diff --git a/CLAUDE.md b/CLAUDE.md
index 7739a6f09925..dea03d87a36c 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -14,15 +14,21 @@ Guidance for Claude Code (claude.ai/code) working in this repository.
 
 ## Architecture
 
-A `FileLoader` loads on `LoaderService`'s background thread and reports through
-`FileLoaderListener`; `LoaderServiceQueue` holds requests until the service is bound.
-`MetadataLoader` caches and identifies the file and `CoreLoader` renders it, publishing the
-html on a local server. Those two are the whole chain - there is no fallback after the core,
-and what it cannot open is reported as an unsupported format.
-
-`MainActivity` owns the service binding and the action modes (find, tts, edit), and swaps
-between `LandingFragment` (recent documents and settings) and `DocumentFragment`, which
-shows the result in `PageView` - a WebView - with `DocumentActions` over it.
+`DocumentLoader` opens a document on its own background thread and reports back on the main
+one, straight through: `FileCache` stores the bytes, `FileIdentifier` names and types the
+copy, `CoreLoader` renders it and publishes the html on a local server, and `DocumentSaver`
+writes it back. There is nothing after the core - what it cannot open is reported as an
+unsupported format.
+
+It is a `ViewModel` scoped to `MainActivity`, so it survives a configuration change and is
+there before anything asks it for a document. A `DocumentRequest` is what the user asked for,
+an `IdentifiedFile` the cached copy it turned out to be, and a `LoadedDocument` the two plus
+the parts to show. Do not add a loader base class or a loader-type enum: there is one loader,
+and a second one is a format odrcore should learn instead.
+
+`MainActivity` owns the loader and the action modes (find, tts, edit), and swaps between
+`LandingFragment` (recent documents and settings) and `DocumentFragment`, which shows the
+result in `PageView` - a WebView - with `DocumentActions` over it.
 
 There is **no options menu**: `menu_main.xml` is gone and the action bar is hidden. An
 action on the open document is a `DocumentActions` button; anything else - the ad removal,
@@ -64,7 +70,7 @@ code says otherwise. Do not add a `BuildConfig.FLAVOR` comparison back - it was
 resource bool `DISABLE_TRACKING` was both mistakes at once: there is no tracking to
 disable, `AnalyticsManager` and `CrashManager` write to logcat and nowhere else.
 
-Those two take no switch at all, which is why `LoaderService` just constructs them. Ads
+Those two take no switch at all, which is why `DocumentLoader` just constructs them. Ads
 and billing are what `MainActivity.initializeManagers` gates, on `Features.withAds` *and*
 `PlayServices` - the device half of the answer, and the reason that method can run twice,
 once more after google's own dialog comes back.
@@ -142,13 +148,13 @@ fail to open it.
 XML cannot read any of that, so the `STRICT_CATCH` alias' three intent-filters are
 *generated* from the same table - a filter matches a mime type exactly, so all 49 spellings
 and 41 extensions are written out. `SupportedFormatsTest` asserts that
-`SupportedDocumentTypes` and the package manager agree, and that every claimed mime type
-reaches `CoreLoader`, so a format added upstream and forgotten fails CI.
+`SupportedDocumentTypes` and the package manager agree, and that every claimed mime type is
+one `isRenderedByCore` takes, so a format added upstream and forgotten fails CI.
 
-The tables live in `libodr_jni`, which is why `CoreLoaderTest` and
+The tables live in `libodr_jni`, which is why `RenderedByCoreTest` and
 `SupportedDocumentTypesTest` are instrumented though neither opens a file. After caching it
-is `Odr.mimetype` that decides, canonicalized through `canonicalMimeType` so the loaders see
-one spelling per format.
+is `Odr.mimetype` that decides, canonicalized through `canonicalMimeType` so one spelling per
+format reaches the core.
 
 Reading the core's table directly, as `isDocument` does, must not `lowercase()` first: it
 matches exactly and spells some types with capitals (`macroEnabled`). Our own sets are the
@@ -166,8 +172,8 @@ Text is the core's fallback for bytes nothing else claims, and it does not refus
 it cannot name a charset for - it answers `text/plain` and throws only once a page is
 rendered, on the server thread, long after `CoreLoader` reported success.
 
-So `MetadataLoader` drops a `text/plain` whose file has no charset (`hasKnownCharset`) and
-lets the fallbacks below it decide, and `CoreLoader.host()` refuses the same file up front.
+So `FileIdentifier` drops a `text/plain` whose file has no charset (`hasKnownCharset`) and
+lets the guesses below it decide, and `CoreLoader.host()` refuses the same file up front.
 Both are needed: the first keeps `isRenderedByCore` off a `.bin`, the second stops a success
 bar appearing over a page that cannot draw.
 `LandingTests.aDocumentThatFailsToOpenComesBackToTheList` holds this.
@@ -175,7 +181,7 @@ bar appearing over a page that cannot draw.
 ### Editability comes from the core, never from a mime type
 
 `Document.isEditable()`/`isSavable()` decides whether `DocumentFragment` offers the Edit
-button, carried on `FileLoader.Result.isEditable`. `CoreLoader.host()` only holds a document
+button, carried on `LoadedDocument.isEditable`. `CoreLoader.host()` only holds a document
 open when the core says yes, so having one *is* the answer. Do not reintroduce a list of
 editable formats in the UI.
 
@@ -201,8 +207,8 @@ The only java is `com/commonsware/android/print`, vendored so it can be diffed a
 upstream. It calls nothing of ours, so no java-to-kotlin call exists and `@JvmStatic`,
 `@JvmField`, `@JvmOverloads` and `@Throws` are not needed for interop.
 
-What remains is for runtimes that reflect over the bytecode: `@JvmField` on `FileLoader`'s
-`CREATOR`s (parcelable needs a static field) and `@JvmStatic` on `@BeforeClass` /
-`@AfterClass` in the instrumented tests. `ProgressDialogFragment` needed `@JvmOverloads` too
-while it took an argument - a fragment the framework re-creates has to have a no-arg
-constructor.
+What remains is for runtimes that reflect over the bytecode: `@JvmField` on the `CREATOR`s of
+`DocumentRequest`, `IdentifiedFile` and `LoadedDocument` (parcelable needs a static field),
+and `@JvmStatic` on `@BeforeClass` / `@AfterClass` in the instrumented tests.
+`ProgressDialogFragment` needed `@JvmOverloads` too while it took an argument - a fragment
+the framework re-creates has to have a no-arg constructor.
diff --git a/app/src/androidTest/java/app/opendocument/droid/background/DocumentParcelTest.kt b/app/src/androidTest/java/app/opendocument/droid/background/DocumentParcelTest.kt
new file mode 100644
index 000000000000..bca398ada55b
--- /dev/null
+++ b/app/src/androidTest/java/app/opendocument/droid/background/DocumentParcelTest.kt
@@ -0,0 +1,156 @@
+package app.opendocument.droid.background
+
+import android.net.Uri
+import android.os.Parcel
+import android.os.Parcelable
+import androidx.test.ext.junit.runners.AndroidJUnit4
+import androidx.test.filters.SmallTest
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertNull
+import org.junit.Assert.assertTrue
+import org.junit.Test
+import org.junit.runner.RunWith
+
+/**
+ * The saved instance state of an open document, written and read back.
+ *
+ * `DocumentFragment` parcels these into the bundle that survives process death, where a field
+ * written and read in a different order is silently the neighbouring one. Nothing else covers the
+ * round trip - the recreation test restores from the view model, which does not parcel.
+ *
+ * Instrumented because [Parcel] is the framework's.
+ */
+@SmallTest
+@RunWith(AndroidJUnit4::class)
+class DocumentParcelTest {
+
+    @Test
+    fun aRequestComesBackAsItself() {
+        val request =
+            DocumentRequest(Uri.parse("content://provider/document/1"), persistentUri = true)
+                .apply {
+                    editable = true
+                    password = "passwort"
+                }
+
+        val restored = roundTrip(request, DocumentRequest.CREATOR)
+
+        assertEquals(request.uri, restored.uri)
+        assertTrue(restored.persistentUri)
+        assertTrue(restored.editable)
+        assertEquals("passwort", restored.password)
+    }
+
+    @Test
+    fun aRequestWithoutAPasswordComesBackWithoutOne() {
+        val restored =
+            roundTrip(
+                DocumentRequest(Uri.parse("content://provider/document/2"), persistentUri = false),
+                DocumentRequest.CREATOR,
+            )
+
+        assertNull(restored.password)
+        assertEquals(false, restored.persistentUri)
+        assertEquals(false, restored.editable)
+    }
+
+    @Test
+    fun anIdentifiedFileComesBackAsItself() {
+        val file =
+            IdentifiedFile(
+                Uri.parse("content://at.tomtasche.reader.pro.provider/cache.1/cached-file.tmp"),
+                "report.odt",
+                "application/vnd.oasis.opendocument.text",
+                "odt",
+            )
+
+        val restored = roundTrip(file, IdentifiedFile.CREATOR)
+
+        assertEquals(file.cacheUri, restored.cacheUri)
+        assertEquals("report.odt", restored.filename)
+        assertEquals("application/vnd.oasis.opendocument.text", restored.mimeType)
+        assertEquals("odt", restored.extension)
+    }
+
+    /** What nothing could name: the mime type and the extension are both allowed to be missing. */
+    @Test
+    fun anUnnamedFileComesBackUnnamed() {
+        val restored =
+            roundTrip(
+                IdentifiedFile(Uri.parse("content://provider/cache.1/x.tmp"), "x", null, null),
+                IdentifiedFile.CREATOR,
+            )
+
+        assertNull(restored.mimeType)
+        assertNull(restored.extension)
+        assertEquals("x", restored.filename)
+    }
+
+    /** A spreadsheet, which is the only shape with more than one part and named tabs. */
+    @Test
+    fun aDocumentComesBackWithEveryPart() {
+        val document =
+            LoadedDocument(
+                DocumentRequest(Uri.parse("content://provider/document/3"), persistentUri = true),
+                IdentifiedFile(
+                    Uri.parse("content://provider/cache.1/cached-file.tmp"),
+                    "budget.ods",
+                    "application/vnd.oasis.opendocument.spreadsheet",
+                    "ods",
+                ),
+                listOf("hey", "ho", "Sheet3"),
+                listOf(
+                    Uri.parse("http://localhost:29665/file/odr/0.html"),
+                    Uri.parse("http://localhost:29665/file/odr/1.html"),
+                    Uri.parse("http://localhost:29665/file/odr/2.html"),
+                ),
+                isEditable = true,
+            )
+
+        val restored = roundTrip(document, LoadedDocument.CREATOR)
+
+        assertEquals(document.request.uri, restored.request.uri)
+        assertEquals("budget.ods", restored.file.filename)
+        assertEquals(listOf("hey", "ho", "Sheet3"), restored.partTitles)
+        assertEquals(document.partUris, restored.partUris)
+        assertTrue(restored.isEditable)
+    }
+
+    /** Everything but a spreadsheet: one part, and the core does not name it. */
+    @Test
+    fun aSinglePartDocumentKeepsItsNullTitle() {
+        val restored =
+            roundTrip(
+                LoadedDocument(
+                    DocumentRequest(Uri.parse("content://provider/document/4"), false),
+                    IdentifiedFile(
+                        Uri.parse("content://provider/cache.1/cached-file.tmp"),
+                        "letter.odt",
+                        "application/vnd.oasis.opendocument.text",
+                        "odt",
+                    ),
+                    listOf<String?>(null),
+                    listOf(Uri.parse("http://localhost:29665/file/odr/document.html")),
+                    isEditable = false,
+                ),
+                LoadedDocument.CREATOR,
+            )
+
+        assertEquals(1, restored.partTitles.size)
+        assertNull(restored.partTitles[0])
+        assertEquals(false, restored.isEditable)
+    }
+
+    private fun <T> roundTrip(value: T, creator: Parcelable.Creator<T>): T {
+        val parcel = Parcel.obtain()
+
+        return try {
+            (value as Parcelable).writeToParcel(parcel, 0)
+            parcel.setDataPosition(0)
+
+            creator.createFromParcel(parcel)
+        } finally {
+            parcel.recycle()
+        }
+    }
+}
diff --git a/app/src/androidTest/java/app/opendocument/droid/background/CoreLoaderTest.kt b/app/src/androidTest/java/app/opendocument/droid/background/RenderedByCoreTest.kt
similarity index 91%
rename from app/src/androidTest/java/app/opendocument/droid/background/CoreLoaderTest.kt
rename to app/src/androidTest/java/app/opendocument/droid/background/RenderedByCoreTest.kt
index c144305f2be5..6cbfde9857f3 100644
--- a/app/src/androidTest/java/app/opendocument/droid/background/CoreLoaderTest.kt
+++ b/app/src/androidTest/java/app/opendocument/droid/background/RenderedByCoreTest.kt
@@ -4,7 +4,6 @@ import androidx.test.ext.junit.runners.AndroidJUnit4
 import androidx.test.filters.SmallTest
 import org.junit.Assert.assertFalse
 import org.junit.Assert.assertTrue
-import org.junit.Before
 import org.junit.Test
 import org.junit.runner.RunWith
 
@@ -17,22 +16,10 @@ import org.junit.runner.RunWith
  */
 @SmallTest
 @RunWith(AndroidJUnit4::class)
-class CoreLoaderTest {
+class RenderedByCoreTest {
 
-    private lateinit var coreLoader: CoreLoader
-
-    @Before
-    fun setUp() {
-        // no context: isSupported() is pure, and constructing a loader has no side effects
-        coreLoader = CoreLoader(null)
-    }
-
-    private fun isSupported(fileType: String?): Boolean {
-        val options = FileLoader.Options()
-        options.fileType = fileType
-
-        return coreLoader.isSupported(options)
-    }
+    private fun isSupported(fileType: String?): Boolean =
+        SupportedDocumentTypes.isRenderedByCore(fileType)
 
     @Test
     fun opendocumentIsSupported() {
diff --git a/app/src/androidTest/java/app/opendocument/droid/test/CoreTest.kt b/app/src/androidTest/java/app/opendocument/droid/test/CoreTest.kt
index eb6bbaf76176..4704663ffb55 100644
--- a/app/src/androidTest/java/app/opendocument/droid/test/CoreTest.kt
+++ b/app/src/androidTest/java/app/opendocument/droid/test/CoreTest.kt
@@ -1,14 +1,10 @@
 package app.opendocument.droid.test
 
-import android.os.Handler
-import android.os.Looper
 import androidx.test.ext.junit.runners.AndroidJUnit4
 import androidx.test.filters.LargeTest
 import androidx.test.platform.app.InstrumentationRegistry
 import app.opendocument.core.OdrException
 import app.opendocument.droid.background.CoreLoader
-import app.opendocument.droid.background.FileLoader
-import app.opendocument.droid.nonfree.AnalyticsManager
 import app.opendocument.droid.nonfree.CrashManager
 import java.io.File
 import java.io.FileOutputStream
@@ -241,22 +237,11 @@ class CoreTest {
         fun startServer() {
             val appCtx = InstrumentationRegistry.getInstrumentation().targetContext
 
-            // nothing here goes through loadAsync, so both handlers can be the main looper and
-            // the listener is never called back
-            val handler = Handler(Looper.getMainLooper())
+            // every test here calls host() straight, so all initialize has to do is start the
+            // core and its server
             val loader = CoreLoader(appCtx)
             sharedLoader = loader
-            loader.initialize(
-                object : FileLoader.FileLoaderListener {
-                    override fun onSuccess(result: FileLoader.Result) {}
-
-                    override fun onError(result: FileLoader.Result, error: Throwable) {}
-                },
-                handler,
-                handler,
-                AnalyticsManager(),
-                CrashManager(),
-            )
+            loader.initialize(CrashManager())
         }
 
         @JvmStatic
diff --git a/app/src/androidTest/java/app/opendocument/droid/test/LandingTests.kt b/app/src/androidTest/java/app/opendocument/droid/test/LandingTests.kt
index 274b15bb66af..bc396cf7fd52 100644
--- a/app/src/androidTest/java/app/opendocument/droid/test/LandingTests.kt
+++ b/app/src/androidTest/java/app/opendocument/droid/test/LandingTests.kt
@@ -375,11 +375,11 @@ class LandingTests {
     }
 
     /**
-     * A recent document that is not a document at all: bytes no loader can make anything of, so the
+     * A recent document that is not a document at all: bytes the core can make nothing of, so the
      * load fails the way a truncated download or a renamed file does.
      *
      * The extension is part of the fixture. `Odr.mimetype` cannot identify these bytes, so
-     * `MetadataLoader` falls back to what the provider makes of the filename - and that type is
+     * `FileIdentifier` falls back to what the provider makes of the filename - and that type is
      * what decides which failure the user gets. `.bin` gives `application/octet-stream`, which the
      * core does not claim, so the file is reported as an unsupported format. Name it `.odt` and the
      * core claims the format and fails on the bytes, which is the broken-file dialog instead.
diff --git a/app/src/androidTest/java/app/opendocument/droid/test/MainActivityTests.kt b/app/src/androidTest/java/app/opendocument/droid/test/MainActivityTests.kt
index 70673d468de2..f415ba854256 100644
--- a/app/src/androidTest/java/app/opendocument/droid/test/MainActivityTests.kt
+++ b/app/src/androidTest/java/app/opendocument/droid/test/MainActivityTests.kt
@@ -224,7 +224,7 @@ class MainActivityTests {
     fun testDocumentSurvivesRecreation() {
         val activity = mainActivityActivityTestRule.activity
         val documentFragment = loadDocument(activity, requireTestFile("test.odt"))
-        val before = documentFragment.lastResult
+        val before = documentFragment.lastDocument
         Assert.assertNotNull(before)
 
         // not rotation, which MainActivity handles itself: recreate() is what a locale or font
@@ -242,8 +242,8 @@ class MainActivityTests {
         )
         Assert.assertEquals(
             "document was reloaded instead of restored",
-            before!!.options.originalUri,
-            afterRecreation.lastResult?.options?.originalUri,
+            before!!.request.uri,
+            afterRecreation.lastDocument?.request?.uri,
         )
     }
 
@@ -405,8 +405,8 @@ class MainActivityTests {
      * lose.
      */
     private fun describeLoadedDocument(fragment: DocumentFragment): String {
-        val result = fragment.lastResult ?: return "no result"
-        val url = result.partUris.firstOrNull() ?: return "no part uri"
+        val document = fragment.lastDocument ?: return "no result"
+        val url = document.partUris.firstOrNull() ?: return "no part uri"
 
         return try {
             val connection = URL(url.toString()).openConnection() as HttpURLConnection
@@ -417,7 +417,7 @@ class MainActivityTests {
                 val html = connection.inputStream.bufferedReader().use { it.readText() }
                 "$url http=${connection.responseCode} length=${html.length}" +
                     " contenteditable=${html.contains("contenteditable")}" +
-                    " translatable=${result.options.translatable}"
+                    " editable=${document.request.editable}"
             } finally {
                 connection.disconnect()
             }
diff --git a/app/src/androidTest/java/app/opendocument/droid/test/SupportedFormatsTest.kt b/app/src/androidTest/java/app/opendocument/droid/test/SupportedFormatsTest.kt
index 1058857a2b9b..a72061c8d43c 100644
--- a/app/src/androidTest/java/app/opendocument/droid/test/SupportedFormatsTest.kt
+++ b/app/src/androidTest/java/app/opendocument/droid/test/SupportedFormatsTest.kt
@@ -8,8 +8,6 @@ import androidx.test.filters.SmallTest
 import androidx.test.platform.app.InstrumentationRegistry
 import app.opendocument.core.Odr
 import app.opendocument.droid.background.CatchAllSetting
-import app.opendocument.droid.background.CoreLoader
-import app.opendocument.droid.background.FileLoader
 import app.opendocument.droid.background.SupportedDocumentTypes
 import org.junit.Assert
 import org.junit.BeforeClass
@@ -84,22 +82,19 @@ class SupportedFormatsTest {
     }
 
     /**
-     * Everything the app offers itself for reaches [CoreLoader]. Claiming a mime type nothing loads
-     * is the "cannot open" the user gets on a file they picked us for, so `CLAIMED_FILE_TYPES` and
-     * `CORE_FILE_TYPES` must not come apart.
+     * Everything the app offers itself for is something the core renders. Claiming a mime type
+     * nothing loads is the "cannot open" the user gets on a file they picked us for, so
+     * `CLAIMED_FILE_TYPES` and `CORE_FILE_TYPES` must not come apart.
      */
     @Test
     fun everythingTheAppClaimsIsLoadedByTheCore() {
-        val coreLoader = CoreLoader(null)
-
         for (mimeType in SupportedDocumentTypes.MIME_TYPES) {
-            val options = FileLoader.Options()
-            options.fileType = SupportedDocumentTypes.canonicalMimeType(mimeType)
+            val canonical = SupportedDocumentTypes.canonicalMimeType(mimeType)
 
             Assert.assertTrue(
-                "$mimeType is claimed by the app, but the core loader does not take it" +
-                    " (as ${options.fileType})",
-                coreLoader.isSupported(options),
+                "$mimeType is claimed by the app, but the core does not render it" +
+                    " (as $canonical)",
+                SupportedDocumentTypes.isRenderedByCore(canonical),
             )
         }
     }
diff --git a/app/src/main/AndroidManifest.xml b/app/src/main/AndroidManifest.xml
index 51479c8e1d76..f14728621ba5 100644
--- a/app/src/main/AndroidManifest.xml
+++ b/app/src/main/AndroidManifest.xml
@@ -50,11 +50,6 @@
         android:networkSecurityConfig="@xml/network_security_config"
         tools:replace="android:label">
 
-        <service
-            android:name="app.opendocument.droid.background.LoaderService"
-            android:enabled="true"
-            android:exported="false" />
-
         <!--
              every component name below keeps its historical at.tomtasche.reader.* spelling:
              the OS persists component names for pinned launcher icons and for "always open
diff --git a/app/src/main/java/app/opendocument/droid/background/CoreLoader.kt b/app/src/main/java/app/opendocument/droid/background/CoreLoader.kt
index edae80a66216..b71b8db6f895 100644
--- a/app/src/main/java/app/opendocument/droid/background/CoreLoader.kt
+++ b/app/src/main/java/app/opendocument/droid/background/CoreLoader.kt
@@ -2,7 +2,6 @@ package app.opendocument.droid.background
 
 import android.content.Context
 import android.net.Uri
-import android.os.Handler
 import android.system.Os
 import android.util.Log
 import app.opendocument.core.DecodedFile
@@ -14,12 +13,6 @@ import app.opendocument.core.HtmlView
 import app.opendocument.core.HttpServer
 import app.opendocument.core.Odr
 import app.opendocument.core.OdrException
-import app.opendocument.droid.background.FileLoader.EncryptedDocumentException
-import app.opendocument.droid.background.FileLoader.FileLoaderListener
-import app.opendocument.droid.background.FileLoader.LoaderType
-import app.opendocument.droid.background.FileLoader.Options
-import app.opendocument.droid.background.FileLoader.Result
-import app.opendocument.droid.nonfree.AnalyticsManager
 import app.opendocument.droid.nonfree.CrashManager
 import java.io.File
 import java.io.IOException
@@ -30,7 +23,9 @@ import java.io.IOException
  * Owns the process wide core state: the one-time initialization, the single http server and the
  * currently open [Document] that [retranslate] edits.
  */
-class CoreLoader(context: Context?) : FileLoader(context, LoaderType.CORE) {
+class CoreLoader(private val context: Context) {
+
+    private lateinit var crashManager: CrashManager
 
     private var document: Document? = null
     private var lastInputPath: String? = null
@@ -42,54 +37,27 @@ class CoreLoader(context: Context?) : FileLoader(context, LoaderType.CORE) {
     val isDocumentEditable: Boolean
         get() = document != null
 
-    override fun initialize(
-        listener: FileLoaderListener,
-        mainHandler: Handler,
-        backgroundHandler: Handler,
-        analyticsManager: AnalyticsManager,
-        crashManager: CrashManager,
-    ) {
+    fun initialize(crashManager: CrashManager) {
+        this.crashManager = crashManager
+
         // loads the native library and points the core at a usable temporary directory
         initializeCore(context)
 
         startSharedServer(crashManager)
-
-        super.initialize(listener, mainHandler, backgroundHandler, analyticsManager, crashManager)
     }
 
     /**
-     * Everything odrcore can turn into html, which is much more than documents. Wider than what the
-     * app offers itself for (see [SupportedDocumentTypes]): this decides how a failed load is
-     * reported, not the share sheet.
+     * Renders [file] and publishes it, replacing whatever was published before.
+     *
+     * Throws what odrcore threw: which failure it is decides which bar the user gets, so
+     * [DocumentLoader] needs the exception itself.
      */
-    override fun isSupported(options: Options): Boolean =
-        SupportedDocumentTypes.isRenderedByCore(options.fileType)
-
-    override fun loadSync(options: Options) {
-        val result = Result(type, options)
-
-        try {
-            translate(options, result)
-
-            callOnSuccess(result)
-        } catch (e: OdrException.FileEncrypted) {
-            callOnError(result, EncryptedDocumentException())
-        } catch (e: OdrException.WrongPassword) {
-            callOnError(result, EncryptedDocumentException())
-        } catch (e: OdrException.DecryptionFailed) {
-            callOnError(result, EncryptedDocumentException())
-        } catch (e: Throwable) {
-            callOnError(result, e)
-        }
-    }
-
-    private fun translate(options: Options, result: Result) {
-        val cacheUri = checkNotNull(options.cacheUri) { "nothing was cached to load" }
+    fun render(request: DocumentRequest, file: IdentifiedFile): LoadedDocument {
         val cachedFile =
-            checkNotNull(AndroidFileCache.getCacheFile(context, cacheUri)) {
-                "not a cached file: $cacheUri"
+            checkNotNull(FileCache.getCacheFile(context, file.cacheUri)) {
+                "not a cached file: " + file.cacheUri
             }
-        val cacheDirectory = AndroidFileCache.getCacheDirectory(cachedFile)
+        val cacheDirectory = FileCache.getCacheDirectory(cachedFile)
 
         val coreCacheDirectory = File(cacheDirectory, "core_cache")
 
@@ -100,18 +68,19 @@ class CoreLoader(context: Context?) : FileLoader(context, LoaderType.CORE) {
                 prefix = "odr",
                 inputPath = cachedFile.path,
                 cachePath = coreCacheDirectory.path,
-                password = options.password,
-                editable = options.translatable,
+                password = request.password,
+                editable = request.editable,
                 paging = PaginationSetting.isEnabled(context),
                 keepDocument = true,
             )
 
-        result.isEditable = isDocumentEditable
-
-        for (view in views) {
-            result.partTitles.add(view.name)
-            result.partUris.add(Uri.parse(view.url))
-        }
+        return LoadedDocument(
+            request,
+            file,
+            views.map { it.name },
+            views.map { Uri.parse(it.url) },
+            isDocumentEditable,
+        )
     }
 
     /**
@@ -196,16 +165,16 @@ class CoreLoader(context: Context?) : FileLoader(context, LoaderType.CORE) {
         }
     }
 
-    override fun retranslate(options: Options, htmlDiff: String): File? {
+    /** The document with [htmlDiff] applied, written to a file of ours. Null if that failed. */
+    fun retranslate(request: DocumentRequest, file: IdentifiedFile, htmlDiff: String): File? {
         try {
             if (document == null) {
-                // necessary if fragment was destroyed in the meanwhile - meaning the Loader is
-                // reinstantiated
-                translate(options, Result(type, options))
+                // nothing is held open after a rebuild, so open it again before editing it
+                render(request, file)
             }
 
             val inputFile = File(checkNotNull(lastInputPath))
-            val inputCacheDirectory = AndroidFileCache.getCacheDirectory(inputFile)
+            val inputCacheDirectory = FileCache.getCacheDirectory(inputFile)
 
             return edit(htmlDiff, File(inputCacheDirectory, "retranslate").path)
         } catch (e: Throwable) {
@@ -238,8 +207,10 @@ class CoreLoader(context: Context?) : FileLoader(context, LoaderType.CORE) {
     /**
      * Drops what this loader published and leaves the server itself running - see [sharedServer]
      * for why it is never stopped.
+     *
+     * Belongs on the thread the loads run on, so it cannot race one in flight.
      */
-    override fun onClose() {
+    fun close() {
         sharedServer?.clear()
 
         closeDocument()
diff --git a/app/src/main/java/app/opendocument/droid/background/DocumentLoader.kt b/app/src/main/java/app/opendocument/droid/background/DocumentLoader.kt
new file mode 100644
index 000000000000..a284dbd1e558
--- /dev/null
+++ b/app/src/main/java/app/opendocument/droid/background/DocumentLoader.kt
@@ -0,0 +1,244 @@
+package app.opendocument.droid.background
+
+import android.app.Application
+import android.content.Context
+import android.net.Uri
+import android.os.Handler
+import android.os.HandlerThread
+import android.os.Looper
+import androidx.lifecycle.AndroidViewModel
+import app.opendocument.core.OdrException
+import app.opendocument.droid.nonfree.AnalyticsConstants
+import app.opendocument.droid.nonfree.AnalyticsManager
+import app.opendocument.droid.nonfree.CrashManager
+import java.io.IOException
+
+/**
+ * Opens a document: caches it, names it, renders it, and reports back on the main thread. Owns the
+ * background thread all of that runs on, and the components that do it.
+ *
+ * Scoped to `MainActivity`, so it outlives a configuration change and is there before anything asks
+ * it for a document.
+ *
+ * There is nothing after [CoreLoader]. A file it cannot open is reported as unsupported and that is
+ * the end of it: a format the app should open is a format odrcore should learn, and no document
+ * leaves the device.
+ */
+class DocumentLoader(application: Application) : AndroidViewModel(application) {
+
+    private val context: Context = application
+
+    private val mainHandler = Handler(Looper.getMainLooper())
+
+    private val backgroundThread =
+        HandlerThread(DocumentLoader::class.java.simpleName).apply { start() }
+
+    private val backgroundHandler = Handler(backgroundThread.looper)
+
+    private val crashManager = CrashManager().apply { initialize() }
+
+    private val analyticsManager = AnalyticsManager().apply { initialize(context) }
+
+    private val fileIdentifier = FileIdentifier(crashManager)
+
+    private val coreLoader = CoreLoader(context)
+
+    private val documentSaver = DocumentSaver(context, coreLoader, crashManager)
+
+    /**
+     * Where the outcomes go. `DocumentFragment` attaches itself before it asks for anything, so an
+     * outcome arriving with nothing to hand it to means the fragment went away mid-load - see
+     * [deliver].
+     */
+    var listener: Listener? = null
+
+    init {
+        // posted, not called: loading the native library is not work for the thread putting the
+        // first frame up, and everything that reaches the core is posted to this one anyway
+        backgroundHandler.post { coreLoader.initialize(crashManager) }
+    }
+
+    fun load(request: DocumentRequest) {
+        backgroundHandler.post { loadSync(request) }
+    }
+
+    /**
+     * Renders a file that has already been read again, after [DocumentRequest.editable] or
+     * [DocumentRequest.password] changed.
+     *
+     * Not a [load]: the copy in the cache is the document, so caching and naming it a second time
+     * would only cost another pass over the bytes and move it up the recent list again.
+     */
+    fun reload(request: DocumentRequest, file: IdentifiedFile) {
+        backgroundHandler.post { renderSync(request, file) }
+    }
+
+    fun save(document: LoadedDocument, target: Uri, htmlDiff: String?) {
+        backgroundHandler.post { saveSync(document, target, htmlDiff) }
+    }
+
+    private fun loadSync(request: DocumentRequest) {
+        val uri = readableUri(request.uri)
+
+        val file =
+            try {
+                fileIdentifier.identify(context, uri, FileCache.store(context, uri))
+            } catch (e: Throwable) {
+                failed("load_error", null, request, e)
+
+                // a document that cannot be read is not one the recent list should offer again
+                try {
+                    RecentDocumentsUtil.removeRecentDocument(context, request.uri)
+                } catch (e1: Exception) {
+                    crashManager.log(e1)
+                }
+
+                deliver { it.onError(request, null, e) }
+
+                return
+            }
+
+        remember(request, uri, file)
+
+        renderSync(request, file)
+    }
+
+    private fun renderSync(request: DocumentRequest, file: IdentifiedFile) {
+        try {
+            val document = coreLoader.render(request, file)
+
+            report("load_success", file)
+
+            deliver { it.onLoadSuccess(document) }
+        } catch (e: OdrException.FileEncrypted) {
+            encrypted(request, file, e)
+        } catch (e: OdrException.WrongPassword) {
+            encrypted(request, file, e)
+        } catch (e: OdrException.DecryptionFailed) {
+            encrypted(request, file, e)
+        } catch (e: Throwable) {
+            failed("load_odf_error", file, request, e)
+
+            if (SupportedDocumentTypes.isRenderedByCore(file.mimeType)) {
+                // the core names the format and still said no, so the file is what is wrong,
+                // not the format
+                deliver { it.onError(request, file, e) }
+            } else {
+                deliver { it.onUnsupported(request, file) }
+            }
+        }
+    }
+
+    private fun encrypted(request: DocumentRequest, file: IdentifiedFile, error: Throwable) {
+        failed("load_error_encrypted", file, request, error)
+
+        deliver { it.onEncrypted(request, file) }
+    }
+
+    /**
+     * Records the document in the recent list, under the uri that was actually opened rather than
+     * the request's own spelling of it - see [readableUri].
+     */
+    private fun remember(request: DocumentRequest, uri: Uri, file: IdentifiedFile) {
+        if (!request.persistentUri) {
+            return
+        }
+
+        try {
+            val evicted = RecentDocumentsUtil.addRecentDocument(context, file.filename, uri)
+            if (evicted.isNotEmpty()) {
+                // stay well below the per package grant limit
+                PersistedUriPermissions.prune(context)
+            }
+        } catch (e: IOException) {
+            crashManager.log(e)
+        }
+    }
+
+    private fun saveSync(document: LoadedDocument, target: Uri, htmlDiff: String?) {
+        try {
+            documentSaver.save(document, target, htmlDiff)
+
+            deliver { it.onSaveSuccess(target) }
+        } catch (e: Throwable) {
+            failed("save_error", document.file, document.request, e)
+
+            deliver { it.onSaveError() }
+        }
+    }
+
+    private fun report(event: String, file: IdentifiedFile?) {
+        analyticsManager.report(event, AnalyticsConstants.PARAM_CONTENT_TYPE, file?.mimeType)
+    }
+
+    private fun failed(
+        event: String,
+        file: IdentifiedFile?,
+        request: DocumentRequest,
+        error: Throwable,
+    ) {
+        report(event, file)
+        crashManager.log(error, request.uri)
+    }
+
+    /**
+     * Hands [outcome] to the listener on the main thread.
+     *
+     * Dropped when there is none: the load it belongs to was abandoned, and replaying it later
+     * would land it in whatever fragment is showing by then. Worth a crash report all the same,
+     * since the document the user asked for is gone with it.
+     */
+    private fun deliver(outcome: (Listener) -> Unit) {
+        mainHandler.post {
+            val listener = this.listener
+            if (listener == null) {
+                crashManager.log(RuntimeException("missing listener"))
+
+                return@post
+            }
+
+            outcome(listener)
+        }
+    }
+
+    override fun onCleared() {
+        listener = null
+
+        // posted, not called: the teardown must not race a load still on the thread
+        backgroundHandler.post { coreLoader.close() }
+
+        // quitSafely, not quit: quit() would drop the teardown just posted
+        backgroundThread.quitSafely()
+
+        super.onCleared()
+    }
+
+    /**
+     * Uris reach us spelled `/./content://...`, which resolves to nothing. Only what is opened is
+     * corrected; the request keeps the spelling it was handed, which is what the reopen offer and
+     * the abandoned-load check compare against.
+     */
+    private fun readableUri(uri: Uri): Uri {
+        val value = uri.toString()
+
+        return if (value.startsWith("/./")) Uri.parse(value.substring(2)) else uri
+    }
+
+    interface Listener {
+
+        fun onLoadSuccess(document: LoadedDocument)
+
+        /** The document needs a password, or the one it was given was wrong. */
+        fun onEncrypted(request: DocumentRequest, file: IdentifiedFile)
+
+        /** Not a format the core renders, so nothing is ever going to show it. */
+        fun onUnsupported(request: DocumentRequest, file: IdentifiedFile)
+
+        /** [file] is null when the document could not be read at all. */
+        fun onError(request: DocumentRequest, file: IdentifiedFile?, error: Throwable)
+
+        fun onSaveSuccess(target: Uri)
+
+        fun onSaveError()
+    }
+}
diff --git a/app/src/main/java/app/opendocument/droid/background/DocumentRequest.kt b/app/src/main/java/app/opendocument/droid/background/DocumentRequest.kt
new file mode 100644
index 000000000000..a8978224cf51
--- /dev/null
+++ b/app/src/main/java/app/opendocument/droid/background/DocumentRequest.kt
@@ -0,0 +1,51 @@
+package app.opendocument.droid.background
+
+import android.net.Uri
+import android.os.Parcel
+import android.os.Parcelable
+
+/**
+ * What the user asked for: a document to open, and how.
+ *
+ * [password] and [editable] are answered after the fact - by the password dialog and by entering
+ * edit mode - and the request is re-issued, which is why they are the only mutable fields.
+ */
+class DocumentRequest(val uri: Uri, val persistentUri: Boolean) : Parcelable {
+
+    /** Whether the html is rendered for editing, and the document held open to be written back. */
+    var editable: Boolean = false
+
+    var password: String? = null
+
+    @Suppress("DEPRECATION") // the typed readParcelable overload only exists since API 33
+    private constructor(
+        parcel: Parcel
+    ) : this(
+        checkNotNull(parcel.readParcelable(Uri::class.java.classLoader)),
+        ParcelUtil.readBoolean(parcel),
+    ) {
+        editable = ParcelUtil.readBoolean(parcel)
+        password = parcel.readString()
+    }
+
+    override fun describeContents(): Int = 0
+
+    override fun writeToParcel(parcel: Parcel, flags: Int) {
+        parcel.writeParcelable(uri, 0)
+        ParcelUtil.writeBoolean(parcel, persistentUri)
+        ParcelUtil.writeBoolean(parcel, editable)
+        parcel.writeString(password)
+    }
+
+    companion object {
+        // @JvmField because the framework looks CREATOR up as a static field
+        @JvmField
+        val CREATOR: Parcelable.Creator<DocumentRequest> =
+            object : Parcelable.Creator<DocumentRequest> {
+                override fun createFromParcel(parcel: Parcel): DocumentRequest =
+                    DocumentRequest(parcel)
+
+                override fun newArray(size: Int): Array<DocumentRequest?> = arrayOfNulls(size)
+            }
+    }
+}
diff --git a/app/src/main/java/app/opendocument/droid/background/DocumentSaver.kt b/app/src/main/java/app/opendocument/droid/background/DocumentSaver.kt
new file mode 100644
index 000000000000..c2c78796b802
--- /dev/null
+++ b/app/src/main/java/app/opendocument/droid/background/DocumentSaver.kt
@@ -0,0 +1,142 @@
+package app.opendocument.droid.background
+
+import android.content.Context
+import android.net.Uri
+import app.opendocument.droid.nonfree.CrashManager
+import java.io.File
+
+/**
+ * Writes a document back to the file the user picked.
+ *
+ * The write goes straight into their own document, so what is there is kept until the new content
+ * has landed whole - and if the rollback does not get it back in, the copy is left in the cache
+ * rather than the job being finished.
+ *
+ * Does file and provider work, so it belongs on the same background thread the loads run on.
+ */
+class DocumentSaver(
+    private val context: Context,
+    private val coreLoader: CoreLoader,
+    private val crashManager: CrashManager,
+) {
+
+    /**
+     * Saves [document] to [target].
+     *
+     * @param htmlDiff the edits still only in the page, or null for a "full save" of the file as it
+     *   is on disk.
+     */
+    fun save(document: LoadedDocument, target: Uri, htmlDiff: String?) {
+        // only the retranslated file is ours to remove afterwards - the other branch hands back
+        // the cache file of the document that is still open
+        var retranslated: File? = null
+        var backup: File? = null
+        var backupIsTheLastCopy = false
+
+        try {
+            val fileToSave =
+                if (htmlDiff != null) {
+                    val edited =
+                        coreLoader.retranslate(document.request, document.file, htmlDiff)
+                            ?: throw RuntimeException("retranslate failed")
+                    retranslated = edited
+
+                    edited
+                } else {
+                    // "full save" from the main UI
+                    checkNotNull(FileCache.getCacheFile(context, document.file.cacheUri)) {
+                        "not a cached file: " + document.file.cacheUri
+                    }
+                }
+
+            // the write goes straight into the user's own document, so keep what is there
+            // until the new content has landed whole
+            backup = backUp(target)
+
+            try {
+                if (!writeTo(target, fileToSave)) {
+                    crashManager.log("saved without truncating: $target")
+                }
+            } catch (e: Throwable) {
+                backupIsTheLastCopy = !restore(target, backup)
+
+                throw e
+            }
+        } finally {
+            retranslated?.delete()
+
+            // if the rollback did not get the old content back in, this copy is all that is
+            // left of it - leave it in the cache rather than finishing the job
+            if (!backupIsTheLastCopy) {
+                backup?.let { FileCache.deleteCacheFile(it) }
+            }
+        }
+    }
+
+    /** Copies [source] over [uri]. False if the provider would not truncate first. */
+    private fun writeTo(uri: Uri, source: File): Boolean {
+        // "wt", not the default "w": not every provider truncates for "w", and the tail of a
+        // longer previous document left behind is what stops an odt or docx opening
+        var truncated = true
+
+        val outputStream =
+            try {
+                context.contentResolver.openOutputStream(uri, "wt")
+            } catch (e: Exception) {
+                // a provider that rejects the mode outright - saving at all beats truncating
+                crashManager.log(e, uri)
+
+                truncated = false
+
+                context.contentResolver.openOutputStream(uri)
+            }
+
+        checkNotNull(outputStream) { "cannot write $uri" }.use { StreamUtil.copy(source, it) }
+
+        return truncated
+    }
+
+    /** What [uri] holds right now, so a half finished write can be rolled back. */
+    private fun backUp(uri: Uri): File? {
+        val backup = FileCache.createCacheFile(context)
+
+        return try {
+            val input =
+                checkNotNull(context.contentResolver.openInputStream(uri)) { "cannot read $uri" }
+            StreamUtil.copy(input, backup)
+
+            if (backup.length() > 0) {
+                backup
+            } else {
+                // a document that was just created has nothing worth keeping
+                FileCache.deleteCacheFile(backup)
+
+                null
+            }
+        } catch (e: Throwable) {
+            // unreadable target: no worse than before, the save just cannot be rolled back
+            crashManager.log(e, uri)
+            FileCache.deleteCacheFile(backup)
+
+            null
+        }
+    }
+
+    /**
+     * Puts [backup] back into [uri]. False if the old content could not be restored, including a
+     * write that did not truncate and so left the tail of the failed save behind it.
+     */
+    private fun restore(uri: Uri, backup: File?): Boolean {
+        if (backup == null) {
+            return false
+        }
+
+        return try {
+            writeTo(uri, backup)
+        } catch (e: Throwable) {
+            crashManager.log(e, uri)
+
+            false
+        }
+    }
+}
diff --git a/app/src/main/java/app/opendocument/droid/background/AndroidFileCache.kt b/app/src/main/java/app/opendocument/droid/background/FileCache.kt
similarity index 74%
rename from app/src/main/java/app/opendocument/droid/background/AndroidFileCache.kt
rename to app/src/main/java/app/opendocument/droid/background/FileCache.kt
index 15082ba82fa9..c73ff13751bd 100644
--- a/app/src/main/java/app/opendocument/droid/background/AndroidFileCache.kt
+++ b/app/src/main/java/app/opendocument/droid/background/FileCache.kt
@@ -5,7 +5,13 @@ import android.net.Uri
 import androidx.core.content.FileProvider
 import java.io.File
 
-object AndroidFileCache {
+/**
+ * The working copy of the document being read.
+ *
+ * A document arrives as a stream that is only readable while the grant lasts, so [store] copies it
+ * in first and every step after that reads a file of ours.
+ */
+object FileCache {
 
     private const val CACHE_DIRECTORY_PREFIX = "cache."
 
@@ -25,6 +31,26 @@ object AndroidFileCache {
         return cache
     }
 
+    /**
+     * Copies what [uri] points at into a fresh cache directory and returns the file, making room
+     * first. A uri that already names a file of ours is handed straight back.
+     *
+     * @throws java.io.FileNotFoundException and the rest of what opening the stream can throw - a
+     *   document that cannot be read has nothing further to be done with it.
+     */
+    fun store(context: Context, uri: Uri): File {
+        cleanup(context)
+
+        if (isCached(context, uri)) {
+            return checkNotNull(getCacheFile(context, uri))
+        }
+
+        return createCacheFile(context).also { cacheFile ->
+            val stream = context.contentResolver.openInputStream(uri)
+            StreamUtil.copy(checkNotNull(stream) { "cannot open $uri" }, cacheFile)
+        }
+    }
+
     fun getCacheDirectory(cacheFile: File): File {
         // !!: reaching the filesystem root means the file was never below a cache directory
         val parentDirectory = cacheFile.parentFile!!
@@ -78,7 +104,8 @@ object AndroidFileCache {
         file.parentFile?.takeIf { it.name.startsWith(CACHE_DIRECTORY_PREFIX) }?.delete()
     }
 
-    fun cleanup(context: Context) {
+    /** Drops every cache directory but the newest, which is the document still open. */
+    private fun cleanup(context: Context) {
         val cache = getRootCacheDirectory(context)
         val directories =
             cache.list { _, name -> name.startsWith(CACHE_DIRECTORY_PREFIX) } ?: return
diff --git a/app/src/main/java/app/opendocument/droid/background/FileIdentifier.kt b/app/src/main/java/app/opendocument/droid/background/FileIdentifier.kt
new file mode 100644
index 000000000000..e7901d696f2e
--- /dev/null
+++ b/app/src/main/java/app/opendocument/droid/background/FileIdentifier.kt
@@ -0,0 +1,151 @@
+package app.opendocument.droid.background
+
+import android.content.Context
+import android.net.Uri
+import android.provider.OpenableColumns
+import android.webkit.MimeTypeMap
+import app.opendocument.core.Odr
+import app.opendocument.droid.nonfree.CrashManager
+import java.io.File
+import java.io.FileInputStream
+import java.io.FileNotFoundException
+import java.io.InputStream
+import java.net.URLConnection
+
+/**
+ * Names and types the cached copy of a document, in that order: the filename comes from the
+ * provider, the mime type from the bytes.
+ *
+ * It never refuses a file - what nothing can name simply gets a null mime type, and the ui shows
+ * "N/A" for it. The one exception is an empty file, which is a document that is not there.
+ */
+class FileIdentifier(private val crashManager: CrashManager) {
+
+    /**
+     * @param uri the document as the user picked it, for the provider's own answers
+     * @param cachedFile our copy of it, for the core's
+     * @throws FileNotFoundException when the file turns out to be empty
+     */
+    fun identify(context: Context, uri: Uri, cachedFile: File): IdentifiedFile {
+        val filename = displayName(context, uri)
+
+        var mimetype = detectMimeType(context, uri, cachedFile, filename)
+
+        // one spelling per format from here on: a provider may volunteer application/csv
+        mimetype = SupportedDocumentTypes.canonicalMimeType(mimetype)
+
+        if (EMPTY_MIME_TYPE == mimetype) {
+            throw FileNotFoundException()
+        }
+
+        val resolution =
+            MimeTypeResolver.resolve(
+                mimetype,
+                MimeTypeResolver.parseExtension(filename),
+                MIME_TYPE_LOOKUP,
+            )
+
+        return IdentifiedFile(
+            FileCache.getCacheFileUri(context, cachedFile),
+            filename,
+            resolution.mimeType,
+            resolution.extension,
+        )
+    }
+
+    private fun displayName(context: Context, uri: Uri): String {
+        var filename: String? = null
+
+        try {
+            // https://stackoverflow.com/a/38304115/198996
+            context.contentResolver.query(uri, null, null, null, null)?.use { cursor ->
+                if (cursor.moveToFirst()) {
+                    val nameIndex = cursor.getColumnIndexOrThrow(OpenableColumns.DISPLAY_NAME)
+                    filename = cursor.getString(nameIndex)
+                }
+            }
+        } catch (e: Exception) {
+            // providers throw here for a missing access token or a missing DISPLAY_NAME column
+            crashManager.log(e)
+        }
+
+        return filename ?: uri.lastPathSegment ?: "N/A"
+    }
+
+    /** The core first, then everything android can guess. Null if none of them can name it. */
+    private fun detectMimeType(
+        context: Context,
+        uri: Uri,
+        cachedFile: File,
+        filename: String,
+    ): String? {
+        try {
+            val mimetype = Odr.mimetype(cachedFile.absolutePath)
+
+            // text/plain without a charset is the core's fallback for bytes nothing else
+            // claims, not an identification - it would hand random binary to the text renderer
+            if (mimetype != null && (mimetype != TEXT_MIME_TYPE || hasKnownCharset(cachedFile))) {
+                return mimetype
+            }
+        } catch (e: Throwable) {
+            crashManager.log(e)
+        }
+
+        context.contentResolver.getType(uri)?.let {
+            return it
+        }
+
+        try {
+            URLConnection.guessContentTypeFromName(filename)?.let {
+                return it
+            }
+        } catch (e: Exception) {
+            // Samsung S7 Edge crashes with java.lang.StringIndexOutOfBoundsException
+            crashManager.log(e)
+        }
+
+        try {
+            FileInputStream(cachedFile).use { tempStream: InputStream ->
+                return URLConnection.guessContentTypeFromStream(tempStream)
+            }
+        } catch (e: Exception) {
+            crashManager.log(e)
+        }
+
+        return null
+    }
+
+    /** Whether the core can name the encoding of a file it decided is text. */
+    private fun hasKnownCharset(file: File): Boolean =
+        try {
+            val opened = Odr.open(file.absolutePath)
+
+            !opened.isTextFile || opened.asTextFile().charset() != null
+        } catch (e: Throwable) {
+            crashManager.log(e)
+
+            false
+        }
+
+    private companion object {
+        const val TEXT_MIME_TYPE = "text/plain"
+
+        /** What the core answers for a file with nothing in it. */
+        const val EMPTY_MIME_TYPE = "inode/x-empty"
+
+        val MIME_TYPE_LOOKUP =
+            object : MimeTypeResolver.ExtensionLookup {
+
+                override fun extensionFromMimeType(mimeType: String): String? =
+                    MimeTypeMap.getSingleton().getExtensionFromMimeType(mimeType)
+
+                override fun mimeTypeFromExtension(extension: String?): String? {
+                    if (extension == null) {
+                        return null
+                    }
+
+                    return MimeTypeMap.getSingleton().getMimeTypeFromExtension(extension)
+                }
+            }
+    }
+}
diff --git a/app/src/main/java/app/opendocument/droid/background/FileLoader.kt b/app/src/main/java/app/opendocument/droid/background/FileLoader.kt
deleted file mode 100644
index d5470c48db7d..000000000000
--- a/app/src/main/java/app/opendocument/droid/background/FileLoader.kt
+++ /dev/null
@@ -1,255 +0,0 @@
-package app.opendocument.droid.background
-
-import android.content.Context
-import android.net.Uri
-import android.os.Handler
-import android.os.Parcel
-import android.os.Parcelable
-import app.opendocument.droid.nonfree.AnalyticsConstants
-import app.opendocument.droid.nonfree.AnalyticsManager
-import app.opendocument.droid.nonfree.CrashManager
-import java.io.File
-import java.util.LinkedList
-
-/**
- * Base of the two loaders: each one turns a document into something the WebView can display and
- * reports back on the main thread through a [FileLoaderListener].
- *
- * The lifecycle is construct - [initialize] - [loadAsync]* - [close]. Constructing is deliberately
- * side effect free, so the unit tests can build a loader without a context and ask [isSupported]
- * about a mime type.
- */
-abstract class FileLoader(context: Context?, protected val type: LoaderType) {
-
-    /**
-     * Null in the unit tests, which only exercise [isSupported], and dropped again by [close]. The
-     * loading path goes through [context], which fails loudly rather than NPEing further down.
-     */
-    private var contextOrNull: Context? = context
-
-    protected val context: Context
-        get() = checkNotNull(contextOrNull) { "loader has no context" }
-
-    private lateinit var backgroundHandler: Handler
-    private lateinit var mainHandler: Handler
-
-    private var listener: FileLoaderListener? = null
-
-    private lateinit var analyticsManager: AnalyticsManager
-    protected lateinit var crashManager: CrashManager
-
-    private var initialized = false
-
-    open fun initialize(
-        listener: FileLoaderListener,
-        mainHandler: Handler,
-        backgroundHandler: Handler,
-        analyticsManager: AnalyticsManager,
-        crashManager: CrashManager,
-    ) {
-        this.listener = listener
-        this.mainHandler = mainHandler
-        this.backgroundHandler = backgroundHandler
-        this.analyticsManager = analyticsManager
-        this.crashManager = crashManager
-
-        initialized = true
-    }
-
-    abstract fun isSupported(options: Options): Boolean
-
-    fun loadAsync(options: Options) {
-        if (!initialized) {
-            throw RuntimeException("not initialized")
-        }
-
-        backgroundHandler.post { loadSync(options) }
-    }
-
-    protected abstract fun loadSync(options: Options)
-
-    open fun retranslate(options: Options, htmlDiff: String): File? {
-        throw RuntimeException("not implemented")
-    }
-
-    protected fun callOnSuccess(result: Result) {
-        mainHandler.post {
-            analyticsManager.report(
-                "loader_success_$type",
-                AnalyticsConstants.PARAM_CONTENT_TYPE,
-                result.options.fileType,
-                AnalyticsConstants.PARAM_CONTENT,
-                result.options.fileExtension,
-            )
-
-            listener?.onSuccess(result)
-        }
-    }
-
-    protected fun callOnError(result: Result, t: Throwable) {
-        crashManager.log(result.loaderType.name + " failed")
-        crashManager.log(t)
-
-        mainHandler.post {
-            analyticsManager.report(
-                "loader_error_$type",
-                AnalyticsConstants.PARAM_CONTENT_TYPE,
-                result.options.fileType,
-                AnalyticsConstants.PARAM_CONTENT,
-                result.options.fileExtension,
-            )
-
-            listener?.onError(result, t)
-        }
-    }
-
-    fun close() {
-        backgroundHandler.post {
-            onClose()
-
-            initialized = false
-            listener = null
-            contextOrNull = null
-        }
-    }
-
-    /** Loader specific teardown, on the background thread so it cannot race a load in flight. */
-    protected open fun onClose() {}
-
-    enum class LoaderType {
-        CORE,
-        METADATA;
-
-        companion object {
-
-            /**
-             * The type a parcelled [Result] names. Saved state outlives an app update and can name
-             * a loader this version does not have, which `valueOf` would throw on.
-             */
-            fun ofParcelled(name: String?): LoaderType =
-                entries.firstOrNull { it.name == name } ?: CORE
-        }
-    }
-
-    /**
-     * What to load and everything the loaders found out about it along the way - [MetadataLoader]
-     * fills most of these in before handing the same instance on to the loader that does the work.
-     */
-    class Options() : Parcelable {
-
-        var originalUri: Uri? = null
-        var cacheUri: Uri? = null
-        var persistentUri: Boolean = false
-
-        var fileExists: Boolean = false
-        var filename: String? = null
-        var fileType: String? = null
-        var fileExtension: String? = null
-
-        var password: String? = null
-
-        var limit: Boolean = false
-        var translatable: Boolean = false
-
-        @Suppress("DEPRECATION") // the typed readParcelable overload only exists since API 33
-        private constructor(parcel: Parcel) : this() {
-            val classLoader = Options::class.java.classLoader
-            originalUri = parcel.readParcelable(classLoader)
-            cacheUri = parcel.readParcelable(classLoader)
-            persistentUri = ParcelUtil.readBoolean(parcel)
-            fileExists = ParcelUtil.readBoolean(parcel)
-            filename = parcel.readString()
-            fileType = parcel.readString()
-            fileExtension = parcel.readString()
-            password = parcel.readString()
-            limit = ParcelUtil.readBoolean(parcel)
-            translatable = ParcelUtil.readBoolean(parcel)
-        }
-
-        override fun describeContents(): Int = 0
-
-        override fun writeToParcel(parcel: Parcel, flags: Int) {
-            parcel.writeParcelable(originalUri, 0)
-            parcel.writeParcelable(cacheUri, 0)
-            ParcelUtil.writeBoolean(parcel, persistentUri)
-            ParcelUtil.writeBoolean(parcel, fileExists)
-            parcel.writeString(filename)
-            parcel.writeString(fileType)
-            parcel.writeString(fileExtension)
-            parcel.writeString(password)
-            ParcelUtil.writeBoolean(parcel, limit)
-            ParcelUtil.writeBoolean(parcel, translatable)
-        }
-
-        companion object {
-            // @JvmField because the framework looks CREATOR up as a static field
-            @JvmField
-            val CREATOR: Parcelable.Creator<Options> =
-                object : Parcelable.Creator<Options> {
-                    override fun createFromParcel(parcel: Parcel): Options = Options(parcel)
-
-                    override fun newArray(size: Int): Array<Options?> = arrayOfNulls(size)
-                }
-        }
-    }
-
-    /**
-     * The outcome of one load: the [Options] it ran with plus one uri per part of the document
-     * (spreadsheets have one per sheet, everything else a single one with a null title).
-     */
-    class Result(val loaderType: LoaderType, val options: Options) : Parcelable {
-
-        val partTitles: MutableList<String?> = LinkedList()
-        val partUris: MutableList<Uri> = LinkedList()
-
-        /**
-         * Whether the loaded document can be edited and saved again, as the core reports it - see
-         * [CoreLoader.isDocumentEditable]. False for a [MetadataLoader] result, which has nothing
-         * to edit.
-         */
-        var isEditable: Boolean = false
-
-        override fun describeContents(): Int = 0
-
-        override fun writeToParcel(parcel: Parcel, flags: Int) {
-            parcel.writeString(loaderType.name)
-            parcel.writeParcelable(options, 0)
-            parcel.writeList(partTitles)
-            parcel.writeList(partUris)
-            ParcelUtil.writeBoolean(parcel, isEditable)
-        }
-
-        companion object {
-            // @JvmField because the framework looks CREATOR up as a static field
-            @JvmField
-            val CREATOR: Parcelable.Creator<Result> =
-                object : Parcelable.Creator<Result> {
-
-                    @Suppress("DEPRECATION") // typed readParcelable needs API 33
-                    override fun createFromParcel(parcel: Parcel): Result {
-                        // in the order writeToParcel wrote them
-                        val classLoader = Result::class.java.classLoader
-                        val loaderType = LoaderType.ofParcelled(parcel.readString())
-                        val options = parcel.readParcelable<Options>(classLoader)!!
-
-                        return Result(loaderType, options).also {
-                            parcel.readList(it.partTitles, classLoader)
-                            parcel.readList(it.partUris, classLoader)
-                            it.isEditable = ParcelUtil.readBoolean(parcel)
-                        }
-                    }
-
-                    override fun newArray(size: Int): Array<Result?> = arrayOfNulls(size)
-                }
-        }
-    }
-
-    interface FileLoaderListener {
-
-        fun onSuccess(result: Result)
-
-        fun onError(result: Result, error: Throwable)
-    }
-
-    class EncryptedDocumentException : Exception()
-}
diff --git a/app/src/main/java/app/opendocument/droid/background/IdentifiedFile.kt b/app/src/main/java/app/opendocument/droid/background/IdentifiedFile.kt
new file mode 100644
index 000000000000..5477c6807e99
--- /dev/null
+++ b/app/src/main/java/app/opendocument/droid/background/IdentifiedFile.kt
@@ -0,0 +1,50 @@
+package app.opendocument.droid.background
+
+import android.net.Uri
+import android.os.Parcel
+import android.os.Parcelable
+
+/**
+ * The working copy of a document and what it turned out to be - see [FileIdentifier].
+ *
+ * Only ever made from a file that was cached whole, so holding one *is* the answer to whether the
+ * document could be read. [mimeType] is null when nothing could name the bytes.
+ */
+class IdentifiedFile(
+    val cacheUri: Uri,
+    val filename: String,
+    val mimeType: String?,
+    val extension: String?,
+) : Parcelable {
+
+    @Suppress("DEPRECATION") // the typed readParcelable overload only exists since API 33
+    private constructor(
+        parcel: Parcel
+    ) : this(
+        checkNotNull(parcel.readParcelable(Uri::class.java.classLoader)),
+        checkNotNull(parcel.readString()),
+        parcel.readString(),
+        parcel.readString(),
+    )
+
+    override fun describeContents(): Int = 0
+
+    override fun writeToParcel(parcel: Parcel, flags: Int) {
+        parcel.writeParcelable(cacheUri, 0)
+        parcel.writeString(filename)
+        parcel.writeString(mimeType)
+        parcel.writeString(extension)
+    }
+
+    companion object {
+        // @JvmField because the framework looks CREATOR up as a static field
+        @JvmField
+        val CREATOR: Parcelable.Creator<IdentifiedFile> =
+            object : Parcelable.Creator<IdentifiedFile> {
+                override fun createFromParcel(parcel: Parcel): IdentifiedFile =
+                    IdentifiedFile(parcel)
+
+                override fun newArray(size: Int): Array<IdentifiedFile?> = arrayOfNulls(size)
+            }
+    }
+}
diff --git a/app/src/main/java/app/opendocument/droid/background/LoadedDocument.kt b/app/src/main/java/app/opendocument/droid/background/LoadedDocument.kt
new file mode 100644
index 000000000000..dc8b90900965
--- /dev/null
+++ b/app/src/main/java/app/opendocument/droid/background/LoadedDocument.kt
@@ -0,0 +1,64 @@
+package app.opendocument.droid.background
+
+import android.net.Uri
+import android.os.Parcel
+import android.os.Parcelable
+
+/**
+ * A document that was rendered and published: the request it came from, the file it turned out to
+ * be, and one uri per part (spreadsheets have one per sheet, everything else a single one with a
+ * null title).
+ *
+ * [isEditable] is the core's own answer about this document, never a guess from its mime type - see
+ * `CoreLoader.isDocumentEditable`.
+ */
+class LoadedDocument(
+    val request: DocumentRequest,
+    val file: IdentifiedFile,
+    val partTitles: List<String?>,
+    val partUris: List<Uri>,
+    val isEditable: Boolean,
+) : Parcelable {
+
+    override fun describeContents(): Int = 0
+
+    override fun writeToParcel(parcel: Parcel, flags: Int) {
+        parcel.writeParcelable(request, 0)
+        parcel.writeParcelable(file, 0)
+        parcel.writeList(partTitles)
+        parcel.writeList(partUris)
+        ParcelUtil.writeBoolean(parcel, isEditable)
+    }
+
+    companion object {
+        // @JvmField because the framework looks CREATOR up as a static field
+        @JvmField
+        val CREATOR: Parcelable.Creator<LoadedDocument> =
+            object : Parcelable.Creator<LoadedDocument> {
+
+                @Suppress("DEPRECATION") // typed readParcelable needs API 33
+                override fun createFromParcel(parcel: Parcel): LoadedDocument {
+                    // in the order writeToParcel wrote them
+                    val classLoader = LoadedDocument::class.java.classLoader
+                    val request = checkNotNull(parcel.readParcelable<DocumentRequest>(classLoader))
+                    val file = checkNotNull(parcel.readParcelable<IdentifiedFile>(classLoader))
+
+                    val partTitles = ArrayList<String?>()
+                    parcel.readList(partTitles, classLoader)
+
+                    val partUris = ArrayList<Uri>()
+                    parcel.readList(partUris, classLoader)
+
+                    return LoadedDocument(
+                        request,
+                        file,
+                        partTitles,
+                        partUris,
+                        ParcelUtil.readBoolean(parcel),
+                    )
+                }
+
+                override fun newArray(size: Int): Array<LoadedDocument?> = arrayOfNulls(size)
+            }
+    }
+}
diff --git a/app/src/main/java/app/opendocument/droid/background/LoaderService.kt b/app/src/main/java/app/opendocument/droid/background/LoaderService.kt
deleted file mode 100644
index 582049e92a1b..000000000000
--- a/app/src/main/java/app/opendocument/droid/background/LoaderService.kt
+++ /dev/null
@@ -1,328 +0,0 @@
-package app.opendocument.droid.background
-
-import android.app.Service
-import android.content.Intent
-import android.net.Uri
-import android.os.Binder
-import android.os.Handler
-import android.os.HandlerThread
-import android.os.IBinder
-import android.os.Looper
-import app.opendocument.droid.nonfree.AnalyticsConstants
-import app.opendocument.droid.nonfree.AnalyticsManager
-import app.opendocument.droid.nonfree.CrashManager
-import app.opendocument.droid.ui.activity.DocumentFragment
-import java.io.File
-
-/**
- * Owns the two loaders and the background thread they run on: metadata first, then the core.
- * Nothing follows the core - what it cannot open is reported as unsupported.
- */
-class LoaderService : Service(), FileLoader.FileLoaderListener {
-
-    private lateinit var mainHandler: Handler
-
-    private lateinit var backgroundThread: HandlerThread
-    private lateinit var backgroundHandler: Handler
-
-    private lateinit var crashManager: CrashManager
-    private lateinit var analyticsManager: AnalyticsManager
-
-    private lateinit var metadataLoader: MetadataLoader
-    private lateinit var coreLoader: CoreLoader
-
-    private var currentListener: LoaderListener? = null
-
-    @Synchronized
-    override fun onCreate() {
-        super.onCreate()
-
-        mainHandler = Handler(Looper.getMainLooper())
-
-        backgroundThread = HandlerThread(DocumentFragment::class.java.simpleName)
-        backgroundThread.start()
-
-        backgroundHandler = Handler(backgroundThread.looper)
-
-        crashManager = CrashManager()
-        crashManager.initialize()
-
-        analyticsManager = AnalyticsManager()
-        analyticsManager.initialize(this)
-
-        metadataLoader = MetadataLoader(this)
-        metadataLoader.initialize(
-            this,
-            mainHandler,
-            backgroundHandler,
-            analyticsManager,
-            crashManager,
-        )
-
-        coreLoader = CoreLoader(this)
-        coreLoader.initialize(this, mainHandler, backgroundHandler, analyticsManager, crashManager)
-    }
-
-    override fun onBind(intent: Intent?): IBinder = LoaderBinder()
-
-    @Synchronized
-    fun setListener(listener: LoaderListener?) {
-        this.currentListener = listener
-    }
-
-    private fun logMissingListener() {
-        crashManager.log(RuntimeException("missing listener"))
-    }
-
-    @Synchronized
-    fun loadWithType(loaderType: FileLoader.LoaderType, options: FileLoader.Options) {
-        val loader =
-            when (loaderType) {
-                FileLoader.LoaderType.CORE -> coreLoader
-                FileLoader.LoaderType.METADATA -> metadataLoader
-            }
-
-        loader.loadAsync(options)
-    }
-
-    override fun onSuccess(result: FileLoader.Result) {
-        val options = result.options
-        if (result.loaderType == FileLoader.LoaderType.METADATA) {
-            if (!coreLoader.isSupported(options)) {
-                crashManager.log("we do not expect this file to be an ODF: " + options.originalUri)
-                analyticsManager.report(
-                    "load_odf_error_expected",
-                    AnalyticsConstants.PARAM_CONTENT_TYPE,
-                    options.fileType,
-                )
-            }
-
-            loadWithType(FileLoader.LoaderType.CORE, options)
-
-            return
-        }
-
-        analyticsManager.report(
-            "load_success",
-            AnalyticsConstants.PARAM_CONTENT_TYPE,
-            options.fileType,
-            AnalyticsConstants.PARAM_CONTENT,
-            result.loaderType.toString(),
-        )
-
-        withListener { it.onLoadSuccess(result) }
-    }
-
-    override fun onError(result: FileLoader.Result, error: Throwable) {
-        val options = result.options
-        crashManager.log(error, options.originalUri)
-
-        if (error is FileLoader.EncryptedDocumentException) {
-            analyticsManager.report("load_error_encrypted")
-
-            withListener { it.onEncrypted(result) }
-
-            return
-        }
-
-        if (result.loaderType == FileLoader.LoaderType.CORE) {
-            analyticsManager.report(
-                "load_odf_error",
-                AnalyticsConstants.PARAM_CONTENT_TYPE,
-                options.fileType,
-            )
-
-            if (coreLoader.isSupported(options)) {
-                // the core names the format and still said no, so the file is what is wrong,
-                // not the format
-                withListener { it.onError(result, error) }
-            } else {
-                withListener { it.onUnsupported(result) }
-            }
-
-            return
-        }
-
-        // MetadataLoader failed, so there's no point in trying to parse the file
-
-        analyticsManager.report(
-            "load_error",
-            AnalyticsConstants.PARAM_CONTENT_TYPE,
-            options.fileType,
-            AnalyticsConstants.PARAM_CONTENT,
-            result.loaderType.toString(),
-        )
-
-        withListener { it.onError(result, error) }
-    }
-
-    fun saveAsync(lastResult: FileLoader.Result, outFile: Uri, htmlDiff: String?) {
-        backgroundHandler.post { saveSync(lastResult, outFile, htmlDiff) }
-    }
-
-    private fun saveSync(lastResult: FileLoader.Result, outFile: Uri, htmlDiff: String?) {
-        val options = lastResult.options
-
-        // only the retranslated file is ours to remove afterwards - the other branch hands back
-        // the cache file of the document that is still open
-        var retranslated: File? = null
-        var backup: File? = null
-        var backupIsTheLastCopy = false
-
-        try {
-            val fileToSave =
-                if (htmlDiff != null) {
-                    val edited =
-                        coreLoader.retranslate(options, htmlDiff)
-                            ?: throw RuntimeException("retranslate failed")
-                    retranslated = edited
-
-                    edited
-                } else {
-                    // "full save" from the main UI
-                    checkNotNull(
-                        AndroidFileCache.getCacheFile(this, checkNotNull(options.cacheUri))
-                    ) {
-                        "not a cached file: " + options.cacheUri
-                    }
-                }
-
-            // the write goes straight into the user's own document, so keep what is there
-            // until the new content has landed whole
-            backup = backUp(outFile)
-
-            try {
-                if (!writeTo(outFile, fileToSave)) {
-                    crashManager.log("saved without truncating: $outFile")
-                }
-            } catch (e: Throwable) {
-                backupIsTheLastCopy = !restore(outFile, backup)
-
-                throw e
-            }
-
-            mainHandler.post { withListener { it.onSaveSuccess(outFile) } }
-        } catch (e: Throwable) {
-            analyticsManager.report(
-                "save_error",
-                AnalyticsConstants.PARAM_CONTENT_TYPE,
-                options.fileType,
-            )
-            crashManager.log(e, options.originalUri)
-
-            mainHandler.post { withListener { it.onSaveError() } }
-        } finally {
-            retranslated?.delete()
-
-            // if the rollback did not get the old content back in, this copy is all that is
-            // left of it - leave it in the cache rather than finishing the job
-            if (!backupIsTheLastCopy) {
-                backup?.let { AndroidFileCache.deleteCacheFile(it) }
-            }
-        }
-    }
-
-    /** Copies [source] over [uri]. False if the provider would not truncate first. */
-    private fun writeTo(uri: Uri, source: File): Boolean {
-        // "wt", not the default "w": not every provider truncates for "w", and the tail of a
-        // longer previous document left behind is what stops an odt or docx opening
-        var truncated = true
-
-        val outputStream =
-            try {
-                contentResolver.openOutputStream(uri, "wt")
-            } catch (e: Exception) {
-                // a provider that rejects the mode outright - saving at all beats truncating
-                crashManager.log(e, uri)
-
-                truncated = false
-
-                contentResolver.openOutputStream(uri)
-            }
-
-        checkNotNull(outputStream) { "cannot write $uri" }.use { StreamUtil.copy(source, it) }
-
-        return truncated
-    }
-
-    /** What [uri] holds right now, so a half finished write can be rolled back. */
-    private fun backUp(uri: Uri): File? {
-        val backup = AndroidFileCache.createCacheFile(this)
-
-        return try {
-            val input = checkNotNull(contentResolver.openInputStream(uri)) { "cannot read $uri" }
-            StreamUtil.copy(input, backup)
-
-            if (backup.length() > 0) {
-                backup
-            } else {
-                // a document that was just created has nothing worth keeping
-                AndroidFileCache.deleteCacheFile(backup)
-
-                null
-            }
-        } catch (e: Throwable) {
-            // unreadable target: no worse than before, the save just cannot be rolled back
-            crashManager.log(e, uri)
-            AndroidFileCache.deleteCacheFile(backup)
-
-            null
-        }
-    }
-
-    /**
-     * Puts [backup] back into [uri]. False if the old content could not be restored, including a
-     * write that did not truncate and so left the tail of the failed save behind it.
-     */
-    private fun restore(uri: Uri, backup: File?): Boolean {
-        if (backup == null) {
-            return false
-        }
-
-        return try {
-            writeTo(uri, backup)
-        } catch (e: Throwable) {
-            crashManager.log(e, uri)
-
-            false
-        }
-    }
-
-    /** Every callback is dropped once the fragment is gone, which is worth a crash report. */
-    private inline fun withListener(block: (LoaderListener) -> Unit) {
-        val listener = currentListener
-        if (listener != null) {
-            block(listener)
-        } else {
-            logMissingListener()
-        }
-    }
-
-    override fun onDestroy() {
-        metadataLoader.close()
-        coreLoader.close()
-
-        // quitSafely, not quit: close() posts each loader's teardown, which quit() would drop
-        backgroundThread.quitSafely()
-
-        super.onDestroy()
-    }
-
-    inner class LoaderBinder : Binder() {
-        fun getService(): LoaderService = this@LoaderService
-    }
-
-    interface LoaderListener {
-        fun onLoadSuccess(result: FileLoader.Result)
-
-        fun onSaveSuccess(outFile: Uri)
-
-        fun onError(result: FileLoader.Result, error: Throwable)
-
-        fun onEncrypted(result: FileLoader.Result)
-
-        fun onUnsupported(result: FileLoader.Result)
-
-        fun onSaveError()
-    }
-}
diff --git a/app/src/main/java/app/opendocument/droid/background/LoaderServiceQueue.kt b/app/src/main/java/app/opendocument/droid/background/LoaderServiceQueue.kt
deleted file mode 100644
index 9841aaa72949..000000000000
--- a/app/src/main/java/app/opendocument/droid/background/LoaderServiceQueue.kt
+++ /dev/null
@@ -1,53 +0,0 @@
-package app.opendocument.droid.background
-
-import java.util.LinkedList
-
-/**
- * Holds on to work that wants a [LoaderService] before the service connection is up, and replays it
- * once the service arrives.
- */
-class LoaderServiceQueue {
-
-    private val queue: MutableList<QueueEntry> = LinkedList()
-
-    private var boundService: LoaderService? = null
-
-    /**
-     * The bound service, or null while the connection is pending or after it dropped. Setting it
-     * replays what queued up in the meantime.
-     */
-    var service: LoaderService?
-        @Synchronized get() = boundService
-        @Synchronized
-        set(value) {
-            boundService = value
-
-            if (value == null) {
-                return
-            }
-
-            // drained, not kept: a reconnect would otherwise replay every load this activity has
-            // ever queued, reopening documents the user has moved on from
-            val pending = queue.toList()
-            queue.clear()
-
-            for (entry in pending) {
-                entry.onService(value)
-            }
-        }
-
-    @Synchronized
-    fun addToQueue(entry: QueueEntry) {
-        val service = boundService
-        if (service != null) {
-            entry.onService(service)
-            return
-        }
-
-        queue.add(entry)
-    }
-
-    fun interface QueueEntry {
-        fun onService(service: LoaderService)
-    }
-}
diff --git a/app/src/main/java/app/opendocument/droid/background/MetadataLoader.kt b/app/src/main/java/app/opendocument/droid/background/MetadataLoader.kt
deleted file mode 100644
index 0b61675aefa7..000000000000
--- a/app/src/main/java/app/opendocument/droid/background/MetadataLoader.kt
+++ /dev/null
@@ -1,193 +0,0 @@
-package app.opendocument.droid.background
-
-import android.content.Context
-import android.net.Uri
-import android.provider.OpenableColumns
-import android.webkit.MimeTypeMap
-import app.opendocument.core.Odr
-import java.io.File
-import java.io.FileInputStream
-import java.io.FileNotFoundException
-import java.io.IOException
-import java.io.InputStream
-import java.net.URLConnection
-
-/**
- * Runs first for every document: copies it into the cache and fills in the filename, mime type and
- * extension the other loaders decide on. It never fails to "support" a file - what it cannot
- * identify simply keeps the "N/A" type.
- */
-class MetadataLoader(context: Context?) : FileLoader(context, LoaderType.METADATA) {
-
-    override fun isSupported(options: Options): Boolean = true
-
-    override fun loadSync(options: Options) {
-        val result = Result(type, options)
-
-        options.fileType = "N/A"
-
-        try {
-            var uri = checkNotNull(options.originalUri) { "nothing to load" }
-
-            val uriString = uri.toString()
-            if (uriString.startsWith("/./")) {
-                uri = Uri.parse(uriString.substring(2))
-            }
-
-            AndroidFileCache.cleanup(context)
-
-            var filename: String? = null
-            try {
-                // https://stackoverflow.com/a/38304115/198996
-                context.contentResolver.query(uri, null, null, null, null)?.use { cursor ->
-                    if (cursor.moveToFirst()) {
-                        val nameIndex = cursor.getColumnIndexOrThrow(OpenableColumns.DISPLAY_NAME)
-                        filename = cursor.getString(nameIndex)
-                    }
-                }
-            } catch (e: Exception) {
-                // providers throw here for a missing access token or a missing DISPLAY_NAME column
-                crashManager.log(e)
-            }
-
-            if (filename == null) {
-                filename = uri.lastPathSegment
-            }
-
-            if (filename == null) {
-                filename = "N/A"
-            }
-
-            options.filename = filename
-
-            val cachedFile =
-                if (AndroidFileCache.isCached(context, uri)) {
-                    checkNotNull(AndroidFileCache.getCacheFile(context, uri))
-                } else {
-                    AndroidFileCache.createCacheFile(context).also { cacheFile ->
-                        val stream = context.contentResolver.openInputStream(uri)
-                        StreamUtil.copy(checkNotNull(stream) { "cannot open $uri" }, cacheFile)
-                    }
-                }
-
-            // if file didn't exist an exception would have been thrown by now
-            options.fileExists = true
-
-            options.cacheUri = AndroidFileCache.getCacheFileUri(context, cachedFile)
-
-            val extension = MimeTypeResolver.parseExtension(options.filename)
-
-            var mimetype: String? = null
-            try {
-                mimetype = Odr.mimetype(cachedFile.absolutePath)
-
-                // text/plain without a charset is the core's fallback for bytes nothing else
-                // claims, not an identification - it would hand random binary to the text
-                // renderer
-                if (mimetype == TEXT_MIME_TYPE && !hasKnownCharset(cachedFile)) {
-                    mimetype = null
-                }
-            } catch (e: Throwable) {
-                crashManager.log(e)
-            }
-
-            if (mimetype == null) {
-                mimetype = context.contentResolver.getType(uri)
-            }
-
-            if (mimetype == null) {
-                try {
-                    mimetype = URLConnection.guessContentTypeFromName(filename)
-                } catch (e: Exception) {
-                    // Samsung S7 Edge crashes with java.lang.StringIndexOutOfBoundsException
-                    crashManager.log(e)
-                }
-            }
-
-            if (mimetype == null) {
-                try {
-                    FileInputStream(cachedFile).use { tempStream: InputStream ->
-                        mimetype = URLConnection.guessContentTypeFromStream(tempStream)
-                    }
-                } catch (e: Exception) {
-                    crashManager.log(e)
-                }
-            }
-
-            // one spelling per format from here on: a provider may volunteer application/csv
-            mimetype = SupportedDocumentTypes.canonicalMimeType(mimetype)
-
-            val resolution = MimeTypeResolver.resolve(mimetype, extension, MIME_TYPE_LOOKUP)
-            mimetype = resolution.mimeType
-
-            if (resolution.extension != null) {
-                options.fileExtension = resolution.extension
-            }
-            if (mimetype != null) {
-                options.fileType = mimetype
-            }
-
-            if ("inode/x-empty" == mimetype) {
-                throw FileNotFoundException()
-            }
-
-            if (options.persistentUri) {
-                try {
-                    val evicted = RecentDocumentsUtil.addRecentDocument(context, filename, uri)
-                    if (evicted.isNotEmpty()) {
-                        // stay well below the per package grant limit
-                        PersistedUriPermissions.prune(context)
-                    }
-                } catch (e: IOException) {
-                    crashManager.log(e)
-                }
-            }
-
-            callOnSuccess(result)
-        } catch (e: Throwable) {
-            options.fileType = "N/A"
-
-            val originalUri = options.originalUri
-            if (originalUri != null) {
-                try {
-                    RecentDocumentsUtil.removeRecentDocument(context, originalUri)
-                } catch (e1: Exception) {
-                    crashManager.log(e1)
-                }
-            }
-
-            callOnError(result, e)
-        }
-    }
-
-    /** Whether the core can name the encoding of a file it decided is text. */
-    private fun hasKnownCharset(file: File): Boolean =
-        try {
-            val opened = Odr.open(file.absolutePath)
-
-            !opened.isTextFile || opened.asTextFile().charset() != null
-        } catch (e: Throwable) {
-            crashManager.log(e)
-
-            false
-        }
-
-    private companion object {
-        const val TEXT_MIME_TYPE = "text/plain"
-
-        val MIME_TYPE_LOOKUP =
-            object : MimeTypeResolver.ExtensionLookup {
-
-                override fun extensionFromMimeType(mimeType: String): String? =
-                    MimeTypeMap.getSingleton().getExtensionFromMimeType(mimeType)
-
-                override fun mimeTypeFromExtension(extension: String?): String? {
-                    if (extension == null) {
-                        return null
-                    }
-
-                    return MimeTypeMap.getSingleton().getMimeTypeFromExtension(extension)
-                }
-            }
-    }
-}
diff --git a/app/src/main/java/app/opendocument/droid/background/MimeTypeResolver.kt b/app/src/main/java/app/opendocument/droid/background/MimeTypeResolver.kt
index 0d9ec55a7d61..9ff42d15edf2 100644
--- a/app/src/main/java/app/opendocument/droid/background/MimeTypeResolver.kt
+++ b/app/src/main/java/app/opendocument/droid/background/MimeTypeResolver.kt
@@ -2,7 +2,7 @@ package app.opendocument.droid.background
 
 /**
  * Derives the final mime type / file extension pair of a document from whatever the detection steps
- * in [MetadataLoader] came up with.
+ * in [FileIdentifier] came up with.
  *
  * Deliberately free of Android dependencies so it can be covered by plain JVM unit tests; in
  * production [ExtensionLookup] is backed by `MimeTypeMap`.
diff --git a/app/src/main/java/app/opendocument/droid/background/PersistedUriPermissions.kt b/app/src/main/java/app/opendocument/droid/background/PersistedUriPermissions.kt
index 9e575b7836e4..a6149cf99f13 100644
--- a/app/src/main/java/app/opendocument/droid/background/PersistedUriPermissions.kt
+++ b/app/src/main/java/app/opendocument/droid/background/PersistedUriPermissions.kt
@@ -20,7 +20,7 @@ object PersistedUriPermissions {
     /**
      * The grants taken during this process that nothing on disk names yet.
      *
-     * A document only reaches the list once [MetadataLoader] has read it, long after [takeRead]
+     * A document only reaches the list once [DocumentLoader] has read it, long after [takeRead]
      * ran; a [prune] in that window would find nothing referring to the fresh grant and hand it
      * straight back. Empty on a fresh process, so a grant whose document never made the list is
      * reclaimed on the next launch rather than leaking for good.
diff --git a/app/src/main/java/app/opendocument/droid/background/RecentDocumentsUtil.kt b/app/src/main/java/app/opendocument/droid/background/RecentDocumentsUtil.kt
index cbc440c33e06..141aa15c739f 100644
--- a/app/src/main/java/app/opendocument/droid/background/RecentDocumentsUtil.kt
+++ b/app/src/main/java/app/opendocument/droid/background/RecentDocumentsUtil.kt
@@ -10,8 +10,8 @@ import org.json.JSONObject
  * Only the fields live here: [JsonFileStore] does the file and json handling, and the ordering and
  * capping rules are in [RecentDocumentList], which is android free and unit tested.
  *
- * Every method is synchronized: the loaders write from [LoaderService]'s background thread while
- * the landing screen reads from its own executor.
+ * Every method is synchronized: [DocumentLoader] writes from its background thread while the
+ * landing screen reads from its own executor.
  */
 object RecentDocumentsUtil {
 
@@ -48,7 +48,7 @@ object RecentDocumentsUtil {
 
         // documents copied into our own cache are reachable through the cache, not through the
         // uri we were handed, so remembering them would hand back a uri that no longer resolves
-        if (AndroidFileCache.isCached(context, uri)) {
+        if (FileCache.isCached(context, uri)) {
             return emptyList()
         }
 
diff --git a/app/src/main/java/app/opendocument/droid/background/SupportedDocumentTypes.kt b/app/src/main/java/app/opendocument/droid/background/SupportedDocumentTypes.kt
index d03c4554ac75..ca0535257989 100644
--- a/app/src/main/java/app/opendocument/droid/background/SupportedDocumentTypes.kt
+++ b/app/src/main/java/app/opendocument/droid/background/SupportedDocumentTypes.kt
@@ -15,7 +15,7 @@ import app.opendocument.core.Odr
  * against the first.
  *
  * All of it is a guess from a name and whatever mime type a provider volunteered. What decides once
- * the file is in the cache is [MetadataLoader], which asks `Odr.mimetype` about the copy, and
+ * the file is in the cache is [FileIdentifier], which asks `Odr.mimetype` about the copy, and
  * [CoreLoader.isDocumentEditable], which asks the opened document.
  */
 object SupportedDocumentTypes {
diff --git a/app/src/main/java/app/opendocument/droid/ui/activity/DocumentFragment.kt b/app/src/main/java/app/opendocument/droid/ui/activity/DocumentFragment.kt
index 2fa87072a5eb..6a43c709fafe 100644
--- a/app/src/main/java/app/opendocument/droid/ui/activity/DocumentFragment.kt
+++ b/app/src/main/java/app/opendocument/droid/ui/activity/DocumentFragment.kt
@@ -24,10 +24,11 @@ import androidx.fragment.app.Fragment
 import androidx.lifecycle.ViewModel
 import androidx.lifecycle.ViewModelProvider
 import app.opendocument.droid.R
-import app.opendocument.droid.background.AndroidFileCache
-import app.opendocument.droid.background.FileLoader
-import app.opendocument.droid.background.LoaderService
-import app.opendocument.droid.background.LoaderServiceQueue
+import app.opendocument.droid.background.DocumentLoader
+import app.opendocument.droid.background.DocumentRequest
+import app.opendocument.droid.background.FileCache
+import app.opendocument.droid.background.IdentifiedFile
+import app.opendocument.droid.background.LoadedDocument
 import app.opendocument.droid.background.StreamUtil
 import app.opendocument.droid.background.SupportedDocumentTypes
 import app.opendocument.droid.background.UsageCounters
@@ -45,7 +46,7 @@ import java.io.File
 import java.io.FileNotFoundException
 import java.io.IOException
 
-class DocumentFragment : Fragment(), LoaderService.LoaderListener {
+class DocumentFragment : Fragment(), DocumentLoader.Listener {
 
     private lateinit var analyticsManager: AnalyticsManager
 
@@ -77,11 +78,22 @@ class DocumentFragment : Fragment(), LoaderService.LoaderListener {
 
     private lateinit var tabLayout: TabLayout
 
-    private lateinit var serviceQueue: LoaderServiceQueue
+    private lateinit var documentLoader: DocumentLoader
 
     /** Survives a configuration change, so the document and any unsaved edits outlive it. */
     class DocumentViewModel : ViewModel() {
-        var lastResult: FileLoader.Result? = null
+
+        /** The last document asked for, whether or not it opened. */
+        var lastRequest: DocumentRequest? = null
+
+        /**
+         * Null until something was read, and again for a document that could not be read at all.
+         */
+        var lastFile: IdentifiedFile? = null
+
+        /** Only ever the document currently on screen. */
+        var lastDocument: LoadedDocument? = null
+
         var currentHtmlDiff: String? = null
 
         // loads cannot be canceled once running, so results of abandoned loads
@@ -193,8 +205,8 @@ class DocumentFragment : Fragment(), LoaderService.LoaderListener {
         // runs the most recently added enabled callback first
         mainActivity.onBackPressedDispatcher.addCallback(viewLifecycleOwner, actionsBackCallback)
 
-        serviceQueue = mainActivity.loaderServiceQueue
-        serviceQueue.addToQueue { service -> service.setListener(this) }
+        documentLoader = mainActivity.documentLoader
+        documentLoader.listener = this
 
         crashManager.log("onViewCreated")
 
@@ -206,32 +218,54 @@ class DocumentFragment : Fragment(), LoaderService.LoaderListener {
 
         initializePageView()
 
-        // the view model survives a rotation, the bundle also survives process death
-        if (state.lastResult == null) {
-            @Suppress("DEPRECATION") // the typed getParcelable overload needs API 33
-            state.lastResult = savedInstanceState.getParcelable(SAVED_KEY_LAST_RESULT)
-        }
-        if (state.currentHtmlDiff == null) {
-            state.currentHtmlDiff = savedInstanceState.getString(SAVED_KEY_CURRENT_HTML_DIFF)
-        }
+        restore(savedInstanceState)
 
-        state.lastResult?.let { lastResult ->
-            crashManager.log("restoring lastResult")
+        state.lastDocument?.let { lastDocument ->
+            crashManager.log("restoring lastDocument")
 
-            restoreTabs(lastResult)
-            prepareActions(lastResult)
+            restoreTabs(lastDocument)
+            prepareActions(lastDocument)
         }
+    }
+
+    /**
+     * Reads back what [onSaveInstanceState] wrote. The view model already survives a rotation; the
+     * bundle also survives process death.
+     *
+     * Guarded because it outlives an app update too: a bundle written by an older version can name
+     * classes this one no longer has, and [android.os.Bundle] reads its whole map on the first
+     * access, so one stale entry takes the rest with it. Losing the reopened document beats
+     * throwing on launch.
+     */
+    private fun restore(savedInstanceState: Bundle) {
+        try {
+            if (state.lastRequest == null) {
+                @Suppress("DEPRECATION") // the typed getParcelable overload needs API 33
+                state.lastRequest = savedInstanceState.getParcelable(SAVED_KEY_LAST_REQUEST)
+
+                @Suppress("DEPRECATION")
+                state.lastFile = savedInstanceState.getParcelable(SAVED_KEY_LAST_FILE)
+
+                @Suppress("DEPRECATION")
+                state.lastDocument = savedInstanceState.getParcelable(SAVED_KEY_LAST_DOCUMENT)
+            }
+            if (state.currentHtmlDiff == null) {
+                state.currentHtmlDiff = savedInstanceState.getString(SAVED_KEY_CURRENT_HTML_DIFF)
+            }
 
-        pageView?.restoreState(savedInstanceState)
+            pageView?.restoreState(savedInstanceState)
+        } catch (e: Throwable) {
+            crashManager.log(e)
+        }
     }
 
     /** Rebuilds the tab strip: the tabs live in the view, which the view model does not hold. */
-    private fun restoreTabs(result: FileLoader.Result) {
-        if (result.partTitles.size <= 1) {
+    private fun restoreTabs(document: LoadedDocument) {
+        if (document.partTitles.size <= 1) {
             return
         }
 
-        addTabs(result.partTitles)
+        addTabs(document.partTitles)
 
         val selected = maxOf(state.lastSelectedTab, 0)
         tabLayout.getTabAt(selected)?.select()
@@ -253,7 +287,9 @@ class DocumentFragment : Fragment(), LoaderService.LoaderListener {
 
         crashManager.log("onSaveInstanceState")
 
-        outState.putParcelable(SAVED_KEY_LAST_RESULT, state.lastResult)
+        outState.putParcelable(SAVED_KEY_LAST_REQUEST, state.lastRequest)
+        outState.putParcelable(SAVED_KEY_LAST_FILE, state.lastFile)
+        outState.putParcelable(SAVED_KEY_LAST_DOCUMENT, state.lastDocument)
         outState.putString(SAVED_KEY_CURRENT_HTML_DIFF, state.currentHtmlDiff)
 
         pageView?.saveState(outState)
@@ -268,7 +304,13 @@ class DocumentFragment : Fragment(), LoaderService.LoaderListener {
         replay()
     }
 
-    private fun loadWithType(loaderType: FileLoader.LoaderType, options: FileLoader.Options) {
+    private fun load(request: DocumentRequest) {
+        beforeLoad()
+
+        documentLoader.load(request)
+    }
+
+    private fun beforeLoad() {
         // whatever the last load had to say was about the last document. the offer to reopen is
         // indefinite, so without this it sits over the document that came after it
         SnackbarHelper.dismiss(requireActivity())
@@ -276,8 +318,6 @@ class DocumentFragment : Fragment(), LoaderService.LoaderListener {
         showProgress()
 
         state.beginLoadIdling()
-
-        serviceQueue.addToQueue { service -> service.loadWithType(loaderType, options) }
     }
 
     /**
@@ -295,28 +335,30 @@ class DocumentFragment : Fragment(), LoaderService.LoaderListener {
 
         state.lastRequestedUri = uri
 
-        val options = FileLoader.Options()
-        options.originalUri = uri
-        options.persistentUri = persistentUri
-        options.translatable = editable
-
-        loadWithType(FileLoader.LoaderType.METADATA, options)
+        load(DocumentRequest(uri, persistentUri).apply { this.editable = editable })
     }
 
-    fun reloadUri(translatable: Boolean) {
+    fun reloadUri(editable: Boolean) {
         // closeDocument() removes this fragment and only then finishes the edit mode, whose
         // onDestroyActionMode reloads - a load queued here would have nothing left to land in
         if (!isAdded) {
             return
         }
 
-        val lastResult = checkNotNull(state.lastResult) { "nothing was loaded yet" }
-        lastResult.options.translatable = translatable
+        val lastRequest = requireLastRequest()
+        lastRequest.editable = editable
 
         // entering or leaving edit mode is not a new document, and the user is working
         freshOpenPending = false
 
-        loadWithType(lastResult.loaderType, lastResult.options)
+        reload(lastRequest, requireLastFile())
+    }
+
+    /** The same document again, rendered differently - see [DocumentLoader.reload]. */
+    private fun reload(request: DocumentRequest, file: IdentifiedFile) {
+        beforeLoad()
+
+        documentLoader.reload(request, file)
     }
 
     /**
@@ -354,13 +396,14 @@ class DocumentFragment : Fragment(), LoaderService.LoaderListener {
             return
         }
 
-        // read inside the entry: the queue replays this once the service is bound
-        serviceQueue.addToQueue { service ->
-            service.saveAsync(requireLastResult(), outFile, state.currentHtmlDiff)
-        }
+        documentLoader.save(requireLastDocument(), outFile, state.currentHtmlDiff)
     }
 
     private fun unload() {
+        // nothing left to save or to switch tabs on. the request and the file stay: they are what
+        // the reopen offer raised over this works from
+        state.lastDocument = null
+
         // guarded like resetTabs below: a load can fail before there is a view to put right
         if (::actions.isInitialized) {
             actions.setActions(null, emptyList())
@@ -386,12 +429,12 @@ class DocumentFragment : Fragment(), LoaderService.LoaderListener {
      * relied on: the menu was only rebuilt when something happened to invalidate it, and a document
      * that finished loading is not one of those things.
      */
-    private fun prepareActions(result: FileLoader.Result) {
+    private fun prepareActions(document: LoadedDocument) {
         // whether editing is on offer is the core's answer, not a list of formats kept here: it
         // knows which of the documents it renders it can also write back, which is why neither the
         // legacy binary formats nor the spreadsheets of issue #442 need naming
         val edit =
-            if (!result.isEditable) null
+            if (!document.isEditable) null
             else
                 DocumentActions.Action(
                     DocumentActions.ACTION_EDIT,
@@ -471,16 +514,17 @@ class DocumentFragment : Fragment(), LoaderService.LoaderListener {
     }
 
     /**
-     * Whether [result] can be acted on now. If not, [replay] is what [onStart] runs instead - it
-     * has to be the caller's own callback, or a failure comes back as a success.
+     * Whether an outcome for [request] can be acted on now. If not, [replay] is what [onStart] runs
+     * instead - it has to be the caller's own callback, or a failure comes back as a success.
      */
-    private fun isActivityReadyForResult(
-        result: FileLoader.Result,
+    private fun isActivityReadyForOutcome(
+        request: DocumentRequest,
+        file: IdentifiedFile?,
         replay: () -> Unit,
     ): Boolean {
         val lastRequestedUri = state.lastRequestedUri
-        if (lastRequestedUri != null && lastRequestedUri != result.options.originalUri) {
-            crashManager.log("dropping result of abandoned load: " + result.options.originalUri)
+        if (lastRequestedUri != null && lastRequestedUri != request.uri) {
+            crashManager.log("dropping result of abandoned load: " + request.uri)
 
             return false
         }
@@ -491,44 +535,46 @@ class DocumentFragment : Fragment(), LoaderService.LoaderListener {
             return false
         }
 
-        // needs to be saved for errors too for features like "Open With" to work
-        state.lastResult = result
+        // needs to be kept for errors too for features like "Open With" to work
+        state.lastRequest = request
+        state.lastFile = file
 
         replayOnStart = null
 
         return true
     }
 
-    override fun onLoadSuccess(result: FileLoader.Result) {
-        if (!isActivityReadyForResult(result) { onLoadSuccess(result) }) {
+    override fun onLoadSuccess(document: LoadedDocument) {
+        if (
+            !isActivityReadyForOutcome(document.request, document.file) { onLoadSuccess(document) }
+        ) {
             return
         }
 
+        state.lastDocument = document
+
         val activity = requireActivity()
-        val options = result.options
+        val file = document.file
 
-        analyticsManager.setCurrentScreen(
-            activity,
-            result.loaderType.toString() + "_" + options.fileType,
-        )
+        analyticsManager.setCurrentScreen(activity, file.mimeType ?: UNKNOWN_FILE_TYPE)
 
         resetTabs()
 
-        val titles = result.partTitles
+        val titles = document.partTitles
         val pages = titles.size
         if (pages > 1) {
             addTabs(titles)
 
             tabLayout.getTabAt(0)?.select()
         } else if (pages == 1) {
-            loadData(result.partUris[0].toString())
+            loadData(document.partUris[0].toString())
         }
 
-        prepareActions(result)
+        prepareActions(document)
 
         // the escape hatch for a file we show rather than read: an image, an archive listing
-        if (!SupportedDocumentTypes.isDocument(options.fileType)) {
-            offerReopen(activity, options, R.string.toast_hint_unsupported_file, false)
+        if (!SupportedDocumentTypes.isDocument(file.mimeType)) {
+            offerReopen(activity, R.string.toast_hint_unsupported_file, false)
         }
 
         dismissProgress()
@@ -548,22 +594,21 @@ class DocumentFragment : Fragment(), LoaderService.LoaderListener {
         }
     }
 
-    override fun onError(result: FileLoader.Result, error: Throwable) {
-        if (!isActivityReadyForResult(result) { onError(result, error) }) {
+    override fun onError(request: DocumentRequest, file: IdentifiedFile?, error: Throwable) {
+        if (!isActivityReadyForOutcome(request, file) { onError(request, file, error) }) {
             return
         }
 
         val activity = requireActivity()
-        val options = result.options
 
         unload()
         dismissProgress()
 
         when {
             error is FileNotFoundException ->
-                offerReopen(activity, options, R.string.toast_error_find_file, true)
+                offerReopen(activity, R.string.toast_error_find_file, true)
             error is OutOfMemoryError ->
-                offerReopen(activity, options, R.string.toast_error_out_of_memory, true)
+                offerReopen(activity, R.string.toast_error_out_of_memory, true)
             // unreadable, or named and still not openable
             else -> {
                 // nothing is ever going to be shown for this file, so drop back to the
@@ -582,13 +627,12 @@ class DocumentFragment : Fragment(), LoaderService.LoaderListener {
         state.endLoadIdling()
     }
 
-    override fun onEncrypted(result: FileLoader.Result) {
-        if (!isActivityReadyForResult(result) { onEncrypted(result) }) {
+    override fun onEncrypted(request: DocumentRequest, file: IdentifiedFile) {
+        if (!isActivityReadyForOutcome(request, file) { onEncrypted(request, file) }) {
             return
         }
 
         val activity = requireActivity()
-        val options = result.options
 
         unload()
         dismissProgress()
@@ -601,16 +645,13 @@ class DocumentFragment : Fragment(), LoaderService.LoaderListener {
         builder.setView(input)
 
         builder.setPositiveButton(getString(android.R.string.ok)) { dialog, _ ->
-            options.password = input.text.toString()
+            request.password = input.text.toString()
 
             // close dialog before progress is shown again
             dialog.dismiss()
 
-            if (result.loaderType != FileLoader.LoaderType.CORE) {
-                throw RuntimeException("encryption not supported for type: " + result.loaderType)
-            }
-
-            loadWithType(FileLoader.LoaderType.CORE, options)
+            // the file is already in the cache - only the key to it was missing
+            reload(request, file)
         }
         builder.setNegativeButton(getString(android.R.string.cancel), null)
         builder.show()
@@ -619,24 +660,23 @@ class DocumentFragment : Fragment(), LoaderService.LoaderListener {
         state.endLoadIdling()
     }
 
-    override fun onUnsupported(result: FileLoader.Result) {
-        if (!isActivityReadyForResult(result) { onUnsupported(result) }) {
+    override fun onUnsupported(request: DocumentRequest, file: IdentifiedFile) {
+        if (!isActivityReadyForOutcome(request, file) { onUnsupported(request, file) }) {
             return
         }
 
         val activity = requireActivity()
-        val options = result.options
 
         unload()
         dismissProgress()
 
-        offerReopen(activity, options, R.string.toast_error_illegal_file_reopen, true)
+        offerReopen(activity, R.string.toast_error_illegal_file_reopen, true)
         giveUp(activity)
 
         state.endLoadIdling()
     }
 
-    override fun onSaveSuccess(outFile: Uri) {
+    override fun onSaveSuccess(target: Uri) {
         state.currentHtmlDiff = null
 
         SnackbarHelper.show(
@@ -647,7 +687,7 @@ class DocumentFragment : Fragment(), LoaderService.LoaderListener {
             isError = false,
         )
 
-        loadUri(outFile, true, true)
+        loadUri(target, true, true)
     }
 
     override fun onSaveError() {
@@ -738,55 +778,58 @@ class DocumentFragment : Fragment(), LoaderService.LoaderListener {
         }
     }
 
-    private fun offerReopen(
-        activity: Activity,
-        options: FileLoader.Options,
-        description: Int,
-        isIndefinite: Boolean,
-    ) {
+    private fun offerReopen(activity: Activity, description: Int, isIndefinite: Boolean) {
+        // taken here rather than when the button is tapped: the bar is about the document that
+        // raised it, and it outlives the fragment on its way over the landing screen
+        val request = requireLastRequest()
+        val file = state.lastFile
+
         analyticsManager.report(
             "reopen_offer",
             AnalyticsConstants.PARAM_CONTENT_TYPE,
-            options.fileType,
+            file?.mimeType,
             AnalyticsConstants.PARAM_CONTENT,
-            options.originalUri,
+            request.uri,
         )
 
         SnackbarHelper.show(
             activity,
             description,
-            { doReopen(options, activity, true, false) },
+            { doReopen(activity, request, file, true, false) },
             isIndefinite = isIndefinite,
             isError = false,
         )
     }
 
     fun openWith(activity: Activity) {
-        doReopen(requireLastResult().options, activity, true, false)
+        doReopen(activity, requireLastRequest(), state.lastFile, true, false)
     }
 
     fun share(activity: Activity) {
-        doReopen(requireLastResult().options, activity, true, true)
+        doReopen(activity, requireLastRequest(), state.lastFile, true, true)
     }
 
     private fun doReopen(
-        options: FileLoader.Options,
         activity: Activity,
+        request: DocumentRequest,
+        file: IdentifiedFile?,
         grantPermission: Boolean,
         share: Boolean,
     ) {
-        val fileType = options.fileType
+        val fileType = file?.mimeType
 
-        var reopenUri = options.originalUri
-        if (options.fileExists) {
-            val cacheFile = AndroidFileCache.getCacheFile(activity, checkNotNull(options.cacheUri))
-            val cacheDirectory = AndroidFileCache.getCacheDirectory(checkNotNull(cacheFile))
+        var reopenUri = request.uri
+        // having a file is having read it whole: what is handed on is our copy, under a name the
+        // receiving app can make sense of
+        if (file != null) {
+            val cacheFile = FileCache.getCacheFile(activity, file.cacheUri)
+            val cacheDirectory = FileCache.getCacheDirectory(checkNotNull(cacheFile))
 
-            val reopenFile = File(cacheDirectory, "yourdocument." + options.fileExtension)
+            val reopenFile = File(cacheDirectory, "yourdocument." + file.extension)
             try {
                 StreamUtil.copy(cacheFile, reopenFile)
 
-                reopenUri = AndroidFileCache.getCacheFileUri(activity, reopenFile)
+                reopenUri = FileCache.getCacheFileUri(activity, reopenFile)
             } catch (e: IOException) {
                 crashManager.log(e)
             }
@@ -796,7 +839,7 @@ class DocumentFragment : Fragment(), LoaderService.LoaderListener {
 
         intent.action = if (share) Intent.ACTION_SEND else Intent.ACTION_VIEW
 
-        if ("N/A" != fileType) {
+        if (fileType != null) {
             intent.setDataAndType(reopenUri, fileType)
         } else {
             intent.data = reopenUri
@@ -834,7 +877,7 @@ class DocumentFragment : Fragment(), LoaderService.LoaderListener {
 
             if (grantPermission) {
                 // if we're trying to reopen the originalUri, the provider might decline the request
-                doReopen(options, activity, false, share)
+                doReopen(activity, request, file, false, share)
             }
         }
     }
@@ -891,11 +934,11 @@ class DocumentFragment : Fragment(), LoaderService.LoaderListener {
     private val tabSelectedListener =
         object : TabLayout.OnTabSelectedListener {
             override fun onTabSelected(tab: TabLayout.Tab) {
-                val lastResult = requireLastResult()
+                val lastDocument = requireLastDocument()
 
                 // an edited document must not switch away from the page being edited,
                 // so the previous tab is re-selected instead
-                if (lastResult.options.translatable && state.lastSelectedTab >= 0) {
+                if (lastDocument.request.editable && state.lastSelectedTab >= 0) {
                     // reselecting from inside onTabSelected() does not take effect
                     tabLayout.postDelayed(
                         { tabLayout.getTabAt(state.lastSelectedTab)?.select() },
@@ -909,7 +952,7 @@ class DocumentFragment : Fragment(), LoaderService.LoaderListener {
                 // the user was looking at after the view is recreated
                 state.lastSelectedTab = tab.position
 
-                loadData(lastResult.partUris[tab.position].toString())
+                loadData(lastDocument.partUris[tab.position].toString())
             }
 
             override fun onTabUnselected(tab: TabLayout.Tab) {}
@@ -921,29 +964,40 @@ class DocumentFragment : Fragment(), LoaderService.LoaderListener {
         pageView?.loadUrl(url)
     }
 
-    private fun requireLastResult(): FileLoader.Result =
-        checkNotNull(state.lastResult) { "nothing was loaded yet" }
+    private fun requireLastRequest(): DocumentRequest =
+        checkNotNull(state.lastRequest) { "nothing was loaded yet" }
+
+    private fun requireLastFile(): IdentifiedFile =
+        checkNotNull(state.lastFile) { "nothing was read yet" }
+
+    private fun requireLastDocument(): LoadedDocument =
+        checkNotNull(state.lastDocument) { "no document is open" }
+
+    @get:VisibleForTesting
+    val lastDocument: LoadedDocument?
+        get() = state.lastDocument
 
     @get:VisibleForTesting
-    val lastResult: FileLoader.Result?
-        get() = state.lastResult
+    val lastRequest: DocumentRequest?
+        get() = state.lastRequest
 
     fun hasLastResult(): Boolean {
         // the activity can hold a freshly constructed fragment that has not been created yet
-        return ::state.isInitialized && state.lastResult != null
+        return ::state.isInitialized && state.lastRequest != null
     }
 
     /** Whether the document is in edit mode, so its changes are still only in the page. */
-    fun isEditing(): Boolean =
-        ::state.isInitialized && state.lastResult?.options?.translatable == true
+    fun isEditing(): Boolean = ::state.isInitialized && state.lastRequest?.editable == true
 
     val lastFileType: String?
-        get() = requireLastResult().options.fileType
+        get() = state.lastFile?.mimeType
 
     override fun onDestroyView() {
         super.onDestroyView()
 
-        serviceQueue.service?.setListener(null)
+        if (::documentLoader.isInitialized) {
+            documentLoader.listener = null
+        }
 
         // no callback is coming, except on a configuration change - there the recreated
         // fragment inherits both the listener and the view model
@@ -955,7 +1009,12 @@ class DocumentFragment : Fragment(), LoaderService.LoaderListener {
     }
 
     private companion object {
-        const val SAVED_KEY_LAST_RESULT = "LAST_RESULT"
+        const val SAVED_KEY_LAST_REQUEST = "LAST_REQUEST"
+        const val SAVED_KEY_LAST_FILE = "LAST_FILE"
+        const val SAVED_KEY_LAST_DOCUMENT = "LAST_DOCUMENT"
         const val SAVED_KEY_CURRENT_HTML_DIFF = "CURRENT_HTML_DIFF"
+
+        /** What the analytics screen name is when nothing could name the bytes. */
+        const val UNKNOWN_FILE_TYPE = "N/A"
     }
 }
diff --git a/app/src/main/java/app/opendocument/droid/ui/activity/MainActivity.kt b/app/src/main/java/app/opendocument/droid/ui/activity/MainActivity.kt
index d6e213eb85cd..5156776e6986 100644
--- a/app/src/main/java/app/opendocument/droid/ui/activity/MainActivity.kt
+++ b/app/src/main/java/app/opendocument/droid/ui/activity/MainActivity.kt
@@ -2,14 +2,11 @@ package app.opendocument.droid.ui.activity
 
 import android.app.Activity
 import android.content.ActivityNotFoundException
-import android.content.ComponentName
 import android.content.Intent
-import android.content.ServiceConnection
 import android.content.res.Configuration
 import android.net.Uri
 import android.os.Bundle
 import android.os.Handler
-import android.os.IBinder
 import android.os.Looper
 import android.view.ActionMode
 import android.view.View
@@ -23,10 +20,10 @@ import androidx.core.view.ViewCompat
 import androidx.core.view.WindowCompat
 import androidx.core.view.WindowInsetsCompat
 import androidx.core.view.WindowInsetsControllerCompat
+import androidx.lifecycle.ViewModelProvider
 import app.opendocument.droid.R
 import app.opendocument.droid.background.CatchAllSetting
-import app.opendocument.droid.background.LoaderService
-import app.opendocument.droid.background.LoaderServiceQueue
+import app.opendocument.droid.background.DocumentLoader
 import app.opendocument.droid.background.PersistedUriPermissions
 import app.opendocument.droid.background.PrintingManager
 import app.opendocument.droid.background.SupportedDocumentTypes
@@ -123,36 +120,12 @@ class MainActivity : AppCompatActivity() {
     // the user opening the app
     private var leftForOwnActivity = false
 
-    lateinit var loaderServiceQueue: LoaderServiceQueue
-        private set
-
-    private var service: LoaderService? = null
-
     /**
-     * Whether [bindService] was called. Not the same as holding a [service]: the binder arrives
-     * asynchronously, and an activity destroyed before it does still has to unbind.
+     * Loads and saves the open document. Scoped to the activity, so it survives a configuration
+     * change and [DocumentFragment] finds it already there rather than waiting for a binding.
      */
-    private var isBound = false
-
-    private val connection =
-        object : ServiceConnection {
-            override fun onServiceDisconnected(name: ComponentName?) {
-                service?.setListener(null)
-
-                service = null
-
-                // the queue holds its own reference, and handing work to a service whose
-                // background thread has quit drops it without telling anyone
-                loaderServiceQueue.service = null
-            }
-
-            override fun onServiceConnected(name: ComponentName?, binder: IBinder) {
-                val service = (binder as LoaderService.LoaderBinder).getService()
-                this@MainActivity.service = service
-
-                loaderServiceQueue.service = service
-            }
-        }
+    lateinit var documentLoader: DocumentLoader
+        private set
 
     // ACTION_OPEN_DOCUMENT, dispatched to a file manager the user picked
     private val openDocumentLauncher =
@@ -196,9 +169,8 @@ class MainActivity : AppCompatActivity() {
 
         onBackPressedDispatcher.addCallback(this, backCallback)
 
-        loaderServiceQueue = LoaderServiceQueue()
-        bindService(Intent(this, LoaderService::class.java), connection, BIND_AUTO_CREATE)
-        isBound = true
+        // before the fragments below: a restored DocumentFragment reaches for it in onViewCreated
+        documentLoader = ViewModelProvider(this)[DocumentLoader::class.java]
 
         handler = Handler(Looper.getMainLooper())
 
@@ -868,11 +840,6 @@ class MainActivity : AppCompatActivity() {
         // engine down when the mode is destroyed
         currentActionMode?.finish()
 
-        if (isBound) {
-            unbindService(connection)
-            isBound = false
-        }
-
         printingManager.close()
 
         adManager.destroyAds()
diff --git a/app/src/main/java/app/opendocument/droid/ui/widget/PageView.kt b/app/src/main/java/app/opendocument/droid/ui/widget/PageView.kt
index ce6954053d30..f021947c92db 100644
--- a/app/src/main/java/app/opendocument/droid/ui/widget/PageView.kt
+++ b/app/src/main/java/app/opendocument/droid/ui/widget/PageView.kt
@@ -18,7 +18,7 @@ import android.webkit.WebViewClient
 import androidx.annotation.Keep
 import androidx.webkit.WebSettingsCompat
 import androidx.webkit.WebViewFeature
-import app.opendocument.droid.background.AndroidFileCache
+import app.opendocument.droid.background.FileCache
 import app.opendocument.droid.background.StreamUtil
 import app.opendocument.droid.nonfree.CrashManager
 import app.opendocument.droid.ui.ParagraphListener
@@ -238,7 +238,7 @@ constructor(context: Context, attributeSet: AttributeSet?) :
     @Keep
     fun sendFile(base64: String) {
         try {
-            val tmpFile = AndroidFileCache.createCacheFile(context)
+            val tmpFile = FileCache.createCacheFile(context)
 
             ByteArrayInputStream(base64.toByteArray(charset(StreamUtil.ENCODING))).use { inputStream
                 ->
@@ -248,7 +248,7 @@ constructor(context: Context, attributeSet: AttributeSet?) :
             post {
                 // the user is mid-read, not opening something
                 documentFragment.loadUri(
-                    AndroidFileCache.getCacheFileUri(context, tmpFile),
+                    FileCache.getCacheFileUri(context, tmpFile),
                     false,
                     freshOpen = false,
                 )
diff --git a/app/src/test/java/app/opendocument/droid/background/LoaderTypeTest.kt b/app/src/test/java/app/opendocument/droid/background/LoaderTypeTest.kt
deleted file mode 100644
index 01791bd290fb..000000000000
--- a/app/src/test/java/app/opendocument/droid/background/LoaderTypeTest.kt
+++ /dev/null
@@ -1,28 +0,0 @@
-package app.opendocument.droid.background
-
-import app.opendocument.droid.background.FileLoader.LoaderType
-import org.junit.Assert.assertEquals
-import org.junit.Test
-
-/** A saved [FileLoader.Result] can name a loader this version does not have. */
-class LoaderTypeTest {
-
-    @Test
-    fun aNameThisVersionStillHasIsItself() {
-        assertEquals(LoaderType.CORE, LoaderType.ofParcelled("CORE"))
-        assertEquals(LoaderType.METADATA, LoaderType.ofParcelled("METADATA"))
-    }
-
-    @Test
-    fun aRetiredLoaderReadsAsTheCore() {
-        assertEquals(LoaderType.CORE, LoaderType.ofParcelled("RAW"))
-        assertEquals(LoaderType.CORE, LoaderType.ofParcelled("ONLINE"))
-    }
-
-    @Test
-    fun nothingAtAllReadsAsTheCore() {
-        assertEquals(LoaderType.CORE, LoaderType.ofParcelled(null))
-        assertEquals(LoaderType.CORE, LoaderType.ofParcelled(""))
-        assertEquals(LoaderType.CORE, LoaderType.ofParcelled("core"))
-    }
-}
diff --git a/tools/render-sweep/README.md b/tools/render-sweep/README.md
index 0f6d23037355..8d1694ef0b90 100644
--- a/tools/render-sweep/README.md
+++ b/tools/render-sweep/README.md
@@ -94,7 +94,7 @@ site, in more detail:
   into internal storage via `run-as` is the route that works, and it is why this needs the
   debug build rather than the store one.
 - **The intent carries no mime type.** That leaves the app's own detection (`Odr.mimetype`, run
-  by `MetadataLoader`) in the path instead of taking a caller's word for the type, which is the
+  by `FileIdentifier`) in the path instead of taking a caller's word for the type, which is the
   half of the app worth exercising.
 - **`uiautomator dump` runs twice per document.** A WebView only builds its accessibility
   tree once something asks for one, so the first dump after a load has no text in it and the
diff --git a/tools/render-sweep/render-sweep.sh b/tools/render-sweep/render-sweep.sh
index bad0743343d2..71b512305394 100755
--- a/tools/render-sweep/render-sweep.sh
+++ b/tools/render-sweep/render-sweep.sh
@@ -126,7 +126,7 @@ while IFS= read -r rel <&3; do
   "$ADB" shell "run-as $PKG sh -c 'cat > files/sweep/doc.$ext'" < "$src" >/dev/null 2>&1
 
   # No -t: leaving the mime type off puts the app's own detection (Odr.mimetype, via
-  # MetadataLoader) in the path instead of taking the caller's word for it.
+  # FileIdentifier) in the path instead of taking the caller's word for it.
   launch=$("$ADB" shell am start -W -a android.intent.action.VIEW \
       -d "file:///data/data/$PKG/files/sweep/doc.$ext" \
       -n "$PKG/$ALIAS_SUFFIX" 2>&1 | grep -E '^Status:' | head -1 | awk '{print $2}')