Minimal Android integration guide (Premium backend)

Transport: POST JSON with family_id plus access_token session proof. Writes add the exact request body signed by the account P-256 key and the bound device_id. Cursors are opaque HMAC strings: return next_cursor verbatim until empty. All responses are no-store without ETags.

Route groups: /v1/ledger/* (records, consent, erase, reports, CSV), /v1/alerts/* (rules, inbox, erase, push tokens), /v1/metrics/* (compare), /v1/cloud/* (sync, snapshots, restore). Paid writes need an active capability and fail 403 on lapse; reads, deletes and erasures stay free so retained data and exits remain reachable.

Errors: 400 malformed, 401 authentication, 403 capability, 404 unknown owner-scoped resource, 409 revision conflict with base, current and proposed versions for explicit resolution, 503 unavailable. Never send GPS, photos, credentials or provider tokens; CSV cells are formula-safe. Golden vectors in contracts/testdata/api pin request shapes.