(wireless("Home"));
+    let engine = start_engine(
+        &server,
+        &store,
+        &fake,
+        listed("Home"),
+        Duration::from_secs(60),
+    )
+    .await;
+    assert!(
+        wait_until(|| engine.status().pause.is_none(), Duration::from_secs(5)).await,
+        "the listed network did not let uploads run"
+    );
+
+    // The OS reports another network, and the change event wakes the check
+    // long before the 60-second poll.
+    fake.set(wireless("Cafe"));
+    fake.announce();
+    assert!(
+        wait_until(
+            || engine.status().pause == Some(PauseReason::NotListed),
+            Duration::from_secs(5)
+        )
+        .await,
+        "leaving the listed network did not pause"
+    );
+
+    // A file written while paused is queued, not failed.
+    let queued = write_file(&photos, "queued.jpg", b"queued while paused");
+    tokio::time::sleep(Duration::from_millis(400)).await;
+    assert_eq!(
+        server.upload_requests(),
+        0,
+        "R8.8: the queue is held, not attempted"
+    );
+    assert!(
+        !uploaded(&store, &queued),
+        "the queued file must still wait"
+    );
+
+    // The listed network comes back: the engine resumes on its own.
+    fake.set(wireless("Home"));
+    fake.announce();
+    assert!(
+        wait_until(|| uploaded(&store, &queued), Duration::from_secs(10)).await,
+        "returning to the listed network did not resume the queue"
+    );
+    assert_eq!(engine.status().pause, None, "the engine reports the resume");
+    engine.stop();
+}
+
+/// R8.8: the 30-second poll is the net under a missed change event, so a
+/// shorter poll must notice a change no event announced.
+#[tokio::test]
+async fn the_fallback_poll_notices_a_missed_change() {
+    let server = MockImmich::start().await;
+    let temp = tempfile::tempdir().expect("create a temp dir");
+    let store = store_in(&temp);
+    let photos = temp.path().join("photos");
+    write_file(&photos, "first.jpg", b"first");
+    add_folder(&store, &photos);
+    let fake = FakeNetwork::new(wireless("Home"));
+    let engine = start_engine(
+        &server,
+        &store,
+        &fake,
+        listed("Home"),
+        Duration::from_millis(50),
+    )
+    .await;
+    assert!(
+        wait_until(
+            || uploaded(&store, &photos.join("first.jpg")),
+            Duration::from_secs(10)
+        )
+        .await,
+        "the listed network did not upload"
+    );
+
+    // No event is sent: only the poll can see this.
+    fake.set(Err(NetworkProblem::new("no active network connection")));
+    assert!(
+        wait_until(
+            || engine.status().pause == Some(PauseReason::Unknown),
+            Duration::from_secs(5)
+        )
+        .await,
+        "the fallback poll did not notice the vanished network"
+    );
+    assert_eq!(engine.status().activity, Activity::Paused);
+    engine.stop();
+}
+
+/// R8.8: an OS call that errors fails closed, and a later successful call
+/// releases the hold.
+#[tokio::test]
+async fn an_os_call_that_errors_fails_closed_and_recovers() {
+    let server = MockImmich::start().await;
+    let temp = tempfile::tempdir().expect("create a temp dir");
+    let store = store_in(&temp);
+    let photos = temp.path().join("photos");
+    let file = write_file(&photos, "first.jpg", b"first");
+    add_folder(&store, &photos);
+    let fake = FakeNetwork::new(Err(NetworkProblem::new("NetworkManager not found")));
+    let engine = start_engine(
+        &server,
+        &store,
+        &fake,
+        listed("Home"),
+        Duration::from_millis(50),
+    )
+    .await;
+    assert!(
+        wait_until(
+            || engine.status().network.problem.as_deref() == Some("NetworkManager not found"),
+            Duration::from_secs(5)
+        )
+        .await,
+        "an OS that errors must hold uploads and report the reason"
+    );
+    assert_eq!(engine.status().pause, Some(PauseReason::Unknown));
+    assert_eq!(server.upload_requests(), 0);
+
+    fake.set(wireless("Home"));
+    assert!(
+        wait_until(|| uploaded(&store, &file), Duration::from_secs(10)).await,
+        "a recovered check did not release the hold"
+    );
+    engine.stop();
+}
+
+/// R8.8: a request that cannot reach the server re-checks the network at once,
+/// so an "allowed" that went stale cannot keep failing. The poll is a minute
+/// here, so only the error path can produce the pause.
+#[tokio::test]
+async fn an_upload_network_error_rechecks_the_network() {
+    let server = MockImmich::start().await;
+    let temp = tempfile::tempdir().expect("create a temp dir");
+    let store = store_in(&temp);
+    let photos = temp.path().join("photos");
+    std::fs::create_dir_all(&photos).expect("create the folder");
+    add_folder(&store, &photos);
+    let fake = FakeNetwork::new(wireless("Home"));
+    let engine = start_engine(
+        &server,
+        &store,
+        &fake,
+        listed("Home"),
+        Duration::from_secs(60),
+    )
+    .await;
+
+    // The first check lets uploads run, and the answer then goes stale: the OS
+    // has already lost the network, but the engine still believes "Home".
+    assert!(
+        wait_until(
+            || engine.status().network.name.as_deref() == Some("Home"),
+            Duration::from_secs(5)
+        )
+        .await,
+        "the first network check did not land"
+    );
+    assert_eq!(engine.status().pause, None);
+    server.fail(Operation::Upload, Fault::Disconnect);
+    fake.set(Err(NetworkProblem::new("no active network connection")));
+
+    // The request now fails on the wire while the stale answer still says
+    // Home; that failure is what wakes the check.
+    let file = write_file(&photos, "first.jpg", b"first");
+    assert!(
+        wait_until(
+            || {
+                store.item(&file.display().to_string()).is_ok_and(|row| {
+                    row.is_some_and(|row| {
+                        matches!(
+                            row.state,
+                            sync_core::store::ItemState::RetryWait
+                                | sync_core::store::ItemState::FailedPermanent
+                                | sync_core::store::ItemState::DeadLetter
+                        )
+                    })
+                })
+            },
+            Duration::from_secs(10)
+        )
+        .await,
+        "the failing upload never recorded a failure"
+    );
+    assert!(
+        wait_until(
+            || engine.status().pause == Some(PauseReason::Unknown),
+            Duration::from_secs(5)
+        )
+        .await,
+        "R8.8: an upload network error did not re-check the network"
+    );
+    engine.stop();
+}
+
+/// R8.8: a backend whose event channel has closed is polled, not spun. A
+/// closed channel returns at once, so the loop must stop selecting on it.
+#[tokio::test]
+async fn a_closed_event_channel_does_not_spin_the_check() {
+    let server = MockImmich::start().await;
+    let temp = tempfile::tempdir().expect("create a temp dir");
+    let store = store_in(&temp);
+    let photos = temp.path().join("photos");
+    std::fs::create_dir_all(&photos).expect("create the folder");
+    add_folder(&store, &photos);
+    let fake =
+        FakeNetwork::with_closed_events(Err(NetworkProblem::new("the event subscription failed")));
+    let engine = start_engine(
+        &server,
+        &store,
+        &fake,
+        KnownNetworks::default(),
+        Duration::from_secs(60),
+    )
+    .await;
+    // The one-shot wakeups and the closed channel's first return each cost a
+    // check; after that the 60-second poll is the only driver, so the count
+    // must stop growing.
+    tokio::time::sleep(Duration::from_millis(200)).await;
+    let settled = fake.calls();
+    tokio::time::sleep(Duration::from_millis(300)).await;
+    assert_eq!(
+        fake.calls(),
+        settled,
+        "a closed event channel kept checking with a 60-second poll"
+    );
+    engine.stop();
+}
+
+/// R8.8: an OS call that outlives its timeout fails closed, and the next check
+/// does not spawn a second call on top of the one still running.
+#[tokio::test]
+async fn a_hung_os_call_times_out_and_holds_then_recovers() {
+    let server = MockImmich::start().await;
+    let temp = tempfile::tempdir().expect("create a temp dir");
+    let store = store_in(&temp);
+    let photos = temp.path().join("photos");
+    std::fs::create_dir_all(&photos).expect("create the folder");
+    add_folder(&store, &photos);
+    let fake = FakeNetwork::answering_after_the_first_check(wireless("Home"));
+    let engine = start_engine_with(
+        &server,
+        &store,
+        &fake,
+        listed("Home"),
+        Duration::from_millis(50),
+        Duration::from_millis(50),
+    )
+    .await;
+    // Both reasons prove the hung call holds: the first check reports the
+    // timeout, and the checks behind it report the still-running call rather
+    // than spawning another.
+    assert!(
+        wait_until(
+            || {
+                let status = engine.status();
+                status.pause == Some(PauseReason::Unknown)
+                    && status
+                        .network
+                        .problem
+                        .as_deref()
+                        .is_some_and(|problem| problem.contains("network check"))
+            },
+            Duration::from_secs(2)
+        )
+        .await,
+        "a check past its timeout must hold uploads and say why: {:?}",
+        engine.status().network.problem
+    );
+    assert_eq!(
+        fake.calls(),
+        1,
+        "the running call must not be joined by another"
+    );
+    // The hung call finally answers and clears the in-flight flag; the next
+    // poll reads the network and lets uploads run again.
+    assert!(
+        wait_until(|| engine.status().pause.is_none(), Duration::from_secs(5)).await,
+        "a check that returned after its timeout must not hold forever"
+    );
+    engine.stop();
+}
+
+/// R8.8: a list that is off keeps the old behaviour, whatever the OS says.
+#[tokio::test]
+async fn a_list_that_is_off_syncs_on_any_network() {
+    let server = MockImmich::start().await;
+    let temp = tempfile::tempdir().expect("create a temp dir");
+    let store = store_in(&temp);
+    let photos = temp.path().join("photos");
+    let file = write_file(&photos, "first.jpg", b"first");
+    add_folder(&store, &photos);
+    let fake = FakeNetwork::new(Err(NetworkProblem::new("NetworkManager not found")));
+    let engine = start_engine(
+        &server,
+        &store,
+        &fake,
+        KnownNetworks::default(),
+        Duration::from_millis(50),
+    )
+    .await;
+    assert!(
+        wait_until(|| uploaded(&store, &file), Duration::from_secs(10)).await,
+        "the list off must not hold uploads"
+    );
+    assert_eq!(engine.status().pause, None);
+    engine.stop();
+}
diff --git a/crates/sync-core/tests/it/status.rs b/crates/sync-core/tests/it/status.rs
index aa85fa5..c7f8ba7 100644
--- a/crates/sync-core/tests/it/status.rs
+++ b/crates/sync-core/tests/it/status.rs
@@ -2,7 +2,10 @@
 //! dashboard show, whether or not the engine runs.
 
 use sync_core::meter::UploadTraffic;
-use sync_core::status::{Activity, ConnectionHealth, FolderStatus, Status, StatusInputs};
+use sync_core::network::NetworkStatus;
+use sync_core::status::{
+    Activity, ConnectionHealth, FolderStatus, PauseReason, Status, StatusInputs,
+};
 use sync_core::store::{AlbumScope, FolderCounts};
 
 fn counts(pending: u32, uploaded: u32, failed: u32, review: u32) -> FolderCounts {
@@ -35,7 +38,8 @@ fn folder(path: &str, counts: FolderCounts) -> FolderStatus {
 fn inputs(folders: Vec<FolderStatus>) -> StatusInputs {
     StatusInputs {
         folders,
-        paused: false,
+        pause: None,
+        network: NetworkStatus::default(),
         connection: ConnectionHealth::Ready,
         review_total: None,
         last_error: None,
@@ -79,10 +83,25 @@ fn a_pending_item_means_syncing_and_drives_the_progress() {
 #[test]
 fn a_pause_wins_over_queued_work() {
     let mut given = inputs(vec![folder("/photos", counts(3, 0, 0, 0))]);
-    given.paused = true;
+    given.pause = Some(PauseReason::User);
     assert_eq!(Status::derive(given).activity, Activity::Paused);
 }
 
+/// R8.8: the network hold is a reason on the existing paused state, and the
+/// reason reaches the views instead of a bare "Paused".
+#[test]
+fn a_network_hold_pauses_with_its_reason() {
+    let mut given = inputs(vec![folder("/photos", counts(3, 0, 0, 0))]);
+    given.pause = Some(PauseReason::NotListed);
+    let status = Status::derive(given);
+    assert_eq!(status.activity, Activity::Paused);
+    assert_eq!(status.pause, Some(PauseReason::NotListed));
+    assert_eq!(
+        status.pause.map(PauseReason::line),
+        Some("Paused — not on a known network")
+    );
+}
+
 #[test]
 fn a_lost_connection_needs_attention() {
     let mut given = inputs(vec![folder("/photos", FolderCounts::default())]);
diff --git a/docs/adr/0008-macos-unsigned-distribution.md b/docs/adr/0008-macos-unsigned-distribution.md
index a51063d..f6abc03 100644
--- a/docs/adr/0008-macos-unsigned-distribution.md
+++ b/docs/adr/0008-macos-unsigned-distribution.md
@@ -70,8 +70,16 @@ not taking, is in
 - Autostart uses `SMAppService.mainApp`. If an unsigned bundle is refused, the
   macOS backend falls back to a `~/Library/LaunchAgents` plist rather than
   adding an account.
-- The `Info.plist` carries the bundle identifier, the five file-access usage strings,
-  and `LSMinimumSystemVersion`. Notifications run from the `.app`; gpui-pre disables
+- **Sync only on known networks** (SPEC R8.8) reads the Wi-Fi network name,
+  which macOS reveals only with Location permission. The app asks when the user
+  turns the list on. There is no entitlement to grant it ahead of time and no
+  signed identity to remember it, so an update may ask again; if the grant is
+  refused, the name reads as unknown, the list holds uploads, and turning the
+  list off restores syncing on any network. The hand checks are in
+  [`docs/network-hand-checks.md`](../network-hand-checks.md).
+- The `Info.plist` carries the bundle identifier, the five file-access usage
+  strings, the Location usage string for the known-network check, and
+  `LSMinimumSystemVersion`. Notifications run from the `.app`; gpui-pre disables
   them when there is no bundle identifier, and whether an unsigned bundle is also
   refused is part of the P0 probe. If it is, notifications degrade to nothing, not a
   crash.
diff --git a/docs/network-hand-checks.md b/docs/network-hand-checks.md
new file mode 100644
index 0000000..52620cb
--- /dev/null
+++ b/docs/network-hand-checks.md
@@ -0,0 +1,78 @@
+# Hand checks: sync only on known networks (SPEC R8.8)
+
+The gate itself is covered by `crates/sync-core/tests/it/network.rs`: the pure
+check's table and a fake backend for startup, an OS change event, the fallback
+poll, an OS that errors, leaving and returning to a listed network with the
+queue kept, and an upload error that re-checks. What no CI runner can prove is
+what each operating system answers, so each backend needs one run on real
+hardware. Record the date, the OS version, and the observed name here when a
+release ships a backend change.
+
+## All platforms
+
+1. With the list off, an upload starts on any network (the old behaviour).
+2. Turn **Sync only on known networks** on and add the current network name
+   (copied from **Settings › Sync › Current network**). The client resumes.
+3. Switch to a network that is not on the list. Within 5 seconds the dashboard
+   reads **Paused — not on a known network**, the tray tooltip says the same,
+   and no upload request is sent (watch **Diagnostics** or the server log).
+4. Put a file in a source folder while paused. It stays pending, no row turns
+   into a failure, and returning to the listed network uploads it without a
+   click.
+5. Turn the list off. Uploads resume on the unlisted network.
+
+## Windows
+
+- **Name.** `NetworkListManager::GetNetworks(NLM_ENUM_NETWORK_CONNECTED)`
+  reports the connected profile, whose name is the SSID on Wi-Fi.
+- Check a domain-joined machine: the profile name is the domain profile, not
+  the SSID, when the Wi-Fi is a Work network. Confirm which name the list has to
+  hold.
+- **Wired.** `GetAdaptersAddresses` with a gateway must classify the Ethernet
+  adapter as wired, so an Ethernet-only machine syncs whatever the list says.
+- **Events.** Disconnecting the Wi-Fi should pause within a second, not 30; a
+  reconnect should resume. The sink is one COM advice on
+  `INetworkListManagerEvents::ConnectivityChanged`.
+- Check what an admin-owned machine without permission to query NLM reports: it
+  must read as unknown (paused), never as allowed.
+
+## macOS
+
+- **Name.** `CNCopyCurrentNetworkInfo` returns the SSID only with Location
+  permission. Turning the list on must show the prompt once; refusing it must
+  leave **Current network: unknown — Location permission is not granted**, and
+  the list must hold uploads. The prompt needs a bundled `.app` (the DMG, or a
+  `cargo packager` build): a binary run from `target/` has no usage string for
+  macOS to show, so it stays unknown — confirm that, and that the page then
+  offers **Open Location Settings**.
+- Check that the prompt reappears after an update, as the other TCC grants do
+  (ADR 0008), and that allowing it then names the network.
+- **Wired.** With Wi-Fi off and Ethernet plugged in, the client must report
+  wired and sync. With Wi-Fi on and joined to an unlisted network, it must
+  pause.
+- **Events.** System Configuration's dynamic store should fire on an SSID
+  change, a link drop, and a wake from sleep; confirm a change is noticed
+  without waiting for the 30-second poll. Note that a hidden network's SSID may
+  be absent even with the permission; that reads as unknown.
+- Check an Ethernet-only Mac, and a Mac whose Wi-Fi is off with Ethernet plugged
+  in: both must sync. A Wi-Fi-only Mac with Wi-Fi off has no link at all, so it
+  must read unknown and hold, not wired.
+
+## Linux
+
+- **Name.** NetworkManager's `PrimaryConnection` carries the default route;
+  `Type` `802-11-wireless` reads the access point's `Ssid`, falling back to the
+  connection `Id` when there is no access point.
+- Test on GNOME (NetworkManager running), with a VPN active (the primary
+  connection must be the underlying link, not the VPN), and with a hidden
+  network.
+- **No NetworkManager.** On a host using systemd-networkd or plain `iwd`, the
+  page must read **Current network: unknown — NetworkManager not found** and the
+  list must hold uploads.
+- **Wired.** An Ethernet-only host must report wired and sync with the list on.
+- **Events.** NetworkManager's `StateChanged` and the D-Bus
+  `PropertiesChanged` signal should pause a switch away from the listed network
+  within a second.
+- Watch the process while it runs with the list on for a day: the event thread
+  must not spin (it blocks in `Connection::process(1s)`), and the 30-second poll
+  must keep working after a suspend and resume.