@@ -67,10 +67,13 @@ All notable changes to CallShield will be documented in this file.
   keep the phone in meeting mode for hours before.
 - After CallShield repairs a damaged database, the trending numbers come
   back as soon as there's a connection instead of up to 30 minutes later.
-- After a restart, CallShield no longer falls back to the trending number
-  ranges and scam web addresses it was built with. Those could be months
-  old and hold ones the community had since cleared. It fetches the current
-  lists right away instead.
+- After a restart, CallShield starts from the trending number ranges, scam
+  web addresses and community watch list it last downloaded, so the
+  "Reported by 2 CallShield users" label is there before the first refresh,
+  with no connection too. It used to fall back to the copies it was built
+  with, which could be months old and hold ones the community had since
+  cleared. A phone updating from an older version fetches the current lists
+  right away instead.
 - A first text that asks you to message a WhatsApp link counts as reply
   bait even when the link ends the sentence, as in "https://wa.me!" or
   "(https://wa.me)".
 
@@ -12,7 +12,7 @@
 <p align="center">
   <a href="https://github.com/SysAdminDoc/CallShield/releases/latest"><img src="https://img.shields.io/github/v/release/SysAdminDoc/CallShield?style=flat-square&color=a6e3a1" alt="Release"></a>
   <img src="https://img.shields.io/badge/Spam%20Numbers-51%2C362-f38ba8?style=flat-square" alt="51,362 Numbers">
-  <img src="https://img.shields.io/badge/JVM%20unit%20tests-1898-94e2d5?style=flat-square" alt="1898 JVM unit tests">
+  <img src="https://img.shields.io/badge/JVM%20unit%20tests-1904-94e2d5?style=flat-square" alt="1904 JVM unit tests">
   <img src="https://img.shields.io/badge/Android-10%2B-89b4fa?style=flat-square" alt="Android 10+">
   <img src="https://img.shields.io/badge/License-MIT-cba6f7?style=flat-square" alt="MIT License">
   <img src="https://img.shields.io/badge/API%20Keys-None-fab387?style=flat-square" alt="No required API keys">
@@ -530,12 +530,12 @@ RELEASE_KEY_PASSWORD=...
 ## Testing
 
 ```bash
-./gradlew testDebugUnitTest   # 1898 tests
+./gradlew testDebugUnitTest   # 1904 tests
 ./gradlew connectedDebugAndroidTest -Pandroid.testInstrumentationRunnerArguments.class=com.sysadmindoc.callshield.platform.TargetSdkBehaviorSmokeTest
 ./gradlew verifyPipelineTests # Cloudflare Worker (node) + data-pipeline and translation checks (python)
 ```
 
-The suite is **1898 total JVM unit tests**, run with Robolectric wherever a screen, a service or the database is involved.
+The suite is **1904 total JVM unit tests**, run with Robolectric wherever a screen, a service or the database is involved.
 
 Two GitHub workflows run without building the app. **Validation** runs the Worker and
 pipeline suites on every push except report-only ones (`run-pipeline-tests.ps1 -CorrectnessOnly`),
@@ -572,7 +572,7 @@ language in [issue #7](https://github.com/SysAdminDoc/CallShield/issues/7).
 | Community API | Cloudflare Workers |
 | URL Safety | Local spam-domain data, with optional PhishTank and OpenPhish |
 | Verification | Local Gradle, lint, and release-artifact checks |
-| Tests | 1898 JVM unit tests (JUnit) |
+| Tests | 1904 JVM unit tests (JUnit) |
 | Strings | 1766 string resources and 38 plural groups (translation-ready) |
 | Accessibility | 100+ content descriptions, 48dp touch targets |
 | Min SDK | 29 (Android 10) |
 
@@ -118,15 +118,16 @@ internal object HotDataSync {
 
     /**
      * Fills the stores a fresh process starts without. Returns true when one
-     * that a network copy filled before is empty now and wants a refresh
-     * soon, rather than at the next periodic run.
+     * that a network copy filled before is empty now, with no kept copy to
+     * start from, and wants a refresh soon rather than at the next periodic run.
      */
     suspend fun primeBundled(
         context: Context,
         source: HotFeedDataSource = GitHubDataSource(),
         repo: SpamRepository = SpamRepository.getInstance(context.applicationContext),
         dao: SpamDao = AppDatabase.getInstance(context.applicationContext).spamDao(),
         dependencies: CheckerDependencies = CheckerDependencies(),
+        kept: PersistedHotFeeds = PersistedHotFeeds(context),
     ): Boolean =
         withContext(Dispatchers.IO) {
             val appContext = context.applicationContext
@@ -137,41 +138,60 @@ internal object HotDataSync {
             // so every process starts with them empty. Once a network copy was
             // read, the build-time copy must not stand in for it: whatever the
             // publisher cleared since the build would block or label again.
-            // Those stores wait for a refresh instead, asked for right away.
+            // Those stores start from the copy kept at the last refresh, and
+            // a phone with none (updated from a build that kept no copy, or a
+            // file that didn't survive) waits for a refresh, asked for right away.
             fun bootstrap(
                 feed: String,
                 hasData: Boolean,
-                apply: () -> Unit,
+                applyKept: (List<String>) -> Unit,
+                applyBundled: () -> Unit,
             ) {
                 if (hasData) return
                 if (health.feedGeneratedAt[feed] == null) {
-                    apply()
-                } else if (feed !in health.clearedFeeds) {
-                    wantsRefresh = true
+                    applyBundled()
+                    return
+                }
+                val lines = kept.read(feed)
+                when {
+                    lines != null -> applyKept(lines)
+                    feed !in health.clearedFeeds -> wantsRefresh = true
                 }
             }
 
             // Gate every store on emptiness, not just the hot list below. WorkManager
             // can run an overdue HotListSyncWorker in-process right after startup, so
             // an ungated write here can land after its fresh data and replace it with
             // the build-time snapshot until the next 30-minute cycle.
-            bootstrap(HOT_RANGES_FEED, dependencies.spamHeuristics.hasHotRanges()) {
+            bootstrap(
+                HOT_RANGES_FEED,
+                dependencies.spamHeuristics.hasHotRanges(),
+                applyKept = { dependencies.spamHeuristics.updateHotRanges(sanitizeHotRanges(it)) },
+            ) {
                 val bundledRanges = loadBundledHotRanges(appContext, source)
                 val ranges = sanitizeHotRanges(bundledRanges.data)
                 if (bundledRanges.resolved && shouldApplyFeed(ranges, bundledRanges.explicitlyCleared)) {
                     dependencies.spamHeuristics.updateHotRanges(ranges)
                 }
             }
 
-            bootstrap(SPAM_DOMAINS_FEED, dependencies.smsContentAnalyzer.hasSpamDomains()) {
+            bootstrap(
+                SPAM_DOMAINS_FEED,
+                dependencies.smsContentAnalyzer.hasSpamDomains(),
+                applyKept = { dependencies.smsContentAnalyzer.updateSpamDomains(sanitizeSpamDomains(it)) },
+            ) {
                 val bundledDomains = loadBundledSpamDomains(appContext, source)
                 val domains = sanitizeSpamDomains(bundledDomains.data)
                 if (bundledDomains.resolved && shouldApplyFeed(domains, bundledDomains.explicitlyCleared)) {
                     dependencies.smsContentAnalyzer.updateSpamDomains(domains)
                 }
             }
 
-            bootstrap(COMMUNITY_WATCH_FEED, dependencies.spamHeuristics.hasCommunityWatch()) {
+            bootstrap(
+                COMMUNITY_WATCH_FEED,
+                dependencies.spamHeuristics.hasCommunityWatch(),
+                applyKept = { dependencies.spamHeuristics.updateCommunityWatch(sanitizeCommunityWatch(decodeCommunityWatch(it))) },
+            ) {
                 val bundledWatch = loadBundledCommunityWatch(appContext, source)
                 val watchNumbers = sanitizeCommunityWatch(bundledWatch.data)
                 if (bundledWatch.resolved && shouldApplyFeed(watchNumbers, bundledWatch.explicitlyCleared)) {
@@ -213,6 +233,7 @@ internal object HotDataSync {
         repo: SpamRepository,
         dao: SpamDao,
         dependencies: CheckerDependencies = CheckerDependencies(),
+        kept: PersistedHotFeeds = PersistedHotFeeds(context),
     ): RefreshOutcome =
         withContext(Dispatchers.IO) {
             val appContext = context.applicationContext
@@ -244,6 +265,8 @@ internal object HotDataSync {
             val hotRangesApplied = !hotRangesReplay && shouldApplyFeed(ranges, hotRanges.explicitlyCleared)
             if (hotRanges.resolved && hotRangesApplied) {
                 dependencies.spamHeuristics.updateHotRanges(ranges)
+                // Only a network copy is kept for the next start; the bundled fallback carries a failure.
+                if (hotRanges.failure == null) kept.write(HOT_RANGES_FEED, ranges)
             }
 
             val spamDomains =
@@ -253,6 +276,7 @@ internal object HotDataSync {
             val spamDomainsApplied = !spamDomainsReplay && shouldApplyFeed(domains, spamDomains.explicitlyCleared)
             if (spamDomains.resolved && spamDomainsApplied) {
                 dependencies.smsContentAnalyzer.updateSpamDomains(domains)
+                if (spamDomains.failure == null) kept.write(SPAM_DOMAINS_FEED, domains)
             }
 
             val communityWatch =
@@ -267,6 +291,7 @@ internal object HotDataSync {
                 !communityWatchReplay && shouldApplyFeed(watchNumbers, communityWatch.explicitlyCleared)
             if (communityWatch.resolved && communityWatchApplied) {
                 dependencies.spamHeuristics.updateCommunityWatch(watchNumbers)
+                if (communityWatch.failure == null) kept.write(COMMUNITY_WATCH_FEED, encodeCommunityWatch(watchNumbers))
             }
 
             val update =
@@ -589,6 +614,15 @@ internal object HotDataSync {
             .distinctBy { it.number }
             .toList()
 
+    /** One kept line per watch entry: the number, a tab, the reporter count. */
+    internal fun encodeCommunityWatch(numbers: List<CommunityWatchNumber>): List<String> = numbers.map { "${it.number}\t${it.reporterCount}" }
+
+    internal fun decodeCommunityWatch(lines: List<String>): List<CommunityWatchNumber> =
+        lines.mapNotNull { line ->
+            val count = line.substringAfter('\t', "").trim().toIntOrNull() ?: return@mapNotNull null
+            CommunityWatchNumber(line.substringBefore('\t'), count)
+        }
+
     private fun canonicalNumberKey(number: String): String = number.trim()
 
     internal const val HOT_LIST_FEED = "hot_list"
 
@@ -0,0 +1,65 @@
+package com.sysadmindoc.callshield.service
+
+import android.content.Context
+import android.util.Log
+import java.io.File
+import java.io.FileOutputStream
+import java.nio.file.Files
+import java.nio.file.StandardCopyOption
+
+/**
+ * The last network copy of each feed that lives only in memory (hot ranges,
+ * scam domains, the community watch list), one line per entry, so a new
+ * process starts from what the publisher last sent instead of the build-time
+ * copy or nothing. Kept in noBackupFilesDir: a cloud backup restored on
+ * another phone fetches its own. A copy that can't be read counts as none.
+ */
+internal class PersistedHotFeeds(
+    private val directory: File,
+) {
+    constructor(context: Context) : this(File(context.applicationContext.noBackupFilesDir, DIRECTORY))
+
+    /** The entries kept for [feed], or null when none were ever kept or the file is unreadable. */
+    fun read(feed: String): List<String>? {
+        val source = file(feed)
+        if (!source.exists()) return null
+        return try {
+            source.readLines(Charsets.UTF_8).filter { it.isNotBlank() }
+        } catch (e: Exception) {
+            Log.w(TAG, "The kept copy of $feed can't be read", e)
+            null
+        }
+    }
+
+    /** Written beside the target and moved over it, so a crash never leaves half a file. */
+    fun write(
+        feed: String,
+        entries: List<String>,
+    ) {
+        try {
+            directory.mkdirs()
+            val target = file(feed)
+            val temp = File(target.path + ".tmp")
+            FileOutputStream(temp).use { out ->
+                out.write(entries.joinToString(separator = "\n", postfix = "\n").toByteArray(Charsets.UTF_8))
+                out.fd.sync()
+            }
+            Files.move(temp.toPath(), target.toPath(), StandardCopyOption.REPLACE_EXISTING, StandardCopyOption.ATOMIC_MOVE)
+        } catch (e: Exception) {
+            // The next refresh writes again; until then a restart asks for one.
+            Log.w(TAG, "Couldn't keep a copy of $feed", e)
+        }
+    }
+
+    /** Forgets every kept copy, as a fresh install has none. */
+    fun clear() {
+        directory.deleteRecursively()
+    }
+
+    private fun file(feed: String) = File(directory, "$feed.txt")
+
+    private companion object {
+        const val TAG = "PersistedHotFeeds"
+        const val DIRECTORY = "hot-feeds"
+    }
+}
@@ -35,6 +35,7 @@ class HotDataSyncReplayTest {
     fun tearDown() {
         SpamHeuristics.updateCommunityWatch(emptyList())
         SpamHeuristics.updateHotRanges(emptyList())
+        PersistedHotFeeds(context).clear()
         fixture.close()
     }
 
@@ -129,7 +130,7 @@ class HotDataSyncReplayTest {
     }
 
     @Test
-    fun `a restart waits for fresh hot ranges instead of the build-time copy`() {
+    fun `a restart starts from the hot ranges kept at the last refresh, not the build-time copy`() {
         refresh()
         assertTrue(SpamHeuristics.hasHotRanges())
         feeds.bundledRanges = listOf("303555")
@@ -138,10 +139,47 @@ class HotDataSyncReplayTest {
         SpamHeuristics.updateHotRanges(emptyList())
         val wantsRefresh = runBlocking { HotDataSync.primeBundled(context, feeds, fixture.repository, fixture.dao) }
 
+        assertFalse("the kept copy is as good as the last refresh", wantsRefresh)
+        assertTrue(SpamHeuristics.isHotCampaignRange("+12125550100"))
+        assertFalse(SpamHeuristics.isHotCampaignRange("+13035550100"))
+    }
+
+    @Test
+    fun `a phone updated from a build that kept no copy asks for a refresh instead of the build-time copy`() {
+        refresh()
+        PersistedHotFeeds(context).clear()
+        feeds.bundledRanges = listOf("303555")
+
+        SpamHeuristics.updateHotRanges(emptyList())
+        val wantsRefresh = runBlocking { HotDataSync.primeBundled(context, feeds, fixture.repository, fixture.dao) }
+
         assertTrue("the app should ask for a refresh now", wantsRefresh)
         assertFalse(SpamHeuristics.hasHotRanges())
     }
 
+    @Test
+    fun `a restart with no connection keeps the watch list's labels, and a newer clear still removes them`() {
+        val entry = CommunityWatchNumber("+33412345678", 2)
+        feeds.communityWatch = HotFeedSnapshot(listOf(entry), generatedAt = "2026-09-21T10:00:00+00:00")
+        refresh()
+
+        SpamHeuristics.updateCommunityWatch(emptyList())
+        feeds.watchOffline = true
+        val wantsRefresh = runBlocking { HotDataSync.primeBundled(context, feeds, fixture.repository, fixture.dao) }
+        refresh()
+
+        assertFalse(wantsRefresh)
+        assertEquals(2, SpamHeuristics.communityWatchReporterCount(context, entry.number))
+
+        feeds.watchOffline = false
+        feeds.communityWatch = HotFeedSnapshot(emptyList(), explicitlyCleared = true, generatedAt = "2026-09-21T11:00:00+00:00")
+        refresh()
+        SpamHeuristics.updateCommunityWatch(emptyList())
+        runBlocking { HotDataSync.primeBundled(context, feeds, fixture.repository, fixture.dao) }
+
+        assertEquals(0, SpamHeuristics.communityWatchReporterCount(context, entry.number))
+    }
+
     @Test
     fun `a phone that never read hot ranges starts from the build-time copy`() {
         feeds.bundledRanges = listOf("303555")
 
@@ -0,0 +1,56 @@
+package com.sysadmindoc.callshield.service
+
+import com.sysadmindoc.callshield.data.remote.CommunityWatchNumber
+import org.junit.After
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertNull
+import org.junit.Test
+import java.nio.file.Files
+
+/** The kept copy of a feed comes back as it went in, and a missing or odd one counts as none. */
+class PersistedHotFeedsTest {
+    private val directory = Files.createTempDirectory("hot-feeds-test").toFile()
+    private val kept = PersistedHotFeeds(directory)
+
+    @After
+    fun tearDown() {
+        kept.clear()
+    }
+
+    @Test
+    fun `a feed reads back as written, and a cleared one as empty`() {
+        kept.write(HotDataSync.HOT_RANGES_FEED, listOf("212555", "303555"))
+        kept.write(HotDataSync.SPAM_DOMAINS_FEED, emptyList())
+
+        assertEquals(listOf("212555", "303555"), kept.read(HotDataSync.HOT_RANGES_FEED))
+        assertEquals(emptyList<String>(), kept.read(HotDataSync.SPAM_DOMAINS_FEED))
+        assertNull(kept.read(HotDataSync.COMMUNITY_WATCH_FEED))
+    }
+
+    @Test
+    fun `a later write replaces the whole copy`() {
+        kept.write(HotDataSync.HOT_RANGES_FEED, listOf("212555"))
+        kept.write(HotDataSync.HOT_RANGES_FEED, listOf("303555"))
+
+        assertEquals(listOf("303555"), kept.read(HotDataSync.HOT_RANGES_FEED))
+    }
+
+    @Test
+    fun `watch entries keep their reporter counts, and a damaged line is dropped`() {
+        val entries = listOf(CommunityWatchNumber("+33412345678", 2), CommunityWatchNumber("+12125550101", 7))
+
+        val lines = HotDataSync.encodeCommunityWatch(entries)
+
+        assertEquals(entries, HotDataSync.decodeCommunityWatch(lines))
+        assertEquals(entries, HotDataSync.decodeCommunityWatch(lines + "+15550100" + "+15550101\tmany"))
+    }
+
+    @Test
+    fun `clearing forgets every copy`() {
+        kept.write(HotDataSync.HOT_RANGES_FEED, listOf("212555"))
+
+        kept.clear()
+
+        assertNull(kept.read(HotDataSync.HOT_RANGES_FEED))
+    }
+}