diff --git a/.changeset/blossom-upload.md b/.changeset/blossom-upload.md
new file mode 100644
index 0000000..038b28e
--- /dev/null
+++ b/.changeset/blossom-upload.md
@@ -0,0 +1,5 @@
+---
+"@kernlize/core": minor
+---
+
+Applets can upload files (NAP-UPLOAD) through Blossom. `kernl.files` follows the account's file-server list (kind 10063) with well-known defaults. `createBlossomUploader` uses `blossom-client-sdk` to upload to the first server and mirror to the rest, succeeds when any server stores the file, and asks the person before each file leaves with a new `public` consent severity. The shell offers the `upload` domain.
diff --git a/DECISIONS.md b/DECISIONS.md
index e8f1cec..488f046 100644
--- a/DECISIONS.md
+++ b/DECISIONS.md
@@ -479,3 +479,18 @@ NZB, Soulseek and mail stay hand-off. Running them inside kernl needs something
 **Consequences.** Each docs page exists twice in the artifact (37 pages today), with the same canonical address. The copy at `/docs/<page>/`, with the trailing slash, loads, but relative links inside it resolve one level too deep; nothing links to that form, and the gate scans the original so it does not report the copy. A pull request can be blocked by an outbound page that was removed since the last run; the fix is to update or drop the link. The live check runs after the deploy, so it reports a bad deploy rather than preventing one; the response is the rollback in D-019. If bunny.net later offers extension fallback or an Edge Script provides it, the copies become unnecessary but stay harmless.
 
 **Reversal cost.** Low. Removing the copies is one call in `build-pages.mjs`; the gate and `servedFile` are independent of how clean URLs are provided, and a host with different rules changes only `pages-host.mjs`.
+
+## D-033 · Applets upload through the shell to the account's own file servers, with Blossom's own client, and the person is asked before each file leaves
+
+**Context.** Sixteen published applets require `upload` (NAP-UPLOAD), and the shell did not offer it. kehto ships the upload service and a reference HTTP uploader that sends a file to one server. Blossom, the file-server protocol most clients use, has a client SDK by its author that uploads to one server, mirrors to the others, checks first whether a server already holds the file, and handles the protocol's rejection and payment answers. BUD-03 gives every account a published list of its file servers (kind 10063).
+
+**Decision.**
+
+- **The wire is kehto's, the transfer is Blossom's.** `createUploadService` answers applets. Behind it, `createBlossomUploader` uses `blossom-client-sdk`'s `multiServerUpload`: the file goes to the first server and is mirrored to the rest. An upload is a success when any server stores it, and the result lists every copy (D-028). When none does it fails with `unavailable:not-accepted:0/<n>`.
+- **The account decides where files go.** `kernl.files` follows the account's kind 10063 list and waits for the lookup to finish before falling back to `DEFAULT_FILE_SERVERS` (blossom.primal.net, nostr.download, blossom.band, which answered an upload preflight when chosen). An applet may not name a server. Settings shows the list and publishes changes to the account's outboxes and the lookup servers.
+- **Every file is asked about.** Before anything is signed or sent, the person sees "Upload a file", marked `public`, with the file's name and type, its size, the servers it goes to, and "Anyone who has its address". The prompt appears once per file. One authorization (kind 24242) is then signed and covers every server. A read-only session is refused with `denied:read-only`, and an applet the shell cannot name is refused without asking.
+- `ConsentSummary.severity` gains `public` for writes that put something where anyone can fetch it.
+
+**Consequences.** Applets that need uploads now run, and their files land where the account's other clients look for them. A file the person allowed is public for good: Blossom has no private uploads, so the prompt says so.
+
+**Reversal cost.** Low. The uploader is one module behind kehto's `Uploader` interface, so a host can pass its own.
diff --git a/apps/web/features/preview-kernl.feature b/apps/web/features/preview-kernl.feature
index afee5ee..18bcd6b 100644
--- a/apps/web/features/preview-kernl.feature
+++ b/apps/web/features/preview-kernl.feature
@@ -260,6 +260,11 @@ Feature: The preview kernl
     When the preview kernl saves inbox "" and outbox ""
     Then the preview kernl save was accepted by 0 servers
 
+  Scenario: the preview's uploads go to the default file servers until it saves its own
+    Then the preview kernl file servers are the defaults
+    When the preview kernl saves file servers "https://mine.test/"
+    Then the preview kernl uploads go to "https://mine.test/"
+
   Scenario: the preview's tiers can be replaced at once
     When the preview kernl sets the "outbox" tier to "wss://a.test,wss://a.test"
     Then the preview kernl "outbox" tier is "wss://a.test"
diff --git a/apps/web/features/steps/kernl.ts b/apps/web/features/steps/kernl.ts
index 396c5ce..08c3b9a 100644
--- a/apps/web/features/steps/kernl.ts
+++ b/apps/web/features/steps/kernl.ts
@@ -3,7 +3,7 @@ import { firstValueFrom, type Observable } from 'rxjs';
 import { Given, Then, When } from 'quickpickle';
 import type { IAccount } from 'applesauce-accounts';
 import { PrivateKeyAccount, ReadonlyAccount } from 'applesauce-accounts/accounts';
-import { BASELINE_DOMAINS } from '@kernlize/core';
+import { BASELINE_DOMAINS, DEFAULT_FILE_SERVERS } from '@kernlize/core';
 import { MemoryStorage } from '../../../../packages/core/features/steps/world.ts';
 import { abbreviate, type AppletHandle, type AppletPointer, type AppletSummary, type ConsentPrompt, type FrameLike, type HandlerPrompt, type KernlHost, type MountPlan, type ShellKernl } from '../../src/shell/contract.ts';
 import { PREVIEW_PUBLISHER, sampleSummary } from '../../src/shell/preview-applet.ts';
@@ -569,3 +569,17 @@ Then('the preview kernl {string} tier is {string}', (world: PreviewWorld, tier:
 Then('the preview kernl refuses to set the {string} tier to {string}', (world: PreviewWorld, tier: 'outbox', urls: string) => {
   expect(() => preview(world).kernl.relays.set(tier, list(urls))).toThrow('invalid:url');
 });
+
+Then('the preview kernl file servers are the defaults', async (world: PreviewWorld) => {
+  expect(preview(world).kernl.files.state()).toEqual({ status: 'missing', servers: DEFAULT_FILE_SERVERS });
+  expect(await preview(world).kernl.files.current()).toEqual(DEFAULT_FILE_SERVERS);
+});
+
+When('the preview kernl saves file servers {string}', async (world: PreviewWorld, servers: string) => {
+  expect(await preview(world).kernl.files.save(list(servers))).toMatchObject({ ok: true });
+});
+
+Then('the preview kernl uploads go to {string}', async (world: PreviewWorld, servers: string) => {
+  expect(await preview(world).kernl.files.current()).toEqual(list(servers));
+  expect(preview(world).kernl.files.state()).toMatchObject({ status: 'found', servers: list(servers) });
+});
diff --git a/apps/web/src/shell/ConsentDialog.svelte b/apps/web/src/shell/ConsentDialog.svelte
index ab75060..f76cbe5 100644
--- a/apps/web/src/shell/ConsentDialog.svelte
+++ b/apps/web/src/shell/ConsentDialog.svelte
@@ -32,6 +32,7 @@
       <span class="shell-badge">{shortId(summary.applet.hash)}</span>
       {appletTitle} wants to
       {#if summary.severity === 'destructive'}<span class="shell-badge warn">destructive</span>{/if}
+      {#if summary.severity === 'public'}<span class="shell-badge warn">public</span>{/if}
     </p>
     <h2 id="consent-title">{summary.title}</h2>
     <dl id="consent-lines" class="lines">
diff --git a/apps/web/src/shell/FileServerSettings.svelte b/apps/web/src/shell/FileServerSettings.svelte
new file mode 100644
index 0000000..16a9623
--- /dev/null
+++ b/apps/web/src/shell/FileServerSettings.svelte
@@ -0,0 +1,123 @@
+<script lang="ts">
+  import type { FileServerState } from '@kernlize/core';
+  import type { ShellKernl } from './contract';
+  import { observe } from './observe.svelte';
+  import { serverLabel } from './servers';
+
+  interface Props {
+    kernl: ShellKernl;
+  }
+
+  const { kernl }: Props = $props();
+
+  const published = observe<FileServerState>(kernl.files.state$, kernl.files.state());
+  $effect(() => published.stop);
+  const session = observe(kernl.session$, kernl.session);
+  $effect(() => session.stop);
+
+  let edited = $state.raw<readonly string[] | undefined>(undefined);
+  let typed = $state('');
+  let error = $state<string | null>(null);
+  let saved = $state<string | null>(null);
+  let saving = $state(false);
+
+  const current = $derived(edited ?? (published.value.status === 'loading' ? undefined : published.value.servers));
+  const readOnly = $derived(session.value?.readOnly !== false);
+  // A name that would say the protocol's name is replaced by the list's own (D-006).
+  const nameOf = (url: string, index: number): string => serverLabel(new URL(url).hostname, 'File', index);
+
+  function add(): void {
+    error = null;
+    saved = null;
+    const input = typed.trim();
+    let url: string;
+    try {
+      url = new URL(/^https?:\/\//i.test(input) ? input : `https://${input}`).origin + '/';
+    } catch {
+      error = 'Enter a file server address such as blossom.primal.net.';
+      return;
+    }
+    if (!url.includes('.')) {
+      error = 'Enter a file server address such as blossom.primal.net.';
+      return;
+    }
+    edited = [...new Set([...(current ?? []), url])];
+    typed = '';
+  }
+
+  function remove(url: string): void {
+    saved = null;
+    edited = (current ?? []).filter((entry) => entry !== url);
+  }
+
+  async function save(): Promise<void> {
+    if (!current) return;
+    saving = true;
+    error = null;
+    try {
+      const { describeOutcome } = await import('@kernlize/core');
+      const outcome = await kernl.files.save(current);
+      saved = describeOutcome(outcome);
+      if (outcome.ok) edited = undefined;
+    } catch {
+      error = 'The list could not be signed. Check that your signer is open, then try again.';
+    } finally {
+      saving = false;
+    }
+  }
+</script>
+
+<section class="shell-section" aria-labelledby="file-servers-heading">
+  <h3 id="file-servers-heading">File servers</h3>
+  <p class="shell-muted small">Where pictures and files you upload through an applet are kept. The first gets each file and the others keep copies. You are asked before every upload.</p>
+  {#if !current}
+    <p class="shell-muted" role="status">Looking for your file servers…</p>
+  {:else}
+    {#if published.value.status === 'missing' && !edited}<p class="small" role="status">This account has not chosen file servers yet, so these well-known ones are used.</p>{/if}
+    <ul class="shell-list urls" aria-label="File servers">
+      {#each current as url, index (url)}
+        {@const name = nameOf(url, index)}
+        <li data-address={url}>
+          <span class="server">{name}{index === 0 ? ' (first)' : ''}</span>
+          {#if !readOnly}<button type="button" class="shell-button quiet" onclick={() => remove(url)} aria-label="Remove {name} from file servers">Remove</button>{/if}
+        </li>
+      {:else}
+        <li class="shell-muted">None. Uploads are refused until you add one.</li>
+      {/each}
+    </ul>
+    {#if !readOnly}
+      <form class="add" onsubmit={(event) => (event.preventDefault(), add())}>
+        <label class="shell-field"><span>Add a file server</span><input class="shell-input mono" type="text" inputmode="url" autocomplete="off" spellcheck="false" bind:value={typed} placeholder="blossom.primal.net" /></label>
+        <button type="submit" class="shell-button" disabled={!typed.trim()}>Add</button>
+      </form>
+      <div class="shell-actions">
+        <button type="button" class="shell-button primary" onclick={save} disabled={saving || edited === undefined}>{saving ? 'Publishing…' : 'Publish file servers'}</button>
+      </div>
+    {/if}
+  {/if}
+  {#if saved}<p class="small" role="status">{saved}</p>{/if}
+  {#if error}<p class="shell-error" role="alert">{error}</p>{/if}
+</section>
+
+<style>
+  .small {
+    font-size: 0.85rem;
+    margin: 0;
+  }
+
+  .urls li {
+    display: flex;
+    justify-content: space-between;
+    align-items: center;
+    gap: 0.5rem;
+    font-size: 0.85rem;
+    max-width: none;
+  }
+
+  .add {
+    display: grid;
+    grid-template-columns: 1fr auto;
+    align-items: end;
+    gap: 0.5rem;
+  }
+</style>
diff --git a/apps/web/src/shell/SettingsPanel.svelte b/apps/web/src/shell/SettingsPanel.svelte
index fb658ef..25a7bf1 100644
--- a/apps/web/src/shell/SettingsPanel.svelte
+++ b/apps/web/src/shell/SettingsPanel.svelte
@@ -5,6 +5,7 @@
   import type { BootMode, RelayTier, ShellKernl } from './contract';
   import type { DownloadMode, ShellDownloads } from './downloads';
   import { toggleTheme } from '../lib/theme';
+  import FileServerSettings from './FileServerSettings.svelte';
   import MailboxSettings from './MailboxSettings.svelte';
   import MessagingSettings from './MessagingSettings.svelte';
   import { observe } from './observe.svelte';
@@ -56,6 +57,7 @@
 
 <Overlay title="Settings" {onclose} wide>
   <MailboxSettings {kernl} {mode} />
+  <FileServerSettings {kernl} />
   <section class="shell-section">
     <h3>How the shell finds things</h3>
     <p class="shell-muted small">Servers the shell itself asks, on your behalf; applets never connect to anything. Your own posts go to your outbox first.</p>
diff --git a/apps/web/src/shell/preview-kernl.ts b/apps/web/src/shell/preview-kernl.ts
index 8356471..9a7de35 100644
--- a/apps/web/src/shell/preview-kernl.ts
+++ b/apps/web/src/shell/preview-kernl.ts
@@ -46,7 +46,7 @@ import { createPreviewBuiltins } from './preview-builtin';
 import { PORT_DOMAINS, createPreviewPorts, type PortLike, type PreviewPorts } from './preview-port';
 import { createPreviewIntents, type PreviewIntentDeps, type PreviewIntents } from './preview-intents';
 import { createPreviewMessaging, PREVIEW_CORRESPONDENT, PREVIEW_LEGACY_CORRESPONDENT } from './preview-messaging';
-import { createPreviewDirectory, createPreviewMailboxes } from './preview-mailboxes';
+import { createPreviewDirectory, createPreviewFileServers, createPreviewMailboxes } from './preview-mailboxes';
 import { createPreviewProfiles } from './preview-profiles';
 import type { ShellTheme } from './shell-theme';
 import { baselineDomains, createPreviewGrants, createPreviewRelays, loadBaselineDomains } from './preview-state';
@@ -413,6 +413,7 @@ export function createPreviewKernl(host: KernlHost, torrent?: TorrentBackend, op
     catalog: { load: async () => PREVIEW_CATALOG, stream: () => of(PREVIEW_CATALOG) },
     profiles,
     mailboxes: createPreviewMailboxes(),
+    files: createPreviewFileServers(),
     directory: createPreviewDirectory(),
     intents: intents.intents,
     session$,
diff --git a/apps/web/src/shell/preview-mailboxes.ts b/apps/web/src/shell/preview-mailboxes.ts
index 8f24fbf..bf068e5 100644
--- a/apps/web/src/shell/preview-mailboxes.ts
+++ b/apps/web/src/shell/preview-mailboxes.ts
@@ -1,5 +1,5 @@
 import { BehaviorSubject, EMPTY } from 'rxjs';
-import { createRelayDirectory, DEFAULT_SUGGESTIONS, type AccountMailboxes, type MailboxState, type RelayDirectory } from '@kernlize/core';
+import { createRelayDirectory, DEFAULT_FILE_SERVERS, DEFAULT_SUGGESTIONS, type AccountFileServers, type AccountMailboxes, type FileServerState, type MailboxState, type RelayDirectory } from '@kernlize/core';
 
 /** The preview's directory hears from no monitor, so it suggests from kernl's built-in list and completes nothing. */
 export function createPreviewDirectory(): RelayDirectory {
@@ -23,3 +23,19 @@ export function createPreviewMailboxes(): AccountMailboxes {
     },
   };
 }
+
+/** The preview account's file servers: the defaults until it saves its own, kept in the page. */
+export function createPreviewFileServers(): AccountFileServers {
+  let current: readonly string[] = DEFAULT_FILE_SERVERS;
+  const state$ = new BehaviorSubject<FileServerState>({ status: 'missing', servers: current });
+  return {
+    state$: state$.asObservable(),
+    state: () => state$.value,
+    current: async () => current,
+    async save(servers) {
+      current = [...servers];
+      state$.next({ status: 'found', servers: [...servers], event: { kind: 10063, tags: [], content: '', created_at: 0, pubkey: '', id: '', sig: '' } });
+      return { accepted: ['preview'], refused: [], ok: true };
+    },
+  };
+}
diff --git a/docs/packages/core.md b/docs/packages/core.md
index 9f59b7b..ccaf881 100644
--- a/docs/packages/core.md
+++ b/docs/packages/core.md
@@ -97,6 +97,7 @@ The host is the only way the core reaches the user or the page. Applets never re
 | `guard: GuardFacade` | `config`, `profile$`, `setProfile(profile)`, `events$`, `mitigations()`, `release(windowId)`. `setProfile` rebuilds kernl's guard layers shell-wide; held window-level messages are dropped and counters restart. Open windows keep the runtime firewall rates they were mounted with. It is not persisted. |
 | `grants: Grants` | The user-facing grants surface, see [Grants](#grants). |
 | `relays: RelayTiers` | `get()`, `add(tier, url)`, `remove(tier, url)`, `set(tier, urls)`, `changes$`. `add` and `set` throw `invalid:relay-url` for anything that is not `ws://` or `wss://`; `set` with an unchanged list emits nothing. |
+| `files: AccountFileServers` | Where the account's uploads go; the `upload` domain is offered and every upload is asked about (D-033). |
 | `mailboxes: AccountMailboxes` | The signed-in account's published inbox and outbox (kind 10002, D-029). While a list is `found`, the `outbox` tier follows its outboxes, so every publish goes where the account says it writes. `save` signs with the active account and refuses `denied:read-only` for a read-only or signed-out session. |
 | `directory: RelayDirectory` | Monitored servers (kind 30166) from `DEFAULT_MONITOR_RELAYS`, idle until `start()`; `search` completes an address and `suggest` proposes servers. Settings starts it while open. |
 | `messaging`, `bridges` | The registries the services read. |
@@ -522,6 +523,10 @@ Signatures are abbreviated; the generated reference has the full ones.
 | `publishAccepted` | `(pool: ApplesaucePool, relays: string[], event: NostrEvent) => Promise<number>` | Publishes everywhere and resolves with how many accepted; throws `unavailable:not-accepted:0/<n>` only when none did (D-028). |
 | `lookupRelaysOf` | `(config) => string[]` | Where an unhinted replaceable is looked up: `discovery`, then `super`. |
 | `createProfiles` | `(options: ProfilesOptions) => Profiles` | `card$(pubkey)` streams a `ProfileCard` (name, `https:` picture, address, about, `found`) and starts a lookup on the lookup relays, then on the author's own write relays when their relay list names servers the lookup relays lacked. Nothing times out; a late profile replaces the short key. `card(pubkey)` reads the store only. `settled(pubkey)` resolves once the profile is found or every lookup server has answered, never on a timer. |
+| `createAccountFileServers` | `(options: AccountFileServersOptions) => AccountFileServers` | The account's file servers (BUD-03, kind 10063): `state$`, `state()` (`loading`, `missing` with the defaults, `found`), `current()` (waits only while the list is looked up), `save(servers) => Promise<PublishOutcome>` (publishes to the outboxes and lookup servers; `denied:read-only`, `invalid:server-url`). `kernl.files` is one (D-033). |
+| `DEFAULT_FILE_SERVERS`, `fileServersFromEvent`, `fileServerTags` | constant and helpers | The fallback servers, the servers a list names in order, and the tags of a new list with every other tag kept. |
+| `createBlossomUploader` | `(options: BlossomUploaderOptions) => Uploader` | kehto's `Uploader` over `blossom-client-sdk`: asks `ask(windowId, details)` once per file before anything is signed or sent, signs one authorization, uploads to the first server and mirrors to the rest; success when any server stores it, with every copy in `fallbackUrls` and NIP-94 tags. Refusals: `denied:read-only`, `denied:consent` (cancelled), `unavailable:no-file-server`, `unavailable:not-accepted:0/<n>`. `transfer` is injectable. |
+| `describeUpload`, `askUploadConsent`, `sizeWords` | helpers | The `public` consent summary for an upload, the host prompt that refuses an unnamed applet without asking, and sizes in words. |
 | `labelConversations` | `(adapter: DmAdapter, profiles: Pick<Profiles, 'settled'>) => DmAdapter` | Names every conversation participant the `dm` domain lists from their profile; a provider's own label is kept, and a person with no profile keeps none. `createKernlServices` applies it when given `profiles`, so messaging applets show names without looking anyone up. |
 | `toProfileCard` | `(pubkey: string, event: NostrEvent \| undefined) => ProfileCard` | Display name, then name, then the abbreviated key. |
 | `createDmRelayPool` | `(pool: ApplesaucePool, tiers: RelayTiers) => DmRelayPool` | For messaging backends. |
diff --git a/packages/core/features/file-uploads.feature b/packages/core/features/file-uploads.feature
new file mode 100644
index 0000000..ea624da
--- /dev/null
+++ b/packages/core/features/file-uploads.feature
@@ -0,0 +1,107 @@
+Feature: Uploading files
+  Applets upload through the shell (NAP-UPLOAD). The shell decides where a file
+  goes: the account's published file-server list (BUD-03, kind 10063), or
+  well-known servers while it has none. The person is asked once per file,
+  with what it is, its size and where it goes, before anything is signed or
+  sent. The file is uploaded to the first server and mirrored to the others
+  with the Blossom client SDK; any server that stores it makes the upload a
+  success (D-028, D-033).
+
+  Scenario: a file-server list reads in order, and a new one keeps its other tags
+    Then the file servers of a list naming "https://cdn.one.test,https://two.test/,https://cdn.one.test/" are "https://cdn.one.test/,https://two.test/"
+    And a list with no event names no file servers
+    And new file-server tags for "blossom.primal.net,https://two.test" over a list with a "client" tag are "server https://blossom.primal.net/|server https://two.test/|client kernl"
+    And new file-server tags for "not a server" are refused with "invalid:server-url"
+
+  Scenario: the account's servers are its published list, or the defaults once the lookup has answered
+    Given a file-server service for a signed-in account
+    Then the file servers are "loading"
+    When an upload asks for its servers while the list is being looked up
+    And the file-server lookup answers with nothing
+    Then the servers it was given are the defaults
+    Then the file servers are "missing" using the defaults
+    And the servers an upload uses are the defaults
+    When the account's list naming "https://mine.test" arrives
+    Then the file servers are "found" using "https://mine.test/"
+    And the servers an upload uses are "https://mine.test/"
+
+  Scenario: a lookup that fails leaves the defaults
+    Given a file-server service for a signed-in account
+    When the file-server lookup fails
+    Then the file servers are "missing" using the defaults
+
+  Scenario: with nobody signed in the defaults stand, and saving is refused
+    Given a file-server service with nobody signed in
+    Then the file servers are "missing" using the defaults
+    When the account saves file servers "https://mine.test"
+    Then the shell refused with "denied:read-only"
+
+  Scenario: saving publishes to the outboxes and lookup servers, and two of three is a success
+    Given a file-server service for a signed-in account
+    And "wss://lookup.test" refuses the file-server list
+    When the account saves file servers "https://mine.test,https://second.test"
+    Then the file-server save was accepted by "wss://out.test/,wss://out2.test/" and refused by "wss://lookup.test/"
+    And the file servers are "found" using "https://mine.test/,https://second.test/"
+    Given every server refuses the file-server list
+    When the account saves file servers "https://third.test"
+    Then the file-server save was accepted by nobody
+    And the file servers are "found" using "https://mine.test/,https://second.test/"
+
+  Scenario: a file-server list nobody can be sent is still a failure, not an error
+    Given a file-server service for a signed-in account
+    And publishing fails outright
+    When the account saves file servers "https://mine.test"
+    Then the file-server save was accepted by nobody
+
+  Scenario: the person is asked what, how big and where, and nothing is signed or sent without a yes
+    Given an uploader over "https://one.test/,https://two.test/" where the person says "no"
+    When an applet uploads a 2048-byte "image/png" file named "cat.png"
+    Then the upload was "cancelled" with "denied:consent"
+    And the person was asked about "cat.png, image/png", "2.0 KB" going to "one.test, two.test"
+    And nothing was signed or sent
+
+  Scenario: an allowed upload is signed once, stored on the first server, mirrored, and lists every copy
+    Given an uploader over "https://one.test/,https://two.test/" where the person says "yes"
+    When an applet uploads a 10-byte "text/plain" file
+    Then the upload is complete at "https://one.test/" with a copy at "https://two.test/"
+    And the authorization was signed 1 times
+    And the upload's file tags carry its address, hash, type and size
+
+  Scenario: a copy on one of two servers is a success; none is a failure that says how many were tried
+    Given an uploader over "https://one.test/,https://two.test/" where the person says "yes"
+    And "https://one.test/" refuses the file
+    When an applet uploads a 10-byte "text/plain" file
+    Then the upload is complete at "https://two.test/" with no copies
+    Given every file server refuses the file
+    When an applet uploads a 10-byte "text/plain" file
+    Then the upload was "failed" with "unavailable:not-accepted:0/2"
+    Given the transfer breaks
+    When an applet uploads a 10-byte "text/plain" file
+    Then the upload was "failed" with "unavailable:not-accepted:0/2"
+
+  Scenario: raw bytes without a type, a read-only session, and no servers at all
+    Given an uploader over "https://one.test/" where the person says "yes"
+    When an applet uploads 4 raw bytes without a type
+    Then the person was asked about "application/octet-stream", "4 bytes" going to "one.test"
+    Given the uploader has no signer
+    When an applet uploads a 10-byte "text/plain" file
+    Then the upload was "failed" with "denied:read-only"
+    Given an uploader over "" where the person says "yes"
+    When an applet uploads a 10-byte "text/plain" file
+    Then the upload was "failed" with "unavailable:no-file-server"
+
+  Scenario Outline: sizes read the way a person reads them
+    Then <bytes> bytes read "<words>"
+
+    Examples:
+      | bytes      | words     |
+      | 1          | 1 byte    |
+      | 512        | 512 bytes |
+      | 1536       | 1.5 KB    |
+      | 3355443    | 3.2 MB    |
+      | 5368709120 | 5.0 GB    |
+      | 5497558138880 | 5120.0 GB |
+
+  Scenario: the prompt goes through the host, and an applet the shell cannot name is refused unasked
+    Then asking the host about an upload from a known applet presents "Upload a file" marked "public"
+    And asking the host about an upload from an unknown applet answers no without asking
diff --git a/packages/core/features/kernl.feature b/packages/core/features/kernl.feature
index 51863f9..969ca3b 100644
--- a/packages/core/features/kernl.feature
+++ b/packages/core/features/kernl.feature
@@ -160,6 +160,23 @@ Feature: The composed shell
     And the shell saves the account's inbox and outbox as "wss://own.test"
     Then the shell's last save was accepted by "wss://own.test/"
 
+  Scenario: an applet granted uploads asks the person before a file leaves, and a no cancels it
+    Given a kernl shell over that host and pool
+    Then the shell offers the "upload" domain
+    When the shell logs in with a password account named "alice"
+    And the shell resolves the manifest address
+    And the shell allows "upload" for the resolved applet
+    And the shell plans the summary
+    And the shell mounts the plan into a fake frame
+    And the applet sends its hello through the shell
+    And the applet asks "shell.ready" over its port
+    And the applet uploads an 8-byte "image/png" file over its port
+    Then the shell asks the person "Upload a file" marked "public", sending it to "blossom.primal.net, nostr.download, blossom.band"
+    When the person answers no to the upload
+    Then the applet is told its upload was "cancelled" with "denied:consent"
+    When the shell saves the account's file servers as "https://mine.test"
+    Then the shell's file servers are "https://mine.test/"
+
   Scenario: an applet is resolved, planned and mounted
     Given a kernl shell over that host and pool
     When the shell resolves the manifest address
diff --git a/packages/core/features/steps/catalog.ts b/packages/core/features/steps/catalog.ts
index f49d8c7..1e74c0c 100644
--- a/packages/core/features/steps/catalog.ts
+++ b/packages/core/features/steps/catalog.ts
@@ -279,7 +279,7 @@ Given('the fake pool streams catalogue manifests {string} seen on {string}, then
         at += 1;
         if (event) observer.next(event);
         else observer.error(new Error('relay closed'));
-      }, 5);
+      }, 25);
       return () => clearInterval(timer);
     })) as typeof pool.request;
 });
diff --git a/packages/core/features/steps/dm-labels.ts b/packages/core/features/steps/dm-labels.ts
index 2e54d95..f7989c6 100644
--- a/packages/core/features/steps/dm-labels.ts
+++ b/packages/core/features/steps/dm-labels.ts
@@ -19,7 +19,7 @@ function participant(spec: string): { pubkey: string; label?: string } {
 }
 
 Given('a conversation adapter listing a conversation with {string}', (world: CoreWorld, specs: string) => {
-  const conversation = { id: 'c1', kind: 'direct', participants: splitList(specs).map(participant) } as unknown as DmConversation;
+  const conversation: DmConversation = { id: 'c1', kind: 'direct', participants: splitList(specs).map(participant), unread: 0 };
   const adapter: DmAdapter = {
     status: () => ({ available: true }) as never,
     conversations: async () => ({ conversations: [conversation] }) as DmConversationPage,
diff --git a/packages/core/features/steps/file-uploads.ts b/packages/core/features/steps/file-uploads.ts
new file mode 100644
index 0000000..df36310
--- /dev/null
+++ b/packages/core/features/steps/file-uploads.ts
@@ -0,0 +1,293 @@
+import { expect } from 'vitest';
+import { Given, Then, When } from 'quickpickle';
+import { Subject, type Observable } from 'rxjs';
+import { EventStore } from 'applesauce-core';
+import { PrivateKeySigner } from 'applesauce-signers';
+import type { BlobDescriptor } from 'blossom-client-sdk';
+import type { UploadResult, UploadStatus } from '@kehto/services';
+import type { NostrEvent } from '@napplet/core';
+import {
+  askUploadConsent,
+  createAccountFileServers,
+  createBlossomUploader,
+  DEFAULT_FILE_SERVERS,
+  fileServersFromEvent,
+  fileServerTags,
+  sizeWords,
+  type AccountFileServers,
+  type ConsentPrompt,
+  type MultiServerUpload,
+  type PublishOutcome,
+  type UploadDetails,
+} from '@kernlize/core';
+import { attempt, scratch, splitList, type CoreWorld } from './world.js';
+
+interface UploadScratch {
+  files?: AccountFileServers;
+  feed?: Subject<NostrEvent>;
+  store?: EventStore;
+  signer?: PrivateKeySigner;
+  refusing: Set<string>;
+  refuseAll: boolean;
+  publishBreaks: boolean;
+  saved?: PublishOutcome;
+  servers: string[];
+  allow: boolean;
+  noSigner: boolean;
+  asked: UploadDetails[];
+  signed: number;
+  sent: number;
+  storing: Set<string> | 'all';
+  breaks: boolean;
+  result?: UploadResult;
+}
+
+const u = (world: CoreWorld): UploadScratch => {
+  const state = scratch(world);
+  state.uploads ??= { refusing: new Set(), refuseAll: false, publishBreaks: false, servers: [], allow: true, noSigner: false, asked: [], signed: 0, sent: 0, storing: 'all', breaks: false } satisfies UploadScratch;
+  return state.uploads as UploadScratch;
+};
+
+const IDENTITY = { dTag: 'gallery', hash: 'ab'.repeat(32) };
+
+async function fileServers(world: CoreWorld, signedIn: boolean): Promise<void> {
+  const state = u(world);
+  const store = new EventStore();
+  const signer = new PrivateKeySigner();
+  const feed = new Subject<NostrEvent>();
+  const pubkey = await signer.getPublicKey();
+  state.store = store;
+  state.signer = signer;
+  state.feed = feed;
+  const pubkey$ = new Subject<string | undefined>();
+  state.files = createAccountFileServers({
+    store,
+    pool: {
+      publish: async (relays) => {
+        if (state.publishBreaks) throw new Error('network down');
+        return (relays as string[]).map((from) => ({ from, ok: !state.refuseAll && !state.refusing.has(from), message: 'blocked' }));
+      },
+    } as never,
+    load: () => feed as Observable<NostrEvent>,
+    pubkey$,
+    pubkey: () => (signedIn ? pubkey : undefined),
+    lookupRelays: () => ['wss://lookup.test'],
+    outboxes: () => ['wss://out.test', 'wss://out2.test'],
+    signer: () => (signedIn ? signer : undefined),
+  });
+  pubkey$.next(signedIn ? pubkey : undefined);
+}
+
+Then('the file servers of a list naming {string} are {string}', (_world: CoreWorld, named: string, expected: string) => {
+  const event = { kind: 10063, tags: splitList(named).map((url) => ['server', url]) } as NostrEvent;
+  expect(fileServersFromEvent(event)).toEqual(splitList(expected));
+});
+
+Then('a list with no event names no file servers', () => {
+  expect(fileServersFromEvent(undefined)).toEqual([]);
+});
+
+Then('new file-server tags for {string} over a list with a {string} tag are {string}', (_world: CoreWorld, servers: string, tag: string, expected: string) => {
+  const previous = { tags: [['server', 'wss-free.test'], [tag, 'kernl']] } as NostrEvent;
+  expect(fileServerTags(splitList(servers), previous).map((entry) => entry.join(' '))).toEqual(expected.split('|'));
+});
+
+Then('new file-server tags for {string} are refused with {string}', (_world: CoreWorld, servers: string, reason: string) => {
+  expect(() => fileServerTags(splitList(servers))).toThrow(reason);
+});
+
+Given('a file-server service for a signed-in account', (world: CoreWorld) => fileServers(world, true));
+Given('a file-server service with nobody signed in', (world: CoreWorld) => fileServers(world, false));
+
+When('the file-server lookup answers with nothing', (world: CoreWorld) => {
+  u(world).feed?.complete();
+});
+
+When("the account's list naming {string} arrives", async (world: CoreWorld, servers: string) => {
+  const state = u(world);
+  const event = await state.signer?.signEvent({ kind: 10063, created_at: 1_700_000_000, tags: splitList(servers).map((url) => ['server', url]), content: '' });
+  state.store?.add(event as NostrEvent);
+});
+
+Then('the file servers are {string}', (world: CoreWorld, status: string) => {
+  expect(u(world).files?.state().status).toBe(status);
+});
+
+Then('the file servers are {string} using the defaults', (world: CoreWorld, status: string) => {
+  expect(u(world).files?.state()).toEqual({ status, servers: DEFAULT_FILE_SERVERS });
+});
+
+Then('the file servers are {string} using {string}', (world: CoreWorld, status: string, servers: string) => {
+  expect(u(world).files?.state()).toMatchObject({ status, servers: splitList(servers) });
+});
+
+Then('the servers an upload uses are the defaults', async (world: CoreWorld) => {
+  expect(await u(world).files?.current()).toEqual(DEFAULT_FILE_SERVERS);
+});
+
+Then('the servers an upload uses are {string}', async (world: CoreWorld, servers: string) => {
+  expect(await u(world).files?.current()).toEqual(splitList(servers));
+});
+
+Given('{string} refuses the file-server list', (world: CoreWorld, relay: string) => {
+  u(world).refusing.add(relay);
+});
+
+Given('every server refuses the file-server list', (world: CoreWorld) => {
+  u(world).refuseAll = true;
+});
+
+Given('publishing fails outright', (world: CoreWorld) => {
+  u(world).publishBreaks = true;
+});
+
+When('the account saves file servers {string}', async (world: CoreWorld, servers: string) => {
+  await attempt(world, async () => {
+    u(world).saved = await u(world).files?.save(splitList(servers));
+  });
+});
+
+Then('the file-server save was accepted by {string} and refused by {string}', (world: CoreWorld, accepted: string, refused: string) => {
+  expect(u(world).saved).toMatchObject({ ok: true, accepted: splitList(accepted) });
+  expect(u(world).saved?.refused.map((entry) => entry.url)).toEqual(splitList(refused));
+});
+
+Then('the file-server save was accepted by nobody', (world: CoreWorld) => {
+  expect(u(world).saved).toMatchObject({ ok: false, accepted: [] });
+});
+
+function transfer(world: CoreWorld): MultiServerUpload {
+  return async (servers, blob, options) => {
+    const state = u(world);
+    if (state.breaks) throw new Error('network down');
+    const stored = new Map<string, BlobDescriptor>();
+    for (const server of servers) {
+      await options.onAuth(server, 'cd'.repeat(32), 'upload');
+      state.sent += 1;
+      if (state.storing !== 'all' && !state.storing.has(server)) {
+        options.onError(server, 'cd'.repeat(32), blob, new Error('rejected'));
+        continue;
+      }
+      stored.set(server, { url: `${server}${'cd'.repeat(32)}`, sha256: 'cd'.repeat(32), size: blob.size, uploaded: 1, ...(server.includes('two') ? {} : { type: blob.type || undefined }) } as BlobDescriptor);
+      options.onUpload(server);
+    }
+    return stored;
+  };
+}
+
+Given('an uploader over {string} where the person says {string}', (world: CoreWorld, servers: string, answer: string) => {
+  const state = u(world);
+  state.servers = splitList(servers);
+  state.allow = answer === 'yes';
+  state.noSigner = false;
+  state.signer = new PrivateKeySigner();
+});
+
+Given('{string} refuses the file', (world: CoreWorld, server: string) => {
+  u(world).storing = new Set(u(world).servers.filter((entry) => entry !== server));
+});
+
+Given('every file server refuses the file', (world: CoreWorld) => {
+  u(world).storing = new Set();
+});
+
+Given('the transfer breaks', (world: CoreWorld) => {
+  u(world).breaks = true;
+});
+
+Given('the uploader has no signer', (world: CoreWorld) => {
+  u(world).noSigner = true;
+});
+
+async function upload(world: CoreWorld, data: Blob | ArrayBuffer, extra: { mimeType?: string; filename?: string } = {}): Promise<void> {
+  const state = u(world);
+  const signer = state.signer as PrivateKeySigner;
+  const uploader = createBlossomUploader({
+    servers: async () => state.servers,
+    signer: () => (state.noSigner ? undefined : { signEvent: (draft) => ((state.signed += 1), signer.signEvent(draft)) }),
+    ask: async (_windowId, details) => (state.asked.push(details), state.allow),
+    transfer: transfer(world),
+  });
+  const statuses: UploadStatus[] = [];
+  state.result = await uploader.upload({ data, ...extra }, { uploadId: 'u1', windowId: 'w1', onStatus: (status) => statuses.push(status) });
+}
+
+When('an applet uploads a {int}-byte {string} file named {string}', (world: CoreWorld, size: number, type: string, filename: string) =>
+  upload(world, new Blob([new Uint8Array(size)], { type }), { filename }),
+);
+
+When('an applet uploads a {int}-byte {string} file', (world: CoreWorld, size: number, type: string) => upload(world, new Blob([new Uint8Array(size)], { type })));
+
+When('an applet uploads {int} raw bytes without a type', (world: CoreWorld, size: number) => upload(world, new Uint8Array(size).buffer));
+
+Then('the upload was {string} with {string}', (world: CoreWorld, status: string, error: string) => {
+  expect(u(world).result).toMatchObject({ ok: false, status, error, rail: 'blossom' });
+});
+
+Then('the person was asked about {string}, {string} going to {string}', (world: CoreWorld, file: string, size: string, hosts: string) => {
+  const details = u(world).asked.at(-1) as UploadDetails;
+  const summary = askedSummary(details);
+  expect(summary.lines.map((line) => line.after)).toEqual([file, size, hosts, 'Anyone who has its address']);
+});
+
+function askedSummary(details: UploadDetails) {
+  let presented: ConsentPrompt | undefined;
+  void askUploadConsent({ presentConsent: (prompt) => void (presented = prompt) }, IDENTITY, details);
+  return (presented as ConsentPrompt).summary;
+}
+
+Then('nothing was signed or sent', (world: CoreWorld) => {
+  expect(u(world).signed).toBe(0);
+  expect(u(world).sent).toBe(0);
+});
+
+Then('the upload is complete at {string} with a copy at {string}', (world: CoreWorld, first: string, copy: string) => {
+  expect(u(world).result).toMatchObject({ ok: true, status: 'complete', url: `${first}${'cd'.repeat(32)}`, fallbackUrls: [`${copy}${'cd'.repeat(32)}`], sha256: 'cd'.repeat(32), size: 10, mimeType: 'text/plain' });
+});
+
+Then('the upload is complete at {string} with no copies', (world: CoreWorld, first: string) => {
+  expect(u(world).result).toMatchObject({ ok: true, url: `${first}${'cd'.repeat(32)}`, mimeType: 'text/plain' });
+  expect(u(world).result?.fallbackUrls).toBeUndefined();
+});
+
+Then('the authorization was signed {int} times', (world: CoreWorld, count: number) => {
+  expect(u(world).signed).toBe(count);
+});
+
+Then("the upload's file tags carry its address, hash, type and size", (world: CoreWorld) => {
+  const tags = u(world).result?.nip94 ?? [];
+  expect(tags.map((tag) => tag[0])).toEqual(['url', 'x', 'm', 'size', 'fallback']);
+  expect(tags.find((tag) => tag[0] === 'size')?.[1]).toBe('10');
+});
+
+Then('{int} bytes read {string}', (_world: CoreWorld, bytes: number, words: string) => {
+  expect(sizeWords(bytes)).toBe(words);
+});
+
+Then('asking the host about an upload from a known applet presents {string} marked {string}', async (_world: CoreWorld, title: string, severity: string) => {
+  const details: UploadDetails = { mimeType: 'image/png', size: 1, sha256: 'cd'.repeat(32), servers: ['https://one.test/'] };
+  let presented: ConsentPrompt | undefined;
+  const answer = askUploadConsent({ presentConsent: (prompt) => void (presented = prompt) }, IDENTITY, details);
+  expect(presented?.summary).toMatchObject({ title, severity, applet: IDENTITY, event: { kind: 24242, tags: [['t', 'upload'], ['x', 'cd'.repeat(32)]] } });
+  presented?.resolve(true);
+  expect(await answer).toBe(true);
+});
+
+Then('asking the host about an upload from an unknown applet answers no without asking', async () => {
+  let asked = false;
+  const details: UploadDetails = { mimeType: 'image/png', size: 1, sha256: 'cd'.repeat(32), servers: [] };
+  expect(await askUploadConsent({ presentConsent: () => void (asked = true) }, undefined, details)).toBe(false);
+  expect(asked).toBe(false);
+});
+
+When('an upload asks for its servers while the list is being looked up', (world: CoreWorld) => {
+  scratch(world).askedServers = u(world).files?.current();
+});
+
+Then('the servers it was given are the defaults', async (world: CoreWorld) => {
+  expect(await (scratch(world).askedServers as Promise<readonly string[]>)).toEqual(DEFAULT_FILE_SERVERS);
+});
+
+When('the file-server lookup fails', (world: CoreWorld) => {
+  u(world).feed?.error(new Error('relays down'));
+});
diff --git a/packages/core/features/steps/index.ts b/packages/core/features/steps/index.ts
index ba83992..80ebf44 100644
--- a/packages/core/features/steps/index.ts
+++ b/packages/core/features/steps/index.ts
@@ -37,3 +37,4 @@ import './event-cache-sqlite.js';
 import './shell-event-cache.js';
 import './kernl-network.js';
 import './dm-labels.js';
+import './file-uploads.js';
diff --git a/packages/core/features/steps/kernl-network.ts b/packages/core/features/steps/kernl-network.ts
index 2b36bc0..ce4f104 100644
--- a/packages/core/features/steps/kernl-network.ts
+++ b/packages/core/features/steps/kernl-network.ts
@@ -1,9 +1,9 @@
-import { expect } from 'vitest';
+import { expect, vi } from 'vitest';
 import { Given, Then, When } from 'quickpickle';
 import { ReadonlyAccount } from 'applesauce-accounts/accounts';
 import { PrivateKeySigner } from 'applesauce-signers';
 import type { RelayTier } from '@kernlize/core';
-import { k } from './kernl.js';
+import { k, settle } from './kernl.js';
 import { attempt, scratch, splitList, type CoreWorld } from './world.js';
 
 Given('the fake pool serves a profile named {string} for a fresh key', async (world: CoreWorld, name: string) => {
@@ -52,3 +52,33 @@ Then("the shell's last save was accepted by {string}", (world: CoreWorld, urls:
   expect(scratch(world).mailboxSave).toMatchObject({ ok: true, refused: [] });
   expect((scratch(world).mailboxSave as { accepted: string[] }).accepted).toEqual(expect.arrayContaining(splitList(urls)));
 });
+
+When('the applet uploads an {int}-byte {string} file over its port', async (world: CoreWorld, size: number, mimeType: string) => {
+  k(world).channel?.port1.postMessage({ type: 'upload.upload', id: 'upload-1', request: { data: new Uint8Array(size).buffer, mimeType } });
+  await vi.waitFor(() => expect(k(world).record.prompts.length).toBeGreaterThan(0), { timeout: 3000 });
+});
+
+Then('the shell asks the person {string} marked {string}, sending it to {string}', (world: CoreWorld, title: string, severity: string, hosts: string) => {
+  const summary = k(world).record.prompts.at(-1)?.summary;
+  expect(summary).toMatchObject({ title, severity });
+  expect(summary?.lines.find((line) => line.label === 'Sent to')?.after).toBe(hosts);
+});
+
+When('the person answers no to the upload', async (world: CoreWorld) => {
+  k(world).record.prompts.at(-1)?.resolve(false);
+  await settle();
+});
+
+Then('the applet is told its upload was {string} with {string}', async (world: CoreWorld, status: string, error: string) => {
+  await vi.waitFor(() => expect(k(world).received.some((message) => message.type === 'upload.upload.result')).toBe(true), { timeout: 3000 });
+  const reply = k(world).received.find((message) => message.type === 'upload.upload.result') as { result?: { status: string; error: string } };
+  expect(reply.result).toMatchObject({ status, error });
+});
+
+When("the shell saves the account's file servers as {string}", async (world: CoreWorld, servers: string) => {
+  await k(world).kernl.files.save(splitList(servers));
+});
+
+Then("the shell's file servers are {string}", (world: CoreWorld, servers: string) => {
+  expect(k(world).kernl.files.state()).toMatchObject({ status: 'found', servers: splitList(servers) });
+});
diff --git a/packages/core/features/steps/services.ts b/packages/core/features/steps/services.ts
index 07689ef..eee015f 100644
--- a/packages/core/features/steps/services.ts
+++ b/packages/core/features/steps/services.ts
@@ -243,6 +243,8 @@ Then('the adapter creates no windows, has no worker relay, forwards no hotkeys a
   const a = adapter(world);
   expect(a.windowManager.createWindow({ title: 'x', class: 'y' })).toBeNull();
   expect(a.workerRelay.getWorkerRelay()).toBeNull();
+  // Without an upload service there is no upload backend, so kehto does not offer the domain.
+  expect(a.upload?.getUploader()).toBe(a.services?.upload ? { rails: ['blossom'] } : null);
   expect(a.hotkeys.executeHotkeyFromForward({ key: 'a', code: 'KeyA', ctrlKey: false, altKey: false, shiftKey: false, metaKey: false })).toBeUndefined();
   expect(a.config.getNappUpdateBehavior()).toBe('banner');
   expect(a.auth.getUserPubkey()).toBeNull();
diff --git a/packages/core/package.json b/packages/core/package.json
index 3dd2508..c723034 100644
--- a/packages/core/package.json
+++ b/packages/core/package.json
@@ -59,6 +59,7 @@
     "applesauce-relay": "^7.0.0",
     "applesauce-signers": "^7.0.1",
     "applesauce-sqlite": "^7.0.0",
+    "blossom-client-sdk": "5.1.0",
     "nostr-double-ratchet": "^0.0.183",
     "rxjs": "^7.8.2"
   },
diff --git a/packages/core/src/files/file-servers.ts b/packages/core/src/files/file-servers.ts
new file mode 100644
index 0000000..ced6f04
--- /dev/null
+++ b/packages/core/src/files/file-servers.ts
@@ -0,0 +1,143 @@
+import { BehaviorSubject, catchError, EMPTY, endWith, firstValueFrom, ignoreElements, map, of, switchMap, type Observable } from 'rxjs';
+import type { EventStore } from 'applesauce-core';
+import { unixNow } from 'applesauce-core/helpers';
+import { BLOSSOM_SERVER_LIST_KIND, getBlossomServersFromList, normalizeBlossomServer } from 'applesauce-common/helpers';
+import type { ISigner } from 'applesauce-signers';
+import type { NostrEvent } from '@napplet/core';
+import type { ApplesaucePool } from '../applesauce/relay-hooks.js';
+import { summarizePublish, type PublishOutcome } from '../relays/publish-outcome.js';
+import type { ProfilePointer } from '../profiles/profiles.js';
+
+/**
+ * File servers to use when the account has not published its own list: public
+ * Blossom servers that answered an upload preflight when this was chosen.
+ *
+ * @example
+ * ```ts
+ * DEFAULT_FILE_SERVERS[0]; // 'https://blossom.primal.net/'
+ * ```
+ */
+export const DEFAULT_FILE_SERVERS: readonly string[] = Object.freeze(['https://blossom.primal.net/', 'https://nostr.download/', 'https://blossom.band/']);
+
+/** Where the account's files go: its published list (BUD-03, kind 10063), or the defaults while it has none. */
+export type FileServerState =
+  | { readonly status: 'loading' }
+  | { readonly status: 'missing'; readonly servers: readonly string[] }
+  | { readonly status: 'found'; readonly servers: readonly string[]; readonly event: NostrEvent };
+
+/** The signed-in account's file servers. */
+export interface AccountFileServers {
+  readonly state$: Observable<FileServerState>;
+  state(): FileServerState;
+  /** The servers an upload goes to now: the published list once it is known, else the defaults. Waits only while the list is being looked up. */
+  current(): Promise<readonly string[]>;
+  /** Publish a new list. Rejects with `denied:read-only` or `invalid:server-url`. */
+  save(servers: readonly string[]): Promise<PublishOutcome>;
+}
+
+/** Options for {@link createAccountFileServers}. */
+export interface AccountFileServersOptions {
+  readonly store: EventStore;
+  readonly pool: Pick<ApplesaucePool, 'publish'>;
+  /** Loads a replaceable event into the store and completes when the servers asked have answered. */
+  readonly load: (pointer: ProfilePointer) => Observable<NostrEvent>;
+  readonly pubkey$: Observable<string | undefined>;
+  readonly pubkey: () => string | undefined;
+  /** Where the list is looked up, and published to besides the account's outboxes. */
+  readonly lookupRelays: () => readonly string[];
+  /** Where the account publishes. */
+  readonly outboxes: () => readonly string[];
+  readonly signer: () => Pick<ISigner, 'signEvent'> | undefined;
+  /** The servers used when no list is published; {@link DEFAULT_FILE_SERVERS} by default. */
+  readonly defaults?: readonly string[];
+}
+
+/**
+ * The servers a file-server list names, in its order, as root URLs.
+ *
+ * @param event - A kind 10063 list, or nothing.
+ * @returns Server URLs, deduplicated.
+ * @example
+ * ```ts
+ * fileServersFromEvent(list); // ['https://blossom.primal.net/']
+ * ```
+ */
+export function fileServersFromEvent(event: NostrEvent | undefined): readonly string[] {
+  return event ? [...new Set(getBlossomServersFromList(event).map((url) => url.href))] : [];
+}
+
+/**
+ * The tags of a new file-server list: one `server` tag per server, in order,
+ * with every other tag of the previous list kept.
+ *
+ * @param servers - Server URLs or hostnames.
+ * @param previous - The list being replaced.
+ * @returns Tags for a kind 10063 event. Throws `invalid:server-url` for something that is not a server.
+ * @example
+ * ```ts
+ * fileServerTags(['blossom.primal.net']); // [['server', 'https://blossom.primal.net/']]
+ * ```
+ */
+export function fileServerTags(servers: readonly string[], previous?: NostrEvent): string[][] {
+  const urls = servers.map((server) => {
+    try {
+      return normalizeBlossomServer(server).href;
+    } catch {
+      throw new Error('invalid:server-url');
+    }
+  });
+  const kept = (previous?.tags ?? []).filter((tag) => tag[0] !== 'server');
+  return [...[...new Set(urls)].map((url) => ['server', url]), ...kept];
+}
+
+function stateFor(options: AccountFileServersOptions, pubkey: string | undefined): Observable<FileServerState> {
+  const defaults = options.defaults ?? DEFAULT_FILE_SERVERS;
+  if (pubkey === undefined) return of({ status: 'missing', servers: defaults });
+  // The list is looked up until every server asked has answered; only then do the defaults stand in.
+  const answered = options.load({ kind: BLOSSOM_SERVER_LIST_KIND, pubkey, relays: [...options.lookupRelays()] }).pipe(catchError(() => EMPTY), ignoreElements(), endWith(true));
+  return options.store.replaceable(BLOSSOM_SERVER_LIST_KIND, pubkey).pipe(
+    switchMap((event) => {
+      if (event) return of<FileServerState>({ status: 'found', servers: fileServersFromEvent(event), event });
+      return answered.pipe(map((): FileServerState => ({ status: 'missing', servers: defaults })));
+    }),
+  );
+}
+
+/**
+ * Follow the active account's file-server list (BUD-03) and save a new one.
+ *
+ * Uploads go to these servers in order: the first gets the file, the rest
+ * mirror it. An account with no published list uses the defaults. Saving signs
+ * the list and publishes it to the account's outboxes and the lookup servers;
+ * it succeeds when any of them accepts it (D-028).
+ *
+ * @param options - Store, pool, loader, account, servers and signer.
+ * @returns The account's file servers.
+ * @example
+ * ```ts
+ * const files = createAccountFileServers({ store, pool, load, pubkey$, pubkey, lookupRelays, outboxes, signer });
+ * await files.current(); // ['https://blossom.primal.net/', …]
+ * ```
+ */
+export function createAccountFileServers(options: AccountFileServersOptions): AccountFileServers {
+  const state$ = new BehaviorSubject<FileServerState>({ status: 'loading' });
+  options.pubkey$.pipe(switchMap((pubkey) => stateFor(options, pubkey))).subscribe((state) => state$.next(state));
+  return {
+    state$: state$.asObservable(),
+    state: () => state$.value,
+    current: () => firstValueFrom(state$.pipe(switchMap((state) => (state.status === 'loading' ? EMPTY : of(state.servers))))),
+    async save(servers) {
+      const signer = options.signer();
+      const pubkey = options.pubkey();
+      if (!signer || !pubkey) throw new Error('denied:read-only');
+      const previous = options.store.getReplaceable(BLOSSOM_SERVER_LIST_KIND, pubkey);
+      const tags = fileServerTags(servers, previous);
+      const created_at = Math.max(unixNow(), (previous?.created_at ?? 0) + 1);
+      const event = await signer.signEvent({ kind: BLOSSOM_SERVER_LIST_KIND, created_at, tags, content: previous?.content ?? '' });
+      const relays = [...new Set([...options.outboxes(), ...options.lookupRelays()])];
+      const outcome = await options.pool.publish(relays, event).then(summarizePublish, () => summarizePublish(relays.map((from) => ({ ok: false, from, message: 'publish failed' }))));
+      if (outcome.ok) options.store.add(event);
+      return outcome;
+    },
+  };
+}
diff --git a/packages/core/src/files/uploader.ts b/packages/core/src/files/uploader.ts
new file mode 100644
index 0000000..9217597
--- /dev/null
+++ b/packages/core/src/files/uploader.ts
@@ -0,0 +1,184 @@
+import { Actions, computeBlobSha256, createUploadAuth, type BlobDescriptor, type SignedEvent } from 'blossom-client-sdk';
+import type { Uploader, UploadRequest, UploadResult } from '@kehto/services';
+import type { ISigner } from 'applesauce-signers';
+import type { NostrEvent } from '@napplet/core';
+import type { AppletIdentity, ConsentSummary, KernlHost } from '../types.js';
+
+/** What the person is asked about before a file leaves for a server. */
+export interface UploadDetails {
+  readonly filename?: string;
+  readonly mimeType: string;
+  readonly size: number;
+  readonly sha256: string;
+  readonly servers: readonly string[];
+}
+
+/** Uploads to several servers, the first first and the rest as mirrors; hzrd149's `multiServerUpload` fits. */
+export type MultiServerUpload = (
+  servers: readonly string[],
+  blob: Blob,
+  options: {
+    onAuth: (server: string, sha256: string, type: 'upload' | 'media') => Promise<SignedEvent>;
+    onUpload: (server: string) => void;
+    onError: (server: string, sha256: string, blob: Blob, error: Error) => void;
+  },
+) => Promise<Map<string, BlobDescriptor>>;
+
+/** Options for {@link createBlossomUploader}. */
+export interface BlossomUploaderOptions {
+  /** The servers this upload goes to, in order. */
+  readonly servers: () => Promise<readonly string[]>;
+  readonly signer: () => Pick<ISigner, 'signEvent'> | undefined;
+  /** Asks the person; resolves true only when they allow it. Called once per upload, before anything is signed or sent. */
+  readonly ask: (windowId: string, details: UploadDetails) => Promise<boolean>;
+  /** The transfer; hzrd149's `Actions.multiServerUpload` by default. */
+  readonly transfer?: MultiServerUpload;
+}
+
+const KIB = 1024;
+
+/**
+ * A size as a person reads it.
+ *
+ * @param bytes - A byte count.
+ * @returns `512 bytes`, `1.5 KB`, `3.2 MB`.
+ * @example
+ * ```ts
+ * sizeWords(1_572_864); // '1.5 MB'
+ * ```
+ */
+export function sizeWords(bytes: number): string {
+  if (bytes < KIB) return `${bytes} ${bytes === 1 ? 'byte' : 'bytes'}`;
+  const units = ['KB', 'MB', 'GB'];
+  let value = bytes / KIB;
+  let unit = 0;
+  while (value >= KIB && unit < units.length - 1) {
+    value /= KIB;
+    unit += 1;
+  }
+  return `${value.toFixed(1)} ${units[unit]}`;
+}
+
+/**
+ * The consent prompt for an upload: what leaves, how big it is, where it goes
+ * and who can then fetch it. A file on a public server can be fetched by
+ * anyone who has its address, so the prompt says so plainly.
+ *
+ * @param details - The file and its servers.
+ * @param applet - The applet asking.
+ * @returns The summary the host renders.
+ * @example
+ * ```ts
+ * describeUpload({ mimeType: 'image/png', size: 2048, sha256, servers }, identity).title; // 'Upload a file'
+ * ```
+ */
+export function describeUpload(details: UploadDetails, applet: AppletIdentity): ConsentSummary {
+  const hosts = details.servers.map((server) => new URL(server).hostname);
+  const draft: NostrEvent = {
+    kind: 24242,
+    content: 'Upload a file',
+    tags: [['t', 'upload'], ['x', details.sha256]],
+    created_at: 0,
+    pubkey: '',
+    id: '',
+    sig: '',
+  };
+  return {
+    title: 'Upload a file',
+    severity: 'public',
+    lines: [
+      { label: 'File', after: `${details.filename ? `${details.filename}, ` : ''}${details.mimeType}` },
+      { label: 'Size', after: sizeWords(details.size) },
+      { label: 'Sent to', after: hosts.join(', ') },
+      { label: 'Who can see it', after: 'Anyone who has its address' },
+    ],
+    applet,
+    event: draft,
+  };
+}
+
+/**
+ * Put an upload to the person through the host's consent prompt. An applet the
+ * shell cannot name is refused without asking.
+ *
+ * @param host - Supplies `presentConsent`.
+ * @param applet - The asking applet's identity, if the shell knows it.
+ * @param details - The file and its servers.
+ * @returns Whether the person allowed it.
+ * @example
+ * ```ts
+ * ask: (windowId, details) => askUploadConsent(host, identityOf(windowId), details);
+ * ```
+ */
+export function askUploadConsent(host: Pick<KernlHost, 'presentConsent'>, applet: AppletIdentity | undefined, details: UploadDetails): Promise<boolean> {
+  if (!applet) return Promise.resolve(false);
+  return new Promise((resolve) => host.presentConsent({ summary: describeUpload(details, applet), resolve }));
+}
+
+const asBlob = (request: UploadRequest): Blob => (request.data instanceof Blob ? request.data : new Blob([request.data], request.mimeType ? { type: request.mimeType } : {}));
+
+function failed(uploadId: string, error: string, status: 'failed' | 'cancelled' = 'failed'): UploadResult {
+  return { ok: false, uploadId, status, rail: 'blossom', error };
+}
+
+function completed(uploadId: string, stored: readonly BlobDescriptor[], mimeType: string): UploadResult {
+  const [first, ...rest] = stored as [BlobDescriptor, ...BlobDescriptor[]];
+  const type = first.type ?? mimeType;
+  return {
+    ok: true,
+    uploadId,
+    status: 'complete',
+    rail: 'blossom',
+    url: first.url,
+    ...(rest.length ? { fallbackUrls: rest.map((descriptor) => descriptor.url) } : {}),
+    sha256: first.sha256,
+    size: first.size,
+    mimeType: type,
+    nip94: [['url', first.url], ['x', first.sha256], ['m', type], ['size', String(first.size)], ...rest.map((descriptor) => ['fallback', descriptor.url])],
+  };
+}
+
+/**
+ * kernl's upload backend for kehto's `createUploadService`: Blossom over
+ * hzrd149's client SDK. The file goes to the account's first file server and
+ * is mirrored to the others; any server that stores it makes the upload a
+ * success, and the result names every copy (D-028). The person is asked first,
+ * once per file, with what it is, its size and where it goes; nothing is signed
+ * or sent unless they allow it. A read-only session cannot upload. An applet
+ * never chooses the servers (D-033).
+ *
+ * @param options - Servers, signer, the consent question and an optional transfer for tests.
+ * @returns An `Uploader`.
+ * @example
+ * ```ts
+ * registry.upload = createUploadService({ uploader: createBlossomUploader({ servers: files.current, signer, ask }) });
+ * ```
+ */
+export function createBlossomUploader(options: BlossomUploaderOptions): Uploader {
+  const transfer: MultiServerUpload = options.transfer ?? Actions.multiServerUpload;
+  return {
+    async upload(request, ctx) {
+      const signer = options.signer();
+      if (!signer) return failed(ctx.uploadId, 'denied:read-only');
+      const blob = asBlob(request);
+      const servers = await options.servers();
+      if (servers.length === 0) return failed(ctx.uploadId, 'unavailable:no-file-server');
+      const sha256 = await computeBlobSha256(blob);
+      const mimeType = blob.type || 'application/octet-stream';
+      const details: UploadDetails = { mimeType, size: blob.size, sha256, servers, ...(request.filename ? { filename: request.filename } : {}) };
+      if (!(await options.ask(ctx.windowId, details))) return failed(ctx.uploadId, 'denied:consent', 'cancelled');
+      let auth: Promise<SignedEvent> | undefined;
+      const signEvent = (draft: Parameters<ISigner['signEvent']>[0]): Promise<SignedEvent> => signer.signEvent(draft) as Promise<SignedEvent>;
+      const stored = await transfer(servers, blob, {
+        // One authorization covers the file on every server, so the signer is asked once.
+        onAuth: (_server, hash) => (auth ??= createUploadAuth(signEvent, hash)),
+        onUpload: () => {
+          ctx.onStatus({ ok: true, uploadId: ctx.uploadId, status: 'uploading', rail: 'blossom', bytesSent: blob.size, bytesTotal: blob.size, updatedAt: Date.now() });
+        },
+        onError: () => undefined,
+      }).catch(() => new Map<string, BlobDescriptor>());
+      if (stored.size === 0) return failed(ctx.uploadId, `unavailable:not-accepted:0/${servers.length}`);
+      return completed(ctx.uploadId, servers.flatMap((server) => stored.get(server) ?? []), mimeType);
+    },
+  };
+}
diff --git a/packages/core/src/index.ts b/packages/core/src/index.ts
index 65d8f6f..c1332f1 100644
--- a/packages/core/src/index.ts
+++ b/packages/core/src/index.ts
@@ -204,6 +204,8 @@ export { createSealedRatchetStorage, type SealedRatchetStorageOptions } from './
 export { createDefaultBridges, type DefaultBridgesOptions } from './bridges/default-registry.js';
 
 export { labelConversations } from './messaging/label-conversations.js';
+export { createAccountFileServers, DEFAULT_FILE_SERVERS, fileServersFromEvent, fileServerTags, type AccountFileServers, type AccountFileServersOptions, type FileServerState } from './files/file-servers.js';
+export { askUploadConsent, createBlossomUploader, describeUpload, sizeWords, type BlossomUploaderOptions, type MultiServerUpload, type UploadDetails } from './files/uploader.js';
 export { createKernlNetwork, type KernlNetwork, type KernlNetworkParts } from './kernl-network.js';
 export { LINK_PROTOCOLS, createKernlServices, isTheme, resourceInitFor, type KernlServiceDeps, type KernlServices } from './kernl-services.js';
 export { createShellAdapter, type ShellAdapterDeps } from './kernl-adapter.js';
diff --git a/packages/core/src/kernl-adapter.ts b/packages/core/src/kernl-adapter.ts
index fc825f4..7a7a684 100644
--- a/packages/core/src/kernl-adapter.ts
+++ b/packages/core/src/kernl-adapter.ts
@@ -29,6 +29,8 @@ export interface ShellAdapterDeps {
   readonly onUnroutedMessage?: (info: UnroutedMessageInfo) => void;
 }
 
+const UPLOAD_BACKEND = Object.freeze({ rails: Object.freeze(['blossom']) });
+
 function isTier(tier: string): tier is RelayTier {
   return TIERS.includes(tier);
 }
@@ -75,6 +77,8 @@ export function createShellAdapter(deps: ShellAdapterDeps): ShellAdapter {
     config: { getNappUpdateBehavior: () => 'banner' },
     hotkeys: { executeHotkeyFromForward: () => undefined },
     workerRelay: { getWorkerRelay: () => null },
+    // kehto offers the upload domain only when both the service and this backend are present; kernl's uploads are Blossom (D-033).
+    upload: { getUploader: () => (deps.services.upload ? UPLOAD_BACKEND : null) },
     crypto: { verifyEvent: (event) => Promise.resolve(verifyEvent(event)) },
     link: { isAvailable: () => true },
     intent: { isAvailable: () => true },
diff --git a/packages/core/src/kernl-network.ts b/packages/core/src/kernl-network.ts
index 4cc14ca..1c1ebfb 100644
--- a/packages/core/src/kernl-network.ts
+++ b/packages/core/src/kernl-network.ts
@@ -2,6 +2,7 @@ import { map, takeUntil, type Observable } from 'rxjs';
 import type { EventStore } from 'applesauce-core';
 import type { RelayPool } from 'applesauce-relay';
 import type { AccountManager } from 'applesauce-accounts';
+import type { ISigner } from 'applesauce-signers';
 import type { AddressPointerLoader } from 'applesauce-loaders/loaders';
 import type { KernlOptions, RelayTiers } from './types.js';
 import { isReadOnlyAccount } from './applesauce/auth-hooks.js';
@@ -10,6 +11,7 @@ import { connectEventCache, type ConnectedEventCache } from './cache/connect.js'
 import { createProfiles, type Profiles } from './profiles/profiles.js';
 import { createRelayDirectory, type RelayDirectory } from './relays/directory.js';
 import { createAccountMailboxes, type AccountMailboxes } from './relays/mailboxes.js';
+import { createAccountFileServers, type AccountFileServers } from './files/file-servers.js';
 
 /** The parts of the shell that know people and servers: the event cache, the loader over it, profiles, mailboxes and the directory. */
 export interface KernlNetwork {
@@ -18,6 +20,9 @@ export interface KernlNetwork {
   readonly profiles: Profiles;
   readonly directory: RelayDirectory;
   readonly mailboxes: AccountMailboxes;
+  readonly files: AccountFileServers;
+  /** The active account's signer, or none for a read-only or signed-out session. */
+  readonly signer: () => ISigner | undefined;
 }
 
 /** What {@link createKernlNetwork} composes over. */
@@ -32,7 +37,8 @@ export interface KernlNetworkParts {
 
 /**
  * Compose the event cache, the replaceable loader that asks it first, the
- * profile service, the relay directory and the active account's mailboxes.
+ * profile service, the relay directory, and the active account's mailboxes
+ * and file servers.
  * A read-only or signed-out session has no signer for the mailboxes, so a
  * save is refused with `denied:read-only` (D-029, D-030).
  *
@@ -51,14 +57,25 @@ export function createKernlNetwork(options: Pick<KernlOptions, 'eventCache'>, pa
   const replaceableLoader = createReplaceableLoader(eventStore, pool, tiers, eventCache.cacheRequest);
   const lookupRelays = (): string[] => lookupRelaysOf(tiers.get());
   const directory = createRelayDirectory({ pool });
+  const signer = (): ISigner | undefined => (accounts.active && !isReadOnlyAccount(accounts.active) ? accounts.active.signer : undefined);
   const mailboxes = createAccountMailboxes({
     store: eventStore,
     pool,
     pubkey$: accounts.active$.pipe(map((account) => account?.pubkey), takeUntil(parts.destroyed$)),
     lookupRelays,
-    signer: () => (accounts.active && !isReadOnlyAccount(accounts.active) ? accounts.active.signer : undefined),
+    signer,
     directory,
   });
   const profiles = createProfiles({ store: eventStore, load: replaceableLoader, lookupRelays });
-  return { eventCache, replaceableLoader, profiles, directory, mailboxes };
+  const files = createAccountFileServers({
+    store: eventStore,
+    pool,
+    load: replaceableLoader,
+    pubkey$: accounts.active$.pipe(map((account) => account?.pubkey), takeUntil(parts.destroyed$)),
+    pubkey: () => accounts.active?.pubkey,
+    lookupRelays,
+    outboxes: () => tiers.get().outbox,
+    signer,
+  });
+  return { eventCache, replaceableLoader, profiles, directory, mailboxes, files, signer };
 }
diff --git a/packages/core/src/kernl-services.ts b/packages/core/src/kernl-services.ts
index 135abd6..1c6d087 100644
--- a/packages/core/src/kernl-services.ts
+++ b/packages/core/src/kernl-services.ts
@@ -12,11 +12,13 @@ import {
   createRelayPoolService,
   createResourceService,
   createThemeService,
+  createUploadService,
   type DmService,
   type OutboxRouter,
   type RelayListEntry,
   type ResourceFetchInit,
   type ThemeService,
+  type Uploader,
 } from '@kehto/services';
 import type { Theme } from '@napplet/nap/theme/types';
 import type { EventTemplate, NostrEvent } from '@napplet/core';
@@ -70,6 +72,8 @@ export interface KernlServiceDeps {
   readonly host: Pick<KernlHost, 'notify' | 'openLink'>;
   readonly bridges: BridgeRegistry;
   readonly messaging: MessagingRegistry;
+  /** Uploads for applets (NAP-UPLOAD); without it the `upload` domain is not offered. */
+  readonly uploader?: Uploader;
   /** Names conversation participants for applets; without it they are listed by key alone. */
   readonly profiles?: Pick<Profiles, 'settled'>;
   readonly theme?: Theme;
@@ -264,6 +268,7 @@ export function createKernlServices(deps: KernlServiceDeps): KernlServices {
     }),
     dm,
     outbox: gateOutboxPublish(createOutbox(deps, identity), deps.consent),
+    ...(deps.uploader ? { upload: createUploadService({ uploader: deps.uploader, uploadInfo: { rails: [{ rail: 'blossom', enabled: true }] } }) } : {}),
   };
   return { registry, theme, dm };
 }
diff --git a/packages/core/src/kernl.ts b/packages/core/src/kernl.ts
index ea3e7ad..2e93a8a 100644
--- a/packages/core/src/kernl.ts
+++ b/packages/core/src/kernl.ts
@@ -11,6 +11,7 @@ import { createKernlAccounts } from './applesauce/accounts.js';
 import { isReadOnlyAccount } from './applesauce/auth-hooks.js';
 import type { ProfileCard, Profiles } from './profiles/profiles.js';
 import { createKernlNetwork } from './kernl-network.js';
+import { askUploadConsent, createBlossomUploader } from './files/uploader.js';
 import type { AccountMailboxes } from './relays/mailboxes.js';
 import { createRelayTiers } from './relays/tiers.js';
 import { decodePointer } from './applets/pointer.js';
@@ -150,6 +151,33 @@ function registriesFor(options: KernlOptions, parts: MessagingParts): Pick<Kernl
   };
 }
 
+interface ShellParts {
+  readonly handles: ReadonlyMap<string, MountedApplet>;
+  readonly subscriptions: Subscription;
+  readonly destroyed$: Subject<void>;
+  readonly network: { readonly directory: { stop(): void }; readonly eventCache: { close(): Promise<void> } };
+  readonly intents: { close(): void };
+  readonly dm: { dispose(): void };
+  readonly bridge: ShellBridge;
+  /** Closed only when the shell created it. */
+  readonly messaging?: MessagingRegistry;
+  readonly pool?: RelayPool;
+}
+
+/** Close every applet, then everything the shell opened, the parts it was handed excepted. */
+function tearDown(parts: ShellParts): void {
+  for (const handle of [...parts.handles.values()]) handle.close();
+  parts.subscriptions.unsubscribe();
+  parts.destroyed$.next();
+  parts.network.directory.stop();
+  void parts.network.eventCache.close();
+  parts.intents.close();
+  parts.dm.dispose();
+  parts.bridge.destroy();
+  parts.messaging?.close();
+  parts.pool?.close();
+}
+
 /**
  * Compose the shell: one `EventStore`, one `RelayPool`, one `AccountManager`,
  * the relay tiers, the guard pipeline, the grants layer, the messaging and
@@ -202,7 +230,7 @@ export function createKernl(options: KernlOptions): Kernl {
   });
 
   const identityOf = (windowId: string): AppletIdentity | undefined => handles.get(windowId)?.summary.identity;
-  const { eventCache, replaceableLoader, profiles, directory, mailboxes } = createKernlNetwork(options, { eventStore, pool, tiers, accounts, destroyed$ });
+  const { eventCache, replaceableLoader, profiles, directory, mailboxes, files, signer } = createKernlNetwork(options, { eventStore, pool, tiers, accounts, destroyed$ });
   const lookupBefore = lookupReplaceable(eventStore, {
     loader: replaceableLoader,
     relays: () => [...tiers.get().outbox, ...tiers.get().discovery],
@@ -218,6 +246,11 @@ export function createKernl(options: KernlOptions): Kernl {
     bridges,
     messaging,
     profiles,
+    uploader: createBlossomUploader({
+      servers: () => files.current(),
+      signer,
+      ask: (windowId, details) => askUploadConsent(host, identityOf(windowId), details),
+    }),
     ...(isTheme(options.theme) ? { theme: options.theme } : {}),
     resolveIdentity(windowId) {
       const identity = identityOf(windowId);
@@ -281,6 +314,7 @@ export function createKernl(options: KernlOptions): Kernl {
     },
     profiles,
     mailboxes,
+    files,
     directory,
     intents: intents.intents,
     session$,
@@ -290,18 +324,7 @@ export function createKernl(options: KernlOptions): Kernl {
     ...createSignIn(accounts),
     decodePointer,
     ...lifecycle,
-    destroy() {
-      const open = [...handles.values()];
-      for (const handle of open) handle.close();
-      subscriptions.unsubscribe();
-      destroyed$.next();
-      directory.stop();
-      void eventCache.close();
-      intents.close();
-      services.dm.dispose();
-      bridge.destroy();
-      if (ownsMessaging) messaging.close();
-      if (ownsPool) pool.close();
-    },
+    destroy: () =>
+      tearDown({ handles, subscriptions, destroyed$, network: { directory, eventCache }, intents, dm: services.dm, bridge, ...(ownsMessaging ? { messaging } : {}), ...(ownsPool ? { pool } : {}) }),
   };
 }
diff --git a/packages/core/src/types.ts b/packages/core/src/types.ts
index cbe420e..64e575a 100644
--- a/packages/core/src/types.ts
+++ b/packages/core/src/types.ts
@@ -13,6 +13,7 @@ import type { CatalogEntry } from './catalog/entry.js';
 import type { Profiles } from './profiles/profiles.js';
 import type { EventCacheOpener } from './cache/connect.js';
 import type { AccountMailboxes } from './relays/mailboxes.js';
+import type { AccountFileServers } from './files/file-servers.js';
 import type { RelayDirectory } from './relays/directory.js';
 import type { LoadCatalogOptions } from './catalog/fetch.js';
 import type { HandlerDefaults } from './intents/defaults.js';
@@ -152,7 +153,8 @@ export interface ConsentLine {
 /** A write described as what it changes, not as JSON. */
 export interface ConsentSummary {
   readonly title: string;
-  readonly severity: 'routine' | 'destructive';
+  /** `destructive` replaces or erases part of the record; `public` puts something where anyone can fetch it; both are asked about. */
+  readonly severity: 'routine' | 'destructive' | 'public';
   readonly lines: readonly ConsentLine[];
   readonly applet: AppletIdentity;
   /** The raw event, for an "advanced" disclosure. */
@@ -345,6 +347,8 @@ export interface Kernl {
   readonly profiles: Profiles;
   /** The signed-in account's published inbox and outbox (NIP-65); the `outbox` tier follows its outboxes. */
   readonly mailboxes: AccountMailboxes;
+  /** Where the account's uploads go (BUD-03, kind 10063); the defaults while it has no list. */
+  readonly files: AccountFileServers;
   /** Monitored servers (NIP-66) for completing and suggesting; idle until `start()`. */
   readonly directory: RelayDirectory;
   readonly intents: Intents;
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 861c359..750bdbf 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -250,6 +250,9 @@ importers:
       applesauce-sqlite:
         specifier: ^7.0.0
         version: 7.0.0(typescript@5.9.3)
+      blossom-client-sdk:
+        specifier: 5.1.0
+        version: 5.1.0
       nostr-double-ratchet:
         specifier: ^0.0.183
         version: 0.0.183(typescript@5.9.3)
@@ -1628,6 +1631,10 @@ packages:
     resolution: {integrity: sha512-P4/62zrgfH33CneE3Dn4WhJVA22YUU0eR51wKIan4NVRvwsA0YnPTwWGpNbpuacSujmSFLvyzpyuR30+fbq2Ew==}
     engines: {node: '>= 20.19.0'}
 
+  '@noble/hashes@1.8.0':
+    resolution: {integrity: sha512-jCs9ldd7NwzpgXDIf6P3+NrHh9/sD6CQdxHyjQI+h/6rDNo88ypBxxz45UDuZHz9r3tNz7N/VInSVoVdtXEI4A==}
+    engines: {node: ^14.21.3 || >=16}
+
   '@noble/hashes@2.0.1':
     resolution: {integrity: sha512-XlOlEbQcE9fmuXxrVTXCTlG2nlRXa9Rj3rr5Ue/+tX+nmkgbX720YHh0VR3hBF9xDvwnb8D2shVGOwNx+ulArw==}
     engines: {node: '>= 20.19.0'}
@@ -2886,6 +2893,15 @@ packages:
   block-iterator@1.1.2:
     resolution: {integrity: sha512-yAHUP44v2K25xLPdrgVTgwtuQctlullzjczu9CoUZom5AP3g4p1R1+aWHjS1GHG9JtcSUVUnbEPiuXiW5YZ24w==}
 
+  blossom-client-sdk@5.1.0:
+    resolution: {integrity: sha512-LINszlSe2ehQ9yzFdBbdFYKja+UR0YP//66e2XZaAUFRwexb3faRMQ2PArliqoSlrWY6g5kkaCCL58NUxEFfNA==}
+    engines: {node: '>=18'}
+    peerDependencies:
+      hls.js: ^1.6.16
+    peerDependenciesMeta:
+      hls.js:
+        optional: true
+
   body-parser@2.4.0:
     resolution: {integrity: sha512-Ifk1KcLrxaGt1occQagQNFNNOqRt1LFuehEnHHzB8Z6cRgIxRU1TBaiIsUiCdA+gy5PL7Y1IX31DNKkRmxtXjQ==}
     engines: {node: '>=18'}
@@ -6851,6 +6867,8 @@ snapshots:
     dependencies:
       '@noble/hashes': 2.4.0
 
+  '@noble/hashes@1.8.0': {}
+
   '@noble/hashes@2.0.1': {}
 
   '@noble/hashes@2.4.0': {}
@@ -8093,6 +8111,10 @@ snapshots:
 
   block-iterator@1.1.2: {}
 
+  blossom-client-sdk@5.1.0:
+    dependencies:
+      '@noble/hashes': 1.8.0
+
   body-parser@2.4.0:
     dependencies:
       bytes: 3.1.2
diff --git a/tests/e2e/public-vocabulary-live.spec.ts b/tests/e2e/public-vocabulary-live.spec.ts
index 97da558..908194c 100644
--- a/tests/e2e/public-vocabulary-live.spec.ts
+++ b/tests/e2e/public-vocabulary-live.spec.ts
@@ -52,7 +52,8 @@ test('the live settings show every default server without naming the protocol',
   await expectClean(page, 'live desktop');
   await page.locator('details.account summary').click();
   await page.getByRole('button', { name: 'Settings' }).click();
-  const defaults = Object.values(core.DEFAULT_RELAY_TIERS).flat();
+  // The shell's own server lists, then the file servers uploads use while the account has chosen none (D-033).
+  const defaults = [...Object.values(core.DEFAULT_RELAY_TIERS).flat(), ...core.DEFAULT_FILE_SERVERS];
   const shown = await page.locator('[data-address]').evaluateAll((items) => items.map((item) => item.getAttribute('data-address')));
   expect(shown.sort()).toEqual([...defaults].sort());
   // The applet catalogue's default server has a name that would say what the protocol is, so it is called by its tier.
diff --git a/tests/e2e/shell-live.spec.ts b/tests/e2e/shell-live.spec.ts
index 3ecf872..4e84fb1 100644
--- a/tests/e2e/shell-live.spec.ts
+++ b/tests/e2e/shell-live.spec.ts
@@ -174,7 +174,7 @@ test('text that is not an address is searched for, never looked up', async ({ pa
 });
 
 test('the store lists an applet this shell cannot fully run, says what it needs, and hides it only when asked', async ({ page }) => {
-  const applet = signApplet({ servers: ['https://blobs.test'], requires: ['upload'] });
+  const applet = signApplet({ servers: ['https://blobs.test'], requires: ['mesh'] });
   await fakeNetwork(page, applet, generalRelays('holds'), { 'blobs.test': 'has' });
   await signInFresh(page);
   await page.getByRole('button', { name: 'Open an applet' }).click();
diff --git a/tests/e2e/shell-preview.spec.ts b/tests/e2e/shell-preview.spec.ts
index 8948f3b..5353b06 100644
--- a/tests/e2e/shell-preview.spec.ts
+++ b/tests/e2e/shell-preview.spec.ts
@@ -363,3 +363,26 @@ test('a relay list change asks in terms of inbox and outbox', async ({ page }) =
   await expect(dialog.getByText('Outbox added')).toBeVisible();
   await expect(dialog.getByText('(write)')).toHaveCount(0);
 });
+
+test('settings show where uploads go, and the list can be changed and published', async ({ page }) => {
+  await page.goto(`${base}/app/?preview=1`);
+  await page.getByRole('button', { name: 'Try the preview' }).click();
+  await openSettings(page);
+  const section = page.getByRole('region', { name: 'File servers' });
+  await expect(section.getByText('This account has not chosen file servers yet')).toBeVisible();
+  const list = section.getByRole('list', { name: 'File servers' });
+  await expect(list.getByRole('listitem')).toHaveCount(3);
+  await expect(list.getByText('blossom.primal.net (first)')).toBeVisible();
+  // A server whose name says the protocol's name is called by the list's own (D-006).
+  await section.getByRole('button', { name: 'Remove File server 2 from file servers' }).click();
+  const field = section.getByRole('textbox', { name: 'Add a file server' });
+  await field.fill('not a server');
+  await field.press('Enter');
+  await expect(section.getByRole('alert')).toHaveText('Enter a file server address such as blossom.primal.net.');
+  await field.fill('files.example.org');
+  await field.press('Enter');
+  await expect(list.getByText('files.example.org')).toBeVisible();
+  await section.getByRole('button', { name: 'Publish file servers' }).click();
+  await expect(section.getByRole('status').filter({ hasText: 'Saved to' })).toBeVisible();
+  await expect(section.getByText('This account has not chosen file servers yet')).toHaveCount(0);
+});