release(android): android-v1.5.0

fix(android): reconcile completed dev work

.github/workflows/ci-android.yml

@@ -38,10 +38,11 @@ on:
       - ".github/workflows/approve-release-android.yml"
       - ".github/workflows/release-android.yml"
 
-# Cancel in-progress runs for the same branch/PR, but let main and dev finish
+# Cancel superseded PR and dev runs. Never cancel main: every release-branch
+# commit must finish its independent validation.
 concurrency:
   group: ci-android-${{ github.ref }}
-  cancel-in-progress: ${{ github.ref != 'refs/heads/main' && github.ref != 'refs/heads/dev' }}
+  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
 
 jobs:
   # ──────────────────────────────────────────────

.github/workflows/ci-desktop-upstream-baseline.yml

@@ -0,0 +1,79 @@
+# Hermes-Relay - Desktop Vanilla-Upstream Baseline
+#
+# Manual/scheduled confidence gate for HRUI-055. This keeps the first CI shape
+# intentionally small: check out a clean upstream hermes-agent beside Relay and
+# run the desktop typed-stream/renderer tests that protect the gateway event
+# contract. A later expansion can boot the upstream gateway with a mock provider
+# once that harness is stable enough for CI.
+
+name: CI - Desktop Upstream Baseline
+
+on:
+  workflow_dispatch:
+    inputs:
+      upstream_ref:
+        description: "NousResearch/hermes-agent ref to check"
+        required: false
+        default: "main"
+  schedule:
+    - cron: "30 6 * * 1"
+
+concurrency:
+  group: ci-desktop-upstream-baseline-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  desktop-baseline:
+    name: Desktop typed gateway baseline
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - name: Checkout hermes-relay
+        uses: actions/checkout@v7
+
+      - name: Resolve upstream ref
+        id: ref
+        run: |
+          if [ -n "${{ github.event.inputs.upstream_ref }}" ]; then
+            REF="${{ github.event.inputs.upstream_ref }}"
+          else
+            REF="main"
+          fi
+          echo "ref=$REF" >> "$GITHUB_OUTPUT"
+
+      - name: Checkout vanilla upstream
+        uses: actions/checkout@v7
+        with:
+          repository: NousResearch/hermes-agent
+          ref: ${{ steps.ref.outputs.ref }}
+          path: _upstream
+          fetch-depth: 1
+
+      - name: Assert upstream checkout is vanilla
+        run: |
+          if [ -e "_upstream/hermes_relay_bootstrap" ] || \
+             [ -e "_upstream/plugin/hermes_relay_bootstrap" ] || \
+             find _upstream -name "hermes_relay_bootstrap.pth" 2>/dev/null | grep -q .; then
+            echo "FAIL: upstream checkout contains a relay bootstrap."; exit 1
+          fi
+          git -C _upstream status --short --untracked-files=no
+
+      - name: Run desktop gateway baseline contract
+        run: python scripts/check-desktop-upstream-baseline.py "_upstream"
+
+      - name: Set up Node
+        uses: actions/setup-node@v7
+        with:
+          node-version: "22"
+          cache: "npm"
+          cache-dependency-path: desktop/package-lock.json
+
+      - name: Install desktop dependencies
+        working-directory: desktop
+        run: npm ci
+
+      - name: Run desktop gateway baseline tests
+        working-directory: desktop
+        env:
+          HERMES_UPSTREAM_BASELINE: ${{ github.workspace }}/_upstream
+        run: npx tsx --test tests/gatewayTypes.test.ts tests/renderer.test.ts tests/typedStreamRenderer.test.ts

.github/workflows/ci-plugin.yml

@@ -50,6 +50,7 @@ jobs:
 
       - name: Syntax check (plugin relay — canonical location)
         run: |
+          python -m py_compile plugin/relay/config.py
           python -m py_compile plugin/relay/server.py
           python -m py_compile plugin/relay/channels/terminal.py
           python -m py_compile plugin/relay/channels/chat.py
@@ -103,4 +104,6 @@ jobs:
             plugin/tests/test_relay_security.py \
             plugin/tests/test_voice_routes.py \
             plugin/tests/test_session_grants.py \
-            plugin/tests/test_native_layout_imports.py
+            plugin/tests/test_native_layout_imports.py \
+            plugin/tests/test_profile_discovery.py \
+            plugin/tests/test_profiles_updated_broadcast.py

.github/workflows/legacy-docs-redirect.yml

@@ -4,11 +4,13 @@ on:
   pull_request:
     paths:
       - "legacy-pages-redirect/**"
+      - "website/public/privacy.html"
       - ".github/workflows/legacy-docs-redirect.yml"
   push:
     branches: [main]
     paths:
       - "legacy-pages-redirect/**"
+      - "website/public/privacy.html"
       - ".github/workflows/legacy-docs-redirect.yml"
   workflow_dispatch:
 
@@ -34,10 +36,12 @@ jobs:
         run: |
           set -euo pipefail
           source_file="legacy-pages-redirect/redirect.html"
+          privacy_file="website/public/privacy.html"
           output_dir="legacy-pages-redirect/_site"
           rm -rf "$output_dir"
           mkdir -p \
             "$output_dir/guide/getting-started" \
+            "$output_dir/privacy" \
             "$output_dir/reference/relay-server" \
             "$output_dir/architecture"
           for target in \
@@ -50,8 +54,12 @@ jobs:
             architecture/connection-security.html; do
             cp "$source_file" "$output_dir/$target"
           done
+          cp "$privacy_file" "$output_dir/privacy.html"
+          cp "$privacy_file" "$output_dir/privacy/index.html"
           touch "$output_dir/.nojekyll"
-          test "$(find "$output_dir" -type f | wc -l)" -eq 8
+          test "$(find "$output_dir" -type f | wc -l)" -eq 10
+          grep -Fq '<h1>Privacy Policy</h1>' "$output_dir/privacy.html"
+          grep -Fq 'https://hermes-relay.dev/privacy.html' "$output_dir/privacy.html"
           if grep -R -E '<title>VitePress|<div id="app">' "$output_dir"; then
             echo "Full documentation content must not be deployed by this workflow." >&2
             exit 1

.github/workflows/play-preflight-android.yml

@@ -81,6 +81,7 @@ jobs:
       - name: Validate release metadata and source compatibility
         run: |
           python3 scripts/check-version-tracks.py
+          python3 scripts/check-privacy-policy.py --live
           python3 scripts/check-android-locales.py
           python3 scripts/check-android-collection-apis.py
           python3 -m json.tool app/src/main/assets/changelog.json >/dev/null

.github/workflows/release-android.yml

@@ -74,6 +74,9 @@ jobs:
 
           echo "Version validated: $TAG_VERSION"
 
+      - name: Verify public privacy policy URLs
+        run: python3 scripts/check-privacy-policy.py --live
+
       - name: Verify tagged commit belongs to main
         run: |
           set -euo pipefail
@@ -123,6 +126,7 @@ jobs:
       - name: Validate release metadata and Android API compatibility
         run: |
           python3 scripts/check-version-tracks.py
+          python3 scripts/check-privacy-policy.py
           python3 scripts/check-android-locales.py
           python3 scripts/check-android-collection-apis.py
 

AGENTS.md

@@ -36,10 +36,12 @@ a staging branch.
 
 ## Non-negotiables (the short list)
 
-- **Vanilla Hermes path = upstream-only.** The default (no-plugin) connection —
-  chat via the API server, Vanilla Hermes voice via the Hermes dashboard — must work
-  against unmodified upstream hermes-agent. Server-side needs go through upstream
-  PRs or the optional relay plugin, never fork patches.
+- **Vanilla Hermes path = upstream-only.** The standard (no-plugin) connection
+  uses the upstream Dashboard/Gateway for chat, authentication, Manage, sessions,
+  and Vanilla Hermes voice. The API server is an optional automatic fallback and
+  advanced headless-compatibility surface; Relay adds optional extensions. This
+  path must work against unmodified upstream hermes-agent. Server-side needs go
+  through upstream PRs or the optional relay plugin, never fork patches.
 - **Verify endpoints against upstream** (`gateway/platforms/api_server.py` /
   `tui_gateway/server.py` in hermes-agent) before assuming a route exists.
 - **Conventional Commits + `main`/`dev` branching.** Normal branches start at

CHANGELOG.md

@@ -8,7 +8,63 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/), and this
 
 ### Fixed
 
+- **Windows-trusted certificates work in the desktop CLI.** The packaged Windows binary and newer Node runtimes add the Windows certificate store without dropping bundled or operator-supplied roots, while TLS verification and Relay certificate pinning remain enforced.
+
+## [Server 1.4.3] - 2026-07-22
+
+### Added
+
+- **Relay diagnostics describe upstream Gateway compatibility.** Doctor and `/relay/info` report optional Gateway health, configuration-route, and capability signals so clients can distinguish an older upstream install from a Relay failure.
+
+### Fixed
+
 - **Relay trust boundaries are enforced across privileged interfaces.** Pairing policy is host-authorized, Android bridge and terminal dispatch require active grants, ordinary sessions can only reduce their own policy, remote profile config is restricted to a public schema, and voice callers cannot redirect host provider credentials.
+- **Plugin bootstrap work no longer blocks the Gateway event loop.** Database initialization and compatibility-state inspection run off the async request path while preserving older upstream bootstrap behavior.
+- **Starting Relay no longer terminates a running Hermes gateway on Windows.** Profile discovery now checks gateway PIDs through non-signalling process APIs, including during periodic rescans.
+
+## [Android 1.5.0] - 2026-07-25
+
+### Added
+
+- **Voice settings are organized around Standard and Realtime paths.** Provider, model, and voice choices use a cleaner card layout with upstream-aware discovery, useful descriptions, inline previews, waveform feedback, loading skeletons, and an expandable scrolling voice browser.
+- **Standard Hermes speech streams while replies are generated.** Android plays completed speech segments as they arrive, interrupts prior playback before starting another preview or reply, and stops audio when leaving voice mode.
+- **Manage and diagnostics expose more upstream Gateway controls.** Android consumes health hints, follows canonical redirects, compresses larger RPC payloads, scopes diagnostics by profile, and surfaces compatibility information without requiring Relay-only behavior.
+- **Chat shows richer upstream state and media.** One-turn model selection, approval policies, advisor progress, queued-recovery and project labels, collapsible attachments, persisted images, interim Gateway events, and a theme-aware image-generation animation make active work easier to follow.
+- **The Agent Passport makes the active agent controllable.** The chat drawer now combines live connection and session context with profile switching, personality, model, reasoning, approval, and speed controls in one focused surface.
+- **Android onboarding finishes with a permission setup step.** After connecting, users can enable background chat alerts with one deliberate Android prompt, review optional feature permissions individually, or continue immediately without granting phone access.
+- **Image generation stays visible when upstream tool progress is hidden.** A paired Relay can expose read-only image-tool activity from Hermes session state so Android shows and completes its existing generation animation during Standard Gateway turns; native Gateway lifecycle events remain authoritative and Relay remains optional.
+- **Background work stays actionable.** User-started turns remain protected until every active session settles, while privacy-safe notifications reopen the correct conversation for approvals, questions, elevated permissions, and secure responses.
+
+### Fixed
+
+- **Voice settings and active-turn correction remain usable across supported languages.** New voice controls are localized and correction copy accurately describes the turn being replaced.
+- **Chat reconnects preserve the running Gateway turn without duplicating it.** Android reactivates the original live session after a socket loss, avoids resubmitting a prompt when its acknowledgement was lost, and de-duplicates session rows before they reach the drawer.
+- **Relay pairing preserves Tailscale and other fallback routes.** Adding Relay to an existing Standard connection now keeps every signed QR route, restores older per-device endpoints hidden by the connection upgrade, and gives remote Dashboard routes their API fallback. When a host-scoped Dashboard sign-in is still required, Chat shows the route-specific sign-in action instead of loading indefinitely.
+- **Remote routes move every Hermes surface together.** Android uses `GET /health` instead of misclassifying the API server's `405 Method Not Allowed` response to `HEAD`, and the selected Tailscale route now carries Dashboard/Gateway, sessions, Manage, and Standard Voice with API and Relay instead of leaving them pinned to the saved LAN host. Manage also distinguishes host-side Nous provider authentication from Dashboard sign-in.
+- **Hosted Manage and direct-chat compatibility stay bounded and secure.** OAuth state remains tied to the selected dashboard, inline image memory is capped, and session reset and queued-recovery boundaries follow upstream contracts.
+- **Dashboard sign-in is secure and route-aware.** Browser-based authorization is scoped and serialized to the selected host, while cold start no longer activates a temporary localhost API fallback or reports a missing key before stored connection state is ready.
+- **Background and promoted voice work retain their owning chat rows.** Completing an initial spoken handoff no longer removes an otherwise empty assistant bubble that still owns a running task, and concurrent turns remain reachable without requiring an always-on idle connection.
+- **Self-hosted rendering is safer.** Android accepts deliberately installed user certificate authorities without bypassing chain, hostname, or Relay-pin verification, and malformed syntax-highlighting ranges no longer crash Markdown rendering.
+- **Developer Options reflect current product behavior.** The obsolete Relay feature toggle is removed, version-tap unlock and explicit relock persist correctly, and backup, import, reset, and completion messages now report their actual results.
+
+## [1.4.9] - 2026-07-19
+
+### Changed
+
+- **Hermes connections now use the Dashboard/Gateway as their standard surface.** Chat, sessions, Manage, and voice share one upstream sign-in; the API server is an optional automatic fallback or headless compatibility path, while Relay remains optional for power features.
+- **Connection management and onboarding now explain each path clearly.** Nearby and remote dashboard setup, Tailscale and custom ports, Relay pairing, startup preference, route details, and security posture are presented in dedicated flows.
+
+### Fixed
+
+- **Server default consistently displays Hermes' pinned active profile.** Chat, session drawers, agent details, settings, voice, diagnostics, and profile inspection now use the active profile identity while preserving server-default routing semantics.
+- **Discovered connections show useful host identity.** Successful local dashboard probes resolve and retain a hostname without overwriting a user-supplied connection label.
+
+## [1.4.8] - 2026-07-18
+
+### Fixed
+
+- **The Google Play privacy-policy URL is permanently available.** The canonical policy now lives on hermes-relay.dev, the historical GitHub Pages URL serves the complete policy for compatibility, and Android release automation blocks publication if either public page is unavailable.
+- **Android opens the hosted privacy policy directly.** The About screen no longer sends users to a repository source file.
 
 ## [1.4.7] - 2026-07-18
 

CONTRIBUTING.md

@@ -168,10 +168,19 @@ Release notes (`RELEASE_NOTES.md`, `app/src/main/assets/whats_new.txt`, `docs/pl
 
 ## Testing
 
+- **Android pre-push gate:** `scripts\dev.bat prepush` on Windows or
+  `./scripts/dev.sh prepush` on macOS/Linux. This runs the Android repository
+  checks, Google Play debug lint, and the same focused unit-test shard used by
+  CI in one cached Gradle invocation. Run it before pushing Android PR updates
+  to catch common hosted failures without waiting for another full Actions
+  cycle; hosted CI remains the exhaustive all-variant gate.
 - **Android unit tests:** `scripts/dev.bat test` (runs JUnit + MockK + Compose testing)
 - **Python tests:** `python -m unittest plugin.tests.test_<name>` from the repo root with the hermes-agent venv active. `pytest` works too but the pre-existing `conftest.py` imports a module that isn't always installed — `unittest` avoids that entirely.
 
 CI is split into path-filtered workflows: `.github/workflows/ci-android.yml` (lint + build + test on app/Gradle changes), `.github/workflows/ci-server.yml` (syntax check + focused server tests on plugin/Python changes), and `.github/workflows/ci-desktop.yml` (desktop type/build/smoke checks). They run on pushes to `main` and `dev` and on PRs targeting either when their paths are touched.
+Superseded Android runs on `dev` and PR refs are canceled automatically; `main`
+runs are never canceled because each release-branch commit must complete its
+independent validation.
 
 ## Questions?
 

DEVLOG.md

@@ -1,5 +1,196 @@
 # Hermes-Relay — Dev Log
 
+## 2026-07-25 — Android 1.5.0 final release reconciliation
+
+The final Android 1.5.0 release tree reconciles the accumulated Dashboard-first
+connection, Gateway recovery, background delivery, Agent Passport, onboarding,
+voice, attachment, image-generation, security, localization, and Developer
+Options work into one public release narrative. Android remains version 1.5.0
+with monotonic versionCode 33 because that prepared version was not previously
+tagged or uploaded to production.
+
+Release notes, the in-app What's New assets, localized Play release notes, and
+the Play listing reference now describe the final tree rather than the earlier
+voice-focused candidate. The release train is gated by the exact-tree private
+Play preflight before the `dev` to `main` release merge and public tag.
+
+## 2026-07-25 — Active-turn retention and actionable interaction alerts
+
+Android now promotes user-started chat work to foreground execution until every
+connection/profile/session-scoped turn settles. Independent leases preserve
+concurrent detached Gateway sessions, track sessions paused for input, and
+prevent one completion from stopping protection for siblings. The existing
+Persistent connection switch now extends retention only to idle periods.
+
+The foreground notification reports active and waiting session counts.
+Interaction alerts add privacy-safe expanded profile/session context and an
+explicit review, answer, or secure-response action that deep-links to the exact
+conversation; commands, questions, passwords, secrets, and environment-variable
+names remain confined to the authenticated chat surface.
+
+Audited `ChatViewModel`, `ConnectionViewModel`, `GatewayChatClient`,
+`GatewayKeepAliveService`, `InteractionRequestNotifier`, the shared Android
+manifest, Android settings copy, chat user documentation, and Play foreground
+service declaration guidance.
+
+## 2026-07-24 — Post-connect permission setup
+
+Android onboarding now finishes with a layered permission step after a
+successful Hermes connection. Standard Chat and Manage are explicitly ready
+without a phone grant; Android notifications are recommended through one
+user-triggered runtime prompt; camera, microphone, notification companion, and
+flavor-supported device tools remain individually optional on the centralized
+Permissions screen. Existing just-in-time permission prompts remain available
+when users skip setup.
+
+Coverage separates the Android-version notification policy from the Compose
+presentation and checks the recommended, granted, optional-review, and skip
+states. English and all shipped Android locale catalogs were updated together.
+
+## 2026-07-24 — Realtime background-task delivery continuity
+
+Chat stream completion now preserves an otherwise empty assistant row when it
+owns a promoted background task. This keeps the task identity available after
+the provider's initial spoken handoff, so later progress, completion, and
+forced-summary events update and settle the initiating row even when a newer
+persistent Voice command has started. Existing empty-response cleanup remains
+unchanged for assistant rows without background work.
+
+## 2026-07-23 — Background interaction notifications
+
+Android Gateway chat now treats approval, clarification, elevated-permission,
+and secret requests as actionable background events. Privacy-safe notifications
+use stable per-session identities, reopen the exact conversation, replace
+replayed requests, and clear on answer, expiry, or resumed turn activity.
+Detached active turns retain and replay their pending interaction when the
+conversation is reopened.
+
+The audit classified `terminal.read.request` as renderer plumbing rather than a
+user decision. Android now answers it with the upstream no-terminal empty
+response instead of showing an interaction or waiting for the server timeout.
+The shared main manifest continues to provide notification and persistent
+connection support to both Google Play and sideload builds.
+
+## 2026-07-23 — Android user-CA trust for self-hosted Hermes
+
+The shared Android network security configuration now accepts CA certificates
+that the device owner deliberately installed in Android's user credential store,
+in addition to system roots. Because the policy is attached to the common
+application manifest, it covers both product flavors and every platform-backed
+Hermes transport: endpoint probes, Dashboard requests and authentication
+WebView, redirects, Gateway WebSockets, API streaming, Standard Voice, and
+Relay HTTPS/WSS. Default OkHttp and WebView certificate-chain and hostname
+checks remain active, and Relay's independent certificate pinner is not
+overridden.
+
+An app-wide policy is required for arbitrary operator-supplied server names and
+for consistent WebView behavior. A runtime opt-in would require parallel custom
+trust implementations for each client and could not safely reconfigure WebView;
+per-connection CA import would add private trust-material lifecycle without
+covering all transports. The tradeoff is that Android disables public
+Certificate Transparency verification when user trust anchors are enabled.
+User documentation records the deliberate-installation boundary and a device or
+emulator validation procedure with positive chain and negative hostname checks.
+JVM coverage locks the accepted anchor sources and rejects pin overrides or
+debug-only trust additions.
+
+## 2026-07-23 — Bounded Android code-highlighting ranges
+
+Android Markdown code rendering now validates every syntax-highlighting span
+before applying it to Compose text. The bundled highlighting dependency can
+emit a reversed multiline-comment range when malformed or incomplete code
+contains a closing delimiter before its opening delimiter; the Markdown
+renderer previously passed that range directly to `AnnotatedString` and
+crashed. Both fenced and indented code use the guarded renderer, valid spans
+remain highlighted, and malformed ranges are clipped or ignored. Focused JVM
+coverage reproduces the dependency output and verifies the safe conversion.
+
+## 2026-07-20 — Image generation placeholder during turns
+
+Android chat now specializes the generic tool lifecycle for active
+`image_generate` calls. While the tool is pending, the message shows a
+theme-aware procedural diffusion canvas with a polite live-region announcement
+instead of a generic tool card. The completed tool result still replaces the
+placeholder through the existing tool completion path. Coverage includes pure
+JVM selection/denoise tests and a Compose accessibility snapshot test.
+
+## 2026-07-20 — Faster Android validation feedback
+
+Android contributors now have one cross-platform pre-push command for locale,
+documentation, collection-API, and version checks plus primary Play-variant
+lint and the focused CI unit-test shard. It uses daemon and configuration-cache
+reuse, supplies a conservative Gradle heap, and discovers the standard Windows
+Android SDK without writing worktree-local configuration. Hosted CI retains
+the exhaustive all-variant lint gate.
+
+Android CI now cancels a superseded run on `dev` or a pull-request ref while
+preserving every `main` run. A newer integration commit therefore stops paying
+for an older release smoke that can no longer become the tested release tip.
+
+## 2026-07-19 — Android 1.4.9 release preparation
+
+Android advanced to 1.4.9 with versionCode 32 after the dashboard-primary
+connection and onboarding work merged to `dev`. The public changelog, GitHub
+release notes, in-app What's New surfaces, English and Simplified Chinese Play
+notes, and store-listing copy now describe the Android-only patch. Unreleased
+Relay security hardening and the Windows gateway PID fix remain assigned to the
+independent server release track.
+
+## 2026-07-19 — Connection management detail pass
+
+The Connections list now uses compact capability chips and exposes a cold-start
+preference when more than one server is saved. Last used remains the default;
+pinning a startup connection does not change the active connection during the
+current run. Dashboard-only connections now render their configured Dashboard
+and authentication status in Routes instead of an empty endpoint list, while
+optional API fallback routes remain explicitly separate.
+
+Advanced settings render directly in their dedicated tab without a redundant
+expander. Security adds Dashboard authentication, credential-storage, Relay
+session, sign-out, and transport posture facts sourced from current runtime
+state. Android catalogs and localization source hashes were refreshed alongside
+focused startup-persistence coverage.
+
+## 2026-07-18 — Dashboard-primary connection contract
+
+The canonical Android connection model now treats one Hermes installation as a
+stable identity with independently optional endpoints. Dashboard/Gateway owns
+the standard upstream chat, authentication, sessions, Manage, and voice path;
+the API server is an automatic fallback and advanced headless compatibility
+surface; Relay remains an additive extension for terminal, bridge, media, and
+enhanced voice capabilities. Existing API-first records and pairing payloads
+remain compatible without defining normal onboarding.
+
+The audit reconciled `AGENTS.md`, `docs/spec.md`, `docs/decisions.md`,
+`docs/upstream-surface-matrix.md`, `README.md`,
+`user-docs/features/connections.md`, `user-docs/features/dashboard.md`,
+`CHANGELOG.md`, and `DEVLOG.md`. `RELEASE.md` was reviewed and required no
+change because it contains no connection-routing contract.
+
+## 2026-07-18 — Non-signalling Windows gateway PID probes
+
+Relay profile discovery now prefers Hermes' supported psutil liveness check and
+falls back to native Windows process handles when psutil is unavailable. The
+POSIX signal-zero probe is restricted to POSIX hosts, preventing relay startup
+and periodic profile rescans from signalling or terminating the gateway named
+by `gateway.pid`. Regression coverage uses disposable child processes instead
+of pointing PID fixtures at the test runner.
+
+## 2026-07-18 — Android privacy-policy URL hotfix
+
+The canonical Android privacy policy moved to a stable public page on
+hermes-relay.dev. The historical GitHub Pages path now serves the complete
+policy for compatibility with existing store metadata instead of depending on
+a client-side redirect. Android's About screen, public privacy references, and
+Play submission documentation use the canonical site URL.
+
+The legacy Pages workflow publishes both file and directory policy paths from
+the same canonical HTML source. Repository validation checks the policy's
+required disclosures and URL wiring, while Play preflight and stable tag release
+jobs additionally require both deployed policy URLs to return complete policy
+content before an artifact can be uploaded or promoted. Android advanced to
+1.4.8 with versionCode 31 for the replacement Play submission.
+
 ## 2026-07-18 — Android 1.4.7 release preparation
 
 Android advanced to 1.4.7 with versionCode 30 after the localization, streaming,

PLUGIN_RELEASE_NOTES.md

@@ -1,20 +1,22 @@
 # Hermes-Relay-Plugin v__VERSION__
 
-**Release Date:** July 15, 2026
+**Release Date:** July 22, 2026
 
-This patch aligns Server default with Hermes' sticky active profile and lets paired clients import conventional profile avatar files without exposing host paths.
+This patch hardens Relay authorization, adds upstream-aware diagnostics, and keeps plugin bootstrap work off the Gateway event loop.
 
-Pairs with Hermes-Relay-Android v1.4.6 for profile image import. Standard chat and Vanilla Hermes voice remain upstream-owned and do not require this plugin.
+It can accompany Hermes-Relay-Android v1.5.0 for optional Relay diagnostics and power features. Standard chat and Vanilla Hermes voice remain upstream-owned and do not require this plugin.
 
 ## What's changed
 
 ### Added
 
-- **Paired clients can import profile avatars.** Relay discovers conventional direct-child images such as `avatar.png` and `profile.jpg`, validates their media type, size, and profile boundary, and serves the bytes through an authenticated route.
+- **Upstream-aware Gateway diagnostics.** Doctor and `/relay/info` expose optional health, configuration-route, and capability signals so clients can explain compatibility gaps without treating an older upstream install as a broken Relay.
 
 ### Fixed
 
-- **Server default follows Hermes' active profile.** Advertised identity, model, SOUL, profile metadata, and avatar resolve through the sticky `active_profile` marker instead of always using the root profile.
+- **Privileged Relay paths enforce host authorization and active grants.** Pairing, Android bridge, terminal, session policy, remote profile configuration, and voice provider origins retain their intended trust boundaries.
+- **Plugin bootstrap remains responsive.** Database initialization and compatibility inspection run outside the Gateway event loop while preserving compatibility with older upstream bootstrap contracts.
+- **Windows Gateway detection is non-signalling.** Starting Relay and periodic profile rescans no longer risk terminating an existing Gateway process.
 
 ## Install / update
 

README.md

@@ -54,52 +54,48 @@ Install → connect → talk, in about two minutes.
 
 Sideload builds check GitHub for updates and show a one-tap banner when you're behind; Play builds update through the Store. See [Release tracks](https://hermes-relay.dev/docs/guide/release-tracks) for the capability matrix.
 
-### 2 · Have Hermes running
+### 2 · Have the Hermes Dashboard running
 
-The app needs your Hermes **API server enabled and reachable from your phone**, plus an **API key** — the token the app sends to authenticate Chat (pick any value you like). Installing Hermes and choosing a provider is vanilla Hermes setup; the [full walkthrough](https://hermes-relay.dev/docs/guide/getting-started) covers Windows, the dashboard for **Manage**, LAN scan, and QR setup.
+The normal Android connection uses the upstream Hermes Dashboard/Gateway for
+chat, sign-in, sessions, Manage, and voice. Installing Hermes and choosing a
+provider is vanilla Hermes setup:
 
 ```bash
-hermes setup --portal                      # install / log in / pick a provider — skip if already done
-
-mkdir -p ~/.hermes
-API_SERVER_KEY="$(openssl rand -hex 32)"   # strong random key — or substitute your own memorable value
-cat >> ~/.hermes/.env <<EOF
-API_SERVER_ENABLED=true
-API_SERVER_HOST=0.0.0.0
-API_SERVER_PORT=8642
-API_SERVER_KEY=$API_SERVER_KEY
-EOF
-chmod 600 ~/.hermes/.env
-
-echo "Android API URL: http://<this-computer-ip>:8642   key: $API_SERVER_KEY"
-hermes gateway
+hermes setup --portal   # install / log in / pick a provider — skip if already done
+hermes dashboard       # start the standard Dashboard/Gateway surface
 ```
 
-`API_SERVER_ENABLED` turns the API server on; `API_SERVER_HOST=0.0.0.0` makes it reachable on your LAN (the default is localhost-only); `API_SERVER_KEY` is the bearer token the app sends — **your choice of value**.
-
-> **Heads up on `0.0.0.0`:** that exposes the API to every device on your network — fine on a trusted home LAN, but off it keep the key set and front it with Tailscale or an HTTPS reverse proxy ([Remote access](https://hermes-relay.dev/docs/guide/remote-access)) rather than exposing it directly. You don't have to type the key on your phone — **Scan for Hermes on LAN**, or have your agent make a setup QR (below). For **Manage** (skills, models, keys), also run the Hermes dashboard — see [Getting Started](https://hermes-relay.dev/docs/guide/getting-started).
+Make the dashboard reachable from your phone over a trusted LAN, Tailscale, or
+an HTTPS reverse proxy. The [full walkthrough](https://hermes-relay.dev/docs/guide/getting-started)
+covers Windows, remote access, and dashboard authentication. You do not need to
+enable the separate API server or invent an API key for the standard path.
 
 ### 3 · Connect and talk
 
-Open the app and pick how to connect — any of:
+Open the app, choose **Connect to Hermes**, and enter or discover the dashboard
+address (conventionally `http://<host>:9119`). Sign in through the dashboard's
+configured provider when prompted. The app probes the available upstream
+capabilities and finishes with a connection summary.
 
-- **Vanilla Hermes** → tap **Scan for Hermes on LAN** to auto-find the server, then enter your key.
-- **Vanilla Hermes** → type the address (`http://<host>:8642`) and key by hand.
-- **Scan setup QR** → ask your Hermes agent to generate a QR with your URL + key (e.g. `{"api_url":"http://<host>:8642","api_key":"<key>","dashboard_url":"http://<host>:9119"}`) and scan it. `dashboard_url` is optional when the dashboard uses the conventional same-host `:9119` URL.
+The separate API server can be discovered automatically or added later under
+**Advanced** as a chat fallback or for a headless compatibility setup. Its API
+key is requested only when that optional endpoint is configured. Existing
+API-first setup QRs remain importable.
 
 The wizard probes everything and finishes with a capability card:
 
 | Line | What it means |
 |------|---------------|
-| **Chat** | API server reachable — you can talk |
-| **Manage** | Dashboard found — models, keys, skills, profiles from the phone |
+| **Chat** | Dashboard/Gateway ready — you can talk |
+| **Manage** | Models, keys, skills, and profiles are available from the phone |
 | **Voice** | Speech ready via your server (or one Manage sign-in away) |
-| **Remote** | Fallback route configured — keeps working away from home |
-| **Relay** | Optional power tools — fine to leave unpaired |
+| **API fallback** | Optional API route available/unavailable |
+| **Relay** | Optional extensions — fine to leave unpaired |
 
-If your dashboard requires sign-in, do it once under the **Manage** tab — the same session unlocks voice. That's the whole Vanilla Hermes setup.
+One dashboard sign-in unlocks Chat, Manage, sessions, and standard voice. That's
+the whole Vanilla Hermes setup.
 
-> **Going places?** Put your server's Tailscale URL in the setup form's *Remote access* field (or add a route any time under **Settings → Connections → Routes**). The app uses LAN at home and switches routes automatically when you leave. See [Remote access](https://hermes-relay.dev/docs/guide/remote-access).
+> **Going places?** Add the Dashboard's Tailscale address — for example `http://100.x.y.z:9119` or a separately published `https://host.ts.net` URL — under **Settings → Connections → Routes**. Android tests it as a Dashboard route; no API server or API key is required. The app uses LAN at home and switches routes automatically when you leave. See [Remote access](https://hermes-relay.dev/docs/guide/remote-access).
 
 ### 4 · Optional: install Relay for power tools
 
@@ -133,7 +129,7 @@ the QR from the phone's Connections screen — or use
 
 Full server setup, TLS, and systemd details: [docs/relay-server.md](docs/relay-server.md).
 
-**Requirements:** Android 8.0+ (SDK 26) · current upstream [hermes-agent](https://github.com/NousResearch/hermes-agent) with the API server and dashboard enabled · Python 3.11+ on the server.
+**Requirements:** Android 8.0+ (SDK 26) · current upstream [hermes-agent](https://github.com/NousResearch/hermes-agent) with the Dashboard/Gateway enabled · Python 3.11+ on the server. The API server and Relay are optional.
 
 ## Screenshots
 

RELEASE_NOTES.md

@@ -1,10 +1,10 @@
-# Hermes-Relay-Android v1.4.7
+# Hermes-Relay-Android v1.5.0
 
-**Release Date:** July 18, 2026
+**Release Date:** July 25, 2026
 
 ## Download
 
-> Installing on your phone? Download `hermes-relay-1.4.7-sideload-release.apk` and tap it for the full feature set, or install the conservative build from [Google Play](https://play.google.com/store/apps/details?id=com.axiomlabs.hermesrelay).
+> Installing on your phone? Download `hermes-relay-1.5.0-sideload-release.apk` and tap it for the full feature set, or install the conservative build from [Google Play](https://play.google.com/store/apps/details?id=com.axiomlabs.hermesrelay).
 
 The `.aab` file is a Play Console upload bundle and cannot be installed by tapping it on a phone.
 
@@ -12,19 +12,28 @@ Verify the download against `SHA256SUMS.txt`. See the [sideload guide](https://h
 
 ## Summary
 
-This patch adds German, Brazilian Portuguese, and Japanese and makes long streamed replies grow smoothly while staying anchored at the latest text.
+This release makes the Hermes Dashboard and Gateway the clear standard connection, keeps active work reachable across the app and Android backgrounding, and gives profiles, voice, attachments, image generation, and approvals a more coherent native interface.
 
 ## Added
 
-- Use German, Brazilian Portuguese, or Japanese throughout both Android product flavors.
-- Language-picker and catalog freshness checks keep every shipped locale aligned with the canonical English resources.
+- The Agent Passport drawer combines live route and session context with explicit profile switching, personality, model, reasoning, approval-policy, chat-override, and processing-tier controls.
+- Secure browser-based Dashboard sign-in is scoped to the selected host. Chat, sessions, Manage, and Standard Voice share the same authenticated Gateway route while the API server remains an automatic fallback.
+- Standard and Realtime voice settings use focused provider, model, and voice cards with upstream-aware discovery, descriptions, inline previews, waveforms, and a browsable catalog. Standard replies can begin speaking completed segments before generation finishes.
+- User-started turns stay protected until every concurrent session settles. Privacy-safe notifications reopen the correct chat for approvals, questions, elevated permissions, or secure responses.
+- Onboarding finishes with a layered permission review: notifications are recommended deliberately, optional capabilities remain separate, and users can continue without granting phone access.
+- Chat surfaces one-turn model choices, approval modes, advisor progress, queued recovery, project labels, collapsible attachments, persisted images, interim Gateway events, and image-generation activity.
 
 ## Fixed
 
-- Long streamed replies insert text at a display-paced cadence instead of visibly rebuilding the conversation.
-- The active response remains anchored at the latest text through growth and completion while readers who scroll into history remain undisturbed.
+- Gateway reconnects reactivate the original live session without resubmitting acknowledged prompts or duplicating session rows.
+- Tailscale, QR, and other remote routes move Dashboard, Gateway, sessions, Manage, Standard Voice, API fallback, and optional Relay together.
+- Dashboard authentication, model routing, recovery, and profile state stay scoped to the selected connection and session, including during cold start and rapid switching.
+- Promoted voice and background tasks keep their owning Chat row until the work settles.
+- User-installed certificate authorities work for self-hosted HTTPS/WSS while normal chain, hostname, and Relay-pin verification remain enforced.
+- Malformed syntax-highlighting ranges no longer crash Markdown rendering.
+- Developer Options no longer exposes the obsolete Relay feature flag; version-tap unlock, relock, backup, import, and reset actions now persist and report accurately.
 
 ## Install / Verify
 
-- App version: **1.4.7** (versionCode **30**).
+- App version: **1.5.0** (versionCode **33**).
 - Standard Chat and Vanilla Hermes voice continue to work against unmodified upstream Hermes.

TODO.md

@@ -6,6 +6,24 @@ For shipped work, see `DEVLOG.md`. For architectural decisions, see `docs/decisi
 
 ---
 
+## Verify Android native dashboard sign-in on device
+
+Android now selects Custom Tab + PKCE for HTTPS gateways that advertise
+`native_pkce`. The lifecycle-owned callback binds only `127.0.0.1` on an
+OS-assigned port, keeps verifier/state inside the sign-in coroutine, rejects
+untrusted callback noise, and closes on completion, cancellation, navigation,
+or timeout. Encrypted bearer/refresh tokens authenticate Gateway chat, Manage,
+prewarm, and standard voice; sign-out clears both cookie and native sessions.
+Older gateways retain the identified WebView cookie fallback.
+
+Before release, device-test the real Custom Tab → provider → loopback return,
+configuration/background transitions, Manage reload, Gateway chat ticket,
+standard voice, sign-out, and process relaunch. Native bearer exchange remains
+disabled for non-loopback HTTP dashboard addresses; configure HTTPS before
+using the native flow.
+
+---
+
 ## Active — Remove temporary GitHub Pages docs redirects
 
 PR #210 moved current source and production documentation to
@@ -36,6 +54,68 @@ removal.
 
 ---
 
+## Upstream impact certification follow-ups (2026-07-19)
+
+The client/plugin implementation batch for queued recovery,
+multiplex-profile fallback routing, gateway diagnostics, Windows system-CA
+trust, and retained bootstrap async safety is implemented. The following gates
+intentionally remain outside that code batch:
+
+- **Image-generation lifecycle while tool progress is hidden.** The upstream
+  TUI gateway suppresses every `tool.start` / `tool.complete` event when
+  `display.tool_progress` is off, so a client cannot distinguish an active
+  `image_generate` turn from generic model work. Propose a narrow upstream
+  exception that always emits the lifecycle for `image_generate` while leaving
+  unrelated tool diagnostics hidden. Android already treats that lifecycle as
+  presentation state rather than a generic tool card and keeps the diffusion
+  canvas visible when its local tool display is off.
+- Run `docs/upstream-compatibility-certification.md` against an approved test
+  gateway with real provider calls and an Android device. Include concurrent
+  model/image routing, turn isolation off/on, queued reconnect, same-profile
+  background-completion ownership, compression lineage, and the explicitly
+  approved restart case. Static upstream fixtures are necessary but do not
+  prove device or restart behavior.
+- Upstream the atomic one-turn model arm/submit contract proposed in
+  `docs/upstream-contributions.md`. Until then, document the narrow race where a
+  disconnect or Stop after `/model --once` succeeds but before prompt submission
+  can leave the override armed for a later prompt.
+- Keep HRUI-052 (`/new` session-control reset parity) blocked until upstream
+  exposes a reset on the active gateway session or an authoritative reset event.
+  `slash.exec` runs the command in a separate worker today, and the mirrored
+  slash side effects do not reset the active TUI session's agent. Relay must not
+  clear local model, reasoning, or Fast pins from a successful command response
+  that did not mutate the agent those controls describe.
+- Keep profile-scoped cron execution attempts blocked on the public upstream API
+  proposed in `docs/upstream-contributions.md`. The first-class interim
+  assistant event is no longer blocked: Relay Android and desktop consume
+  upstream `message.interim` / `response_previewed`.
+- Keep Standard voice labeled host-global until upstream exposes a stable
+  profile/per-request audio contract; do not emulate it through Relay on the
+  vanilla path.
+- Keep provider exclusion/disable filtering out of Android Manage until the
+  public model-options payload identifies excluded and disabled providers.
+  `include_unconfigured=1` currently re-adds indistinguishable setup rows, so
+  empty models are not authoritative evidence that a provider should be hidden.
+- Keep persistent approval-mode writes for multiplexed non-launch profiles
+  read-only until upstream `config.get` / `config.set` bind an explicit
+  `profile` to that profile's `HERMES_HOME`. Gateway contract v3 currently
+  accepts `approvals.mode` but resolves it against the gateway process home;
+  Android may reconcile a selected profile's `session.info.approval_mode`, but
+  must not claim a profile-scoped write that upstream ignores.
+- Keep gateway `model.options` profile scoping blocked until the supported
+  upstream RPC accepts an explicit `profile` and documents that the returned
+  provider inventory was built inside that profile's runtime scope. Android
+  now keys picker results to its active profile context and rejects late
+  responses after a profile switch, but it deliberately does not send an
+  invented `profile` parameter. API-server fallback can use the separate,
+  authenticated `/p/<profile>/api/model/options` surface when multiplexed.
+- Expand the desktop upstream-baseline workflow into a live mock-provider E2E
+  once the harness can boot a credential-free upstream gateway deterministically.
+  The initial `ci-desktop-upstream-baseline` gate only checks a clean vanilla
+  checkout and the desktop typed gateway renderer/tests.
+
+---
+
 ## Multi-profile Phone/Threads routing — deferred (2026-07-12)
 
 Android profile hot-swap and concurrent Gateway turns are separate from proactive
@@ -1070,7 +1150,7 @@ Things to look into:
 - **Update discovery (shipped 2026-06-30 — CLI + dashboard + app).** `hermes relay update-check`, a dashboard "Plugin version" card, and an app **About → "Relay"** row all compare the installed plugin against the latest `plugin-v*` release and surface the right update command (`hermes plugins update hermes-relay` vs `hermes-relay-update`). The app polls the relay's `GET /relay/update-check` (`:8767`, bearer) on each `auth.ok`; the relay is the single source of truth (the app never hits GitHub). Possible polish (deferred): a more prominent dismissible "relay is behind" banner outside About (today it's capability-first + the About row), and showing the app's own version alongside the relay's in the same readout (the app-Version row already exists separately just above it).
 - **Per-profile enablement (shipped 2026-06-30).** `hermes relay profiles list|enable [--all|NAME]` + `plugin/profiles.py` resolve the install-once/enable-per-profile papercut; docs now cover the pair-once/one-relay model. Possible follow-up: an `install.sh` / `hermes plugins install` prompt offering "enable for all existing profiles" so new installs don't need the manual `profiles enable --all`.
 - `**hermes-relay-self-setup` SKILL.md as a precedent** — we just shipped a self-installing skill that an LLM can fetch from a raw GitHub URL and execute. Does this pattern generalize? Could it become a recommended way for any third-party Hermes project to ship setup automation?
-- **Bootstrap injection** — `hermes_relay_bootstrap/` monkey-patches `aiohttp.web.Application` to inject endpoints into vanilla/partial upstream. This is intentional but feels like a hack. The original broad PR #8556 was **closed as superseded**; native upstream now covers sessions/chat/fork via [#33134](https://github.com/NousResearch/hermes-agent/pull/33134) and skill/toolset discovery via `/v1/skills` + `/v1/toolsets` (#33016). **Done (2026-07-08, HRUI-002):** the bootstrap's sessions CRUD/messages/fork handlers and the legacy `GET /api/skills` list were retired outright — no pre-#33134 fallback remains; old core builds degrade via the client capability probe. **Still gapped (bootstrap remains for these):** config, memory, legacy `/api/skills/{name}` detail + `PUT /api/skills/toggle` (501 stub), available-models, `/api/sessions/search`, and the slash-command middleware — each retires individually when a native replacement lands or the dependent UX is removed. Track upstream per surface.
+- **Bootstrap injection** — `hermes_relay_bootstrap/` monkey-patches `aiohttp.web.Application` to inject endpoints into vanilla/partial upstream. This is intentional but feels like a hack. The original broad PR #8556 was **closed as superseded**; native upstream now covers sessions/chat/fork via [#33134](https://github.com/NousResearch/hermes-agent/pull/33134) and skill/toolset discovery via `/v1/skills` + `/v1/toolsets` (#33016). **Done (2026-07-08, HRUI-002):** the bootstrap's sessions CRUD/messages/fork handlers and the legacy `GET /api/skills` list were retired outright — no pre-#33134 fallback remains; old core builds degrade via the client capability probe. **Done (2026-07-19, HRUI-004/012):** retained session search now uses upstream `AsyncSessionDB` when available and `asyncio.to_thread` on older Hermes, and every compatibility memory mutation resets the upstream consolidation-failure budget when that API exists. **Still gapped (bootstrap remains for these):** config, memory, legacy `/api/skills/{name}` detail + `PUT /api/skills/toggle` (501 stub), available-models, `/api/sessions/search`, and the slash-command middleware — each retires individually when a native replacement lands or the dependent UX is removed. Track upstream per surface.
 - **Gateway slash-command preprocessor — upstream Stage 1 PR.** Sibling follow-up to the native session-control baseline (#33134). Intercepts known gateway commands on `/v1/runs` + `/v1/chat/completions`, dispatches the stateless ones (`/help`, `/commands`) via `gateway_help_lines()`, returns a deterministic "use a channel with session state" notice for the stateful majority. Currently being prepared in `C:/Users/Bailey/Desktop/Open-Projects/hermes-agent-pr-prep/` on branch `feat/api-server-gateway-commands`; awaiting subagent's code + draft PR body before pushing. See `docs/upstream-contributions.md` §5.
 - **Gateway slash-command preprocessor — bootstrap middleware (Stage 1 equivalent).** Sibling shim in `hermes_relay_bootstrap/_command_middleware.py` that mirrors the upstream Stage 1 PR as an aiohttp middleware injected at bootstrap time. Ships the hallucination fix to vanilla-upstream installs before the upstream PR lands. Planned for v0.4.1, after the current bridge feature branch wraps. See `ROADMAP.md` v0.4.1 entry.
 - **Stage 2 — stateful slash-command dispatch on `/api/sessions/{id}/chat/stream`.** Unblocked now that session primitives shipped upstream (#33134 / `f7527b0`). Add a preprocessor scoped to the session chat stream endpoint only, using `session_id` as the persistence handle. Separate upstream PR + matching bootstrap middleware. See `docs/upstream-contributions.md` §5 ("Stage 2").
@@ -1121,6 +1201,7 @@ Follow-ups:
 
 ## Attachments (shipped 2026-06-18 — `docs/plans/2026-06-18-attachment-experience.md`)
 
+- **Collapsible message groups (shipped 2026-07-25).** Android wraps rendered galleries and generic/LOADING/FAILED cards in a localized, accessible attachment disclosure. It defaults open, remembers the user's fold state by stable message identity, and leaves a compact count/name/type summary available to restore all attachment actions.
 - **B3 — download progress + cancel.** Inbound fetch is un-cancelable; the previews work scaffolded an indeterminate bar + nullable `onCancel`. Live wiring needs the fetch-path owner (`ChatViewModel`/`Attachment`) to expose determinate progress (Content-Length) + a cancel hook.
 - **C5 — agent-side sensitivity config gate.** `RELAY_MEDIA_SENSITIVITY_HINTS` (env or per-profile) instructing the agent to annotate sensitive media via the prompt-builder. Transport (relay `X-Media-Sensitive` header + client blur) already ships; the agent isn't asked to set the bit yet.
 - **Relay thumbnails (D6).** Server-side thumbnail generation to avoid full-size download for cards/galleries. Needs an image lib (Pillow not currently a dep) — evaluate before adding.

app/build.gradle.kts

@@ -245,6 +245,7 @@ dependencies {
 
     // Activity
     implementation(libs.activity.compose)
+    implementation(libs.browser)
     implementation(libs.appcompat)
 
     // Core
@@ -326,8 +327,8 @@ dependencies {
     // [POC] Roborazzi host-side screenshot rendering (src/test, Robolectric).
     // Renders real composables on the JVM at an exact canvas — no device, no
     // status bar, no clipping. See StoreScreenshotTest.
-    testImplementation("io.github.takahirom.roborazzi:roborazzi:1.68.0")
-    testImplementation("io.github.takahirom.roborazzi:roborazzi-compose:1.68.0")
+    testImplementation("io.github.takahirom.roborazzi:roborazzi:1.70.0")
+    testImplementation("io.github.takahirom.roborazzi:roborazzi-compose:1.70.0")
     testImplementation(libs.compose.ui.test.junit4)
     testImplementation(libs.compose.ui.test.manifest)
     testImplementation("androidx.test.ext:junit:1.3.0")

app/src/androidTest/kotlin/com/hermesandroid/relay/data/ConnectionReviewSeedTest.kt

@@ -0,0 +1,48 @@
+package com.hermesandroid.relay.data
+
+import android.content.Context
+import androidx.test.core.app.ApplicationProvider
+import androidx.test.ext.junit.runners.AndroidJUnit4
+import kotlinx.coroutines.flow.first
+import kotlinx.coroutines.runBlocking
+import org.junit.Test
+import org.junit.runner.RunWith
+
+/** Local device-review helper. Never runs in or ships with the application APK. */
+@RunWith(AndroidJUnit4::class)
+class ConnectionReviewSeedTest {
+
+    @Test
+    fun seedOfflineSecondaryConnection() = runBlocking {
+        val context = ApplicationProvider.getApplicationContext<Context>()
+        val store = ConnectionStore(context)
+        store.isHydrated.first { it }
+        if (store.connections.value.none { it.id == REVIEW_ID }) {
+            store.addConnection(
+                Connection(
+                    id = REVIEW_ID,
+                    label = "Lab NAS",
+                    apiServerUrl = "",
+                    relayUrl = "",
+                    tokenStoreKey = Connection.buildTokenStoreKey(REVIEW_ID),
+                    dashboardUrl = "http://192.0.2.10:9119",
+                    lastUsedAt = System.currentTimeMillis() - 2L * 24L * 60L * 60L * 1_000L,
+                ),
+            )
+        }
+    }
+
+    @Test
+    fun removeOfflineSecondaryConnection() = runBlocking {
+        val context = ApplicationProvider.getApplicationContext<Context>()
+        val store = ConnectionStore(context)
+        store.isHydrated.first { it }
+        if (store.connections.value.any { it.id == REVIEW_ID }) {
+            store.removeConnection(REVIEW_ID)
+        }
+    }
+
+    private companion object {
+        const val REVIEW_ID = "00000000-0000-4000-8000-000000000220"
+    }
+}

app/src/androidTest/kotlin/com/hermesandroid/relay/ui/onboarding/OnboardingFlowTest.kt

@@ -121,42 +121,39 @@ class OnboardingFlowTest {
     }
 
     @Test
-    fun connectPage_showsStandardChoiceFirst() {
+    fun connectPage_showsNearbyFirst() {
         setOnboardingContent()
         navigateToPage(4)
 
         composeTestRule
-            .onNodeWithText("Vanilla Hermes")
+            .onNodeWithText("Enter address instead")
             .assertIsDisplayed()
     }
 
     @Test
-    fun standardSetup_showsApiFields() {
+    fun manualSetup_showsHermesAddressWithoutApiCredentials() {
         setOnboardingContent()
         navigateToPage(4)
 
-        composeTestRule.onNodeWithText("Vanilla Hermes").performClick()
+        composeTestRule.onNodeWithText("Enter address instead").performClick()
         composeTestRule.waitForIdle()
 
         composeTestRule
-            .onNodeWithText("API server URL")
-            .assertIsDisplayed()
-        composeTestRule
-            .onNodeWithText("API key")
+            .onNodeWithText("Hermes address")
             .assertIsDisplayed()
     }
 
     @Test
-    fun standardSetup_connectButton_isEnabled_withDefaultUrl() {
+    fun manualSetup_findButton_isShown() {
         setOnboardingContent()
         navigateToPage(4)
 
-        composeTestRule.onNodeWithText("Vanilla Hermes").performClick()
+        composeTestRule.onNodeWithText("Enter address instead").performClick()
         composeTestRule.waitForIdle()
 
         composeTestRule
-            .onNodeWithText("Connect")
-            .assertIsEnabled()
+            .onNodeWithText("Find Hermes")
+            .assertIsDisplayed()
     }
 
     @Test
@@ -164,6 +161,9 @@ class OnboardingFlowTest {
         setOnboardingContent()
         navigateToPage(4)
 
+        composeTestRule.onNodeWithText("Other connection methods").performClick()
+        composeTestRule.waitForIdle()
+
         composeTestRule
             .onNodeWithText("Pair Relay by code")
             .assertIsDisplayed()

app/src/debug/AndroidManifest.xml

@@ -0,0 +1,13 @@
+<?xml version="1.0" encoding="utf-8"?>
+<manifest xmlns:android="http://schemas.android.com/apk/res/android">
+    <application>
+        <activity
+            android:name="com.hermesandroid.relay.ui.screens.VoiceSettingsDesignQaActivity"
+            android:exported="true"
+            android:screenOrientation="portrait" />
+        <activity
+            android:name="com.hermesandroid.relay.ui.screens.ImageGenerationDesignQaActivity"
+            android:exported="true"
+            android:screenOrientation="portrait" />
+    </application>
+</manifest>

app/src/debug/kotlin/com/hermesandroid/relay/ui/screens/ImageGenerationDesignQaActivity.kt

@@ -0,0 +1,196 @@
+package com.hermesandroid.relay.ui.screens
+
+import android.os.Bundle
+import androidx.activity.ComponentActivity
+import androidx.activity.compose.setContent
+import androidx.compose.foundation.layout.Arrangement
+import androidx.compose.foundation.layout.Column
+import androidx.compose.foundation.layout.Row
+import androidx.compose.foundation.layout.aspectRatio
+import androidx.compose.foundation.layout.fillMaxSize
+import androidx.compose.foundation.layout.fillMaxWidth
+import androidx.compose.foundation.layout.padding
+import androidx.compose.foundation.Image
+import androidx.compose.foundation.background
+import androidx.compose.foundation.shape.RoundedCornerShape
+import androidx.compose.material3.Button
+import androidx.compose.material3.ExperimentalMaterial3Api
+import androidx.compose.material3.FilterChip
+import androidx.compose.material3.Icon
+import androidx.compose.material3.IconButton
+import androidx.compose.material3.MaterialTheme
+import androidx.compose.material3.Scaffold
+import androidx.compose.material3.Text
+import androidx.compose.material3.TopAppBar
+import androidx.compose.material.icons.Icons
+import androidx.compose.material.icons.automirrored.filled.ArrowBack
+import androidx.compose.runtime.Composable
+import androidx.compose.runtime.getValue
+import androidx.compose.runtime.key
+import androidx.compose.runtime.mutableIntStateOf
+import androidx.compose.runtime.remember
+import androidx.compose.runtime.setValue
+import androidx.compose.ui.Modifier
+import androidx.compose.ui.draw.clip
+import androidx.compose.ui.layout.ContentScale
+import androidx.compose.ui.res.painterResource
+import androidx.compose.ui.unit.dp
+import com.hermesandroid.relay.R
+import com.hermesandroid.relay.ui.components.ImageGenerationPlaceholder
+import com.hermesandroid.relay.ui.components.ImageGenerationResultTransition
+import com.hermesandroid.relay.ui.components.ImageGenerationVisualStyle
+import com.hermesandroid.relay.ui.theme.HermesRelayTheme
+
+/**
+ * Debug-build-only live host for fast image-generation motion tuning.
+ *
+ * Launch directly:
+ * adb shell am start -n <applicationId>/
+ *   com.hermesandroid.relay.ui.screens.ImageGenerationDesignQaActivity
+ */
+class ImageGenerationDesignQaActivity : ComponentActivity() {
+    override fun onCreate(savedInstanceState: Bundle?) {
+        super.onCreate(savedInstanceState)
+        val themePreference = intent.getStringExtra("theme") ?: "auto"
+        setContent {
+            HermesRelayTheme(themePreference = themePreference) {
+                ImageGenerationDesignQaScene(onBack = ::finish)
+            }
+        }
+    }
+}
+
+@OptIn(ExperimentalMaterial3Api::class)
+@Composable
+private fun ImageGenerationDesignQaScene(onBack: () -> Unit) {
+    var restartKey by remember { mutableIntStateOf(0) }
+    var durationMillis by remember { mutableIntStateOf(4_800) }
+    var visualStyle by remember { androidx.compose.runtime.mutableStateOf(ImageGenerationVisualStyle.LatentGrid) }
+    var showResult by remember { androidx.compose.runtime.mutableStateOf(false) }
+
+    Scaffold(
+        topBar = {
+            TopAppBar(
+                title = { Text("Image generation lab") },
+                navigationIcon = {
+                    IconButton(onClick = onBack) {
+                        Icon(
+                            imageVector = Icons.AutoMirrored.Filled.ArrowBack,
+                            contentDescription = "Back",
+                        )
+                    }
+                },
+            )
+        },
+    ) { padding ->
+        Column(
+            modifier = Modifier
+                .fillMaxSize()
+                .padding(padding)
+                .padding(16.dp),
+            verticalArrangement = Arrangement.spacedBy(16.dp),
+        ) {
+            Text(
+                text = "Live debug preview · no generation request",
+                style = MaterialTheme.typography.labelMedium,
+                color = MaterialTheme.colorScheme.onSurfaceVariant,
+            )
+            Row(
+                modifier = Modifier.fillMaxWidth(),
+                horizontalArrangement = Arrangement.spacedBy(8.dp),
+            ) {
+                listOf(
+                    ImageGenerationVisualStyle.LatentGrid to "Grid",
+                    ImageGenerationVisualStyle.ParticleOrb to "Orb",
+                    ImageGenerationVisualStyle.Constellation to "Nodes",
+                ).forEach { (style, label) ->
+                    FilterChip(
+                        selected = visualStyle == style,
+                        onClick = { visualStyle = style },
+                        label = { Text(label) },
+                    )
+                }
+            }
+            key(restartKey, durationMillis, visualStyle) {
+                val startedAtMillis = remember { System.currentTimeMillis() }
+                ImageGenerationResultTransition(
+                    generating = !showResult,
+                    startedAtMillis = startedAtMillis,
+                    animationDurationMillis = durationMillis,
+                    visualStyle = visualStyle,
+                ) {
+                    Column(
+                        modifier = Modifier
+                            .fillMaxWidth()
+                            .clip(RoundedCornerShape(18.dp))
+                            .background(MaterialTheme.colorScheme.surfaceVariant),
+                    ) {
+                        Image(
+                            painter = painterResource(R.drawable.image_generation_transition_preview),
+                            contentDescription = "Generated landscape preview",
+                            contentScale = ContentScale.Crop,
+                            modifier = Modifier
+                                .fillMaxWidth()
+                                .aspectRatio(16f / 9f),
+                        )
+                        Row(
+                            modifier = Modifier
+                                .fillMaxWidth()
+                                .padding(horizontal = 12.dp, vertical = 8.dp),
+                            horizontalArrangement = Arrangement.SpaceBetween,
+                        ) {
+                            Text(
+                                text = "Generated image",
+                                style = MaterialTheme.typography.labelSmall,
+                                color = MaterialTheme.colorScheme.onSurfaceVariant,
+                            )
+                            Text(
+                                text = "12.4s",
+                                style = MaterialTheme.typography.labelSmall,
+                                color = MaterialTheme.colorScheme.onSurfaceVariant,
+                            )
+                        }
+                    }
+                }
+            }
+            Text(
+                text = "Cycle speed",
+                style = MaterialTheme.typography.labelMedium,
+            )
+            Row(
+                modifier = Modifier.fillMaxWidth(),
+                horizontalArrangement = Arrangement.spacedBy(8.dp),
+            ) {
+                listOf(
+                    7_200 to "Slow",
+                    4_800 to "Normal",
+                    3_200 to "Fast",
+                ).forEach { (duration, label) ->
+                    FilterChip(
+                        selected = durationMillis == duration,
+                        onClick = { durationMillis = duration },
+                        label = { Text(label) },
+                    )
+                }
+            }
+            Row(horizontalArrangement = Arrangement.spacedBy(8.dp)) {
+                Button(
+                    onClick = {
+                        showResult = true
+                    },
+                    enabled = !showResult,
+                ) {
+                    Text("Reveal result")
+                }
+                Button(
+                    onClick = {
+                        showResult = false
+                        restartKey++
+                    },
+                ) {
+                    Text("Restart")
+                }
+            }
+        }
+    }
+}

app/src/debug/kotlin/com/hermesandroid/relay/ui/screens/VoiceSettingsDesignQaActivity.kt

@@ -0,0 +1,128 @@
+package com.hermesandroid.relay.ui.screens
+
+import android.os.Bundle
+import androidx.activity.ComponentActivity
+import androidx.activity.compose.setContent
+import androidx.compose.foundation.layout.Arrangement
+import androidx.compose.foundation.layout.Column
+import androidx.compose.foundation.layout.fillMaxSize
+import androidx.compose.foundation.layout.fillMaxWidth
+import androidx.compose.foundation.layout.padding
+import androidx.compose.foundation.rememberScrollState
+import androidx.compose.foundation.verticalScroll
+import androidx.compose.material3.Card
+import androidx.compose.material3.CardDefaults
+import androidx.compose.material3.ExperimentalMaterial3Api
+import androidx.compose.material3.MaterialTheme
+import androidx.compose.material3.Scaffold
+import androidx.compose.material3.Text
+import androidx.compose.material3.TopAppBar
+import androidx.compose.runtime.Composable
+import androidx.compose.runtime.getValue
+import androidx.compose.runtime.mutableStateOf
+import androidx.compose.runtime.remember
+import androidx.compose.runtime.setValue
+import androidx.compose.ui.Modifier
+import androidx.compose.ui.unit.dp
+import com.hermesandroid.relay.network.relay.RealtimeProviderInfo
+import com.hermesandroid.relay.ui.theme.HermesRelayTheme
+import com.hermesandroid.relay.viewmodel.VoicePreviewUiState
+
+/** Debug-build-only deterministic host for design QA screenshots. */
+class VoiceSettingsDesignQaActivity : ComponentActivity() {
+    override fun onCreate(savedInstanceState: Bundle?) {
+        super.onCreate(savedInstanceState)
+        val themePreference = intent.getStringExtra("theme") ?: "auto"
+        setContent { HermesRelayTheme(themePreference = themePreference) { VoiceSettingsDesignQaScene() } }
+    }
+}
+
+@OptIn(ExperimentalMaterial3Api::class)
+@Composable
+private fun VoiceSettingsDesignQaScene() {
+    val provider = remember {
+        RealtimeProviderInfo(
+            id = "xai_tts",
+            name = "xAI Grok TTS",
+            status = "ready",
+            models = listOf("grok-tts", "grok-tts-fast"),
+            voices = listOf("eve", "ara", "sal", "rex", "leo"),
+            model_labels = mapOf("grok-tts" to "Grok TTS"),
+            voice_labels = mapOf("eve" to "Eve", "ara" to "Ara", "sal" to "Sal"),
+            recommended_voices = listOf("eve", "ara"),
+            supports_tts = true,
+        )
+    }
+    var selectedSection by remember { mutableStateOf(VoiceSettingsSection.Output) }
+    var selectedVoice by remember { mutableStateOf("eve") }
+    var expanded by remember { mutableStateOf(false) }
+    val allVoices = remember {
+        listOf(
+            VoiceChoice("eve", "Eve", "Warm · expressive", recommended = true),
+            VoiceChoice("ara", "Ara", "Clear · balanced", recommended = true),
+            VoiceChoice("sal", "Sal", "Calm · grounded"),
+            VoiceChoice("rex", "Rex", "Direct · confident"),
+            VoiceChoice("leo", "Leo", "Bright · conversational"),
+        )
+    }
+
+    Scaffold(topBar = { TopAppBar(title = { Text("Voice") }) }) { padding ->
+        Column(
+            modifier = Modifier
+                .fillMaxSize()
+                .padding(padding)
+                .verticalScroll(rememberScrollState())
+                .padding(16.dp),
+            verticalArrangement = Arrangement.spacedBy(12.dp),
+        ) {
+            Card(
+                modifier = Modifier.fillMaxWidth(),
+                colors = CardDefaults.cardColors(
+                    containerColor = MaterialTheme.colorScheme.primaryContainer.copy(alpha = 0.58f),
+                ),
+            ) {
+                Column(modifier = Modifier.padding(16.dp)) {
+                    Text("Hermes Chat + Voice Output", style = MaterialTheme.typography.titleMedium)
+                    Text("Default profile · Profile voice", color = MaterialTheme.colorScheme.onSurfaceVariant)
+                }
+            }
+            VoiceSettingsTabs(selectedSection) { selectedSection = it }
+            VoiceProviderGroupCard(
+                provider = provider,
+                providerValue = provider.id,
+                enabled = true,
+                providerChoices = listOf(VoiceChoice(provider.id, provider.name.orEmpty())),
+                onEnabledChange = {},
+                onProviderChange = {},
+                controlsEnabled = true,
+            )
+            ModelAndVoiceGroupCard(
+                modelValue = "grok-tts",
+                modelChoices = listOf(VoiceChoice("grok-tts", "Grok TTS")),
+                voices = previewVoiceChoices(allVoices, selectedVoice),
+                allVoices = allVoices,
+                selectedVoice = selectedVoice,
+                previewState = VoicePreviewUiState(
+                    selectionKey = "voice:eve",
+                    isPlaying = true,
+                    amplitude = 0.42f,
+                ),
+                onModelChange = {},
+                onVoiceChange = { selectedVoice = it },
+                onPreviewVoice = {},
+                enabled = true,
+            )
+            LanguageQualityCard(
+                expanded = expanded,
+                onExpandedChange = { expanded = it },
+                language = "English",
+                languages = listOf(VoiceChoice("en", "English")),
+                onLanguageChange = {},
+                sampleRate = "24000",
+                sampleRates = listOf(VoiceChoice("24000", "24 kHz")),
+                onSampleRateChange = {},
+                enabled = true,
+            )
+        }
+    }
+}

app/src/googlePlay/play/release-notes/en-US/default.txt

@@ -1 +1 @@
-Long streamed replies now grow smoothly and stay anchored at the newest text through completion, while scrolling into history preserves your reading position. German, Brazilian Portuguese, and Japanese are now available throughout the app.
+Connect through secure Dashboard sign-in, switch profiles from the new Agent Passport, and keep multiple background chats active with actionable approval and question alerts. Image generation, attachments, model routing, voice, and Gateway recovery are clearer and more reliable. Setup now guides optional notification, camera, microphone, and companion permissions without blocking chat.

app/src/googlePlay/play/release-notes/zh-CN/default.txt

@@ -1 +1 @@
-长回复现在会平滑流式显示，并在完成时保持定位到最新文本；向上滚动查看历史记录时仍会保留阅读位置。应用现已支持德语、巴西葡萄牙语和日语。
+通过安全的 Dashboard 登录连接，并在新的智能体护照中切换配置文件。多个后台对话可保持运行，审批或提问通知可直接返回正确会话。图像生成、附件、模型路由、语音和 Gateway 恢复更加清晰可靠。设置流程会说明可选的通知、相机、麦克风和通知伴侣权限，且不会阻止聊天。

app/src/main/AndroidManifest.xml

@@ -90,12 +90,10 @@
             android:name=".notifications.ProactiveReplyReceiver"
             android:exported="false" />
 
-        <!-- Opt-in "Persistent connection" — holds the user's connection to
-             Hermes open while backgrounded so messages and live features stay
-             responsive (relay-paired setups also keep device control +
-             notification mirroring reachable). In main so BOTH flavors ship it
-             (Home-Assistant-class persistent connection). Off by default; only
-             runs while the user has explicitly enabled the toggle. specialUse
+        <!-- Protects user-started active turns automatically; the optional
+             "Persistent connection" setting extends the same foreground
+             protection to idle/background connectivity (and relay-paired
+             device features). In main so BOTH flavors ship it. specialUse
              needs a Play Console foreground-service declaration at submission. -->
         <service
             android:name=".network.upstream.GatewayKeepAliveService"
@@ -103,7 +101,7 @@
             android:foregroundServiceType="specialUse">
             <property
                 android:name="android.app.PROPERTY_SPECIAL_USE_FGS_SUBTYPE"
-                android:value="Keeps the user's connection to their Hermes agent open in the background so messages and live features stay responsive, only when the user has explicitly enabled 'Persistent connection'." />
+                android:value="Keeps user-started Hermes turns connected until they finish or need input, and optionally keeps idle connections responsive when the user enables Persistent connection." />
         </service>
 
     </application>

app/src/main/assets/changelog.json

@@ -1,5 +1,75 @@
 {
  "versions": [
+  {
+   "version": "1.5.0",
+   "title": "Hermes, always in reach",
+   "date": "2026-07-25",
+   "sections": [
+    {
+     "header": "One secure Hermes connection",
+     "bullets": [
+      "Connect through secure Dashboard sign-in while Chat, sessions, Manage, and Standard Voice follow the same active route.",
+      "Switch profiles and control personality, model, reasoning, approvals, and processing speed from the new Agent Passport."
+     ]
+    },
+    {
+     "header": "Active work stays reachable",
+     "bullets": [
+      "Multiple user-started chats remain active in the background until every session settles.",
+      "Approval, question, elevated-permission, and secure-response alerts reopen the correct conversation."
+     ]
+    },
+    {
+     "header": "Richer chat and voice",
+     "bullets": [
+      "Attachments, image generation, model routing, recovery, advisor progress, and upstream events are clearer and more reliable.",
+      "Browse and preview Standard and Realtime voices, and hear Standard replies begin speaking as completed segments arrive."
+     ]
+    },
+    {
+     "header": "Setup without surprises",
+     "bullets": [
+      "Onboarding explains optional notification, camera, microphone, companion, and device permissions without blocking standard chat.",
+      "Tailscale, QR, and remote routes now move all Hermes surfaces together and recover the original session after connection loss."
+     ]
+    }
+   ]
+  },
+  {
+   "version": "1.4.9",
+   "title": "Clearer Hermes connections",
+   "date": "2026-07-19",
+   "sections": [
+    {
+     "header": "Dashboard-first setup",
+     "bullets": [
+      "Connect through the Hermes dashboard with one sign-in for Chat, sessions, Manage, and voice; API fallback and optional Relay remain available.",
+      "Onboarding and connection management now explain nearby, remote, Tailscale, custom-port, startup, route, and security choices."
+     ]
+    },
+    {
+     "header": "Consistent identity",
+     "bullets": [
+      "Server default now displays Hermes' pinned active profile consistently across the app.",
+      "Successful local discovery adds useful hostname identity without replacing a custom connection label."
+     ]
+    }
+   ]
+  },
+  {
+   "version": "1.4.8",
+   "title": "Privacy policy restored",
+   "date": "2026-07-18",
+   "sections": [
+    {
+     "header": "Google Play compliance",
+     "bullets": [
+      "The privacy policy now lives at hermes-relay.dev and the historical store URL remains valid for compatibility.",
+      "The About screen opens the hosted policy directly, and releases verify it is publicly available before publishing."
+     ]
+    }
+   ]
+  },
   {
    "version": "1.4.7",
    "title": "Smoother replies, more languages",

app/src/main/assets/whats_new.txt

@@ -1,8 +1,6 @@
-v1.4.7 - Smoother replies, more languages
+v1.5.0 - Hermes, always in reach
 
-Smooth streaming
-* Long replies grow steadily and stay anchored at the newest text through completion.
-* Scrolling into history still leaves your reading position alone.
-
-More languages
-* Use German, Brazilian Portuguese, or Japanese throughout the app.
+* Connect through secure Dashboard sign-in and switch profiles from the new Agent Passport.
+* Keep multiple background chats active and reopen the right session from approval or question alerts.
+* Follow richer attachments, image generation, model routing, Gateway recovery, and streaming voice.
+* Finish setup with clear, optional permission guidance that never blocks standard chat.

app/src/main/kotlin/com/hermesandroid/relay/MainActivity.kt

@@ -20,6 +20,7 @@ import com.hermesandroid.relay.bridge.BridgeForegroundService
 import com.hermesandroid.relay.bridge.UnattendedAccessManager
 import com.hermesandroid.relay.data.BuildFlavor
 import com.hermesandroid.relay.notifications.TurnCompleteNotifier
+import com.hermesandroid.relay.notifications.InteractionRequestNotifier
 import com.hermesandroid.relay.ui.RelayApp
 import com.hermesandroid.relay.util.NavRouteRequest
 import com.hermesandroid.relay.viewmodel.ConnectionViewModel
@@ -142,6 +143,10 @@ class MainActivity : AppCompatActivity() {
         // Returning to the app clears the one-slot "Hermes finished
         // responding" notification — the chat surface is the answer.
         TurnCompleteNotifier.cancel(this)
+        // Action-required notifications are durable across process death.
+        // Once the authenticated chat surface is visible it owns presentation;
+        // unresolved asks are re-posted if the app returns to the background.
+        InteractionRequestNotifier.cancelAll(this)
         // v0.4.1 — register this activity as the host for
         // KeyguardManager.requestDismissKeyguard. Cleared in onPause so
         // we don't leak the Activity past its lifecycle. The unattended-

app/src/main/kotlin/com/hermesandroid/relay/data/AgentDisplay.kt

@@ -31,7 +31,16 @@ object AgentDisplay {
     fun effectiveDisplayProfile(
         selectedProfile: Profile?,
         profiles: List<Profile>,
-    ): Profile? = selectedProfile ?: profiles.firstOrNull { isServerDefaultAlias(it.name) }
+        serverDefaultProfileName: String? = null,
+    ): Profile? {
+        selectedProfile?.let { return it }
+        val resolvedServerDefault = profileRequestName(serverDefaultProfileName)
+        return resolvedServerDefault
+            ?.let { activeName ->
+                profiles.firstOrNull { it.name.equals(activeName, ignoreCase = true) }
+            }
+            ?: profiles.firstOrNull { isServerDefaultAlias(it.name) }
+    }
 
     // The NAME goes in the name slot. Non-default profiles use their profile
     // name first. The synthetic default profile uses its description only when

app/src/main/kotlin/com/hermesandroid/relay/data/ChatMessage.kt

@@ -142,6 +142,21 @@ data class ChatMessage(
      * through `copy`, while [id] remains the authoritative lookup/wire id.
      */
     val uiKey: String = id,
+    /**
+     * Mixture-of-Agents advisor responses surfaced during the live turn.
+     * Unavailable advisors retain only neutral state, never their raw failure
+     * body. A sanitized bounded copy may enter the local in-flight checkpoint,
+     * but server history never owns these presentation blocks.
+     */
+    val moaReferences: List<MoaReference> = emptyList(),
+)
+
+data class MoaReference(
+    val index: Int,
+    val count: Int?,
+    val label: String,
+    val text: String,
+    val available: Boolean = true,
 )
 
 /** One Chat-visible identity for a promoted/durable realtime Hermes run. */
@@ -392,6 +407,8 @@ data class ChatSession(
      * for locally-created optimistic rows. Drives the drawer's Thread tag (see ADR 12).
      */
     val source: String? = null,
+    /** Server reports a persisted session runtime/model binding. */
+    val hasModelConfig: Boolean = false,
 ) {
     val activityTimestamp: Long
         get() = firstPositive(lastActivityAt, updatedAt, startedAt)

app/src/main/kotlin/com/hermesandroid/relay/data/ChatTurnCheckpointStore.kt

@@ -66,6 +66,17 @@ data class ChatTurnAssistantCheckpoint(
     val cardDispatches: List<HermesCardDispatch> = emptyList(),
     val toolCalls: List<ChatTurnToolCheckpoint> = emptyList(),
     val backgroundTask: ChatTurnBackgroundTaskCheckpoint? = null,
+    /** Sanitized, bounded live-only MoA presentation state; never server transcript data. */
+    val moaReferences: List<ChatTurnMoaReferenceCheckpoint> = emptyList(),
+)
+
+@Serializable
+data class ChatTurnMoaReferenceCheckpoint(
+    val index: Int,
+    val count: Int? = null,
+    val label: String,
+    val text: String = "",
+    val available: Boolean = true,
 )
 
 @Serializable

app/src/main/kotlin/com/hermesandroid/relay/data/ConnectionCapabilities.kt

@@ -0,0 +1,31 @@
+package com.hermesandroid.relay.data
+
+/**
+ * Pure, persisted-state-derived availability for a Hermes connection.
+ *
+ * This deliberately describes configured surfaces, not live reachability or
+ * authentication. Runtime layers can combine it with their probe/auth state
+ * without treating a missing optional API server or Relay as a broken Hermes
+ * connection.
+ */
+data class ConnectionCapabilities(
+    val dashboardGatewayConfigured: Boolean,
+    val apiServerConfigured: Boolean,
+    val relayConfigured: Boolean,
+) {
+    val gatewayChatAvailable: Boolean get() = dashboardGatewayConfigured
+    val manageAvailable: Boolean get() = dashboardGatewayConfigured
+    val standardVoiceAvailable: Boolean get() = dashboardGatewayConfigured
+    val apiChatFallbackAvailable: Boolean get() = apiServerConfigured
+    val relayFeaturesAvailable: Boolean get() = relayConfigured
+    val chatConfigured: Boolean get() = gatewayChatAvailable || apiChatFallbackAvailable
+    val anySurfaceConfigured: Boolean
+        get() = dashboardGatewayConfigured || apiServerConfigured || relayConfigured
+}
+
+val Connection.capabilities: ConnectionCapabilities
+    get() = ConnectionCapabilities(
+        dashboardGatewayConfigured = resolvedDashboardUrl.isNotBlank(),
+        apiServerConfigured = apiServerUrl.isNotBlank(),
+        relayConfigured = relayUrl.isNotBlank(),
+    )

app/src/main/kotlin/com/hermesandroid/relay/data/ConnectionData.kt

@@ -13,13 +13,16 @@ data class DashboardConnectionStatus(
     val authProvider: String? = null,
     val gatewayTicketAvailable: Boolean? = null,
     val message: String? = null,
+    val gatewayMode: String? = null,
+    val profiles: List<String> = emptyList(),
 )
 
 /**
  * A "connection" = a distinct Hermes server connection the app can switch between.
  *
  * Each connection has its own:
- *  - API server URL + relay URL
+ *  - One or more independently-configured Hermes surfaces. Dashboard/Gateway
+ *    is the standard primary path; API server and Relay are optional.
  *  - EncryptedSharedPreferences file (keyed by [tokenStoreKey]) holding the
  *    session token, device ID, API key, and paired-session metadata.
  *  - Cert pin (already host-keyed in [com.hermesandroid.relay.auth.CertPinStore]
@@ -73,17 +76,34 @@ data class Connection(
     val preferredRouteRole: String? = null,
     /** Epoch milliseconds. Pass `System.currentTimeMillis()`; do not pass seconds. */
     val pairedAt: Long? = null,
+    /** Last time the user explicitly selected this connection. */
+    val lastUsedAt: Long? = null,
     val lastActiveSessionId: String? = null,
     val transportHint: String? = null,
     /** Epoch milliseconds. The auth.ok `expires_at` field is seconds — multiply by 1000 at the call site. */
     val expiresAt: Long? = null,
 ) {
+    /**
+     * Effective Dashboard/Gateway endpoint. Legacy records did not persist a
+     * dashboard URL, so they retain the conventional same-host `:9119`
+     * derivation from the API server. Dashboard-only records persist an
+     * explicit URL and may leave [apiServerUrl] and [relayUrl] blank.
+     */
     val resolvedDashboardUrl: String
         get() = dashboardUrl
             ?.trim()
             ?.takeIf { it.isNotBlank() }
             ?: deriveDefaultDashboardUrl(apiServerUrl).orEmpty()
 
+    /** Stable display/host identity that does not depend on the API surface. */
+    val primaryEndpointUrl: String
+        get() = resolvedDashboardUrl.takeIf { it.isNotBlank() }
+            ?: apiServerUrl.trim().takeIf { it.isNotBlank() }
+            ?: relayUrl.trim()
+
+    val primaryHost: String
+        get() = extractHost(primaryEndpointUrl).orEmpty()
+
     companion object {
         /**
          * The pre-multi-connection EncryptedSharedPreferences filename. Matches
@@ -94,6 +114,8 @@ data class Connection(
         const val LEGACY_TOKEN_STORE_KEY: String = "hermes_companion_auth_hw"
 
         const val DEFAULT_DASHBOARD_PORT: Int = 9119
+        const val DEFAULT_API_PORT: Int = 8642
+        const val DEFAULT_RELAY_PORT: Int = 8767
 
         /**
          * Derive a stable per-connection EncryptedSharedPreferences filename
@@ -111,12 +133,40 @@ data class Connection(
          * user typed a malformed value — better to show something recognizable
          * than to crash).
          */
-        fun extractDefaultLabel(apiServerUrl: String): String {
-            return try {
-                URI(apiServerUrl).host ?: apiServerUrl
-            } catch (_: Exception) {
-                apiServerUrl
-            }
+        fun extractDefaultLabel(apiServerUrl: String): String =
+            extractHost(apiServerUrl) ?: apiServerUrl
+
+        /** Preserve explicit labels while upgrading an auto-generated IP label to a discovered host name. */
+        fun chooseDiscoveredLabel(
+            currentLabel: String,
+            primaryHost: String,
+            discoveredHostname: String?,
+        ): String {
+            val current = currentLabel.trim()
+            val discovered = discoveredHostname?.trim()?.takeIf { it.isNotBlank() }
+            val isAutomatic = current.isBlank() || current.equals(primaryHost.trim(), ignoreCase = true)
+            return if (isAutomatic && discovered != null) discovered else currentLabel
+        }
+
+        /**
+         * Dashboard-first label for a connection whose surfaces are optional.
+         * The one-argument overload above remains for source compatibility.
+         */
+        fun extractDefaultLabel(
+            dashboardUrl: String?,
+            apiServerUrl: String,
+            relayUrl: String,
+        ): String {
+            val primary = dashboardUrl?.trim()?.takeIf { it.isNotBlank() }
+                ?: apiServerUrl.trim().takeIf { it.isNotBlank() }
+                ?: relayUrl.trim()
+            return extractHost(primary) ?: primary
+        }
+
+        private fun extractHost(url: String): String? = try {
+            URI(url).host
+        } catch (_: Exception) {
+            null
         }
 
         fun deriveDefaultDashboardUrl(
@@ -141,6 +191,29 @@ data class Connection(
             return "$scheme://$hostPart:$dashboardPort"
         }
 
+        /** Derive the conventional same-host direct API fallback from a Dashboard URL. */
+        fun deriveDefaultApiUrl(
+            dashboardUrl: String,
+            apiPort: Int = DEFAULT_API_PORT,
+        ): String? {
+            val trimmed = dashboardUrl.trim().trimEnd('/')
+            if (trimmed.isEmpty()) return null
+
+            val uri = runCatching { URI(trimmed) }.getOrNull() ?: return null
+            val scheme = when (uri.scheme?.lowercase()) {
+                "http" -> "http"
+                "https" -> "https"
+                else -> return null
+            }
+            val host = uri.host?.takeIf { it.isNotBlank() } ?: return null
+            val hostPart = if (host.contains(":") && !host.startsWith("[")) {
+                "[$host]"
+            } else {
+                host
+            }
+            return "$scheme://$hostPart:$apiPort"
+        }
+
         fun isAutoManagedDashboardUrl(dashboardUrl: String?, apiServerUrl: String): Boolean {
             val trimmed = dashboardUrl?.trim()?.trimEnd('/').orEmpty()
             if (trimmed.isEmpty()) return true
@@ -150,7 +223,7 @@ data class Connection(
 
         fun deriveDefaultRelayUrl(
             apiServerUrl: String,
-            relayPort: Int = 8767,
+            relayPort: Int = DEFAULT_RELAY_PORT,
         ): String? {
             val trimmed = apiServerUrl.trim().trimEnd('/')
             if (trimmed.isEmpty()) return null
@@ -199,7 +272,7 @@ data class Connection(
 
             return routes
                 .distinctBy {
-                    "${it.role.lowercase()}|${it.api.host.lowercase()}:${it.api.port}"
+                    "${it.role.lowercase()}|${it.routeAuthority()}"
                 }
                 .sortedWith(compareBy<EndpointCandidate> { it.priority }.thenBy { it.role })
         }
@@ -222,13 +295,13 @@ data class Connection(
             existing: List<EndpointCandidate>,
         ): List<EndpointCandidate> {
             val rebuiltHostPorts = rebuilt
-                .map { "${it.api.host.lowercase()}:${it.api.port}" }
+                .mapNotNull { it.mergeAuthority() }
                 .toSet()
             val preserved = existing
                 .filter { it.priority > 0 }
-                .filterNot { "${it.api.host.lowercase()}:${it.api.port}" in rebuiltHostPorts }
+                .filterNot { it.mergeAuthority() in rebuiltHostPorts }
             return (rebuilt + preserved)
-                .distinctBy { "${it.role.lowercase()}|${it.api.host.lowercase()}:${it.api.port}" }
+                .distinctBy { "${it.role.lowercase()}|${it.routeAuthority()}" }
                 .sortedWith(compareBy<EndpointCandidate> { it.priority }.thenBy { it.role })
         }
 
@@ -296,6 +369,85 @@ data class Connection(
             )
         }
 
+        /**
+         * De-duplication identity for rebuilding stored routes. Prefer the
+         * legacy API authority when present so an older API-only candidate and
+         * its dashboard-enriched replacement still collide. Dashboard-only
+         * candidates fall back to their primary route authority.
+         */
+        private fun EndpointCandidate.mergeAuthority(): String? =
+            api?.let { endpoint -> "api|${endpoint.host.lowercase()}:${endpoint.port}" }
+                ?: routeAuthority()?.let { authority -> "route|$authority" }
+
+        /**
+         * Build a Dashboard/Gateway-primary route from a remote host or URL.
+         * API and Relay are retained only when explicitly configured; callers
+         * no longer need to invent an API key or legacy surface URL.
+         */
+        fun endpointCandidateFromDashboardUrl(
+            role: String,
+            priority: Int,
+            dashboardUrl: String,
+            apiServerUrl: String? = null,
+            relayUrl: String? = null,
+        ): EndpointCandidate? {
+            val normalizedDashboard = normalizeDashboardUrlInput(dashboardUrl)
+            val dashboardUri = runCatching { URI(normalizedDashboard) }.getOrNull() ?: return null
+            if (dashboardUri.scheme?.lowercase() !in setOf("http", "https") ||
+                dashboardUri.host.isNullOrBlank()
+            ) return null
+
+            val api = apiServerUrl
+                ?.trim()
+                ?.takeIf { it.isNotBlank() }
+                ?.let { apiUrl ->
+                    val apiUri = runCatching { URI(apiUrl.trimEnd('/')) }.getOrNull()
+                        ?: return@let null
+                    val tls = when (apiUri.scheme?.lowercase()) {
+                        "http" -> false
+                        "https" -> true
+                        else -> return@let null
+                    }
+                    val host = apiUri.host?.takeIf { it.isNotBlank() } ?: return@let null
+                    ApiEndpoint(host, if (apiUri.port > 0) apiUri.port else 8642, tls)
+                }
+            val relay = relayUrl
+                ?.trim()
+                ?.takeIf { it.isNotBlank() }
+                ?.let { url ->
+                    val hint = when {
+                        url.startsWith("wss://", ignoreCase = true) -> "wss"
+                        url.startsWith("ws://", ignoreCase = true) -> "ws"
+                        else -> null
+                    }
+                    RelayEndpoint(url, hint)
+                }
+            return EndpointCandidate(
+                role = role.ifBlank { inferRouteRole(normalizedDashboard) },
+                priority = priority,
+                dashboard = DashboardEndpoint(normalizedDashboard),
+                api = api,
+                relay = relay,
+            )
+        }
+
+        fun normalizeDashboardUrlInput(
+            raw: String,
+            defaultPort: Int = DEFAULT_DASHBOARD_PORT,
+        ): String {
+            val trimmed = raw.trim().trimEnd('/')
+            if (trimmed.isEmpty()) return trimmed
+            if (SCHEME_REGEX.containsMatchIn(trimmed)) return trimmed
+            val withScheme = "http://$trimmed"
+            val uri = runCatching { URI(withScheme) }.getOrNull()
+            val canAppendPort = uri != null &&
+                !uri.host.isNullOrBlank() &&
+                uri.port <= 0 &&
+                uri.rawPath.isNullOrEmpty() &&
+                uri.rawQuery == null
+            return if (canAppendPort) "$withScheme:$defaultPort" else withScheme
+        }
+
         fun inferRouteRole(apiServerUrl: String): String {
             val host = runCatching { URI(apiServerUrl.trim().trimEnd('/')).host }
                 .getOrNull()

app/src/main/kotlin/com/hermesandroid/relay/data/ConnectionStore.kt

@@ -60,6 +60,7 @@ import kotlinx.serialization.json.Json
 class ConnectionStore private constructor(
     private val dataStore: DataStore<Preferences>,
     private val context: Context?,
+    private val scope: CoroutineScope,
 ) {
 
     /**
@@ -71,6 +72,7 @@ class ConnectionStore private constructor(
     constructor(context: Context) : this(
         dataStore = context.relayDataStore,
         context = context.applicationContext,
+        scope = CoroutineScope(Dispatchers.Default + SupervisorJob()),
     )
 
     /**
@@ -81,9 +83,13 @@ class ConnectionStore private constructor(
     internal constructor(dataStore: DataStore<Preferences>) : this(
         dataStore = dataStore,
         context = null,
+        scope = CoroutineScope(Dispatchers.Default + SupervisorJob()),
     )
 
-    private val scope = CoroutineScope(Dispatchers.Default + SupervisorJob())
+    internal constructor(
+        dataStore: DataStore<Preferences>,
+        scope: CoroutineScope,
+    ) : this(dataStore = dataStore, context = null, scope = scope)
 
     private val json = Json {
         ignoreUnknownKeys = true
@@ -100,6 +106,13 @@ class ConnectionStore private constructor(
     private val _activeConnectionId = MutableStateFlow<String?>(null)
     val activeConnectionId: StateFlow<String?> = _activeConnectionId.asStateFlow()
 
+    /**
+     * Optional cold-start pin. `null` means restore the last connection the
+     * user actively selected, which remains the recommended default.
+     */
+    private val _startupConnectionId = MutableStateFlow<String?>(null)
+    val startupConnectionId: StateFlow<String?> = _startupConnectionId.asStateFlow()
+
     /**
      * Flips to `true` once the initial DataStore hydrate completes (success OR
      * failure). Until then [connections] / [activeConnection] hold their empty
@@ -128,6 +141,7 @@ class ConnectionStore private constructor(
                 val oldJson = prefs[KEY_LEGACY_PROFILES]
                 val activeNew = prefs[KEY_ACTIVE_CONNECTION_ID]
                 val activeOld = prefs[KEY_LEGACY_ACTIVE_PROFILE_ID]
+                val startupId = prefs[KEY_STARTUP_CONNECTION_ID]
 
                 // Prefer the new key. If absent and the old key has data,
                 // migrate it once: write to the new key and clear the old ones
@@ -143,15 +157,21 @@ class ConnectionStore private constructor(
                             p.remove(KEY_LEGACY_ACTIVE_PROFILE_ID)
                         }
                     }
-                    _connections.value = decodeConnections(oldJson)
-                    _activeConnectionId.value = activeOld
+                    val restored = decodeConnections(oldJson)
+                    val validStartupId = startupId?.takeIf { id -> restored.any { it.id == id } }
+                    _connections.value = restored
+                    _startupConnectionId.value = validStartupId
+                    _activeConnectionId.value = validStartupId ?: activeOld
                     Log.i(
                         TAG,
                         "Migrated legacy DataStore keys (profiles_v1 → connections_v1)",
                     )
                 } else {
-                    _connections.value = decodeConnections(newJson)
-                    _activeConnectionId.value = activeNew
+                    val restored = decodeConnections(newJson)
+                    val validStartupId = startupId?.takeIf { id -> restored.any { it.id == id } }
+                    _connections.value = restored
+                    _startupConnectionId.value = validStartupId
+                    _activeConnectionId.value = validStartupId ?: activeNew
                 }
             } catch (e: Exception) {
                 Log.w(TAG, "Initial hydrate failed: ${e.message}")
@@ -229,6 +249,10 @@ class ConnectionStore private constructor(
                     prefs.remove(KEY_ACTIVE_CONNECTION_ID)
                     _activeConnectionId.value = null
                 }
+                if (prefs[KEY_STARTUP_CONNECTION_ID] == id) {
+                    prefs.remove(KEY_STARTUP_CONNECTION_ID)
+                    _startupConnectionId.value = null
+                }
             }
             removed?.let { deleteTokenStoresFor(it) }
         }
@@ -247,10 +271,12 @@ class ConnectionStore private constructor(
                 removed = decodeConnections(prefs[KEY_CONNECTIONS])
                 prefs.remove(KEY_CONNECTIONS)
                 prefs.remove(KEY_ACTIVE_CONNECTION_ID)
+                prefs.remove(KEY_STARTUP_CONNECTION_ID)
                 prefs.remove(KEY_LEGACY_PROFILES)
                 prefs.remove(KEY_LEGACY_ACTIVE_PROFILE_ID)
                 _connections.value = emptyList()
                 _activeConnectionId.value = null
+                _startupConnectionId.value = null
             }
             removed.forEach { deleteTokenStoresFor(it) }
         }
@@ -259,6 +285,7 @@ class ConnectionStore private constructor(
     suspend fun replaceConnections(
         connections: List<Connection>,
         activeConnectionId: String? = null,
+        startupConnectionId: String? = null,
     ) {
         writeMutex.withLock {
             var removed: List<Connection> = emptyList()
@@ -266,6 +293,8 @@ class ConnectionStore private constructor(
             val normalizedActiveId = activeConnectionId
                 ?.takeIf { id -> normalizedConnections.any { it.id == id } }
                 ?: normalizedConnections.firstOrNull()?.id
+            val normalizedStartupId = startupConnectionId
+                ?.takeIf { id -> normalizedConnections.any { it.id == id } }
 
             dataStore.edit { prefs ->
                 removed = decodeConnections(prefs[KEY_CONNECTIONS])
@@ -281,8 +310,14 @@ class ConnectionStore private constructor(
                 }
                 prefs.remove(KEY_LEGACY_PROFILES)
                 prefs.remove(KEY_LEGACY_ACTIVE_PROFILE_ID)
+                if (normalizedStartupId == null) {
+                    prefs.remove(KEY_STARTUP_CONNECTION_ID)
+                } else {
+                    prefs[KEY_STARTUP_CONNECTION_ID] = normalizedStartupId
+                }
                 _connections.value = normalizedConnections
-                _activeConnectionId.value = normalizedActiveId
+                _activeConnectionId.value = normalizedStartupId ?: normalizedActiveId
+                _startupConnectionId.value = normalizedStartupId
             }
             removed.forEach { deleteTokenStoresFor(it) }
         }
@@ -315,12 +350,44 @@ class ConnectionStore private constructor(
     suspend fun setActiveConnection(id: String) {
         writeMutex.withLock {
             dataStore.edit { prefs ->
+                val current = decodeConnections(prefs[KEY_CONNECTIONS])
+                if (current.any { it.id == id }) {
+                    val next = current.map { connection ->
+                        if (connection.id == id) {
+                            connection.copy(lastUsedAt = System.currentTimeMillis())
+                        } else {
+                            connection
+                        }
+                    }
+                    prefs[KEY_CONNECTIONS] = encodeConnections(next)
+                    _connections.value = next
+                }
                 prefs[KEY_ACTIVE_CONNECTION_ID] = id
                 _activeConnectionId.value = id
             }
         }
     }
 
+    /** Set a specific cold-start connection, or `null` to restore last used. */
+    suspend fun setStartupConnection(id: String?) {
+        writeMutex.withLock {
+            dataStore.edit { prefs ->
+                val validId = id?.takeIf { candidate ->
+                    decodeConnections(prefs[KEY_CONNECTIONS]).any { it.id == candidate }
+                }
+                if (validId == null) {
+                    prefs.remove(KEY_STARTUP_CONNECTION_ID)
+                    _activeConnectionId.value?.let { activeId ->
+                        prefs[KEY_ACTIVE_CONNECTION_ID] = activeId
+                    }
+                } else {
+                    prefs[KEY_STARTUP_CONNECTION_ID] = validId
+                }
+                _startupConnectionId.value = validId
+            }
+        }
+    }
+
     /**
      * Update just the `lastActiveSessionId` on the identified connection.
      * Called whenever the user picks a chat session so connection-switch can
@@ -504,6 +571,7 @@ class ConnectionStore private constructor(
 
         private val KEY_CONNECTIONS = stringPreferencesKey("connections_v1")
         private val KEY_ACTIVE_CONNECTION_ID = stringPreferencesKey("active_connection_id")
+        private val KEY_STARTUP_CONNECTION_ID = stringPreferencesKey("startup_connection_id")
 
         // Pre-rename DataStore keys — read once in init on first launch after
         // the rename, then wiped. See the init block above.

app/src/main/kotlin/com/hermesandroid/relay/data/ConnectionValidation.kt

@@ -52,6 +52,45 @@ object ConnectionValidation {
         kind = "relay URL",
     )
 
+    /** Dashboard/Gateway URL must be HTTP(S) when configured. */
+    fun validateDashboardUrl(raw: String): String? = validateOptionalUrl(
+        raw = raw,
+        allowedSchemes = setOf("http", "https"),
+        kind = "Dashboard URL",
+    )
+
+    /** A blank API server means the optional SSE fallback is not configured. */
+    fun validateOptionalApiServerUrl(raw: String): String? = validateOptionalUrl(
+        raw = raw,
+        allowedSchemes = setOf("http", "https"),
+        kind = "API server URL",
+    )
+
+    /** A blank Relay URL means Relay-only power features are not configured. */
+    fun validateOptionalRelayUrl(raw: String): String? = validateOptionalUrl(
+        raw = raw,
+        allowedSchemes = setOf("ws", "wss"),
+        kind = "relay URL",
+    )
+
+    /**
+     * Validate the independently optional connection surfaces. A connection
+     * needs at least one endpoint, but Dashboard-only, API-only, and
+     * Relay-only records are all structurally valid.
+     */
+    fun validateConnectionEndpoints(
+        dashboardUrl: String?,
+        apiServerUrl: String,
+        relayUrl: String,
+    ): String? {
+        if (dashboardUrl.isNullOrBlank() && apiServerUrl.isBlank() && relayUrl.isBlank()) {
+            return "Configure at least one Hermes endpoint"
+        }
+        return validateDashboardUrl(dashboardUrl.orEmpty())
+            ?: validateOptionalApiServerUrl(apiServerUrl)
+            ?: validateOptionalRelayUrl(relayUrl)
+    }
+
     /**
      * Catches the "added the same server twice" mistake. Matches when the
      * candidate's api + relay URLs exactly match an existing connection
@@ -67,12 +106,33 @@ object ConnectionValidation {
         apiServerUrl: String,
         relayUrl: String,
         excludeId: String? = null,
+        dashboardUrl: String? = null,
     ): Connection? = connections.firstOrNull { c ->
-        c.id != excludeId &&
-            c.apiServerUrl.equals(apiServerUrl, ignoreCase = true) &&
-            c.relayUrl.equals(relayUrl, ignoreCase = true)
+        if (c.id == excludeId) {
+            false
+        } else {
+            val legacyExactMatch =
+                (apiServerUrl.isNotBlank() || relayUrl.isNotBlank()) &&
+                    urlsEqual(c.apiServerUrl, apiServerUrl) &&
+                    urlsEqual(c.relayUrl, relayUrl)
+            val candidateDashboard = dashboardUrl
+                ?.takeIf { it.isNotBlank() }
+                ?: Connection.deriveDefaultDashboardUrl(apiServerUrl)
+            val dashboardMatch = !candidateDashboard.isNullOrBlank() &&
+                urlsEqual(c.resolvedDashboardUrl, candidateDashboard)
+            legacyExactMatch || dashboardMatch
+        }
     }
 
+    private fun validateOptionalUrl(
+        raw: String,
+        allowedSchemes: Set<String>,
+        kind: String,
+    ): String? = if (raw.isBlank()) null else validateUrl(raw, allowedSchemes, kind)
+
+    private fun urlsEqual(first: String, second: String): Boolean =
+        first.trim().trimEnd('/').equals(second.trim().trimEnd('/'), ignoreCase = true)
+
     private fun validateUrl(raw: String, allowedSchemes: Set<String>, kind: String): String? {
         val trimmed = raw.trim()
         if (trimmed.isEmpty()) return "$kind can't be blank"

app/src/main/kotlin/com/hermesandroid/relay/data/DataManager.kt

@@ -72,10 +72,11 @@ class DataManager(
      *  - v5 (2026-06-08): full connection backups. Adds active connection id
      *    and `connectionSecrets`, including API keys, relay tokens, device id,
      *    paired metadata, and dashboard cookies.
+     *  - v6 (2026-07-19): preserves the optional pinned startup connection.
      */
     @Serializable
     data class AppBackup(
-        val version: Int = 5,
+        val version: Int = 6,
         val serverUrl: String? = null, // legacy (v1 compat)
         val apiServerUrl: String? = null,
         val relayUrl: String? = null,
@@ -83,6 +84,7 @@ class DataManager(
         val onboardingCompleted: Boolean = false,
         val connections: List<Connection> = emptyList(),
         val activeConnectionId: String? = null,
+        val startupConnectionId: String? = null,
         val containsSensitiveData: Boolean = true,
         val connectionSecrets: List<ConnectionSecretBackup> = emptyList(),
         val exportedAt: Long = System.currentTimeMillis(),
@@ -160,6 +162,7 @@ class DataManager(
             onboardingCompleted = onboardingCompleted,
             connections = connectionsSnapshot,
             activeConnectionId = connectionStore?.activeConnectionId?.value,
+            startupConnectionId = connectionStore?.startupConnectionId?.value,
             containsSensitiveData = true,
             connectionSecrets = connectionSecrets,
             exportedAt = System.currentTimeMillis(),
@@ -173,6 +176,7 @@ class DataManager(
         store.replaceConnections(
             connections = backup.connections,
             activeConnectionId = backup.activeConnectionId,
+            startupConnectionId = backup.startupConnectionId,
         )
 
         val connectionsById = backup.connections.associateBy { it.id }
@@ -251,9 +255,11 @@ class DataManager(
     suspend fun writeBackupToUri(uri: Uri, backup: String): Boolean {
         return withContext(Dispatchers.IO) {
             try {
-                context.contentResolver.openOutputStream(uri)?.use { outputStream ->
-                    outputStream.write(backup.toByteArray(Charsets.UTF_8))
-                    outputStream.flush()
+                val outputStream = context.contentResolver.openOutputStream(uri)
+                    ?: return@withContext false
+                outputStream.use {
+                    it.write(backup.toByteArray(Charsets.UTF_8))
+                    it.flush()
                 }
                 true
             } catch (e: Exception) {
@@ -284,9 +290,10 @@ class DataManager(
      * - Clear DataStore preferences
      * - Clear EncryptedSharedPreferences (auth tokens)
      * - Clear any cached data
-     * Does NOT clear the onboarding flag (that's separate via [resetOnboarding]).
+     * Preserves the onboarding flag. Use [resetOnboarding] when the next launch
+     * should show onboarding again.
      */
-    suspend fun resetAppData() {
+    suspend fun resetAppData(): Boolean =
         try {
             // Preserve onboarding state before clearing
             val onboarding = isOnboardingCompleted()
@@ -316,10 +323,11 @@ class DataManager(
             }
 
             Log.d(TAG, "App data reset complete")
+            true
         } catch (e: Exception) {
             Log.e(TAG, "Failed to reset app data", e)
+            false
         }
-    }
 
     private suspend fun deleteSensitivePreferenceFiles() {
         withContext(Dispatchers.IO) {
@@ -380,16 +388,17 @@ class DataManager(
      * Reset only the onboarding completion flag.
      * Next app launch will show onboarding again.
      */
-    suspend fun resetOnboarding() {
+    suspend fun resetOnboarding(): Boolean =
         try {
             context.relayDataStore.edit { preferences ->
                 preferences.remove(KEY_ONBOARDING_COMPLETED)
             }
             Log.d(TAG, "Onboarding flag reset")
+            true
         } catch (e: Exception) {
             Log.e(TAG, "Failed to reset onboarding flag", e)
+            false
         }
-    }
 
     /**
      * Check if onboarding has been completed.
@@ -408,13 +417,14 @@ class DataManager(
     /**
      * Mark onboarding as completed.
      */
-    suspend fun setOnboardingCompleted(completed: Boolean) {
+    suspend fun setOnboardingCompleted(completed: Boolean): Boolean =
         try {
             context.relayDataStore.edit { preferences ->
                 preferences[KEY_ONBOARDING_COMPLETED] = completed
             }
+            true
         } catch (e: Exception) {
             Log.e(TAG, "Failed to set onboarding completed", e)
+            false
         }
-    }
 }

app/src/main/kotlin/com/hermesandroid/relay/data/Endpoint.kt

@@ -2,6 +2,7 @@ package com.hermesandroid.relay.data
 
 import kotlinx.serialization.SerialName
 import kotlinx.serialization.Serializable
+import java.net.URI
 
 /**
  * One entry in a pairing payload's `endpoints` array (ADR 24 — multi-endpoint
@@ -38,8 +39,10 @@ import kotlinx.serialization.Serializable
 data class EndpointCandidate(
     val role: String,
     val priority: Int = 0,
-    val api: ApiEndpoint,
-    val relay: RelayEndpoint,
+    /** Optional legacy/API-server surface. Dashboard-only routes omit it. */
+    val api: ApiEndpoint? = null,
+    /** Optional Hermes-Relay bridge surface. Standard upstream routes omit it. */
+    val relay: RelayEndpoint? = null,
     val dashboard: DashboardEndpoint? = null,
     val proxy: ProxyEndpoint? = null,
     val security: String? = null,
@@ -137,13 +140,42 @@ fun EndpointCandidate.displayLabel(): String {
     return when (role.lowercase()) {
         "lan" -> "LAN"
         "tailscale" -> "Tailscale"
-        "public" -> if (api.tls) "HTTPS" else "Public"
+        "public" -> if (primaryRouteUrl()?.startsWith("https://", ignoreCase = true) == true) {
+            "HTTPS"
+        } else {
+            "Public"
+        }
         "https" -> "HTTPS"
         "plugin_proxy", "plugin-proxy" -> "Plugin proxy"
         else -> "Custom VPN ($role)"
     }
 }
 
+/** Dashboard-first URL identity for routing, diagnostics, and UI labels. */
+fun EndpointCandidate.primaryRouteUrl(): String? =
+    dashboard?.url?.trim()?.trimEnd('/')?.takeIf { it.isNotBlank() }
+        ?: api?.url
+        ?: relay?.url?.trim()?.trimEnd('/')?.takeIf { it.isNotBlank() }
+        ?: proxy?.url?.trim()?.trimEnd('/')?.takeIf { it.isNotBlank() }
+
+/** Stable host/port identity without assuming that an API surface exists. */
+fun EndpointCandidate.routeAuthority(): String? {
+    val rawUrl = primaryRouteUrl() ?: return null
+    val httpUrl = when {
+        rawUrl.startsWith("ws://", ignoreCase = true) -> "http://${rawUrl.substringAfter("://")}"
+        rawUrl.startsWith("wss://", ignoreCase = true) -> "https://${rawUrl.substringAfter("://")}"
+        else -> rawUrl
+    }
+    val uri = runCatching { URI(httpUrl) }.getOrNull() ?: return null
+    val host = uri.host?.lowercase()?.takeIf { it.isNotBlank() } ?: return null
+    val port = when {
+        uri.port > 0 -> uri.port
+        uri.scheme.equals("https", ignoreCase = true) -> 443
+        else -> 80
+    }
+    return "$host:$port"
+}
+
 fun EndpointCandidate.hasSecureProxy(): Boolean =
     proxy?.url?.startsWith("https://", ignoreCase = true) == true ||
         proxy?.url?.startsWith("wss://", ignoreCase = true) == true ||

app/src/main/kotlin/com/hermesandroid/relay/data/FeatureFlags.kt

@@ -10,7 +10,8 @@ import kotlinx.coroutines.flow.map
 /**
  * Feature flags with compile-time defaults and runtime overrides.
  *
- * In debug builds, all features are unlocked by default.
+ * In debug builds, Developer Options are unlocked by default until the user
+ * explicitly locks them.
  * In release builds, experimental features are hidden unless the user
  * enables Developer Options (tap version 7 times in Settings > About).
  *
@@ -21,7 +22,6 @@ object FeatureFlags {
 
     // DataStore keys
     private val KEY_DEV_OPTIONS_UNLOCKED = booleanPreferencesKey("dev_options_unlocked")
-    private val KEY_RELAY_ENABLED = booleanPreferencesKey("feature_relay_enabled")
 
     /** Whether the app is running a debug build. */
     val isDevBuild: Boolean get() = BuildConfig.DEV_MODE
@@ -29,13 +29,7 @@ object FeatureFlags {
     /** Observe whether Developer Options have been unlocked. */
     fun devOptionsUnlocked(context: Context): Flow<Boolean> =
         context.relayDataStore.data.map { prefs ->
-            if (isDevBuild) true else prefs[KEY_DEV_OPTIONS_UNLOCKED] ?: false
-        }
-
-    /** Observe whether relay features (settings, pairing, onboarding pages) are enabled. */
-    fun relayEnabled(context: Context): Flow<Boolean> =
-        context.relayDataStore.data.map { prefs ->
-            if (isDevBuild) true else prefs[KEY_RELAY_ENABLED] ?: false
+            prefs[KEY_DEV_OPTIONS_UNLOCKED] ?: isDevBuild
         }
 
     /** Unlock Developer Options. */
@@ -45,18 +39,10 @@ object FeatureFlags {
         }
     }
 
-    /** Lock Developer Options and disable all experimental features. */
+    /** Lock Developer Options, including in debug builds. */
     suspend fun lockDevOptions(context: Context) {
         context.relayDataStore.edit { prefs ->
             prefs[KEY_DEV_OPTIONS_UNLOCKED] = false
-            prefs[KEY_RELAY_ENABLED] = false
-        }
-    }
-
-    /** Toggle relay features (terminal/bridge settings, pairing, onboarding relay page). */
-    suspend fun setRelayEnabled(context: Context, enabled: Boolean) {
-        context.relayDataStore.edit { prefs ->
-            prefs[KEY_RELAY_ENABLED] = enabled
         }
     }
 

app/src/main/kotlin/com/hermesandroid/relay/network/relay/ConnectionManager.kt

@@ -9,6 +9,7 @@ import android.util.Log
 import com.hermesandroid.relay.R
 import com.hermesandroid.relay.auth.CertPinStore
 import com.hermesandroid.relay.data.EndpointCandidate
+import com.hermesandroid.relay.data.primaryRouteUrl
 import com.hermesandroid.relay.data.PairingPreferences
 import com.hermesandroid.relay.diagnostics.DiagnosticCategory
 import com.hermesandroid.relay.diagnostics.DiagnosticSeverity
@@ -325,17 +326,18 @@ class ConnectionManager(
         // the synthesized list just collapses to the same URL anyway.
         scope.launch {
             val resolved = resolveBestEndpointSafe()
-            val targetUrl = resolved?.relay?.url ?: url
+            val resolvedRelayUrl = resolved?.relay?.url?.takeIf { it.isNotBlank() }
+            val targetUrl = resolvedRelayUrl ?: url.takeIf { it.isNotBlank() }
             if (resolved != null) {
                 _activeEndpoint.value = resolved
                 Log.i(TAG, "connect: resolver picked role=${resolved.role} " +
-                    "relay=${resolved.relay.url} (fallback would have been $url)")
+                    "route=${resolved.primaryRouteUrl()} (relay fallback would have been $url)")
                 DiagnosticsLog.record(
                     category = DiagnosticCategory.Relay,
                     severity = DiagnosticSeverity.Info,
                     title = context?.getString(R.string.conn_diag_route_selected) ?: "Relay route selected",
                     endpointRole = resolved.role,
-                    url = resolved.relay.url,
+                    url = resolved.primaryRouteUrl(),
                 )
             } else {
                 _activeEndpoint.value = null
@@ -348,7 +350,11 @@ class ConnectionManager(
                     url = url,
                 )
             }
-            connectToUrlOnMainPath(targetUrl)
+            if (targetUrl != null) {
+                connectToUrlOnMainPath(targetUrl)
+            } else {
+                Log.d(TAG, "connect: selected route has no Relay surface; route published for HTTP/Gateway clients")
+            }
         }
     }
 
@@ -656,10 +662,11 @@ class ConnectionManager(
             // (connectToUrlOnMainPath force-sets shouldReconnect = true, so
             // the swap path never re-checked it.)
             if (!shouldReconnect) return@launch
-            val normalizedNew = normalizeRelayUrl(resolved.relay.url)
+            val relayUrl = resolved.relay?.url?.takeIf { it.isNotBlank() } ?: return@launch
+            val normalizedNew = normalizeRelayUrl(relayUrl)
             if (normalizedNew != current) {
                 Log.i(TAG, "network change: swapping $current → $normalizedNew")
-                connectToUrlOnMainPath(resolved.relay.url, closeReason)
+                connectToUrlOnMainPath(relayUrl, closeReason)
             } else if (_connectionState.value == ConnectionState.Disconnected &&
                 reconnectGate()
             ) {

app/src/main/kotlin/com/hermesandroid/relay/network/relay/RelayHttpClient.kt

@@ -135,6 +135,91 @@ class RelayHttpClient(
         val text: String,
     )
 
+    @Serializable
+    data class ImageActivitySnapshot(
+        @SerialName("session_id") val sessionId: String,
+        val profile: String,
+        val activities: List<ImageActivity> = emptyList(),
+    )
+
+    @Serializable
+    data class ImageActivity(
+        @SerialName("call_id") val callId: String,
+        @SerialName("tool_name") val toolName: String,
+        val state: String,
+        @SerialName("started_at") val startedAt: Double,
+        @SerialName("completed_at") val completedAt: Double? = null,
+    )
+
+    /**
+     * Poll the optional Relay image lifecycle bridge. A null success means the
+     * connected Relay predates the endpoint; callers should stop polling and
+     * continue using native Gateway events without surfacing an error.
+     */
+    suspend fun fetchImageActivity(
+        profile: String,
+        sessionId: String,
+        sinceEpochSeconds: Double,
+    ): Result<ImageActivitySnapshot?> = withContext(Dispatchers.IO) {
+        val relayUrl = relayUrlProvider()?.trim().orEmpty()
+        if (relayUrl.isEmpty()) {
+            return@withContext Result.failure(
+                IllegalStateException("Relay URL not configured")
+            )
+        }
+        val sessionToken = sessionTokenProvider()
+        if (sessionToken.isNullOrBlank()) {
+            return@withContext Result.failure(
+                IllegalStateException("Relay not paired — session token missing")
+            )
+        }
+
+        val httpBase = relayUrl
+            .replace(Regex("^wss://", RegexOption.IGNORE_CASE), "https://")
+            .replace(Regex("^ws://", RegexOption.IGNORE_CASE), "http://")
+            .trimEnd('/')
+        val url = try {
+            "$httpBase/chat/image-activity".toHttpUrl().newBuilder()
+                .addQueryParameter("profile", profile)
+                .addQueryParameter("session_id", sessionId)
+                .addQueryParameter("since", sinceEpochSeconds.toString())
+                .build()
+        } catch (e: IllegalArgumentException) {
+            return@withContext Result.failure(IOException("Invalid relay URL: ${e.message}"))
+        }
+        val request = Request.Builder()
+            .url(url)
+            .get()
+            .header("Authorization", "Bearer $sessionToken")
+            .header("Accept", "application/json")
+            .build()
+        val activityClient = okHttpClient.newBuilder()
+            .callTimeout(3, java.util.concurrent.TimeUnit.SECONDS)
+            .build()
+
+        try {
+            activityClient.newCall(request).execute().use { response ->
+                if (response.code == 404) {
+                    return@withContext Result.success(null)
+                }
+                if (!response.isSuccessful) {
+                    return@withContext Result.failure(
+                        IOException("Image activity request failed (HTTP ${response.code})")
+                    )
+                }
+                val body = response.body?.string().orEmpty()
+                if (body.isBlank()) {
+                    return@withContext Result.failure(IOException("Empty response body"))
+                }
+                Result.success(
+                    sessionsJson.decodeFromString(ImageActivitySnapshot.serializer(), body)
+                )
+            }
+        } catch (e: Exception) {
+            Result.failure(e)
+        }
+    }
+
     /**
      * Fetch `GET /media/<token>` from the relay over HTTP(S). Returns a
      * [Result] — success carries a [FetchedMedia], failure wraps the
@@ -615,6 +700,14 @@ class RelayHttpClient(
         val capabilities: List<String> = emptyList(),
         val profiles: List<RelayProfileInfo> = emptyList(),
         val health: String = "unknown",
+        @SerialName("gateway_heartbeat") val gatewayHeartbeat: GatewayHeartbeat? = null,
+    )
+
+    @Serializable
+    data class GatewayHeartbeat(
+        val status: String = "missing",
+        val supported: Boolean = false,
+        @SerialName("age_seconds") val ageSeconds: Int? = null,
     )
 
     /** Fetch the installed plugin/protocol/profile capability contract. */

app/src/main/kotlin/com/hermesandroid/relay/network/relay/RelayVoiceClient.kt

@@ -834,6 +834,11 @@ class RelayVoiceClient(
     suspend fun runVoiceOutput(
         text: String,
         renderMode: String? = "verbatim",
+        provider: String? = null,
+        model: String? = null,
+        voice: String? = null,
+        sampleRate: Int? = null,
+        language: String? = null,
         onHandoff: (VoiceHandoffEvent) -> Unit = {},
         onEvent: (RealtimeVoiceEvent) -> Unit,
     ): Result<VoiceOutputSummary> = withContext(Dispatchers.IO) {
@@ -844,7 +849,15 @@ class RelayVoiceClient(
             return@withContext Result.failure(missingAuthError())
         }
 
-        val sessionResult = createVoiceOutputSession(httpBase, token)
+        val sessionResult = createVoiceOutputSession(
+            httpBase = httpBase,
+            token = token,
+            provider = provider,
+            model = model,
+            voice = voice,
+            sampleRate = sampleRate,
+            language = language,
+        )
         if (sessionResult.isFailure) {
             return@withContext Result.failure(sessionResult.exceptionOrNull() ?: IOException("Voice output session failed"))
         }
@@ -1261,8 +1274,10 @@ class RelayVoiceClient(
         inputSampleRate: Int = 16_000,
         chatSessionId: String? = null,
         conversationContext: List<RealtimeConversationContextMessage> = emptyList(),
+        provider: String? = null,
         model: String? = null,
         voice: String? = null,
+        sampleRate: Int? = null,
         onHandoff: (VoiceHandoffEvent) -> Unit = {},
         turnInputs: kotlinx.coroutines.channels.ReceiveChannel<RealtimeTurnInput>? = null,
         onTurnComplete: (RealtimeVoiceSummary) -> Unit = {},
@@ -1290,8 +1305,10 @@ class RelayVoiceClient(
             token = token,
             chatSessionId = chatSessionId,
             conversationContext = conversationContext,
+            provider = provider,
             model = model,
             voice = voice,
+            sampleRate = sampleRate,
         )
         if (sessionResult.isFailure) {
             return@withContext Result.failure(sessionResult.exceptionOrNull() ?: IOException("Realtime agent session failed"))
@@ -2658,17 +2675,25 @@ class RelayVoiceClient(
         token: String,
         chatSessionId: String?,
         conversationContext: List<RealtimeConversationContextMessage> = emptyList(),
+        provider: String? = null,
         model: String? = null,
         voice: String? = null,
+        sampleRate: Int? = null,
     ): Result<RealtimeSessionResponse> {
         val body = buildJsonObject {
             putProfile()
+            provider?.trim()?.takeIf { it.isNotBlank() }?.let {
+                put("provider", JsonPrimitive(it))
+            }
             model?.trim()?.takeIf { it.isNotBlank() }?.let {
                 put("model", JsonPrimitive(it))
             }
             voice?.trim()?.takeIf { it.isNotBlank() }?.let {
                 put("voice", JsonPrimitive(it))
             }
+            sampleRate?.takeIf { it > 0 }?.let {
+                put("sample_rate", JsonPrimitive(it))
+            }
             chatSessionId?.trim()?.takeIf { it.isNotBlank() }?.let {
                 put("chat_session_id", JsonPrimitive(it))
             }
@@ -2726,8 +2751,23 @@ class RelayVoiceClient(
         }
     }
 
-    private fun createVoiceOutputSession(httpBase: String, token: String): Result<VoiceOutputSessionResponse> {
-        val body = buildJsonObject { putProfile() }.toString()
+    private fun createVoiceOutputSession(
+        httpBase: String,
+        token: String,
+        provider: String? = null,
+        model: String? = null,
+        voice: String? = null,
+        sampleRate: Int? = null,
+        language: String? = null,
+    ): Result<VoiceOutputSessionResponse> {
+        val body = buildVoiceOutputSessionPayload(
+            profile = currentProfileName(),
+            provider = provider,
+            model = model,
+            voice = voice,
+            sampleRate = sampleRate,
+            language = language,
+        )
         val request = Request.Builder()
             .url("$httpBase/voice/output/session")
             .post(body.toRequestBody(JSON_MEDIA_TYPE))
@@ -2970,6 +3010,22 @@ class RelayVoiceClient(
     }
 }
 
+internal fun buildVoiceOutputSessionPayload(
+    profile: String?,
+    provider: String? = null,
+    model: String? = null,
+    voice: String? = null,
+    sampleRate: Int? = null,
+    language: String? = null,
+): String = buildJsonObject {
+    profile?.trim()?.takeIf { it.isNotBlank() }?.let { put("profile", JsonPrimitive(it)) }
+    provider?.trim()?.takeIf { it.isNotBlank() }?.let { put("provider", JsonPrimitive(it)) }
+    model?.trim()?.takeIf { it.isNotBlank() }?.let { put("model", JsonPrimitive(it)) }
+    voice?.trim()?.takeIf { it.isNotBlank() }?.let { put("voice", JsonPrimitive(it)) }
+    sampleRate?.let { put("sample_rate", JsonPrimitive(it)) }
+    language?.trim()?.takeIf { it.isNotBlank() }?.let { put("language", JsonPrimitive(it)) }
+}.toString()
+
 /**
  * Wire shape of `GET /voice/config`. Providers are returned as nested
  * objects describing the currently-active STT and TTS backend. Extra

app/src/main/kotlin/com/hermesandroid/relay/network/shared/EndpointResolver.kt

@@ -4,6 +4,8 @@ import android.content.Context
 import android.util.Log
 import com.hermesandroid.relay.R
 import com.hermesandroid.relay.data.EndpointCandidate
+import com.hermesandroid.relay.data.primaryRouteUrl
+import com.hermesandroid.relay.data.routeAuthority
 import com.hermesandroid.relay.diagnostics.DiagnosticCategory
 import com.hermesandroid.relay.diagnostics.DiagnosticSeverity
 import com.hermesandroid.relay.diagnostics.DiagnosticsLog
@@ -56,7 +58,10 @@ data class RouteProbeOutcome(
  *    candidate is reachable we use it; reachability never promotes a lower
  *    priority over a higher one. Reachability is **only** the tiebreaker
  *    among candidates that share the same priority.
- *  * **Reachability probe.** `HEAD ${api.url}/health` with a 2-second
+ *  * **Reachability probe.** Dashboard-first routes use `GET
+ *    ${dashboard.url}/api/status`; legacy API routes use `GET
+ *    ${api.url}/health`. Relay-only routes use `GET ${relay.httpUrl}/health`.
+ *    Each request has a 4-second
  *    per-candidate timeout. Positive results are cached longer than negative
  *    results so repeated `connect()` calls don't hammer healthy routes, while
  *    transient handoff misses do not pin a good fallback offline.
@@ -101,6 +106,12 @@ class EndpointResolver(
      */
     private data class CacheEntry(val expiresAt: Long, val reachable: Boolean)
 
+    private data class ProbeTarget(
+        val baseUrl: String,
+        val requestUrl: String,
+        val path: String,
+    )
+
     private val probeCache = ConcurrentHashMap<String, CacheEntry>()
 
     private val _probeOutcomes = MutableStateFlow<Map<String, RouteProbeOutcome>>(emptyMap())
@@ -156,13 +167,13 @@ class EndpointResolver(
         private const val PROBE_TIMEOUT_DETAIL = "No answer (timed out)"
 
         /**
-         * Stable cache key for a candidate: `"<role>|<api.host>:<api.port>"`.
+         * Stable cache key for a candidate: `"<role>|<primary host>:<port>"`.
          * Roles are preserved case-verbatim (HMAC canonicalization contract)
          * but hostnames are lowercased — two roles pointing at the same
          * host:port share reachability state.
          */
         internal fun cacheKey(candidate: EndpointCandidate): String =
-            "${candidate.role}|${candidate.api.host.lowercase()}:${candidate.api.port}"
+            "${candidate.role}|${candidate.routeAuthority() ?: candidate.primaryRouteUrl().orEmpty().lowercase()}"
     }
 
     /**
@@ -194,14 +205,14 @@ class EndpointResolver(
             val winner = raceGroup(group)
             if (winner != null) {
                 Log.i(TAG, "resolve winner: role=${winner.role} " +
-                    "api=${winner.api.host}:${winner.api.port} priority=$priority")
+                    "route=${winner.primaryRouteUrl()} priority=$priority")
                 DiagnosticsLog.record(
                     category = DiagnosticCategory.Endpoint,
                     severity = DiagnosticSeverity.Info,
                     title = context?.getString(R.string.endpoint_diag_selected) ?: "Endpoint selected",
                     detail = "priority=$priority",
                     endpointRole = winner.role,
-                    url = winner.relay.url,
+                    url = winner.primaryRouteUrl(),
                 )
                 return winner
             }
@@ -281,7 +292,7 @@ class EndpointResolver(
     }
 
     /**
-     * One-shot HEAD /health probe against a candidate. 2-second timeout,
+     * One-shot probe against a candidate's primary configured surface.
      * no retries — callers that need retry semantics can re-invoke after
      * the cache expires.
      *
@@ -290,18 +301,19 @@ class EndpointResolver(
      */
     private suspend fun probe(candidate: EndpointCandidate): Boolean {
         val startedAtMs = clock()
-        val url = "${candidate.api.url}/health".toHttpUrlOrNull()
+        val target = probeTarget(candidate)
+        val url = target?.requestUrl?.toHttpUrlOrNull()
             ?: run {
                 Log.w(TAG, "probe: invalid url for role=${candidate.role}")
                 DiagnosticsLog.record(
                     category = DiagnosticCategory.Endpoint,
                     severity = DiagnosticSeverity.Error,
                     title = context?.getString(R.string.endpoint_diag_probe_invalid) ?: "Endpoint probe invalid",
-                    detail = "Invalid API URL",
+                    detail = "No valid Dashboard, API, or Relay URL",
                     endpointRole = candidate.role,
-                    url = candidate.api.url,
+                    url = candidate.primaryRouteUrl(),
                 )
-                recordOutcome(candidate, reachable = false, detail = "Invalid API URL")
+                recordOutcome(candidate, reachable = false, detail = "Invalid route URL")
                 return false
             }
         val fastClient = httpClient.newBuilder()
@@ -310,11 +322,14 @@ class EndpointResolver(
             .writeTimeout(PROBE_TIMEOUT_MS, TimeUnit.MILLISECONDS)
             .callTimeout(PROBE_TIMEOUT_MS, TimeUnit.MILLISECONDS)
             .build()
-        val request = Request.Builder()
+        val requestBuilder = Request.Builder()
             .url(url)
-            .head()
             .header("Accept", "*/*")
-            .build()
+        // Hermes API's aiohttp health route accepts GET but returns 405 to
+        // HEAD. That response proves connectivity while the old probe marked
+        // the route unreachable. Health payloads are tiny, so follow the
+        // endpoint's actual public contract on every surface.
+        val request = requestBuilder.get().build()
         return withContext(Dispatchers.IO) {
             try {
                 withTimeoutOrNull(PROBE_TIMEOUT_MS + 200L) {
@@ -331,13 +346,13 @@ class EndpointResolver(
                             title = probeTitle,
                             detail = if (ok) null else "HTTP ${resp.code}",
                             endpointRole = candidate.role,
-                            url = candidate.api.url,
+                            url = target.baseUrl,
                             elapsedMs = clock() - startedAtMs,
                         )
                         recordOutcome(
                             candidate,
                             reachable = ok,
-                            detail = if (ok) null else "HTTP ${resp.code} from /health",
+                            detail = if (ok) null else "HTTP ${resp.code} from ${target.path}",
                         )
                         ok
                     }
@@ -346,9 +361,9 @@ class EndpointResolver(
                         category = DiagnosticCategory.Endpoint,
                         severity = DiagnosticSeverity.Warning,
                         title = context?.getString(R.string.endpoint_diag_probe_timeout) ?: "Endpoint probe timeout",
-                        detail = "No /health response in ${PROBE_TIMEOUT_MS}ms",
+                        detail = "No ${target.path} response in ${PROBE_TIMEOUT_MS}ms",
                         endpointRole = candidate.role,
-                        url = candidate.api.url,
+                        url = target.baseUrl,
                         elapsedMs = clock() - startedAtMs,
                     )
                     recordOutcome(candidate, reachable = false, detail = PROBE_TIMEOUT_DETAIL)
@@ -359,23 +374,23 @@ class EndpointResolver(
                     category = DiagnosticCategory.Endpoint,
                     severity = DiagnosticSeverity.Warning,
                     title = context?.getString(R.string.endpoint_diag_probe_timeout) ?: "Endpoint probe timeout",
-                    detail = "No /health response in ${PROBE_TIMEOUT_MS}ms",
+                    detail = "No ${target.path} response in ${PROBE_TIMEOUT_MS}ms",
                     endpointRole = candidate.role,
-                    url = candidate.api.url,
+                    url = target.baseUrl,
                     elapsedMs = clock() - startedAtMs,
                 )
                 recordOutcome(candidate, reachable = false, detail = PROBE_TIMEOUT_DETAIL)
                 false
             } catch (e: Exception) {
                 Log.d(TAG, "probe failed role=${candidate.role} " +
-                    "host=${candidate.api.host}: ${e.javaClass.simpleName}")
+                    "route=${target.baseUrl}: ${e.javaClass.simpleName}")
                 DiagnosticsLog.record(
                     category = DiagnosticCategory.Endpoint,
                     severity = DiagnosticSeverity.Warning,
                     title = context?.getString(R.string.endpoint_diag_probe_failed) ?: "Endpoint probe failed",
                     detail = e.javaClass.simpleName,
                     endpointRole = candidate.role,
-                    url = candidate.api.url,
+                    url = target.baseUrl,
                     elapsedMs = clock() - startedAtMs,
                 )
                 recordOutcome(candidate, reachable = false, detail = humanProbeFailure(e))
@@ -384,6 +399,50 @@ class EndpointResolver(
         }
     }
 
+    /** Choose the standard Dashboard/Gateway surface first when advertised. */
+    private fun probeTarget(candidate: EndpointCandidate): ProbeTarget? {
+        candidate.dashboard?.url
+            ?.trim()
+            ?.trimEnd('/')
+            ?.takeIf { it.isNotBlank() }
+            ?.let { base ->
+                return ProbeTarget(
+                    baseUrl = base,
+                    requestUrl = "$base/api/status",
+                    path = "/api/status",
+                )
+            }
+
+        candidate.api?.url?.let { base ->
+            return ProbeTarget(
+                baseUrl = base,
+                requestUrl = "$base/health",
+                path = "/health",
+            )
+        }
+
+        candidate.relay?.url
+            ?.trim()
+            ?.trimEnd('/')
+            ?.takeIf { it.isNotBlank() }
+            ?.let { relayUrl ->
+                val httpBase = when {
+                    relayUrl.startsWith("ws://", ignoreCase = true) ->
+                        "http://${relayUrl.substringAfter("://")}"
+                    relayUrl.startsWith("wss://", ignoreCase = true) ->
+                        "https://${relayUrl.substringAfter("://")}"
+                    else -> return null
+                }
+                return ProbeTarget(
+                    baseUrl = relayUrl,
+                    requestUrl = "$httpBase/health",
+                    path = "/health",
+                )
+            }
+
+        return null
+    }
+
     /**
      * Map a probe exception to a short, actionable string for the Routes
      * card. The TLS case is the headline: a route saved with `https://`

app/src/main/kotlin/com/hermesandroid/relay/network/shared/HermesLanDiscovery.kt

@@ -8,22 +8,29 @@ import kotlinx.coroutines.Dispatchers
 import kotlinx.coroutines.async
 import kotlinx.coroutines.awaitAll
 import kotlinx.coroutines.coroutineScope
+import kotlinx.coroutines.runInterruptible
 import kotlinx.coroutines.sync.Semaphore
 import kotlinx.coroutines.sync.withPermit
 import kotlinx.coroutines.withContext
+import kotlinx.coroutines.withTimeoutOrNull
 import okhttp3.HttpUrl.Companion.toHttpUrlOrNull
 import okhttp3.OkHttpClient
 import okhttp3.Request
 import java.net.Inet4Address
+import java.net.InetAddress
 import java.util.concurrent.TimeUnit
 
 data class HermesLanDiscoveryResult(
     val host: String,
+    val hostname: String? = null,
     val apiUrl: String,
     val dashboardUrl: String?,
     val apiReachable: Boolean,
     val dashboardReachable: Boolean,
-)
+) {
+    val displayHost: String
+        get() = hostname ?: host
+}
 
 /**
  * User-triggered local-network discovery for standard Hermes setup.
@@ -59,7 +66,9 @@ object HermesLanDiscovery {
             hosts.map { host ->
                 async {
                     semaphore.withPermit {
-                        probeHost(client, host, apiPort, dashboardPort)
+                        probeHost(client, host, apiPort, dashboardPort)?.let { result ->
+                            result.copy(hostname = resolveHostname(host))
+                        }
                     }
                 }
             }.awaitAll()
@@ -130,6 +139,24 @@ object HermesLanDiscovery {
         }
     }
 
+    private suspend fun resolveHostname(address: String): String? =
+        withTimeoutOrNull(350L) {
+            runInterruptible(Dispatchers.IO) {
+                normalizeResolvedHostname(
+                    address = address,
+                    resolved = InetAddress.getByName(address).canonicalHostName,
+                )
+            }
+        }
+
+    internal fun normalizeResolvedHostname(address: String, resolved: String?): String? {
+        val normalized = resolved?.trim()?.trimEnd('.')?.takeIf { it.isNotBlank() } ?: return null
+        if (normalized.equals(address.trim(), ignoreCase = true)) return null
+        if (normalized.equals("localhost", ignoreCase = true)) return null
+        if (normalized.matches(Regex("^\\d{1,3}(?:\\.\\d{1,3}){3}$"))) return null
+        return normalized
+    }
+
     private fun looksLikeDashboardStatus(body: String, contentType: String): Boolean {
         val lower = body.lowercase()
         return contentType.contains("json", ignoreCase = true) && (

app/src/main/kotlin/com/hermesandroid/relay/network/shared/ProfileApiUrlResolver.kt

@@ -1,6 +1,7 @@
 package com.hermesandroid.relay.network.shared
 
 import java.net.URI
+import okhttp3.HttpUrl.Companion.toHttpUrlOrNull
 
 /**
  * Resolves profile-scoped Hermes API URLs for phone use.
@@ -43,6 +44,44 @@ object ProfileApiUrlResolver {
         return "$scheme://$hostPart$portPart$pathPart$queryPart$fragmentPart".trimEnd('/')
     }
 
+    /**
+     * Resolve the canonical API base for a selected Hermes profile.
+     *
+     * A dedicated profile API URL remains authoritative when advertised. When
+     * the dashboard has positively identified a shared multiplex gateway and
+     * the selected non-default profile is in its served-profile list, route
+     * through the upstream `/p/<profile>` mirror on the connection's root API
+     * origin. Older/single-profile servers and incomplete topology snapshots
+     * deliberately keep the root URL.
+     */
+    fun resolveChatBase(
+        profileApiUrl: String?,
+        baseApiUrl: String?,
+        selectedProfileName: String?,
+        gatewayMode: String?,
+        servedProfiles: Collection<String>,
+    ): String? {
+        val base = normalize(baseApiUrl)
+        val dedicated = resolveForConnection(profileApiUrl, base)
+        if (dedicated != null) return dedicated
+
+        val profile = selectedProfileName
+            ?.trim()
+            ?.takeIf { it.isNotBlank() && !it.equals("default", ignoreCase = true) }
+            ?: return base
+        val isKnownMultiplexProfile = gatewayMode.equals("multiplex", ignoreCase = true) &&
+            servedProfiles.any { it.equals(profile, ignoreCase = false) }
+        if (!isKnownMultiplexProfile) return base
+
+        val root = base?.toHttpUrlOrNull() ?: return base
+        return root.newBuilder()
+            .addPathSegment("p")
+            .addPathSegment(profile)
+            .build()
+            .toString()
+            .trimEnd('/')
+    }
+
     private fun isLocalBindHost(host: String): Boolean {
         return when (host.lowercase().trim('[', ']')) {
             "localhost", "127.0.0.1", "0.0.0.0", "::1", "::" -> true

app/src/main/kotlin/com/hermesandroid/relay/network/shared/VoiceAudioClient.kt

@@ -3,6 +3,31 @@ package com.hermesandroid.relay.network.shared
 import com.hermesandroid.relay.data.VoiceAudioRoute
 import java.io.File
 
+enum class VoiceSpeechStreamStatus {
+    Completed,
+    Fallback,
+    Stopped,
+    Failed,
+}
+
+data class VoiceSpeechStreamOutcome(
+    val status: VoiceSpeechStreamStatus,
+    val audioStarted: Boolean,
+    val error: Throwable? = null,
+)
+
+data class VoiceSpeechStreamCallbacks(
+    val onStart: (sampleRate: Int, channels: Int) -> Unit = { _, _ -> },
+    val onPcm: (pcm16Le: ByteArray, sampleRate: Int) -> Unit,
+)
+
+interface VoiceSpeechStream {
+    fun append(text: String)
+    fun finish()
+    fun stop()
+    suspend fun awaitOutcome(): VoiceSpeechStreamOutcome
+}
+
 /**
  * Transport-neutral STT/TTS contract. The routing seam between the Standard
  * (dashboard) and Relay voice clients — implementations live in `network.upstream`
@@ -25,6 +50,16 @@ interface VoiceAudioClient {
 
     suspend fun transcribe(audioFile: File): Result<String>
     suspend fun synthesize(text: String): Result<File>
+
+    /**
+     * Open one provider-backed PCM stream for an assistant reply. A null
+     * success means this route has no streaming surface and the caller should
+     * keep using [synthesize]. Concrete implementations must queue [VoiceSpeechStream.append]
+     * calls made before the socket opens and report whether any PCM was emitted
+     * so callers never replay already-heard audio during compatibility fallback.
+     */
+    suspend fun openSpeechStream(callbacks: VoiceSpeechStreamCallbacks): Result<VoiceSpeechStream?> =
+        Result.success(null)
 }
 
 /**
@@ -70,6 +105,12 @@ class AutoVoiceAudioClient(
     override suspend fun synthesize(text: String): Result<File> =
         runWithSelectedRoute { it.synthesize(text) }
 
+    override suspend fun openSpeechStream(
+        callbacks: VoiceSpeechStreamCallbacks,
+    ): Result<VoiceSpeechStream?> = runWithSelectedRoute { client ->
+        client.openSpeechStream(callbacks)
+    }
+
     private suspend fun <T> runWithSelectedRoute(
         block: suspend (VoiceAudioClient) -> Result<T>,
     ): Result<T> {

app/src/main/kotlin/com/hermesandroid/relay/network/upstream/ActiveTurnKeepAliveRegistry.kt

@@ -0,0 +1,76 @@
+package com.hermesandroid.relay.network.upstream
+
+import kotlinx.coroutines.flow.MutableStateFlow
+import kotlinx.coroutines.flow.StateFlow
+import kotlinx.coroutines.flow.asStateFlow
+
+/**
+ * Process-local ownership of background protection for work the user already
+ * started. Keys are connection/profile/session scoped, so detached sibling
+ * sessions retain independent leases and one completion cannot release
+ * another session's protection.
+ */
+object ActiveTurnKeepAliveRegistry {
+    data class Snapshot(
+        val activeTurnCount: Int = 0,
+        val waitingSessionCount: Int = 0,
+    ) {
+        val required: Boolean get() = activeTurnCount > 0
+    }
+
+    private val lock = Any()
+    private val leases = linkedMapOf<String, Boolean>()
+    private val _snapshot = MutableStateFlow(Snapshot())
+    val snapshot: StateFlow<Snapshot> = _snapshot.asStateFlow()
+
+    fun acquire(key: String) {
+        synchronized(lock) {
+            leases[key] = leases[key] ?: false
+            publishLocked()
+        }
+    }
+
+    fun setWaiting(key: String, waiting: Boolean) {
+        synchronized(lock) {
+            if (key in leases) {
+                leases[key] = waiting
+                publishLocked()
+            }
+        }
+    }
+
+    fun rename(oldKey: String, newKey: String) {
+        if (oldKey == newKey) return
+        synchronized(lock) {
+            val waiting = leases.remove(oldKey) ?: return
+            leases[newKey] = waiting
+            publishLocked()
+        }
+    }
+
+    fun release(key: String) {
+        synchronized(lock) {
+            if (leases.remove(key) != null) publishLocked()
+        }
+    }
+
+    fun releaseAll() {
+        synchronized(lock) {
+            if (leases.isNotEmpty()) {
+                leases.clear()
+                publishLocked()
+            }
+        }
+    }
+
+    internal fun resetForTest() {
+        releaseAll()
+    }
+
+    private fun publishLocked() {
+        _snapshot.value = Snapshot(
+            activeTurnCount = leases.size,
+            waitingSessionCount = leases.count { it.value },
+        )
+    }
+}

app/src/main/kotlin/com/hermesandroid/relay/network/upstream/ChatHandler.kt

@@ -10,11 +10,11 @@ import com.hermesandroid.relay.data.ChatTurnCheckpoint
 import com.hermesandroid.relay.data.HermesCard
 import com.hermesandroid.relay.data.MessageDeliveryStatus
 import com.hermesandroid.relay.data.MessageRole
+import com.hermesandroid.relay.data.MoaReference
 import com.hermesandroid.relay.data.RealtimeTurnTrace
 import com.hermesandroid.relay.data.ToolCall
 import com.hermesandroid.relay.data.VoiceIntentTrace
 import com.hermesandroid.relay.network.shared.LocalDispatchResult
-import com.hermesandroid.relay.network.upstream.GatewaySubagentEvent
 import com.hermesandroid.relay.network.upstream.models.MessageItem
 import com.hermesandroid.relay.network.upstream.models.RelayStreamEventEnvelope
 import com.hermesandroid.relay.network.upstream.models.SessionItem
@@ -43,6 +43,9 @@ class ChatHandler {
 
         /** Maximum number of messages kept in memory per session. Oldest are trimmed. */
         internal const val MAX_MESSAGES = 500
+        private const val MAX_MOA_REFERENCES = 32
+        private const val MAX_MOA_LABEL_CHARS = 120
+        private const val MAX_MOA_REFERENCE_CHARS = 16_000
 
         private fun timestampToMillis(timestamp: Double?): Long {
             val value = timestamp ?: return 0L
@@ -155,6 +158,15 @@ class ChatHandler {
      */
     var onMediaBarePathRequested: (messageId: String, originalPath: String) -> Unit = { _, _ -> }
 
+    /**
+     * Fired for a canonical `@image:<path>` directive found on a persisted
+     * USER history row. This is intentionally separate from free-form
+     * assistant `MEDIA:` parsing: only the bounded upstream directive parser
+     * can reach this callback.
+     */
+    var onPersistedUserImageRequested: (messageId: String, originalPath: String) -> Unit =
+        { _, _ -> }
+
     /**
      * Buffer for incomplete lines during streaming. Tool annotations are line-oriented
      * (backtick + emoji + tool_name + backtick), so we accumulate text until we see a
@@ -512,6 +524,42 @@ class ChatHandler {
         }
     }
 
+    /**
+     * Collapse a provisional post-interim segment back into its sealed
+     * assistant bubble when the terminal text proves they are one response.
+     * Tool/card state accumulated after the interim remains attached.
+     */
+    fun reconcileInterimMessage(
+        interimMessageId: String,
+        currentMessageId: String,
+        content: String,
+    ) {
+        _messages.update { messages ->
+            val interim = messages.firstOrNull { it.id == interimMessageId } ?: return@update messages
+            val current = messages.firstOrNull { it.id == currentMessageId }
+            val mergedTools = (interim.toolCalls + current?.toolCalls.orEmpty())
+                .distinctBy { it.id ?: "${it.name}:${it.startedAt}" }
+            val merged = interim.copy(
+                content = content,
+                isStreaming = true,
+                toolCalls = mergedTools,
+                thinkingContent = current?.thinkingContent
+                    ?.takeIf { it.isNotBlank() }
+                    ?: interim.thinkingContent,
+                isThinkingStreaming = current?.isThinkingStreaming
+                    ?: interim.isThinkingStreaming,
+                badges = (interim.badges + current?.badges.orEmpty()).distinct(),
+                cards = (interim.cards + current?.cards.orEmpty()).distinct(),
+                cardDispatches = (interim.cardDispatches + current?.cardDispatches.orEmpty())
+                    .distinctBy { "${it.cardKey}:${it.actionValue}:${it.timestamp}" },
+                backgroundTask = current?.backgroundTask ?: interim.backgroundTask,
+            )
+            messages
+                .filterNot { it.id == currentMessageId && currentMessageId != interimMessageId }
+                .map { if (it.id == interimMessageId) merged else it }
+        }
+    }
+
     /** Remove a provisional client-side message that never became a real turn. */
     fun removeMessage(messageId: String) {
         _messages.update { messages -> messages.filterNot { it.id == messageId } }
@@ -973,6 +1021,27 @@ class ChatHandler {
                 startedAt = task.startedAt,
             )
         }
+        val checkpointMoaReferences = assistant.moaReferences
+            .filter { it.index in 1..MAX_MOA_REFERENCES }
+            .distinctBy { it.index }
+            .sortedBy { it.index }
+            .take(MAX_MOA_REFERENCES)
+            .map { reference ->
+                MoaReference(
+                    index = reference.index,
+                    count = reference.count,
+                    label = reference.label.take(MAX_MOA_LABEL_CHARS),
+                    text = if (reference.available) {
+                        reference.text.take(MAX_MOA_REFERENCE_CHARS)
+                    } else {
+                        ""
+                    },
+                    available = reference.available,
+                )
+            }
+        val restoredMoaReferences = currentAssistant?.moaReferences
+            ?.takeIf { it.isNotEmpty() }
+            ?: checkpointMoaReferences
         val restoredAssistant = ChatMessage(
             id = assistant.id,
             role = MessageRole.ASSISTANT,
@@ -996,6 +1065,7 @@ class ChatHandler {
             cardDispatches = currentAssistant?.cardDispatches?.takeIf { it.isNotEmpty() }
                 ?: assistant.cardDispatches,
             backgroundTask = currentAssistant?.backgroundTask ?: restoredBackgroundTask,
+            moaReferences = restoredMoaReferences,
         )
 
         activeAgentName = restoredAssistant.agentName ?: activeAgentName
@@ -1158,6 +1228,7 @@ class ChatHandler {
         // the wholesale `_messages.value = ...` assignment so the ViewModel's
         // mutateMessage lookups find the newly-loaded messages.
         val pendingMediaHits = mutableListOf<Pair<String, MediaMarkerHit>>()
+        val pendingPersistedUserImages = mutableListOf<Pair<String, String>>()
 
         // Reconcile optimistic (client-UUID) live ids to their server ids BEFORE
         // building the carry map, so the id-keyed delta-merge updates rows in
@@ -1208,10 +1279,15 @@ class ChatHandler {
         val syncedRealtimeTurnContents = mutableSetOf<String>()
 
         val loaded = items.mapNotNull { item ->
-            val role = when (item.role) {
-                "user" -> MessageRole.USER
-                "assistant" -> MessageRole.ASSISTANT
-                "system" ->
+            val displayKind = item.displayKind?.trim()?.lowercase()
+            if (displayKind == "hidden") return@mapNotNull null
+            val role = when {
+                displayKind == "model_switch" ||
+                    displayKind == "async_delegation_complete" ||
+                    displayKind == "auto_continue" -> MessageRole.SYSTEM
+                item.role == "user" -> MessageRole.USER
+                item.role == "assistant" -> MessageRole.ASSISTANT
+                item.role == "system" ->
                     // Upstream injects role:system STEERING markers into the
                     // session history on model/personality change — e.g.
                     // "[System: The active model for this chat has changed to …]"
@@ -1227,9 +1303,11 @@ class ChatHandler {
                     } else {
                         MessageRole.SYSTEM
                     }
-                "tool" -> return@mapNotNull null // Merged into assistant tool calls above
+                item.role == "tool" -> return@mapNotNull null // Merged into assistant tool calls above
                 else -> return@mapNotNull null
             }
+            val displayContent = displayEventContent(displayKind, item.displayMetadata)
+            val rawServerContent = displayContent ?: item.contentText ?: ""
             // If > 1e12, already in milliseconds; otherwise convert from seconds
             val ts = item.timestamp ?: 0.0
             val timestampMs = if (ts > 1e12) ts.toLong() else (ts * 1000).toLong()
@@ -1241,15 +1319,21 @@ class ChatHandler {
                 emptyList()
             }
 
-            val messageId = item.id?.toString() ?: java.util.UUID.randomUUID().toString()
-            val rawContent = item.contentText ?: ""
+            val messageId = item.id ?: java.util.UUID.randomUUID().toString()
+            val rawContent = rawServerContent
+
+            val persistedImages = if (role == MessageRole.USER && rawContent.isNotEmpty()) {
+                PersistedImageReferenceParser.parse(rawContent)
+            } else {
+                PersistedImageReferences(rawContent, emptyList())
+            }
 
             // Run the media marker parser on assistant content; strip matched
             // lines and queue hits for post-assignment dispatch.
-            val afterMedia = if (role == MessageRole.ASSISTANT && rawContent.isNotEmpty()) {
-                extractMediaMarkersFromContent(messageId, rawContent, pendingMediaHits)
+            val afterMedia = if (role == MessageRole.ASSISTANT && persistedImages.cleanedText.isNotEmpty()) {
+                extractMediaMarkersFromContent(messageId, persistedImages.cleanedText, pendingMediaHits)
             } else {
-                rawContent
+                persistedImages.cleanedText
             }
 
             // Cards are synchronous (no async fetch) so we attach them
@@ -1287,7 +1371,14 @@ class ChatHandler {
             // content-keyed queue. Inbound attachments are intentionally
             // excluded — they come back via the marker re-dispatch.
             val carriedAttachments = run {
-                val byId = prior?.attachments.orEmpty().filter { it.relayToken == null }
+                val persistedImagePaths = persistedImages.paths.toHashSet()
+                val byId = prior?.attachments.orEmpty().filter { attachment ->
+                    attachment.relayToken == null ||
+                        (
+                            role == MessageRole.USER &&
+                                attachment.relayToken in persistedImagePaths
+                            )
+                }
                 when {
                     byId.isNotEmpty() -> byId
                     role == MessageRole.USER ->
@@ -1295,6 +1386,15 @@ class ChatHandler {
                     else -> emptyList()
                 }
             }
+            if (
+                role == MessageRole.USER &&
+                carriedAttachments.isEmpty() &&
+                persistedImages.paths.isNotEmpty()
+            ) {
+                persistedImages.paths.forEach { path ->
+                    pendingPersistedUserImages += messageId to path
+                }
+            }
             // Server reasoning is authoritative when present; absent, keep the
             // live-streamed thinking rather than blanking it on reload.
             val serverThinking =
@@ -1339,6 +1439,10 @@ class ChatHandler {
                     } else {
                         prior.badges
                     },
+                    // Keep sanitized advisor state while reconciling a still-live
+                    // row, but clear it once completion made history authoritative.
+                    // The server transcript never becomes the source of these blocks.
+                    moaReferences = if (prior.isStreaming) prior.moaReferences else emptyList(),
                 )
             } else {
                 // INSERT — a server message with no local row yet. Built from
@@ -1431,6 +1535,9 @@ class ChatHandler {
                 }
             }
         }
+        for ((messageId, path) in pendingPersistedUserImages) {
+            onPersistedUserImageRequested(messageId, path)
+        }
     }
 
     /** One adoptable server row during id reconciliation. `taken` enforces consume-once. */
@@ -1496,19 +1603,54 @@ class ChatHandler {
      * [loadMessageHistory] so reconciliation only adopts ids onto rows that
      * actually render.
      */
-    private fun renderedRoleOf(item: MessageItem): MessageRole? = when (item.role) {
-        "user" -> MessageRole.USER
-        "assistant" -> MessageRole.ASSISTANT
-        "system" ->
-            if (!showSystemMarkers &&
-                item.contentText?.trimStart()?.startsWith("[System:") == true
-            ) {
-                null
-            } else {
-                MessageRole.SYSTEM
+    private fun renderedRoleOf(item: MessageItem): MessageRole? =
+        when (item.displayKind?.trim()?.lowercase()) {
+            "hidden" -> null
+            "model_switch", "async_delegation_complete", "auto_continue" -> MessageRole.SYSTEM
+            else -> when (item.role) {
+                "user" -> MessageRole.USER
+                "assistant" -> MessageRole.ASSISTANT
+                "system" ->
+                    if (!showSystemMarkers &&
+                        item.contentText?.trimStart()?.startsWith("[System:") == true
+                    ) {
+                        null
+                    } else {
+                        MessageRole.SYSTEM
+                    }
+                else -> null
             }
-        else -> null
-    }
+        }
+
+    private fun displayEventContent(displayKind: String?, metadata: JsonObject?): String? =
+        when (displayKind) {
+            "model_switch" -> {
+                val model = metadata.stringField("model")
+                    ?: metadata.stringField("to_model")
+                    ?: metadata.stringField("target_model")
+                if (model.isNullOrBlank()) "Model changed" else "Model changed to $model"
+            }
+            "async_delegation_complete" -> {
+                val count = metadata.intField("task_count")
+                    ?: metadata.intField("tasks")
+                    ?: metadata.intField("count")
+                when (count) {
+                    null -> "Background work completed"
+                    1 -> "1 background task completed"
+                    else -> "$count background tasks completed"
+                }
+            }
+            "auto_continue" -> "Continued after an interrupted turn"
+            else -> null
+        }
+
+    private fun JsonObject?.stringField(key: String): String? =
+        (this?.get(key) as? JsonPrimitive)?.contentOrNull?.trim()?.takeIf { it.isNotEmpty() }
+
+    private fun JsonObject?.intField(key: String): Int? =
+        (this?.get(key) as? JsonPrimitive)?.let { primitive ->
+            primitive.contentOrNull?.toIntOrNull()
+        }
 
     /**
      * Normalize content for reconciliation matching: strip `MEDIA:`/`CARD:` marker
@@ -1525,6 +1667,7 @@ class ChatHandler {
             val t = line.trim()
             if (t.isEmpty()) continue
             if (mediaRelayRegex.containsMatchIn(t) || mediaBarePathRegex.containsMatchIn(t)) continue
+            if (PersistedImageReferenceParser.parse(t).paths.isNotEmpty()) continue
             if (cardMarkerRegex.containsMatchIn(t)) continue
             if (sb.isNotEmpty()) sb.append('\n')
             sb.append(t)
@@ -1682,7 +1825,10 @@ class ChatHandler {
         // sessions as "Untitled" in the drawer (issue #133). Preserve the known
         // local title whenever the server hasn't supplied a non-blank one.
         val existingById = _sessions.value.associateBy { it.sessionId }
-        val mapped = items.map { item ->
+        // The drawer is always composed, even while closed, and keys rows by
+        // session id. A refresh race or duplicated upstream row must not put
+        // the same key into Compose's LazyColumn.
+        val mapped = items.distinctBy { it.id }.map { item ->
             val startedAtMs = timestampToMillis(item.startedAt)
             val lastActivityAtMs = timestampToMillis(item.resolvedLastActivity)
             val activityAtMs = firstPositive(lastActivityAtMs, startedAtMs)
@@ -1710,6 +1856,7 @@ class ChatHandler {
                 // SessionItem; the other ChatSession() call sites are local optimistic
                 // rows (default source). (ADR 12 — Threads surface, slice 1.)
                 source = item.source,
+                hasModelConfig = item.hasModelConfig,
             )
         }.sortedByDescending { it.activityTimestamp }
         // Preserve the active session's optimistic row when the server list
@@ -1760,7 +1907,15 @@ class ChatHandler {
      * Add a newly created session to the list.
      */
     fun addSession(session: ChatSession) {
-        _sessions.update { listOf(session) + it }
+        // Gateway onSessionId and an overlapping REST refresh can both publish
+        // the same freshly-created session. Treat this as an idempotent upsert,
+        // preferring an existing server-enriched row while collapsing any
+        // duplicates that were already present.
+        _sessions.update { current ->
+            val existing = current.firstOrNull { it.sessionId == session.sessionId }
+            listOf(existing ?: session) +
+                current.filterNot { it.sessionId == session.sessionId }
+        }
     }
 
     // --- SSE streaming event entry points ---
@@ -2542,6 +2697,44 @@ class ChatHandler {
 
     // --- Gateway subagent lanes ---
 
+    fun onMoaReference(messageId: String, event: GatewayMoaReference) {
+        _messages.update { messages ->
+            val targetIndex = messages.indexOfLast {
+                it.id == messageId && it.role == MessageRole.ASSISTANT
+            }
+            if (targetIndex < 0) return@update messages
+            _isStreaming.value = true
+
+            val message = messages[targetIndex]
+            val nextIndex = event.index ?: ((message.moaReferences.maxOfOrNull { it.index } ?: 0) + 1)
+            if (nextIndex !in 1..MAX_MOA_REFERENCES) return@update messages
+            val reference = MoaReference(
+                index = nextIndex,
+                count = event.count,
+                label = event.label.take(MAX_MOA_LABEL_CHARS),
+                text = if (event.available) event.text.take(MAX_MOA_REFERENCE_CHARS) else "",
+                available = event.available,
+            )
+            val existingAtIndex = message.moaReferences.firstOrNull { it.index == nextIndex }
+            val exactReplay = existingAtIndex == reference
+            val base = if (nextIndex == 1 && !exactReplay) {
+                emptyList()
+            } else {
+                message.moaReferences
+            }
+            if (exactReplay) {
+                messages
+            } else {
+                val upserted = (base.filterNot { it.index == nextIndex } + reference)
+                    .sortedBy(MoaReference::index)
+                    .take(MAX_MOA_REFERENCES)
+                messages.toMutableList().also {
+                    it[targetIndex] = message.copy(moaReferences = upserted)
+                }
+            }
+        }
+    }
+
     /**
      * Lane labels by task index, captured from `subagent.start` (goal
      * truncated to 60 chars) and stamped onto every child ToolCall so
@@ -2867,13 +3060,22 @@ class ChatHandler {
         }
 
         _messages.update { messages ->
-            messages.map { msg ->
-                if (msg.id == messageId || msg.isStreaming) {
-                    msg.copy(isStreaming = false, isThinkingStreaming = false)
-                } else {
-                    msg
+            messages
+                .filterNot { msg ->
+                        msg.id == messageId &&
+                        msg.role == MessageRole.ASSISTANT &&
+                        msg.toolCalls.isEmpty() &&
+                        msg.backgroundTask == null &&
+                        msg.thinkingContent.isBlank() &&
+                        (msg.content.isBlank() || isIntentionalSilenceMarker(msg.content))
+                }
+                .map { msg ->
+                    if (msg.id == messageId || msg.isStreaming) {
+                        msg.copy(isStreaming = false, isThinkingStreaming = false)
+                    } else {
+                        msg
+                    }
                 }
-            }
         }
 
         // Post-stream reconciliation: re-scan final content for any annotation
@@ -3073,3 +3275,15 @@ internal fun formatPhoneActionResult(
         append("Status ${result.status}.")
     }
 }
+
+internal fun isIntentionalSilenceMarker(content: String): Boolean =
+    when (content.trim().trim('"', '\'', '`').uppercase()) {
+        "NO_REPLY",
+        "[NO_REPLY]",
+        "SILENT",
+        "[SILENT]",
+        "<SILENT>",
+        "(SILENT)",
+        -> true
+        else -> false
+    }

app/src/main/kotlin/com/hermesandroid/relay/network/upstream/DashboardApiClient.kt

@@ -16,6 +16,7 @@ import com.hermesandroid.relay.auth.buildRawTokenStore
 import kotlinx.coroutines.Dispatchers
 import kotlinx.coroutines.withContext
 import kotlinx.serialization.Serializable
+import kotlinx.serialization.SerialName
 import kotlinx.serialization.builtins.ListSerializer
 import kotlinx.serialization.encodeToString
 import kotlinx.serialization.json.Json
@@ -49,8 +50,40 @@ data class DashboardStatus(
     val authRequired: Boolean,
     val authProviders: List<String> = emptyList(),
     val authProviderDetails: List<DashboardAuthProvider> = emptyList(),
+    @SerialName("auth_flows") val authFlows: List<String> = emptyList(),
     val version: String? = null,
     val message: String? = null,
+    @SerialName("nous_session_valid") val nousSessionValid: String? = null,
+    val profiles: List<String> = emptyList(),
+    @SerialName("gateway_mode") val gatewayMode: String? = null,
+    val gateways: List<DashboardGatewayTopology> = emptyList(),
+    val componentHealth: DashboardComponentHealthRollup = DashboardComponentHealthRollup(),
+)
+
+@Serializable
+data class DashboardGatewayTopology(
+    val profile: String,
+    val ports: Map<String, Int> = emptyMap(),
+    @SerialName("served_profiles") val servedProfiles: List<String> = emptyList(),
+)
+
+@Serializable
+data class DashboardComponentHealthRollup(
+    val supported: Boolean = false,
+    val overall: String? = null,
+    val components: List<DashboardComponentHealth> = emptyList(),
+)
+
+@Serializable
+data class DashboardComponentHealth(
+    val name: String,
+    val status: String,
+    val message: String? = null,
+    val configured: Int? = null,
+    val connected: Int? = null,
+    val healthy: Boolean? = null,
+    val ok: Boolean? = null,
+    @SerialName("unhandled_5xx_count_5m") val unhandled5xxCount5m: Int? = null,
 )
 
 @Serializable
@@ -92,6 +125,54 @@ data class DashboardChatDisplaySettings(
     val toolDisplay: String? = null,
 )
 
+data class DashboardMcpOAuthFlow(
+    val flowId: String,
+    val serverName: String,
+    val status: String,
+    val authorizationUrl: String? = null,
+    val error: String? = null,
+) {
+    val isTerminal: Boolean get() = status == "approved" || status == "error"
+}
+
+data class DashboardCustomEndpoint(
+    val id: String,
+    val name: String,
+    val baseUrl: String,
+    val model: String,
+    val models: List<String> = emptyList(),
+    val contextLength: Int? = null,
+    val discoverModels: Boolean = true,
+    val hasApiKey: Boolean = false,
+    val apiKeyPreview: String? = null,
+    val isCurrent: Boolean = false,
+)
+
+data class DashboardCustomEndpoints(
+    val endpoints: List<DashboardCustomEndpoint>,
+    val currentProvider: String? = null,
+    val currentModel: String? = null,
+)
+
+data class DashboardCustomEndpointDraft(
+    val id: String? = null,
+    val name: String,
+    val baseUrl: String,
+    val model: String,
+    val models: List<String> = emptyList(),
+    val apiKey: String? = null,
+    val contextLength: Int? = null,
+    val discoverModels: Boolean = true,
+    val makeDefault: Boolean = false,
+)
+
+data class DashboardCustomEndpointValidation(
+    val ok: Boolean,
+    val reachable: Boolean,
+    val message: String,
+    val models: List<String>,
+)
+
 /** One entry from `GET /api/audio/elevenlabs/voices` — non-secret voice metadata. */
 data class ElevenLabsVoice(
     val voiceId: String,
@@ -255,6 +336,14 @@ class DashboardApiClient(
      */
     suspend fun getConfigSchema(): Result<JsonObject> = getJsonObject("/api/config/schema")
 
+    /**
+     * Runtime TTS provider matrix used by upstream's Tools/Capabilities picker.
+     * This adds plugin provider names and readiness metadata. Command-provider
+     * IDs remain sourced from the dynamic config-schema enum.
+     */
+    suspend fun getTtsToolsetConfig(): Result<JsonObject> =
+        getJsonObject("/api/tools/toolsets/tts/config")
+
     /**
      * Replace the runtime config (`PUT /api/config`). Upstream `save_config`
      * writes the WHOLE document, so [config] MUST be the full values tree
@@ -466,25 +555,100 @@ class DashboardApiClient(
     suspend fun deleteCronJob(jobId: String, profile: String? = null): Result<JsonObject> =
         deleteJsonObject("/api/cron/jobs/${pathSegment(jobId)}${profileQuery(profile)}")
 
-    suspend fun setMcpServerEnabled(name: String, enabled: Boolean): Result<JsonObject> =
+    suspend fun setMcpServerEnabled(
+        name: String,
+        enabled: Boolean,
+        profile: String? = null,
+    ): Result<JsonObject> =
         putJsonObject(
-            path = "/api/mcp/servers/${pathSegment(name)}/enabled",
+            path = "/api/mcp/servers/${pathSegment(name)}/enabled${profileQuery(profile)}",
             payload = buildJsonObject { put("enabled", enabled) },
         )
 
-    suspend fun testMcpServer(name: String): Result<JsonObject> =
-        postJsonObject("/api/mcp/servers/${pathSegment(name)}/test")
+    suspend fun testMcpServer(name: String, profile: String? = null): Result<JsonObject> =
+        postJsonObject("/api/mcp/servers/${pathSegment(name)}/test${profileQuery(profile)}")
 
-    suspend fun removeMcpServer(name: String): Result<JsonObject> =
-        deleteJsonObject("/api/mcp/servers/${pathSegment(name)}")
+    suspend fun removeMcpServer(name: String, profile: String? = null): Result<JsonObject> =
+        deleteJsonObject("/api/mcp/servers/${pathSegment(name)}${profileQuery(profile)}")
+
+    suspend fun startMcpOAuth(
+        name: String,
+        profile: String? = null,
+    ): Result<DashboardMcpOAuthFlow> =
+        postJsonObject("/api/mcp/servers/${pathSegment(name)}/auth${profileQuery(profile)}")
+            .mapCatching(::parseMcpOAuthFlow)
+
+    suspend fun getMcpOAuthFlow(flowId: String): Result<DashboardMcpOAuthFlow> =
+        getJsonObject("/api/mcp/oauth/flows/${pathSegment(flowId)}")
+            .mapCatching(::parseMcpOAuthFlow)
+
+    /**
+     * Read-only hosted-OAuth capability probe. New dashboards recognize the
+     * flow-status route and return its canonical expired-flow 404; older
+     * FastAPI routers return the generic route-level 404. No OAuth worker is
+     * started and no provider/browser interaction occurs.
+     */
+    suspend fun supportsHostedMcpOAuth(): Result<Boolean> {
+        val result = getJsonObject("/api/mcp/oauth/flows/__relay_capability_probe_never_a_flow__")
+        return result.fold(
+            onSuccess = { Result.success(true) },
+            onFailure = { error ->
+                val message = error.message.orEmpty()
+                when {
+                    message.contains("OAuth flow not found or expired") -> Result.success(true)
+                    message.contains("HTTP 404") -> Result.success(false)
+                    else -> Result.failure(error)
+                }
+            },
+        )
+    }
+
+    suspend fun getCustomEndpoints(): Result<DashboardCustomEndpoints> =
+        getJsonObject("/api/providers/custom-endpoints")
+            .mapCatching(::parseCustomEndpoints)
+
+    suspend fun saveCustomEndpoint(
+        draft: DashboardCustomEndpointDraft,
+    ): Result<DashboardCustomEndpoints> =
+        postJsonObject(
+            "/api/providers/custom-endpoints",
+            customEndpointPayload(draft),
+        ).mapCatching(::parseCustomEndpoints)
+
+    suspend fun validateCustomEndpoint(
+        draft: DashboardCustomEndpointDraft,
+    ): Result<DashboardCustomEndpointValidation> =
+        postJsonObject(
+            "/api/providers/custom-endpoints/validate",
+            customEndpointPayload(draft),
+        ).mapCatching { root ->
+            DashboardCustomEndpointValidation(
+                ok = root.booleanField("ok") == true,
+                reachable = root.booleanField("reachable") == true,
+                message = root.stringField("message").orEmpty(),
+                models = root.stringList("models"),
+            )
+        }
+
+    suspend fun activateCustomEndpoint(
+        id: String,
+    ): Result<JsonObject> =
+        postJsonObject("/api/providers/custom-endpoints/${pathSegment(id)}/activate")
+
+    suspend fun deleteCustomEndpoint(
+        id: String,
+    ): Result<DashboardCustomEndpoints> =
+        deleteJsonObject("/api/providers/custom-endpoints/${pathSegment(id)}")
+            .mapCatching(::parseCustomEndpoints)
 
     suspend fun installMcpCatalogEntry(
         name: String,
         env: Map<String, String> = emptyMap(),
         enable: Boolean = true,
+        profile: String? = null,
     ): Result<JsonObject> =
         postJsonObject(
-            path = "/api/mcp/catalog/install",
+            path = "/api/mcp/catalog/install${profileQuery(profile)}",
             payload = buildJsonObject {
                 put("name", name)
                 put(
@@ -929,17 +1093,87 @@ class DashboardApiClient(
             return params.joinToString(prefix = "?", separator = "&")
         }
 
+        private fun parseMcpOAuthFlow(root: JsonObject): DashboardMcpOAuthFlow {
+            val flowId = root.stringField("flow_id")
+                ?: throw IOException("MCP OAuth response did not include a flow id")
+            val status = root.stringField("status")
+                ?: throw IOException("MCP OAuth response did not include a status")
+            return DashboardMcpOAuthFlow(
+                flowId = flowId,
+                serverName = root.stringField("server_name").orEmpty(),
+                status = status,
+                authorizationUrl = root.stringField("authorization_url"),
+                error = root.stringField("error"),
+            )
+        }
+
+        private fun parseCustomEndpoints(root: JsonObject): DashboardCustomEndpoints {
+            val current = root["current"] as? JsonObject
+            val endpoints = (root["endpoints"] as? JsonArray).orEmpty().mapNotNull { element ->
+                val obj = element as? JsonObject ?: return@mapNotNull null
+                val id = obj.stringField("id") ?: return@mapNotNull null
+                DashboardCustomEndpoint(
+                    id = id,
+                    name = obj.stringField("name") ?: id,
+                    baseUrl = obj.stringField("base_url").orEmpty(),
+                    model = obj.stringField("model").orEmpty(),
+                    models = obj.stringList("models"),
+                    contextLength = obj.intField("context_length"),
+                    discoverModels = obj.booleanField("discover_models") != false,
+                    hasApiKey = obj.booleanField("has_api_key") == true,
+                    apiKeyPreview = obj.stringField("api_key_preview"),
+                    isCurrent = obj.booleanField("is_current") == true,
+                )
+            }
+            return DashboardCustomEndpoints(
+                endpoints = endpoints,
+                currentProvider = current?.stringField("provider"),
+                currentModel = current?.stringField("model"),
+            )
+        }
+
+        private fun customEndpointPayload(draft: DashboardCustomEndpointDraft): JsonObject =
+            buildJsonObject {
+                draft.id?.takeIf { it.isNotBlank() }?.let { put("id", it) }
+                put("name", draft.name)
+                put("base_url", draft.baseUrl)
+                put("model", draft.model)
+                draft.models
+                    .asSequence()
+                    .map(String::trim)
+                    .filter(String::isNotBlank)
+                    .distinct()
+                    .take(MAX_CUSTOM_ENDPOINT_MODELS)
+                    .map(::JsonPrimitive)
+                    .toList()
+                    .takeIf { it.isNotEmpty() }
+                    ?.let { put("models", JsonArray(it)) }
+                draft.apiKey?.takeIf { it.isNotBlank() }?.let { put("api_key", it) }
+                draft.contextLength?.takeIf { it > 0 }?.let { put("context_length", it) }
+                put("discover_models", draft.discoverModels)
+                put("make_default", draft.makeDefault)
+            }
+
+        private const val MAX_CUSTOM_ENDPOINT_MODELS = 256
+
         fun defaultClient(
             cookieStore: DashboardCookieStore = InMemoryDashboardCookieStore(),
-        ): OkHttpClient = OkHttpClient.Builder()
-            .cookieJar(DashboardCookieJar(cookieStore))
-            .connectTimeout(10, TimeUnit.SECONDS)
-            // Skills-hub search fans out server-side with a 30s overall
-            // timeout; keep the read window above it so a slow-but-successful
-            // search doesn't die client-side at the edge.
-            .readTimeout(45, TimeUnit.SECONDS)
-            .writeTimeout(30, TimeUnit.SECONDS)
-            .build()
+            bearerAuth: DashboardBearerAuth? = null,
+        ): OkHttpClient {
+            val builder = OkHttpClient.Builder()
+                .cookieJar(DashboardCookieJar(cookieStore))
+                .connectTimeout(10, TimeUnit.SECONDS)
+                // Skills-hub search fans out server-side with a 30s overall
+                // timeout; keep the read window above it so a slow-but-successful
+                // search doesn't die client-side at the edge.
+                .readTimeout(45, TimeUnit.SECONDS)
+                .writeTimeout(30, TimeUnit.SECONDS)
+            bearerAuth?.let {
+                builder.addInterceptor(it)
+                builder.authenticator(it)
+            }
+            return builder.build()
+        }
 
         fun parseStatus(root: JsonObject): DashboardStatus {
             val authObject = root["auth"] as? JsonObject
@@ -947,14 +1181,70 @@ class DashboardApiClient(
                 ?: root["providers"]
                 ?: authObject?.get("providers")
             val providers = parseProviders(providersElement)
+            val profiles = (root["profiles"] as? JsonArray).orEmpty().mapNotNull {
+                (it as? JsonPrimitive)?.contentOrNull?.trim()?.takeIf(String::isNotBlank)
+            }
+            val gateways = (root["gateways"] as? JsonArray).orEmpty().mapNotNull { element ->
+                val obj = element as? JsonObject ?: return@mapNotNull null
+                val profile = obj.stringField("profile") ?: return@mapNotNull null
+                val ports = (obj["ports"] as? JsonObject).orEmpty().mapNotNull { (name, value) ->
+                    (value as? JsonPrimitive)?.contentOrNull?.toIntOrNull()?.let { name to it }
+                }.toMap()
+                val served = (obj["served_profiles"] as? JsonArray).orEmpty().mapNotNull {
+                    (it as? JsonPrimitive)?.contentOrNull
+                }
+                DashboardGatewayTopology(profile = profile, ports = ports, servedProfiles = served)
+            }
             return DashboardStatus(
                 authRequired = root.booleanField("auth_required")
                     ?: authObject.booleanField("required")
                     ?: false,
                 authProviders = providers.map { it.name },
                 authProviderDetails = providers,
+                authFlows = (root["auth_flows"] as? JsonArray).orEmpty().mapNotNull {
+                    (it as? JsonPrimitive)?.contentOrNull
+                },
                 version = root.stringField("version"),
                 message = root.stringField("message") ?: root.stringField("detail"),
+                nousSessionValid = root.stringField("nous_session_valid"),
+                profiles = profiles,
+                gatewayMode = root.stringField("gateway_mode"),
+                gateways = gateways,
+                componentHealth = parseComponentHealth(root),
+            )
+        }
+
+        private fun parseComponentHealth(root: JsonObject): DashboardComponentHealthRollup {
+            val rawComponents = root["components"] as? JsonObject
+                ?: return DashboardComponentHealthRollup()
+            val components = rawComponents.mapNotNull { (name, element) ->
+                val component = element as? JsonObject ?: return@mapNotNull null
+                val safeName = name.trim().takeIf { it.isNotBlank() } ?: return@mapNotNull null
+                DashboardComponentHealth(
+                    name = safeName,
+                    status = component.stringField("status")
+                        ?: component.stringField("state")
+                        ?: component.stringField("health")
+                        ?: component.booleanField("ok")?.let { if (it) "ok" else "degraded" }
+                        ?: component.booleanField("healthy")?.let { if (it) "ok" else "degraded" }
+                        ?: "unknown",
+                    message = component.stringField("message")
+                        ?: component.stringField("summary")
+                        ?: component.stringField("error")
+                        ?: component.stringField("reason"),
+                    configured = component.intField("configured"),
+                    connected = component.intField("connected"),
+                    healthy = component.booleanField("healthy"),
+                    ok = component.booleanField("ok"),
+                    unhandled5xxCount5m = component.intField("unhandled_5xx_count_5m"),
+                )
+            }.sortedBy { it.name }
+            return DashboardComponentHealthRollup(
+                supported = true,
+                overall = root.stringField("overall")
+                    ?: root.stringField("status")
+                    ?: root.stringField("health"),
+                components = components,
             )
         }
 
@@ -1072,6 +1362,35 @@ class DashboardApiClient(
     }
 }
 
+/**
+ * Bearer credentials are scoped to the exact saved dashboard base, including
+ * reverse-proxy path prefix. A same-host or arbitrary Add Connection probe is
+ * not sufficient authority to receive the active connection's token.
+ */
+fun sameDashboardBase(candidate: String, trusted: String): Boolean {
+    val candidateUrl = candidate.trim().trimEnd('/').toHttpUrlOrNull() ?: return false
+    val trustedUrl = trusted.trim().trimEnd('/').toHttpUrlOrNull() ?: return false
+    return candidateUrl.scheme == trustedUrl.scheme &&
+        candidateUrl.host == trustedUrl.host &&
+        candidateUrl.port == trustedUrl.port &&
+        candidateUrl.encodedPath.trimEnd('/') == trustedUrl.encodedPath.trimEnd('/') &&
+        candidateUrl.query == null &&
+        trustedUrl.query == null
+}
+
+fun trustedDashboardBearerAuthOrNull(
+    candidate: String,
+    trusted: String,
+    tokenStoreProvider: () -> NativeDashboardTokenStore,
+): DashboardBearerAuth? =
+    if (isNativeDashboardTransportEligible(candidate) &&
+        sameDashboardBase(candidate, trusted)
+    ) {
+        DashboardBearerAuth(candidate, tokenStoreProvider())
+    } else {
+        null
+    }
+
 interface DashboardCookieStore {
     fun load(): List<StoredDashboardCookie>
     fun save(cookies: List<StoredDashboardCookie>)
@@ -1203,6 +1522,61 @@ class DashboardCookieJar(
     }
 }
 
+/**
+ * Copy only Hermes' authenticated dashboard session cookies to another host
+ * that belongs to the same saved Connection. Dashboard cookies are host-only
+ * by design, while a Connection may reach one server through LAN and
+ * Tailscale hostnames/IPs. The encrypted store remains the source of truth and
+ * explicit sign-out clears every mirrored host together.
+ *
+ * PKCE, SSO-attempt, and unrelated application cookies are intentionally not
+ * copied. Secure cookies also remain Secure; this helper never downgrades them
+ * for an HTTP route.
+ */
+fun mirrorDashboardSessionCookies(
+    store: DashboardCookieStore,
+    targetUrl: String,
+    trustedHosts: Set<String>,
+    clockMillis: () -> Long = { System.currentTimeMillis() },
+): Int {
+    val targetHost = targetUrl.toHttpUrlOrNull()?.host?.lowercase() ?: return 0
+    val allowedHosts = trustedHosts.mapTo(mutableSetOf()) { it.lowercase() }
+    if (targetHost !in allowedHosts) return 0
+
+    val now = clockMillis()
+    val all = store.load()
+    val live = all.filterNot { it.isExpired(now) }
+    val existingTargetKeys = live.asSequence()
+        .filter { it.domain.equals(targetHost, ignoreCase = true) }
+        .map { "${it.name.lowercase()}|$targetHost|${it.path}" }
+        .toSet()
+    val mirrored = live.asSequence()
+        .filter { it.isDashboardSessionCookie() }
+        .filter { it.domain.lowercase() in allowedHosts }
+        .filterNot { it.domain.equals(targetHost, ignoreCase = true) }
+        .groupBy { "${it.name.lowercase()}|${it.path}" }
+        .values
+        .mapNotNull { candidates -> candidates.maxByOrNull { it.expiresAt } }
+        .map { it.copy(domain = targetHost, hostOnly = true) }
+        .filterNot { it.key in existingTargetKeys }
+        .toList()
+
+    if (mirrored.isNotEmpty() || live.size != all.size) {
+        store.save(live + mirrored)
+    }
+    return mirrored.size
+}
+
+private fun StoredDashboardCookie.isDashboardSessionCookie(): Boolean {
+    val bareName = name
+        .removePrefix("__Host-")
+        .removePrefix("__Secure-")
+    return bareName == "hermes_session" ||
+        bareName == "hermes_session_at" ||
+        bareName == "hermes_session_rt" ||
+        bareName == "hermes_session_provider"
+}
+
 /**
  * Cookie jar that resolves the backing per-connection store at request time.
  *
@@ -1353,3 +1727,8 @@ private fun JsonObject?.booleanField(name: String): Boolean? =
 
 private fun JsonObject?.intField(name: String): Int? =
     (this?.get(name) as? JsonPrimitive)?.contentOrNull?.toIntOrNull()
+
+private fun JsonObject?.stringList(name: String): List<String> =
+    (this?.get(name) as? JsonArray).orEmpty().mapNotNull { element ->
+        (element as? JsonPrimitive)?.contentOrNull?.trim()?.takeIf { it.isNotBlank() }
+    }

app/src/main/kotlin/com/hermesandroid/relay/network/upstream/DashboardConfigEditing.kt

@@ -84,7 +84,44 @@ fun parseConfigSchema(schemaRoot: JsonObject): List<ConfigSchemaField> {
  * `category` field so it is robust to upstream's category-merging.
  */
 fun voiceConfigFields(fields: List<ConfigSchemaField>): List<ConfigSchemaField> =
-    fields.filter { it.key.startsWith("tts.") || it.key.startsWith("stt.") }
+    fields.filter {
+        it.key.startsWith("tts.") ||
+            it.key.startsWith("stt.") ||
+            it.key.startsWith("voice.")
+    }
+
+/** A TTS provider advertised by upstream's `hermes tools` provider registry. */
+data class TtsToolsetProvider(
+    val id: String,
+    val name: String,
+    val status: String? = null,
+    val isActive: Boolean = false,
+)
+
+/**
+ * Parse `GET /api/tools/toolsets/tts/config` into provider choices.
+ *
+ * Unlike the config-schema enum, this payload adds readiness metadata and
+ * reliably discovered plugin providers. Command providers remain schema-owned.
+ * Older upstream builds may omit `tts_provider`;
+ * those rows are ignored because their picker label is not a stable config ID.
+ */
+fun parseTtsToolsetProviders(root: JsonObject): List<TtsToolsetProvider> {
+    val providers = root["providers"] as? JsonArray ?: return emptyList()
+    return providers.mapNotNull { element ->
+        val provider = element as? JsonObject ?: return@mapNotNull null
+        val id = provider.configString("tts_provider")
+            ?.trim()
+            ?.takeIf { it.isNotEmpty() }
+            ?: return@mapNotNull null
+        TtsToolsetProvider(
+            id = id,
+            name = provider.configString("name")?.takeIf { it.isNotBlank() } ?: id,
+            status = provider.configString("status"),
+            isActive = (provider["is_active"] as? JsonPrimitive)?.contentOrNull?.toBooleanStrictOrNull() ?: false,
+        )
+    }.distinctBy { it.id }
+}
 
 /** Read the value at a dot-path from the nested config values tree, or null. */
 fun configValueAt(tree: JsonObject, dotPath: String): JsonElement? {

app/src/main/kotlin/com/hermesandroid/relay/network/upstream/GatewayEventMapper.kt

@@ -31,13 +31,25 @@ class GatewayEventMapper(
     var turnEnded: Boolean = false
         private set
 
+    internal val currentInteraction: GatewayAsk?
+        get() = pendingInteraction
+
+    internal fun restoreInteraction(ask: GatewayAsk) {
+        val duplicate = pendingInteraction?.sameRequestAs(ask) == true
+        pendingInteraction = ask
+        if (!duplicate) callbacks.onInteractionRequest(ask)
+    }
+
     private var sawMessageStart = false
     private var previousEventType: String? = null
     private var sawTextDelta = false
     private var sawThinkingDelta = false
+    private var previewedText: String? = null
     private var syntheticToolCounter = 0
     private var providerWaitStatusActive = false
     private var compactionStatusActive = false
+    private var moaStatusActive = false
+    private var pendingInteraction: GatewayAsk? = null
 
     /**
      * `tool.complete` events match their `tool.start` by `tool_id`; when a
@@ -56,6 +68,30 @@ class GatewayEventMapper(
 
     fun onEvent(type: String, payload: JsonObject?) {
         if (turnEnded) return
+
+        interactionRequest(type, payload)?.let { ask ->
+            restoreInteraction(ask)
+            previousEventType = type
+            return
+        }
+        interactionExpiry(type, payload)?.let { expiry ->
+            val pending = pendingInteraction
+            if (pending != null && pending.matches(expiry)) {
+                pendingInteraction = null
+            }
+            callbacks.onInteractionExpired(expiry)
+            previousEventType = type
+            return
+        }
+        if (type in INTERACTION_RESUME_EVENTS) {
+            pendingInteraction?.let { ask ->
+                pendingInteraction = null
+                callbacks.onInteractionResolved(
+                    GatewayAskExpiry(kind = ask.kind, requestId = ask.requestId),
+                )
+            }
+        }
+
         when (type) {
             "reasoning.delta" -> {
                 val text = payload.string("text")
@@ -95,13 +131,30 @@ class GatewayEventMapper(
 
             "message.delta" -> {
                 val text = payload.string("text")
-                if (!text.isNullOrEmpty()) {
+                if (!text.isNullOrEmpty() && !isIntentionalSilenceMarker(text)) {
                     clearActivityStatuses()
                     sawTextDelta = true
+                    previewedText = null
                     callbacks.onTextDelta(text)
                 }
             }
 
+            "message.interim" -> {
+                val text = payload.string("text") ?: payload.string("message")
+                    ?: payload.string("preview") ?: payload.string("rendered")
+                val alreadyStreamed = payload.boolean("already_streamed") == true
+                if (!text.isNullOrBlank() || alreadyStreamed) {
+                    clearActivityStatuses()
+                    if (!sawMessageStart) {
+                        sawMessageStart = true
+                        callbacks.onStart()
+                    }
+                    callbacks.onInterimMessage(text.orEmpty(), alreadyStreamed)
+                    previewedText = text
+                    sawTextDelta = alreadyStreamed
+                }
+            }
+
             "message.start" -> {
                 // The upstream background-completion poller currently emits
                 // message.start immediately before _run_prompt_submit(), which
@@ -114,6 +167,7 @@ class GatewayEventMapper(
                 // assistant message began — close out the previous one.
                 if (sawMessageStart) callbacks.onTurnComplete()
                 sawMessageStart = true
+                previewedText = null
                 callbacks.onStart()
             }
 
@@ -163,8 +217,21 @@ class GatewayEventMapper(
             "message.complete" -> {
                 // Non-streaming servers (or error turns) deliver everything
                 // here; backfill whatever never streamed.
+                val failed = payload.string("status").equals(ERROR_STATUS_KIND, ignoreCase = true)
+                val error = payload.string("error")
                 val text = payload.string("text")
-                if (!sawTextDelta && !text.isNullOrEmpty()) {
+                    ?: error?.takeIf { failed }?.let { "Error: $it" }
+                val reconcilesInterim = !text.isNullOrEmpty() &&
+                    previewedText?.let { preview ->
+                        preview.isNotEmpty() &&
+                            (text.startsWith(preview) || preview.startsWith(text))
+                    } == true
+                if (reconcilesInterim) {
+                    callbacks.onInterimReconciled(text)
+                } else if (!text.isNullOrEmpty() &&
+                    !isIntentionalSilenceMarker(text) &&
+                    (!sawTextDelta || previewedText != null)
+                ) {
                     callbacks.onTextDelta(text)
                 }
                 val reasoning = payload.string("reasoning")
@@ -172,6 +239,12 @@ class GatewayEventMapper(
                     callbacks.onThinkingDelta(reasoning)
                 }
                 callbacks.onUsage(parseGatewayUsage(payload?.get("usage") as? JsonObject))
+                if (failed) {
+                    callbacks.onStatusUpdate(
+                        ERROR_STATUS_KIND,
+                        error?.takeIf { it.isNotBlank() } ?: text.orEmpty().ifBlank { "Turn failed" },
+                    )
+                }
                 turnEnded = true
                 callbacks.onComplete()
             }
@@ -209,36 +282,6 @@ class GatewayEventMapper(
                 )
             }
 
-            "clarify.request" -> callbacks.onInteractionRequest(
-                GatewayAsk(
-                    kind = GatewayAsk.Kind.CLARIFY,
-                    requestId = payload.string("request_id"),
-                    text = payload.string("question") ?: "The agent needs clarification",
-                    choices = (payload?.get("choices") as? JsonArray)
-                        ?.mapNotNull { (it as? JsonPrimitive)?.contentOrNull }
-                        ?.takeIf { it.isNotEmpty() },
-                    timeoutSeconds = CLARIFY_TIMEOUT_SECONDS,
-                ),
-            )
-
-            "approval.request" -> callbacks.onInteractionRequest(
-                GatewayAsk(
-                    kind = GatewayAsk.Kind.APPROVAL,
-                    // Upstream approvals correlate per-SESSION, never
-                    // per-request — a stray request_id must not be adopted.
-                    requestId = null,
-                    text = listOfNotNull(payload.string("command"), payload.string("description"))
-                        .joinToString(" — ")
-                        .ifBlank { "a command approval" },
-                    choices = payload.approvalChoices(),
-                    smartDenied = payload.boolean("smart_denied") == true,
-                    // Current Hermes omits timeout metadata. Keep the legacy
-                    // no-countdown behavior unless a future contract exposes
-                    // the effective per-request timeout explicitly.
-                    timeoutSeconds = payload.int("timeout_seconds") ?: 0,
-                ),
-            )
-
             "tool.output_risk" -> {
                 val toolId = payload.string("tool_id")
                 val risk = payload.string("risk")?.lowercase() ?: return
@@ -259,52 +302,57 @@ class GatewayEventMapper(
                 }
             }
 
-            // MoA activity proves auto-compaction has resumed even though
-            // Android does not currently render these upstream events.
-            "moa.reference", "moa.aggregating", "tool.progress" -> clearActivityStatuses()
+            "moa.reference" -> {
+                clearProviderWaitAndCompaction()
+                val text = payload.string("text")?.trim().orEmpty()
+                if (text.isNotEmpty()) {
+                    val available = !isFailedMoaReference(text)
+                    callbacks.onMoaReference(
+                        GatewayMoaReference(
+                            index = payload.int("index")?.takeIf { it > 0 },
+                            count = payload.int("count")
+                                ?.takeIf { it > 0 },
+                            label = payload.string("label")?.trim()?.take(MAX_MOA_LABEL_CHARS).orEmpty()
+                                .ifBlank { "Advisor" },
+                            text = if (available) text.take(MAX_MOA_REFERENCE_CHARS) else "",
+                            available = available,
+                        ),
+                    )
+                }
+            }
 
-            "sudo.request" -> callbacks.onInteractionRequest(
-                GatewayAsk(
-                    kind = GatewayAsk.Kind.SUDO,
-                    requestId = payload.string("request_id"),
-                    // Payload carries request_id ONLY — no command to show.
-                    text = "Elevated permissions requested",
-                    timeoutSeconds = SUDO_TIMEOUT_SECONDS,
-                ),
-            )
+            "moa.progress" -> {
+                clearProviderWaitAndCompaction()
+                val total = payload.int("refs_total")
+                    ?.takeIf { it > 0 }
+                val done = payload.int("refs_done")
+                if (total != null && done != null) {
+                    setMoaStatus("MoA: ${done.coerceIn(0, total)}/$total advisors complete")
+                }
+            }
 
-            "secret.request" -> callbacks.onInteractionRequest(
-                GatewayAsk(
-                    kind = GatewayAsk.Kind.SECRET,
-                    requestId = payload.string("request_id"),
-                    text = payload.string("prompt") ?: "The agent needs a secret value",
-                    envVar = payload.string("env_var"),
-                    timeoutSeconds = SECRET_TIMEOUT_SECONDS,
-                ),
-            )
+            "moa.phase" -> {
+                clearProviderWaitAndCompaction()
+                when (payload.string("phase")?.lowercase()) {
+                    "aggregator", "aggregating" -> setMoaStatus("MoA: aggregating…")
+                    "reference", "references" -> {
+                        val total = payload.int("refs_total")
+                            ?.takeIf { it > 0 }
+                        val done = payload.int("refs_done")
+                        if (total != null && done != null) {
+                            setMoaStatus("MoA: ${done.coerceIn(0, total)}/$total advisors complete")
+                        }
+                    }
+                }
+            }
 
-            "sudo.expire" -> callbacks.onInteractionExpired(
-                GatewayAskExpiry(
-                    kind = GatewayAsk.Kind.SUDO,
-                    requestId = payload.string("request_id"),
-                ),
-            )
+            // Legacy phase marker retained by upstream for older consumers.
+            "moa.aggregating" -> {
+                clearProviderWaitAndCompaction()
+                setMoaStatus("MoA: aggregating…")
+            }
 
-            "secret.expire" -> callbacks.onInteractionExpired(
-                GatewayAskExpiry(
-                    kind = GatewayAsk.Kind.SECRET,
-                    requestId = payload.string("request_id"),
-                ),
-            )
-
-            // Forward-compatible consumer for the proposed upstream approval
-            // expiry event. Approvals correlate by session, never request id.
-            "approval.expire" -> callbacks.onInteractionExpired(
-                GatewayAskExpiry(
-                    kind = GatewayAsk.Kind.APPROVAL,
-                    requestId = null,
-                ),
-            )
+            "tool.progress" -> clearActivityStatuses()
 
             "status.update" -> {
                 val text = payload.string("text")
@@ -336,27 +384,120 @@ class GatewayEventMapper(
     }
 
     private fun clearActivityStatuses() {
+        clearProviderWaitAndCompaction()
+        if (!moaStatusActive) return
+        moaStatusActive = false
+        callbacks.onStatusClear(MOA_STATUS_KIND)
+    }
+
+    private fun clearProviderWaitAndCompaction() {
         clearProviderWaitStatus()
         if (!compactionStatusActive) return
         compactionStatusActive = false
         callbacks.onStatusClear(COMPACTION_STATUS_KIND)
     }
 
-    private fun JsonObject?.approvalChoices(): List<String>? =
-        (this?.get("choices") as? JsonArray)
-            ?.mapNotNull { (it as? JsonPrimitive)?.contentOrNull?.lowercase() }
-            ?.filter { it in APPROVAL_CHOICES }
-            ?.distinct()
-            ?.takeIf { it.isNotEmpty() }
-
-    private fun JsonObject?.boolean(key: String): Boolean? =
-        (this?.get(key) as? JsonPrimitive)?.booleanOrNull
+    private fun setMoaStatus(text: String) {
+        moaStatusActive = true
+        callbacks.onStatusUpdate(MOA_STATUS_KIND, text)
+    }
 
     companion object {
         const val PROVIDER_WAIT_STATUS_KIND = "provider_wait"
         const val COMPACTION_STATUS_KIND = "compacting"
-        private val APPROVAL_CHOICES = setOf("once", "session", "always", "deny")
+        const val ERROR_STATUS_KIND = "error"
+        const val MOA_STATUS_KIND = "moa"
+        private const val MAX_MOA_LABEL_CHARS = 120
+        private const val MAX_MOA_REFERENCE_CHARS = 16_000
         private val OUTPUT_RISK_LEVELS = setOf("low", "medium", "high", "critical")
+        private val INTERACTION_RESUME_EVENTS = setOf(
+            "reasoning.delta",
+            "thinking.delta",
+            "reasoning.available",
+            "message.delta",
+            "message.interim",
+            "message.start",
+            "tool.generating",
+            "tool.start",
+            "tool.complete",
+            "message.complete",
+            "error",
+        )
+
+        internal fun isFailedMoaReference(text: String): Boolean {
+            val normalized = text.trimStart().lowercase()
+            return normalized.startsWith("[failed:") || normalized.startsWith("[skipped:")
+        }
+
+        fun interactionRequest(type: String, payload: JsonObject?): GatewayAsk? = when (type) {
+            "clarify.request" -> GatewayAsk(
+                kind = GatewayAsk.Kind.CLARIFY,
+                requestId = payload.string("request_id"),
+                text = payload.string("question") ?: "The agent needs clarification",
+                choices = (payload?.get("choices") as? JsonArray)
+                    ?.mapNotNull { (it as? JsonPrimitive)?.contentOrNull }
+                    ?.takeIf { it.isNotEmpty() },
+                timeoutSeconds = CLARIFY_TIMEOUT_SECONDS,
+            )
+
+            "approval.request" -> GatewayAsk(
+                kind = GatewayAsk.Kind.APPROVAL,
+                // Upstream approvals correlate per-SESSION, never
+                // per-request — a stray request_id must not be adopted.
+                requestId = null,
+                text = listOfNotNull(payload.string("command"), payload.string("description"))
+                    .joinToString(" — ")
+                    .ifBlank { "a command approval" },
+                choices = payload.approvalChoices(),
+                smartDenied = payload.boolean("smart_denied") == true,
+                timeoutSeconds = payload.int("timeout_seconds") ?: 0,
+            )
+
+            "sudo.request" -> GatewayAsk(
+                kind = GatewayAsk.Kind.SUDO,
+                requestId = payload.string("request_id"),
+                text = "Elevated permissions requested",
+                timeoutSeconds = SUDO_TIMEOUT_SECONDS,
+            )
+
+            "secret.request" -> GatewayAsk(
+                kind = GatewayAsk.Kind.SECRET,
+                requestId = payload.string("request_id"),
+                text = payload.string("prompt") ?: "The agent needs a secret value",
+                envVar = payload.string("env_var"),
+                timeoutSeconds = SECRET_TIMEOUT_SECONDS,
+            )
+
+            else -> null
+        }
+
+        fun interactionExpiry(type: String, payload: JsonObject?): GatewayAskExpiry? = when (type) {
+            "clarify.expire" -> GatewayAskExpiry(
+                kind = GatewayAsk.Kind.CLARIFY,
+                requestId = payload.string("request_id"),
+            )
+
+            "sudo.expire" -> GatewayAskExpiry(
+                kind = GatewayAsk.Kind.SUDO,
+                requestId = payload.string("request_id"),
+            )
+
+            "secret.expire" -> GatewayAskExpiry(
+                kind = GatewayAsk.Kind.SECRET,
+                requestId = payload.string("request_id"),
+            )
+
+            // Forward-compatible consumer for a future upstream approval
+            // expiry event. Approvals correlate by session, never request id.
+            "approval.expire" -> GatewayAskExpiry(
+                kind = GatewayAsk.Kind.APPROVAL,
+                requestId = null,
+            )
+
+            else -> null
+        }
+
+        fun isInteractionResumeEvent(type: String): Boolean = type in INTERACTION_RESUME_EVENTS
 
         /**
          * Hermes 2026-07-15 emits these operational wait lines through the
@@ -422,3 +563,20 @@ private fun JsonObject?.int(key: String): Int? =
 
 private fun JsonObject?.double(key: String): Double? =
     (this?.get(key) as? JsonPrimitive)?.doubleOrNull
+
+private fun JsonObject?.boolean(key: String): Boolean? =
+    (this?.get(key) as? JsonPrimitive)?.booleanOrNull
+
+private fun JsonObject?.approvalChoices(): List<String>? =
+    (this?.get("choices") as? JsonArray)
+        ?.mapNotNull { (it as? JsonPrimitive)?.contentOrNull?.lowercase() }
+        ?.filter { it in setOf("once", "session", "always", "deny") }
+        ?.distinct()
+        ?.takeIf { it.isNotEmpty() }
+
+private fun GatewayAsk.sameRequestAs(other: GatewayAsk): Boolean =
+    kind == other.kind && requestId == other.requestId
+
+private fun GatewayAsk.matches(expiry: GatewayAskExpiry): Boolean =
+    kind == expiry.kind &&
+        (kind == GatewayAsk.Kind.APPROVAL || requestId == expiry.requestId)

app/src/main/kotlin/com/hermesandroid/relay/network/upstream/GatewayKeepAliveService.kt

@@ -22,8 +22,9 @@ import kotlinx.coroutines.cancel
 import kotlinx.coroutines.launch
 
 /**
- * Opt-in foreground service that holds the app process up so the app's
- * connection to Hermes survives Android's background-freeze / Doze — i.e.
+ * Foreground service that holds the app process up so work the user already
+ * started survives Android's background-freeze / Doze. It runs automatically
+ * while one or more turns are active, or continuously when the user enables
  * "persistent connection". Concretely it keeps the gateway chat WebSocket
  * (held by [com.hermesandroid.relay.viewmodel.ConnectionViewModel]'s
  * [GatewayChatClient]) open; for relay-paired setups, holding the whole
@@ -39,13 +40,14 @@ import kotlinx.coroutines.launch
  * connection use case Google Play permits. The `specialUse` type is honest for
  * an always-on connection (`dataSync` is force-stopped after a 6h/day cap on
  * SDK 35) but requires a one-time Play Console foreground-service declaration
- * at submission. Off by default; only runs while the user enables the toggle.
+ * at submission. Continuous idle retention is off by default; active work is
+ * protected automatically and releases its lease on terminal settlement.
  *
  * # It does NOT own the socket
  *
  * The service's only job is to hold the process in the foreground. The socket
  * stays open because [GatewayChatClient.setKeepAliveInBackground] stops its
- * idle-close timer while the toggle is on. On task removal (user swipes the app
+ * idle-close timer while retention is required. On task removal (user swipes the app
  * away) the ViewModel + socket die with the process, so the service stops
  * itself rather than leave a notification that lies about being connected.
  *
@@ -63,9 +65,31 @@ class GatewayKeepAliveService : Service() {
         private const val CHANNEL_NAME = "Persistent connection"
         const val NOTIFICATION_ID = 4713
         const val ACTION_STOP = "com.hermesandroid.relay.gateway.KEEPALIVE_STOP"
+        private const val ACTION_REFRESH = "com.hermesandroid.relay.gateway.KEEPALIVE_REFRESH"
+        private const val EXTRA_PERSISTENT = "persistent"
+        private const val EXTRA_ACTIVE_TURNS = "active_turns"
+        private const val EXTRA_WAITING_SESSIONS = "waiting_sessions"
+        @Volatile private var runningInstance: GatewayKeepAliveService? = null
 
-        fun start(context: Context) {
+        fun update(
+            context: Context,
+            persistent: Boolean,
+            activeTurns: ActiveTurnKeepAliveRegistry.Snapshot,
+        ) {
+            if (!persistent && !activeTurns.required) {
+                stop(context)
+                return
+            }
+            runningInstance?.let { service ->
+                service.applyState(persistent, activeTurns)
+                service.startForegroundNotification()
+                return
+            }
             val intent = Intent(context.applicationContext, GatewayKeepAliveService::class.java)
+                .setAction(ACTION_REFRESH)
+                .putExtra(EXTRA_PERSISTENT, persistent)
+                .putExtra(EXTRA_ACTIVE_TURNS, activeTurns.activeTurnCount)
+                .putExtra(EXTRA_WAITING_SESSIONS, activeTurns.waitingSessionCount)
             if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.O) {
                 context.applicationContext.startForegroundService(intent)
             } else {
@@ -83,21 +107,38 @@ class GatewayKeepAliveService : Service() {
     }
 
     private val scope = CoroutineScope(SupervisorJob() + Dispatchers.IO)
+    private var persistent = false
+    private var activeTurns = 0
+    private var waitingSessions = 0
 
     override fun onBind(intent: Intent?): IBinder? = null
 
+    override fun onCreate() {
+        super.onCreate()
+        runningInstance = this
+    }
+
     override fun onStartCommand(intent: Intent?, flags: Int, startId: Int): Int {
+        if (intent?.action == ACTION_REFRESH) {
+            persistent = intent.getBooleanExtra(EXTRA_PERSISTENT, false)
+            activeTurns = intent.getIntExtra(EXTRA_ACTIVE_TURNS, 0).coerceAtLeast(0)
+            waitingSessions = intent.getIntExtra(EXTRA_WAITING_SESSIONS, 0)
+                .coerceIn(0, activeTurns)
+        }
         startForegroundNotification()
         if (intent?.action == ACTION_STOP) {
-            Log.i(TAG, "ACTION_STOP → user dismissed background connection")
-            // Flip the pref off so ConnectionViewModel's collector won't
-            // restart us on the next foreground.
+            Log.i(TAG, "ACTION_STOP → user disabled continuous background connection")
             scope.launch { runCatching { applicationContext.setGatewayKeepAlive(false) } }
-            stopForeground(STOP_FOREGROUND_REMOVE)
-            stopSelf()
+            persistent = false
+            if (activeTurns == 0) {
+                stopForeground(STOP_FOREGROUND_REMOVE)
+                stopSelf()
+            } else {
+                startForegroundNotification()
+            }
             return START_NOT_STICKY
         }
-        return START_STICKY
+        return START_NOT_STICKY
     }
 
     override fun onTaskRemoved(rootIntent: Intent?) {
@@ -105,15 +146,26 @@ class GatewayKeepAliveService : Service() {
         // The socket lives in the ViewModel, which dies when the task is
         // removed — keeping the notification would be a lie. Stop cleanly.
         Log.i(TAG, "onTaskRemoved → app swiped away; stopping keep-alive")
+        ActiveTurnKeepAliveRegistry.releaseAll()
         stopForeground(STOP_FOREGROUND_REMOVE)
         stopSelf()
     }
 
     override fun onDestroy() {
+        if (runningInstance === this) runningInstance = null
         scope.cancel()
         super.onDestroy()
     }
 
+    private fun applyState(
+        persistent: Boolean,
+        turns: ActiveTurnKeepAliveRegistry.Snapshot,
+    ) {
+        this.persistent = persistent
+        activeTurns = turns.activeTurnCount
+        waitingSessions = turns.waitingSessionCount.coerceIn(0, activeTurns)
+    }
+
     // The service + specialUse type + FOREGROUND_SERVICE_SPECIAL_USE permission
     // are all declared in the main manifest (both flavors), so the type is
     // satisfied. Suppress retained defensively — lint's ForegroundServiceType
@@ -148,17 +200,42 @@ class GatewayKeepAliveService : Service() {
         val stopIntent = Intent(this, GatewayKeepAliveService::class.java).setAction(ACTION_STOP)
         val stopPending = PendingIntent.getService(this, 1, stopIntent, pendingFlags)
 
-        return NotificationCompat.Builder(this, CHANNEL_ID)
+        val (title, body) = when {
+            waitingSessions > 0 -> {
+                val title = if (waitingSessions == 1) {
+                    "Hermes is waiting for input"
+                } else {
+                    "$waitingSessions Hermes sessions need input"
+                }
+                title to if (activeTurns > waitingSessions) {
+                    "$waitingSessions waiting · ${activeTurns - waitingSessions} still working"
+                } else {
+                    "Open the requested session to review and continue."
+                }
+            }
+            activeTurns > 0 -> {
+                val title = if (activeTurns == 1) {
+                    "Hermes is finishing a turn"
+                } else {
+                    "Hermes is finishing $activeTurns turns"
+                }
+                title to "The connection stays active until this work completes."
+            }
+            else -> getString(R.string.gateway_keepalive_title) to
+                getString(R.string.gateway_keepalive_body)
+        }
+        val builder = NotificationCompat.Builder(this, CHANNEL_ID)
             .setSmallIcon(R.mipmap.ic_launcher)
-            .setContentTitle(getString(R.string.gateway_keepalive_title))
-            .setContentText(getString(R.string.gateway_keepalive_body))
+            .setContentTitle(title)
+            .setContentText(body)
+            .setStyle(NotificationCompat.BigTextStyle().bigText(body))
             .setContentIntent(tapPending)
             .setOngoing(true)
             .setOnlyAlertOnce(true)
             .setPriority(NotificationCompat.PRIORITY_LOW)
             .setCategory(NotificationCompat.CATEGORY_SERVICE)
-            .addAction(0, "Turn off", stopPending)
-            .build()
+        if (persistent) builder.addAction(0, "Turn off always-on", stopPending)
+        return builder.build()
     }
 
     private fun ensureChannel() {

app/src/main/kotlin/com/hermesandroid/relay/network/upstream/GatewayModels.kt

@@ -50,6 +50,29 @@ enum class GatewayConnectionState {
     Ready,
 }
 
+/** Profile-persisted approval policy introduced by upstream gateway contract v3. */
+enum class GatewayApprovalMode(val wireValue: String) {
+    Manual("manual"),
+    Smart("smart"),
+    Off("off");
+
+    companion object {
+        fun fromWire(value: String?): GatewayApprovalMode? = when (value?.trim()?.lowercase()) {
+            "manual" -> Manual
+            "smart" -> Smart
+            "off" -> Off
+            else -> null
+        }
+    }
+}
+
+/** Whether this gateway exposes the contract-v3 profile approval-mode RPCs. */
+enum class GatewayApprovalModeCapability {
+    Unknown,
+    Supported,
+    Unsupported,
+}
+
 /**
  * Streaming-endpoint resolution with the gateway tier — pure so the matrix
  * is unit-testable without an AndroidViewModel. ConnectionViewModel
@@ -57,8 +80,9 @@ enum class GatewayConnectionState {
  *
  * Manual picks pass through untouched (ChatViewModel handles per-turn
  * fallback when a "gateway" pick can't serve a send); "auto" prefers the
- * gateway only when the dashboard probe says [GatewayAvailability.Ready],
- * otherwise it falls back to the capability-preferred SSE endpoint.
+ * gateway while the dashboard probe is unresolved or ready. A capability-
+ * preferred SSE fallback is selected only after a definitive unavailable,
+ * unsupported, or sign-in-required verdict.
  */
 fun resolveStreamingEndpointPreference(
     preference: String,
@@ -66,7 +90,10 @@ fun resolveStreamingEndpointPreference(
     capabilities: ServerCapabilities,
 ): String = when (preference) {
     "sessions", "completions", "runs", "gateway" -> preference
-    else -> if (gateway == GatewayAvailability.Ready) {
+    else -> if (
+        gateway == GatewayAvailability.Ready ||
+        gateway == GatewayAvailability.Unknown
+    ) {
         "gateway"
     } else {
         capabilities.preferredChatEndpoint()
@@ -95,6 +122,28 @@ data class GatewayInflightTurn(
     val user: String,
     val assistant: String,
     val streaming: Boolean,
+    val status: String? = null,
+    val error: String? = null,
+    val recoverable: Boolean = false,
+)
+
+/** A next-turn prompt accepted by upstream while the current turn was busy. */
+data class GatewayQueuedTurn(
+    val user: String,
+)
+
+/** A fresh crash marker caused `session.resume` to schedule one continuation. */
+data class GatewayAutoContinue(
+    val attempt: Int,
+    val interruptedAt: Double?,
+)
+
+/** Optional project identity attached to newer upstream session metadata. */
+data class GatewaySessionProject(
+    val id: String?,
+    val slug: String?,
+    val name: String,
+    val primaryPath: String?,
 )
 
 /** Result of reattaching Android to an existing durable Gateway session. */
@@ -104,9 +153,15 @@ data class GatewaySessionRecovery(
     val running: Boolean,
     val status: String?,
     val inflight: GatewayInflightTurn?,
+    val queued: GatewayQueuedTurn?,
     /** Non-null only when subsequent turn events are bound to [GatewayTurnCallbacks]. */
     val handle: ActiveTurnHandle?,
-)
+    val autoContinue: GatewayAutoContinue? = null,
+) {
+    /** Whether upstream still owes this client live turn events. */
+    val hasPendingWork: Boolean
+        get() = running || queued != null || autoContinue != null
+}
 
 /** A detached sibling turn reached its terminal event on the shared Gateway socket. */
 data class GatewayBackgroundTurnCompletion(
@@ -115,6 +170,25 @@ data class GatewayBackgroundTurnCompletion(
     val expectedAssistantText: String?,
 )
 
+/** Input lifecycle from a deliberately detached Gateway turn. */
+sealed interface GatewayBackgroundInteractionEvent {
+    val storedSessionId: String
+    val profile: String?
+    val ask: GatewayAsk
+
+    data class Requested(
+        override val storedSessionId: String,
+        override val profile: String?,
+        override val ask: GatewayAsk,
+    ) : GatewayBackgroundInteractionEvent
+
+    data class Resolved(
+        override val storedSessionId: String,
+        override val profile: String?,
+        override val ask: GatewayAsk,
+    ) : GatewayBackgroundInteractionEvent
+}
+
 /**
  * One server-side interactive ask. The agent thread upstream is BLOCKED
  * until the matching respond RPC arrives, the ask times out (resolves to ""
@@ -273,6 +347,14 @@ data class GatewayModelProvider(
     val totalModels: Int = 0,
 )
 
+data class GatewayMoaReference(
+    val index: Int?,
+    val count: Int?,
+    val label: String,
+    val text: String,
+    val available: Boolean = true,
+)
+
 /** Result of the gateway `model.options` RPC. */
 data class GatewayModelOptions(
     val providers: List<GatewayModelProvider>,
@@ -280,6 +362,15 @@ data class GatewayModelOptions(
     val currentProvider: String,
 )
 
+/** Reject provider catalogs that completed after a profile/context switch. */
+internal fun isCurrentModelOptionsResponse(
+    requestGeneration: Long,
+    currentGeneration: Long,
+    requestProfileKey: String,
+    currentProfileKey: String,
+): Boolean =
+    requestGeneration == currentGeneration && requestProfileKey == currentProfileKey
+
 /**
  * The explicit in-chat overrides to bind onto a gateway `session.create` as the
  * new session's PER-SESSION overrides. Matches the upstream desktop client,
@@ -296,7 +387,9 @@ data class GatewayModelOptions(
  *
  * [model] is the model id (e.g. `grok-4.3`); [provider] is the authenticated
  * provider slug (e.g. `xai`). [reasoningEffort] is the upstream effort string
- * (`low`/`medium`/`high`/…). [fast] pins the priority service tier when true.
+ * (`low`/`medium`/`high`/…). [fast] follows the contract-v4 tri-state: `true`
+ * pins priority, `false` explicitly pins normal, and `null` omits the field so
+ * the profile's service tier is inherited.
  * Note `yolo` is intentionally absent — upstream `session.create` does NOT
  * accept it as a per-session override, so it is applied post-create instead.
  */
@@ -328,6 +421,19 @@ class GatewayTurnCallbacks(
     /** A gateway `message.start` opened an assistant response for this turn. */
     val onStart: () -> Unit,
     val onTextDelta: (String) -> Unit,
+    /**
+     * Gateway `message.interim` sealed an attempted assistant message before
+     * the terminal `message.complete`. When [alreadyStreamed] is false, [text]
+     * has not arrived through `message.delta` and should be rendered before
+     * sealing the current assistant segment.
+     */
+    val onInterimMessage: (text: String, alreadyStreamed: Boolean) -> Unit = { _, _ -> },
+    /**
+     * The terminal text is equal/prefix-related to the sealed interim, so the
+     * existing segment should be replaced in place instead of opening a second
+     * assistant bubble.
+     */
+    val onInterimReconciled: (text: String) -> Unit = { _ -> },
     val onThinkingDelta: (String) -> Unit,
     val onToolCallStart: (toolCallId: String, toolName: String) -> Unit,
     val onToolCallDone: (toolCallId: String, resultPreview: String?) -> Unit,
@@ -352,6 +458,8 @@ class GatewayTurnCallbacks(
     val onToolGenerating: (toolName: String?) -> Unit,
     /** `subagent.*` lifecycle on the parent session — feeds the subagent lanes. */
     val onSubagentEvent: (GatewaySubagentEvent) -> Unit,
+    /** Successful MoA advisor output for a transient labelled reference block. */
+    val onMoaReference: (GatewayMoaReference) -> Unit,
     /**
      * Server-side interactive ask (clarify/approval/sudo/secret) that blocks
      * the turn until answered via the matching respond RPC or the turn is
@@ -360,6 +468,8 @@ class GatewayTurnCallbacks(
     val onInteractionRequest: (GatewayAsk) -> Unit,
     /** Server declared a pending interaction expired; clear only the matching card. */
     val onInteractionExpired: (GatewayAskExpiry) -> Unit,
+    /** The turn resumed after a pending interaction was resolved elsewhere. */
+    val onInteractionResolved: (GatewayAskExpiry) -> Unit = { _ -> },
     /**
      * Gateway `status.update` lifecycle line — model fallback, retries, and
      * errors (often emoji-prefixed: 🔄 fallback, ⏳ retry, ❌ error). Default

app/src/main/kotlin/com/hermesandroid/relay/network/upstream/HermesApiClient.kt

@@ -21,6 +21,7 @@ import com.hermesandroid.relay.util.TurnLatencyTracer
 import kotlinx.coroutines.Dispatchers
 import kotlinx.coroutines.withContext
 import kotlinx.serialization.encodeToString
+import kotlinx.serialization.Serializable
 import kotlinx.serialization.json.Json
 import kotlinx.serialization.json.JsonArray
 import kotlinx.serialization.json.JsonObject
@@ -28,6 +29,7 @@ import kotlinx.serialization.json.JsonPrimitive
 import kotlinx.serialization.json.booleanOrNull
 import kotlinx.serialization.json.contentOrNull
 import kotlinx.serialization.json.decodeFromJsonElement
+import kotlinx.serialization.json.put
 import okhttp3.HttpUrl.Companion.toHttpUrlOrNull
 import okhttp3.MediaType.Companion.toMediaType
 import okhttp3.OkHttpClient
@@ -76,6 +78,10 @@ data class ServerCapabilities(
     val portable: Boolean,
     /** `/health` — basic reachability. */
     val healthy: Boolean,
+    /** Authenticated provider/model inventory at `/api/model/options`. */
+    val modelOptions: Boolean = false,
+    /** Backend-acknowledged per-session model lock. */
+    val sessionModelLock: Boolean = false,
 ) {
     /** Resolve `streamingEndpoint = "auto"` to the best concrete choice. */
     fun preferredChatEndpoint(): String = when {
@@ -99,6 +105,8 @@ data class ServerCapabilities(
             runs = false,
             portable = false,
             healthy = false,
+            modelOptions = false,
+            sessionModelLock = false,
         )
     }
 }
@@ -138,6 +146,8 @@ internal fun parseCapabilitiesBody(json: Json, body: String): ServerCapabilities
             feature("chat_completions") ||
             endpoint("chat_completions"),
         healthy = true,
+        modelOptions = feature("model_options") || endpoint("model_options"),
+        sessionModelLock = feature("session_model_lock") || endpoint("session_model_lock"),
     )
 }
 
@@ -159,6 +169,269 @@ internal fun parseSkillListBody(json: Json, body: String): List<SkillInfo>? {
     }
 }
 
+@Serializable
+data class ToolsetInfo(
+    val name: String,
+    val label: String = "",
+    val description: String = "",
+    val enabled: Boolean = false,
+    val configured: Boolean = false,
+    val tools: List<String> = emptyList(),
+)
+
+@Serializable
+private data class ToolsetListResponse(val data: List<ToolsetInfo> = emptyList())
+
+internal fun parseToolsetListBody(json: Json, body: String): List<ToolsetInfo>? = try {
+    json.decodeFromString<ToolsetListResponse>(body).data
+} catch (_: Exception) {
+    null
+}
+
+/** One OpenAI-compatible `/v1/models` row. [id] is always the request value. */
+data class ApiModelOption(
+    val id: String,
+    val root: String? = null,
+    val parent: String? = null,
+) {
+    /** Secondary picker copy for a configured route alias. */
+    val routeDetail: String?
+        get() = root?.takeIf { it.isNotBlank() && it != id }?.let { "Routes to $it" }
+}
+
+/** Authenticated provider/model inventory advertised by `/api/model/options`. */
+data class ApiProviderModelOptions(
+    val providers: List<GatewayModelProvider>,
+    val currentModel: String,
+    val currentProvider: String,
+)
+
+internal fun parseApiProviderModelOptionsBody(
+    json: Json,
+    body: String,
+): ApiProviderModelOptions? {
+    val root = runCatching { json.parseToJsonElement(body) as? JsonObject }.getOrNull()
+        ?: return null
+    val rows = root["providers"] as? JsonArray ?: return null
+    val providers = rows.mapNotNull { element ->
+        val obj = element as? JsonObject ?: return@mapNotNull null
+        val slug = (obj["slug"] as? JsonPrimitive)?.contentOrNull
+            ?.trim()?.takeIf { it.isNotEmpty() } ?: return@mapNotNull null
+        GatewayModelProvider(
+            name = (obj["name"] as? JsonPrimitive)?.contentOrNull ?: slug,
+            slug = slug,
+            models = (obj["models"] as? JsonArray).orEmpty()
+                .mapNotNull { (it as? JsonPrimitive)?.contentOrNull },
+            isCurrent = (obj["is_current"] as? JsonPrimitive)?.booleanOrNull ?: false,
+            warning = (obj["warning"] as? JsonPrimitive)?.contentOrNull,
+            authenticated = (obj["authenticated"] as? JsonPrimitive)?.booleanOrNull ?: true,
+            unavailableModels = (obj["unavailable_models"] as? JsonArray).orEmpty()
+                .mapNotNull { (it as? JsonPrimitive)?.contentOrNull },
+            freeTier = (obj["free_tier"] as? JsonPrimitive)?.booleanOrNull ?: false,
+            totalModels = (obj["total_models"] as? JsonPrimitive)?.contentOrNull
+                ?.toIntOrNull() ?: 0,
+        )
+    }
+    return ApiProviderModelOptions(
+        providers = providers,
+        currentModel = (root["model"] as? JsonPrimitive)?.contentOrNull.orEmpty(),
+        currentProvider = (root["provider"] as? JsonPrimitive)?.contentOrNull.orEmpty(),
+    )
+}
+
+enum class ApiModelRoutingErrorCode {
+    INVENTORY_UNSUPPORTED,
+    INVENTORY_UNAVAILABLE,
+    PROVIDER_NOT_AUTHENTICATED,
+    MODEL_NOT_AVAILABLE,
+    MODEL_NOT_AVAILABLE_ON_PLAN,
+    LOCK_CAPABILITY_INCOMPLETE,
+    LOCK_REJECTED,
+    LOCK_ACK_MISMATCH,
+    LEGACY_PROVIDER_UNSUPPORTED,
+}
+
+class ApiModelRoutingException(
+    val code: ApiModelRoutingErrorCode,
+    message: String,
+) : IOException(message)
+
+sealed interface ApiModelSelectionAck {
+    data object ServerDefault : ApiModelSelectionAck
+    data class Locked(
+        val sessionId: String,
+        val model: String,
+        val provider: String?,
+        val effectiveModel: String = model,
+        val effectiveProvider: String? = provider,
+    ) : ApiModelSelectionAck
+    data class LegacyModelHint(val model: String) : ApiModelSelectionAck
+}
+
+internal enum class ApiModelRoutingStrategy { LOCKED, LEGACY_HINT, INCOMPLETE }
+
+internal fun apiModelRoutingStrategy(capabilities: ServerCapabilities): ApiModelRoutingStrategy =
+    when {
+        capabilities.sessionModelLock && capabilities.modelOptions ->
+            ApiModelRoutingStrategy.LOCKED
+        capabilities.sessionModelLock ->
+            ApiModelRoutingStrategy.INCOMPLETE
+        else ->
+            ApiModelRoutingStrategy.LEGACY_HINT
+    }
+
+internal fun sessionTurnModelHint(
+    acknowledgement: ApiModelSelectionAck,
+    requestedModel: String?,
+): String? =
+    if (acknowledgement is ApiModelSelectionAck.Locked) null else requestedModel
+
+internal data class ParsedApiModelLockAck(
+    val sessionId: String?,
+    val model: String?,
+    val provider: String?,
+    val state: String?,
+    val effectiveModel: String?,
+    val effectiveProvider: String?,
+)
+
+internal fun parseApiModelLockAck(json: Json, body: String): ParsedApiModelLockAck? {
+    val root = runCatching { json.parseToJsonElement(body) as? JsonObject }.getOrNull()
+        ?: return null
+    val runtime = root["runtime"] as? JsonObject ?: return null
+    val requested = runtime["requested"] as? JsonObject
+    val effective = runtime["effective"] as? JsonObject
+    return ParsedApiModelLockAck(
+        sessionId = (root["session_id"] as? JsonPrimitive)?.contentOrNull,
+        model = (requested?.get("model") as? JsonPrimitive)?.contentOrNull,
+        provider = (requested?.get("provider") as? JsonPrimitive)?.contentOrNull,
+        state = (runtime["model_lock"] as? JsonPrimitive)?.contentOrNull,
+        effectiveModel = (effective?.get("model") as? JsonPrimitive)?.contentOrNull,
+        effectiveProvider = (effective?.get("provider") as? JsonPrimitive)?.contentOrNull,
+    )
+}
+
+internal fun confirmedRuntimeMatches(
+    runtime: JsonObject?,
+    expected: ApiModelSelectionAck.Locked,
+): Boolean {
+    runtime ?: return false
+    val effective = runtime["effective"] as? JsonObject ?: return false
+    return (runtime["model_lock"] as? JsonPrimitive)?.contentOrNull == "confirmed" &&
+        (effective["model"] as? JsonPrimitive)?.contentOrNull == expected.effectiveModel &&
+        (effective["provider"] as? JsonPrimitive)?.contentOrNull == expected.effectiveProvider
+}
+
+internal fun parseModelOptionsBody(json: Json, body: String): List<ApiModelOption>? {
+    val data = try {
+        (json.parseToJsonElement(body) as? JsonObject)?.get("data") as? JsonArray
+    } catch (_: Exception) {
+        null
+    } ?: return null
+    return data.mapNotNull { row ->
+        val obj = row as? JsonObject ?: return@mapNotNull null
+        val id = (obj["id"] as? JsonPrimitive)?.contentOrNull
+            ?.trim()?.takeIf { it.isNotEmpty() } ?: return@mapNotNull null
+        ApiModelOption(
+            id = id,
+            root = (obj["root"] as? JsonPrimitive)?.contentOrNull,
+            parent = (obj["parent"] as? JsonPrimitive)?.contentOrNull,
+        )
+    }
+}
+
+private const val STREAM_ERROR_BODY_LIMIT = 16L * 1024L
+
+/** Preserve the upstream drain code and bounded retry hint without leaking large bodies. */
+internal fun streamHttpFailureMessage(
+    code: Int,
+    reason: String,
+    retryAfter: String?,
+    body: String?,
+    json: Json,
+): String {
+    val error = body?.takeIf { it.length <= STREAM_ERROR_BODY_LIMIT }?.let { raw ->
+        runCatching { json.parseToJsonElement(raw) as? JsonObject }.getOrNull()?.get("error")
+    }
+    val errorObj = error as? JsonObject
+    val errorCode = (errorObj?.get("code") as? JsonPrimitive)?.contentOrNull
+    val detail = (errorObj?.get("message") as? JsonPrimitive)?.contentOrNull
+        ?: (error as? JsonPrimitive)?.contentOrNull
+    return buildString {
+        append("API error ").append(code).append(": ")
+        if (!errorCode.isNullOrBlank()) append(errorCode).append(": ")
+        append(detail?.takeIf { it.isNotBlank() } ?: reason)
+        retryAfter?.trim()?.toIntOrNull()?.takeIf { it in 0..60 }?.let {
+            append(" (Retry-After: ").append(it).append("s)")
+        }
+    }
+}
+
+internal fun gatewayDrainRetryDelayMillis(
+    httpCode: Int?,
+    retryAfter: String?,
+    errorMessage: String,
+    receivedEvent: Boolean,
+    retryAlreadyScheduled: Boolean,
+): Long? {
+    if (httpCode != 503 || receivedEvent || retryAlreadyScheduled ||
+        !errorMessage.startsWith("API error 503: gateway_draining:")
+    ) return null
+    val seconds = retryAfter?.trim()?.toIntOrNull()?.coerceIn(0, 5) ?: 1
+    return seconds * 1_000L
+}
+
+/** Owns the initial SSE, its one delayed drain retry, and the replacement SSE. */
+private class RetryingEventSource(
+    private val originalRequest: Request,
+    private val handler: Handler,
+) : EventSource {
+    private val lock = Any()
+    private var active: EventSource? = null
+    private var retryRunnable: Runnable? = null
+    private var cancelled = false
+
+    override fun request(): Request = originalRequest
+
+    fun attach(source: EventSource) {
+        synchronized(lock) {
+            if (cancelled) source.cancel() else active = source
+        }
+    }
+
+    fun retryAfter(delayMillis: Long, create: () -> EventSource) {
+        val task = Runnable {
+            synchronized(lock) {
+                retryRunnable = null
+                if (cancelled) return@Runnable
+                // Keep creation under the same lock as cancel(): once Stop or
+                // a session switch wins, no delayed POST can start afterward.
+                active = create()
+            }
+        }
+        synchronized(lock) {
+            if (cancelled) return
+            retryRunnable = task
+            handler.postDelayed(task, delayMillis)
+        }
+    }
+
+    override fun cancel() {
+        val source: EventSource?
+        val task: Runnable?
+        synchronized(lock) {
+            if (cancelled) return
+            cancelled = true
+            source = active
+            active = null
+            task = retryRunnable
+            retryRunnable = null
+        }
+        task?.let(handler::removeCallbacks)
+        source?.cancel()
+    }
+}
+
 /**
  * Direct HTTP/SSE client for the Hermes API Server.
  *
@@ -174,6 +447,8 @@ class HermesApiClient(
         isLenient = true
     }
 ) {
+    @Volatile
+    private var lastCapabilities: ServerCapabilities? = null
     private val baseUrl: String = baseUrl.trimEnd('/')
 
     companion object {
@@ -199,8 +474,13 @@ class HermesApiClient(
 
         /** Shared human-readable message for an SSE [EventSourceListener.onFailure]. */
         private fun streamFailureMessage(t: Throwable?, response: Response?): String = when {
-            response != null && !response.isSuccessful ->
-                "API error ${response.code}: ${response.message}"
+            response != null && !response.isSuccessful -> streamHttpFailureMessage(
+                code = response.code,
+                reason = response.message,
+                retryAfter = response.header("Retry-After"),
+                body = runCatching { response.peekBody(STREAM_ERROR_BODY_LIMIT).string() }.getOrNull(),
+                json = Json { ignoreUnknownKeys = true },
+            )
             t is IOException -> "$TRANSPORT_ERROR_PREFIX: ${t.message}"
             t != null -> "Stream error: ${t.message}"
             else -> "Unknown stream error"
@@ -445,6 +725,24 @@ class HermesApiClient(
         emptyList()
     }
 
+    /** Authenticated read-only inventory from upstream `GET /v1/toolsets`. */
+    suspend fun getToolsets(): Result<List<ToolsetInfo>> = withContext(Dispatchers.IO) {
+        try {
+            val request = authRequest("$baseUrl/v1/toolsets").get().build()
+            client.newCall(request).execute().use { response ->
+                if (!response.isSuccessful) {
+                    return@withContext Result.failure(IOException("HTTP ${response.code}"))
+                }
+                val body = response.body?.string().orEmpty()
+                val parsed = parseToolsetListBody(json, body)
+                    ?: return@withContext Result.failure(IOException("Malformed toolset inventory"))
+                Result.success(parsed)
+            }
+        } catch (e: Exception) {
+            Result.failure(e)
+        }
+    }
+
     // --- Available models ---
 
     /**
@@ -453,17 +751,13 @@ class HermesApiClient(
      * picker. Returns ids in server order; empty on any failure (the picker
      * then offers only "Server default").
      */
-    suspend fun getModels(): List<String> = withContext(Dispatchers.IO) {
+    suspend fun getModelOptions(): List<ApiModelOption> = withContext(Dispatchers.IO) {
         try {
             val request = authRequest("$baseUrl/v1/models").get().build()
             client.newCall(request).execute().use { response ->
                 if (!response.isSuccessful) return@withContext emptyList()
                 val body = response.body?.string() ?: return@withContext emptyList()
-                val data = (json.parseToJsonElement(body) as? JsonObject)
-                    ?.get("data") as? JsonArray ?: return@withContext emptyList()
-                data.mapNotNull {
-                    ((it as? JsonObject)?.get("id") as? JsonPrimitive)?.contentOrNull
-                }
+                parseModelOptionsBody(json, body).orEmpty()
             }
         } catch (e: Exception) {
             Log.w(TAG, "Failed to fetch models: ${e.message}")
@@ -471,6 +765,208 @@ class HermesApiClient(
         }
     }
 
+    /** Compatibility view for callers that only need request ids. */
+    suspend fun getModels(): List<String> = getModelOptions().map { it.id }
+
+    /** Provider-aware picker inventory; never falls back to unauthenticated local guesses. */
+    suspend fun getProviderModelOptions(
+        refresh: Boolean = false,
+    ): Result<ApiProviderModelOptions> = withContext(Dispatchers.IO) {
+        try {
+            val suffix = if (refresh) "?refresh=true" else ""
+            val request = authRequest("$baseUrl/api/model/options$suffix").get().build()
+            client.newCall(request).execute().use { response ->
+                if (!response.isSuccessful) {
+                    return@withContext Result.failure(
+                        ApiModelRoutingException(
+                            if (response.code == 404) {
+                                ApiModelRoutingErrorCode.INVENTORY_UNSUPPORTED
+                            } else {
+                                ApiModelRoutingErrorCode.INVENTORY_UNAVAILABLE
+                            },
+                            if (response.code == 401 || response.code == 403) {
+                                "Model inventory authorization failed (HTTP ${response.code})."
+                            } else {
+                                "Model inventory unavailable (HTTP ${response.code})."
+                            },
+                        ),
+                    )
+                }
+                val parsed = parseApiProviderModelOptionsBody(json, response.body.string())
+                    ?: return@withContext Result.failure(
+                        ApiModelRoutingException(
+                            ApiModelRoutingErrorCode.INVENTORY_UNAVAILABLE,
+                            "Model inventory returned an invalid response.",
+                        ),
+                    )
+                Result.success(parsed)
+            }
+        } catch (e: Exception) {
+            Result.failure(
+                if (e is ApiModelRoutingException) e else {
+                    ApiModelRoutingException(
+                        ApiModelRoutingErrorCode.INVENTORY_UNAVAILABLE,
+                        "Model inventory could not be loaded.",
+                    )
+                },
+            )
+        }
+    }
+
+    /**
+     * Validate and, on capable servers, persist a model/provider lock before a
+     * session turn is submitted. This never writes global config.
+     */
+    suspend fun acknowledgeSessionModelSelection(
+        sessionId: String,
+        model: String?,
+        provider: String?,
+    ): Result<ApiModelSelectionAck> = withContext(Dispatchers.IO) {
+        val selectedModel = AgentDisplay.requestModelName(model)
+            ?: return@withContext Result.success(ApiModelSelectionAck.ServerDefault)
+        val selectedProvider = provider?.trim()?.takeIf { it.isNotEmpty() }
+        // Capability snapshots can be populated by a disconnected startup
+        // probe. Re-probe at the lock boundary instead of trusting a stale
+        // false forever after the connection recovers.
+        val capabilities = probeCapabilities()
+
+        if (apiModelRoutingStrategy(capabilities) == ApiModelRoutingStrategy.LOCKED) {
+            val inventory = getProviderModelOptions().getOrElse {
+                return@withContext Result.failure(it)
+            }
+            val aliases = getModelOptions()
+            val selectedRoot = aliases.firstOrNull { it.id == selectedModel }?.root
+                ?.takeIf { it.isNotBlank() }
+            val providerModel = selectedRoot ?: selectedModel
+            val providerRow = when {
+                selectedProvider != null ->
+                    inventory.providers.firstOrNull { it.slug == selectedProvider }
+                else -> inventory.providers.singleOrNull { providerModel in it.models }
+                        ?: inventory.providers.firstOrNull {
+                            it.isCurrent && providerModel in it.models
+                        }
+            } ?: return@withContext Result.failure(
+                ApiModelRoutingException(
+                    ApiModelRoutingErrorCode.MODEL_NOT_AVAILABLE,
+                    "The selected model is not in the API server's authenticated inventory.",
+                ),
+            )
+            if (!providerRow.authenticated) {
+                return@withContext Result.failure(
+                    ApiModelRoutingException(
+                        ApiModelRoutingErrorCode.PROVIDER_NOT_AUTHENTICATED,
+                        "The selected provider is not authenticated on this profile.",
+                    ),
+                )
+            }
+            if (providerModel !in providerRow.models) {
+                return@withContext Result.failure(
+                    ApiModelRoutingException(
+                        ApiModelRoutingErrorCode.MODEL_NOT_AVAILABLE,
+                        "The selected model is not available from ${providerRow.name}.",
+                    ),
+                )
+            }
+            if (providerModel in providerRow.unavailableModels) {
+                return@withContext Result.failure(
+                    ApiModelRoutingException(
+                        ApiModelRoutingErrorCode.MODEL_NOT_AVAILABLE_ON_PLAN,
+                        "The selected model is not available on the authenticated account.",
+                    ),
+                )
+            }
+
+            val body = kotlinx.serialization.json.buildJsonObject {
+                put("model", selectedModel)
+                put("provider", providerRow.slug)
+            }
+            try {
+                val request = authRequest("$baseUrl/api/sessions/$sessionId/model")
+                    .post(json.encodeToString(JsonObject.serializer(), body).toRequestBody(JSON_MEDIA))
+                    .build()
+                client.newCall(request).execute().use { response ->
+                    val responseBody = response.body.string()
+                    if (!response.isSuccessful) {
+                        return@withContext Result.failure(
+                            ApiModelRoutingException(
+                                ApiModelRoutingErrorCode.LOCK_REJECTED,
+                                streamHttpFailureMessage(
+                                    response.code,
+                                    response.message,
+                                    response.header("Retry-After"),
+                                    responseBody,
+                                    json,
+                                ),
+                            ),
+                        )
+                    }
+                    val ack = parseApiModelLockAck(json, responseBody)
+                    if (
+                        ack?.sessionId != sessionId ||
+                        ack?.model != selectedModel ||
+                        ack?.provider != providerRow.slug ||
+                        ack?.state != "accepted" ||
+                        ack?.effectiveModel.isNullOrBlank() ||
+                        ack?.effectiveProvider.isNullOrBlank()
+                    ) {
+                        return@withContext Result.failure(
+                            ApiModelRoutingException(
+                                ApiModelRoutingErrorCode.LOCK_ACK_MISMATCH,
+                                "Server did not acknowledge the requested model lock.",
+                            ),
+                        )
+                    }
+                    val confirmedAck = requireNotNull(ack)
+                    Result.success(
+                        ApiModelSelectionAck.Locked(
+                            sessionId = sessionId,
+                            model = selectedModel,
+                            provider = providerRow.slug,
+                            effectiveModel = requireNotNull(confirmedAck.effectiveModel),
+                            effectiveProvider = confirmedAck.effectiveProvider,
+                        ),
+                    )
+                }
+            } catch (e: Exception) {
+                Result.failure(
+                    if (e is ApiModelRoutingException) e else {
+                        ApiModelRoutingException(
+                            ApiModelRoutingErrorCode.LOCK_REJECTED,
+                            "Model lock request failed before the message was sent.",
+                        )
+                    },
+                )
+            }
+        } else {
+            if (apiModelRoutingStrategy(capabilities) == ApiModelRoutingStrategy.INCOMPLETE) {
+                return@withContext Result.failure(
+                    ApiModelRoutingException(
+                        ApiModelRoutingErrorCode.LOCK_CAPABILITY_INCOMPLETE,
+                        "Server advertises an incomplete model-routing contract.",
+                    ),
+                )
+            }
+            if (selectedProvider != null) {
+                return@withContext Result.failure(
+                    ApiModelRoutingException(
+                        ApiModelRoutingErrorCode.LEGACY_PROVIDER_UNSUPPORTED,
+                        "This Hermes version cannot safely preserve a provider selection on API fallback.",
+                    ),
+                )
+            }
+            val advertised = getModelOptions().map { it.id }
+            if (selectedModel !in advertised) {
+                return@withContext Result.failure(
+                    ApiModelRoutingException(
+                        ApiModelRoutingErrorCode.MODEL_NOT_AVAILABLE,
+                        "This Hermes version did not advertise the selected model for API fallback.",
+                    ),
+                )
+            }
+            Result.success(ApiModelSelectionAck.LegacyModelHint(selectedModel))
+        }
+    }
+
     // --- Server personalities ---
 
     /**
@@ -593,6 +1089,7 @@ class HermesApiClient(
         onError: (String) -> Unit,
         modelOverride: String? = null,
         profileName: String? = null,
+        expectedModelLock: ApiModelSelectionAck.Locked? = null,
     ): EventSource {
         if (!modelOverride.isNullOrBlank()) {
             Log.d(TAG, "sendChatStream: modelOverride=$modelOverride (profile pick)")
@@ -623,6 +1120,10 @@ class HermesApiClient(
             }
 
         val completeCalled = AtomicBoolean(false)
+        val runtimeConfirmed = AtomicBoolean(expectedModelLock == null)
+        val receivedEvent = AtomicBoolean(false)
+        val drainRetryScheduled = AtomicBoolean(false)
+        val turnSource = RetryingEventSource(request, mainHandler)
         // Comparable to the gateway's turn[gateway] line — see TurnLatencyTracer.
         val tracer = TurnLatencyTracer("sessions")
 
@@ -636,10 +1137,17 @@ class HermesApiClient(
                 type: String?,
                 data: String
             ) {
+                receivedEvent.set(true)
                 tracer.mark("ttfe")
                 if (data == "[DONE]") {
                     if (completeCalled.compareAndSet(false, true)) {
-                        mainHandler.post { onComplete() }
+                        mainHandler.post {
+                            if (runtimeConfirmed.get()) {
+                                onComplete()
+                            } else {
+                                onError("Server ended the turn without confirming the selected model route.")
+                            }
+                        }
                     }
                     return
                 }
@@ -715,9 +1223,17 @@ class HermesApiClient(
                         }
                         // assistant.completed — one turn finished, but run may continue with tool calls
                         "assistant.completed" -> {
+                            val runtimeMatches = expectedModelLock?.let {
+                                confirmedRuntimeMatches(event.runtime, it)
+                            } ?: true
+                            if (runtimeMatches) runtimeConfirmed.set(true)
                             mainHandler.post {
                                 onUsage(event.usage)
-                                if (event.interrupted == true) {
+                                if (!runtimeMatches) {
+                                    if (completeCalled.compareAndSet(false, true)) {
+                                        onError("Server response did not confirm the selected model route.")
+                                    }
+                                } else if (event.interrupted == true) {
                                     if (completeCalled.compareAndSet(false, true)) {
                                         onError("Response interrupted")
                                     }
@@ -729,9 +1245,15 @@ class HermesApiClient(
                         // run.completed — the entire agent loop is done (all turns + tool calls)
                         "run.completed" -> {
                             if (completeCalled.compareAndSet(false, true)) {
+                                val runtimeMatches = expectedModelLock?.let {
+                                    confirmedRuntimeMatches(event.runtime, it)
+                                } ?: true
+                                if (runtimeMatches) runtimeConfirmed.set(true)
                                 mainHandler.post {
                                     onUsage(event.usage)
-                                    if (event.interrupted == true) {
+                                    if (!runtimeMatches) {
+                                        onError("Server response did not confirm the selected model route.")
+                                    } else if (event.interrupted == true) {
                                         onError("Run interrupted")
                                     } else {
                                         onComplete()
@@ -741,7 +1263,13 @@ class HermesApiClient(
                         }
                         "done" -> {
                             if (completeCalled.compareAndSet(false, true)) {
-                                mainHandler.post { onComplete() }
+                                mainHandler.post {
+                                    if (runtimeConfirmed.get()) {
+                                        onComplete()
+                                    } else {
+                                        onError("Server ended the turn without confirming the selected model route.")
+                                    }
+                                }
                             }
                         }
                         "error" -> {
@@ -799,9 +1327,20 @@ class HermesApiClient(
                 t: Throwable?,
                 response: Response?
             ) {
+                val msg = streamFailureMessage(t, response)
+                val retryDelay = gatewayDrainRetryDelayMillis(
+                    response?.code,
+                    response?.header("Retry-After"),
+                    msg,
+                    receivedEvent.get(),
+                    drainRetryScheduled.get(),
+                )
+                if (retryDelay != null && drainRetryScheduled.compareAndSet(false, true)) {
+                    turnSource.retryAfter(retryDelay) { sseFactory.newEventSource(request, this) }
+                    return
+                }
                 tracer.done("error")
                 if (completeCalled.compareAndSet(false, true)) {
-                    val msg = streamFailureMessage(t, response)
                     mainHandler.post { onError(msg) }
                 }
             }
@@ -809,12 +1348,19 @@ class HermesApiClient(
             override fun onClosed(eventSource: EventSource) {
                 tracer.done()
                 if (completeCalled.compareAndSet(false, true)) {
-                    mainHandler.post { onComplete() }
+                    mainHandler.post {
+                        if (runtimeConfirmed.get()) {
+                            onComplete()
+                        } else {
+                            onError("Server closed the turn without confirming the selected model route.")
+                        }
+                    }
                 }
             }
         }
 
-        return sseFactory.newEventSource(request, listener)
+        turnSource.attach(sseFactory.newEventSource(request, listener))
+        return turnSource
     }
 
     // --- OpenAI-compatible chat streaming via /v1/chat/completions ---
@@ -876,6 +1422,9 @@ class HermesApiClient(
 
         val completeCalled = AtomicBoolean(false)
         val messageStarted = AtomicBoolean(false)
+        val receivedEvent = AtomicBoolean(false)
+        val drainRetryScheduled = AtomicBoolean(false)
+        val turnSource = RetryingEventSource(request, mainHandler)
         // Comparable to the gateway's turn[gateway] line — see TurnLatencyTracer.
         val tracer = TurnLatencyTracer("completions")
 
@@ -886,6 +1435,7 @@ class HermesApiClient(
                 type: String?,
                 data: String
             ) {
+                receivedEvent.set(true)
                 tracer.mark("ttfe")
                 if (data == "[DONE]") {
                     if (completeCalled.compareAndSet(false, true)) {
@@ -941,9 +1491,20 @@ class HermesApiClient(
                 t: Throwable?,
                 response: Response?
             ) {
+                val msg = streamFailureMessage(t, response)
+                val retryDelay = gatewayDrainRetryDelayMillis(
+                    response?.code,
+                    response?.header("Retry-After"),
+                    msg,
+                    receivedEvent.get(),
+                    drainRetryScheduled.get(),
+                )
+                if (retryDelay != null && drainRetryScheduled.compareAndSet(false, true)) {
+                    turnSource.retryAfter(retryDelay) { sseFactory.newEventSource(request, this) }
+                    return
+                }
                 tracer.done("error")
                 if (completeCalled.compareAndSet(false, true)) {
-                    val msg = streamFailureMessage(t, response)
                     mainHandler.post { onError(msg) }
                 }
             }
@@ -956,7 +1517,8 @@ class HermesApiClient(
             }
         }
 
-        return sseFactory.newEventSource(request, listener)
+        turnSource.attach(sseFactory.newEventSource(request, listener))
+        return turnSource
     }
 
     private fun openAiChoice(event: JsonObject): JsonObject? =
@@ -1070,6 +1632,9 @@ class HermesApiClient(
             }
 
         val completeCalled = AtomicBoolean(false)
+        val receivedEvent = AtomicBoolean(false)
+        val drainRetryScheduled = AtomicBoolean(false)
+        val turnSource = RetryingEventSource(request, mainHandler)
         // Comparable to the gateway's turn[gateway] line — see TurnLatencyTracer.
         val tracer = TurnLatencyTracer("runs")
 
@@ -1080,6 +1645,7 @@ class HermesApiClient(
                 type: String?,
                 data: String
             ) {
+                receivedEvent.set(true)
                 tracer.mark("ttfe")
                 if (data == "[DONE]") {
                     if (completeCalled.compareAndSet(false, true)) {
@@ -1246,9 +1812,20 @@ class HermesApiClient(
                 t: Throwable?,
                 response: Response?
             ) {
+                val msg = streamFailureMessage(t, response)
+                val retryDelay = gatewayDrainRetryDelayMillis(
+                    response?.code,
+                    response?.header("Retry-After"),
+                    msg,
+                    receivedEvent.get(),
+                    drainRetryScheduled.get(),
+                )
+                if (retryDelay != null && drainRetryScheduled.compareAndSet(false, true)) {
+                    turnSource.retryAfter(retryDelay) { sseFactory.newEventSource(request, this) }
+                    return
+                }
                 tracer.done("error")
                 if (completeCalled.compareAndSet(false, true)) {
-                    val msg = streamFailureMessage(t, response)
                     mainHandler.post { onError(msg) }
                 }
             }
@@ -1261,7 +1838,8 @@ class HermesApiClient(
             }
         }
 
-        return sseFactory.newEventSource(request, listener)
+        turnSource.attach(sseFactory.newEventSource(request, listener))
+        return turnSource
     }
 
     // --- Capability detection ---
@@ -1319,7 +1897,10 @@ class HermesApiClient(
         } catch (_: Exception) {
             false
         }
-        if (!healthy) return@withContext ServerCapabilities.DISCONNECTED
+        if (!healthy) {
+            lastCapabilities = ServerCapabilities.DISCONNECTED
+            return@withContext ServerCapabilities.DISCONNECTED
+        }
 
         val advertisedCapabilities = try {
             val req = authRequest("$baseUrl/v1/capabilities").get().build()
@@ -1333,7 +1914,10 @@ class HermesApiClient(
         } catch (_: Exception) {
             null
         }
-        if (advertisedCapabilities != null) return@withContext advertisedCapabilities
+        if (advertisedCapabilities != null) {
+            lastCapabilities = advertisedCapabilities
+            return@withContext advertisedCapabilities
+        }
 
         // Reusable HEAD probe — returns true if the route is registered
         // (any status except 404 + network errors). Already inside the
@@ -1378,7 +1962,7 @@ class HermesApiClient(
             runs = runs,
             portable = portable,
             healthy = true,
-        )
+        ).also { lastCapabilities = it }
     }
 
     // --- Lifecycle ---

app/src/main/kotlin/com/hermesandroid/relay/network/upstream/HermesChatPayloads.kt

@@ -26,10 +26,12 @@ import kotlinx.serialization.json.putJsonObject
  *
  *  - `POST /api/sessions/{id}/chat/stream` (`_handle_session_chat_stream`)
  *    consumes `message` (or `input`) and `system_message` (or
- *    `instructions`, string only). `message` accepts either a plain string
- *    or OpenAI-style content parts (text + `image_url`) via
- *    `_normalize_multimodal_content`. Top-level `messages`, `attachments`,
- *    `model`, and `profile` are NOT parsed.
+ *    `instructions`, string only). Newer servers also parse per-request model
+ *    fields and reuse a backend-acknowledged session model lock when those
+ *    fields are omitted. Android therefore acknowledges a lock first and
+ *    omits `model` on that turn; the builder's model field remains only for
+ *    older-server compatibility. Top-level `messages`, `attachments`, and
+ *    `profile` are not parsed.
  *
  *  - `POST /v1/runs` (`_handle_runs`) consumes `input` (string or message
  *    array), `instructions`, `conversation_history` (array of
@@ -45,9 +47,8 @@ import kotlinx.serialization.json.putJsonObject
  *    entries are silently skipped and `tool_calls` fields are stripped.
  *    Top-level `attachments` and `profile` are NOT parsed.
  *
- * Legacy hint fields we deliberately keep sending although current native
- * upstream ignores them: `model` + `profile` on the sessions path,
- * `profile` on runs/completions, and `stream` on runs. They are
+ * Legacy hint fields we deliberately keep sending: `model` + `profile` on the
+ * sessions path, `profile` on runs/completions, and `stream` on runs. They are
  * configuration hints (never user content, so they cannot mask data
  * loss) honored by legacy fork builds — the runs path in particular only
  * activates against servers that explicitly advertise SSE-on-POST, which

app/src/main/kotlin/com/hermesandroid/relay/network/upstream/McpOAuthFlowCoordinator.kt

@@ -0,0 +1,80 @@
+package com.hermesandroid.relay.network.upstream
+
+import kotlinx.coroutines.delay
+import kotlinx.coroutines.CancellationException
+import okhttp3.HttpUrl.Companion.toHttpUrlOrNull
+import java.io.IOException
+
+/**
+ * Ephemeral hosted MCP OAuth driver. The opaque flow id and authorization URL
+ * remain in memory only; OAuth codes, callback state, and tokens never enter
+ * the Android client. The dashboard owns the complete PKCE/callback exchange.
+ */
+class McpOAuthFlowCoordinator(
+    private val client: DashboardApiClient,
+    private val pollDelayMillis: Long = 1_000,
+    private val maxPolls: Int = 900,
+    private val maxConsecutiveFailures: Int = 3,
+    private val sleep: suspend (Long) -> Unit = { delay(it) },
+) {
+    suspend fun start(
+        serverName: String,
+        profile: String? = null,
+    ): Result<DashboardMcpOAuthFlow> = client.startMcpOAuth(serverName, profile).mapCatching { started ->
+        if (started.status == "error") {
+            throw IOException(started.error ?: "MCP OAuth failed to start")
+        }
+        started
+    }
+
+    suspend fun resume(flowId: String): Result<DashboardMcpOAuthFlow> = runCatching {
+        var failures = 0
+        repeat(maxPolls.coerceAtLeast(1)) {
+            val current = client.getMcpOAuthFlow(flowId)
+            if (current.isFailure) {
+                failures += 1
+                if (failures >= maxConsecutiveFailures.coerceAtLeast(1)) {
+                    throw current.exceptionOrNull() ?: IOException("MCP OAuth status check failed")
+                }
+            } else {
+                failures = 0
+                val flow = current.getOrThrow()
+                when (flow.status) {
+                    "approved" -> return@runCatching flow
+                    "error" -> throw IOException(flow.error ?: "MCP OAuth authorization failed")
+                }
+            }
+            sleep(pollDelayMillis.coerceAtLeast(0))
+        }
+        throw IOException("MCP OAuth authorization timed out")
+    }.onFailure { error ->
+        if (error is CancellationException) throw error
+    }
+
+    suspend fun complete(
+        serverName: String,
+        profile: String? = null,
+        openAuthorization: (String) -> Boolean,
+    ): Result<DashboardMcpOAuthFlow> = runCatching {
+        val started = start(serverName, profile).getOrThrow()
+        if (started.status == "approved") return@runCatching started
+        val authorizationUrl = validatedAuthorizationUrl(started).getOrThrow()
+        if (!openAuthorization(authorizationUrl)) {
+            throw IOException("No browser is available to complete MCP OAuth")
+        }
+        resume(started.flowId).getOrThrow()
+    }.onFailure { error ->
+        if (error is CancellationException) throw error
+    }
+
+    companion object {
+        fun validatedAuthorizationUrl(flow: DashboardMcpOAuthFlow): Result<String> = runCatching {
+            val url = flow.authorizationUrl
+                ?: throw IOException("MCP OAuth server did not provide an authorization URL")
+            if (url.toHttpUrlOrNull()?.scheme != "https") {
+                throw IOException("MCP OAuth authorization URL must use HTTPS")
+            }
+            url
+        }
+    }
+}

app/src/main/kotlin/com/hermesandroid/relay/network/upstream/NativeDashboardAuth.kt

@@ -0,0 +1,393 @@
+package com.hermesandroid.relay.network.upstream
+
+import android.content.Context
+import com.hermesandroid.relay.auth.SessionTokenStore
+import com.hermesandroid.relay.auth.SecureStoreCache
+import com.hermesandroid.relay.auth.buildRawTokenStore
+import java.io.IOException
+import java.security.MessageDigest
+import java.security.SecureRandom
+import java.util.concurrent.ConcurrentHashMap
+import java.util.concurrent.TimeUnit
+import kotlinx.serialization.SerialName
+import kotlinx.serialization.Serializable
+import kotlinx.serialization.decodeFromString
+import kotlinx.serialization.encodeToString
+import kotlinx.serialization.json.Json
+import okhttp3.Authenticator
+import okhttp3.Interceptor
+import okhttp3.MediaType.Companion.toMediaType
+import okhttp3.OkHttpClient
+import okhttp3.Request
+import okhttp3.RequestBody.Companion.toRequestBody
+import okhttp3.Response
+import okhttp3.Route
+import okhttp3.HttpUrl.Companion.toHttpUrlOrNull
+import okio.ByteString.Companion.toByteString
+
+private const val NATIVE_PKCE_FLOW = "native_pkce"
+private const val CALLBACK_PATH = "/callback"
+private const val TOKEN_KEY = "dashboard_native_tokens_json"
+private val JSON_MEDIA = "application/json; charset=utf-8".toMediaType()
+
+@Serializable
+data class NativeDashboardTokens(
+    @SerialName("access_token") val accessToken: String,
+    @SerialName("refresh_token") val refreshToken: String = "",
+    @SerialName("expires_at") val expiresAt: Long = 0L,
+    val provider: String = "",
+    @SerialName("user_id") val userId: String = "",
+)
+
+interface NativeDashboardTokenStore {
+    /** Stable, non-secret identity used to serialize refresh-token rotation. */
+    val coordinationKey: String
+    fun load(): NativeDashboardTokens?
+    fun save(tokens: NativeDashboardTokens)
+    fun clear()
+}
+
+internal fun clearNativeDashboardTokens(store: NativeDashboardTokenStore) {
+    NativeTokenRefreshCoordinator.clear(store)
+}
+
+class EncryptedNativeDashboardTokenStore(
+    context: Context,
+    tokenStoreKey: String,
+    private val json: Json = Json { ignoreUnknownKeys = true },
+) : NativeDashboardTokenStore {
+    override val coordinationKey: String = tokenStoreKey
+    private val store: SessionTokenStore = SecureStoreCache.getOrBuild(tokenStoreKey) {
+        buildRawTokenStore(context.applicationContext, tokenStoreKey)
+    }
+
+    override fun load(): NativeDashboardTokens? =
+        store.getString(TOKEN_KEY)?.let { raw ->
+            runCatching { json.decodeFromString<NativeDashboardTokens>(raw) }.getOrNull()
+        }
+
+    override fun save(tokens: NativeDashboardTokens) {
+        store.putString(TOKEN_KEY, json.encodeToString(tokens))
+    }
+
+    override fun clear() {
+        store.remove(TOKEN_KEY)
+    }
+}
+
+/**
+ * Ephemeral authorization state. Keep this object in the sign-in coroutine:
+ * its verifier and CSRF state must never be persisted, logged, or copied into
+ * Compose/SavedState UI state.
+ */
+class NativeDashboardAuthorization internal constructor(
+    val authorizationUrl: String,
+    internal val verifier: String,
+    internal val state: String,
+    internal val generation: Long,
+)
+
+class NativeDashboardAuthClient(
+    baseUrl: String,
+    private val tokenStore: NativeDashboardTokenStore,
+    private val client: OkHttpClient = OkHttpClient.Builder()
+        .connectTimeout(10, TimeUnit.SECONDS)
+        .readTimeout(15, TimeUnit.SECONDS)
+        .writeTimeout(15, TimeUnit.SECONDS)
+        .build(),
+    private val json: Json = Json { ignoreUnknownKeys = true },
+    private val random: SecureRandom = SecureRandom(),
+) {
+    private val baseUrl = baseUrl.trim().trimEnd('/')
+
+    fun supportsNativePkce(status: DashboardStatus): Boolean =
+        NATIVE_PKCE_FLOW in status.authFlows
+
+    fun beginAuthorization(
+        redirectUri: String,
+        provider: String? = null,
+    ): NativeDashboardAuthorization {
+        requireStrictLoopbackRedirect(redirectUri)
+        val verifier = randomBytes(32).base64Url()
+        val challenge = MessageDigest.getInstance("SHA-256")
+            .digest(verifier.toByteArray(Charsets.US_ASCII))
+            .toByteString()
+            .base64Url()
+        val state = randomBytes(24).base64Url()
+        val root = "$baseUrl/auth/native/authorize".toHttpUrlOrNull()
+            ?: throw IOException("Dashboard URL is not a valid http(s) address")
+        val url = root.newBuilder()
+            .addQueryParameter("code_challenge", challenge)
+            .addQueryParameter("code_challenge_method", "S256")
+            .addQueryParameter("redirect_uri", redirectUri)
+            .addQueryParameter("state", state)
+            .apply { provider?.takeIf(String::isNotBlank)?.let { addQueryParameter("provider", it) } }
+            .build()
+            .toString()
+        val generation = NativeTokenRefreshCoordinator.beginAuthorization(
+            tokenStore.coordinationKey,
+        )
+        return NativeDashboardAuthorization(url, verifier, state, generation)
+    }
+
+    fun exchangeCallback(
+        authorization: NativeDashboardAuthorization,
+        callbackTarget: String,
+        commitAllowed: () -> Boolean = { true },
+    ): NativeDashboardTokens {
+        val callback = callbackTarget.toHttpUrlOrNull()
+            ?: "http://127.0.0.1$callbackTarget".toHttpUrlOrNull()
+            ?: throw NativeDashboardCallbackException("Native sign-in callback was malformed")
+        if (callback.host != "127.0.0.1" || callback.encodedPath != CALLBACK_PATH) {
+            throw NativeDashboardCallbackException(
+                "Native sign-in callback did not use the expected loopback path",
+            )
+        }
+        if (callback.queryParameter("state") != authorization.state) {
+            throw NativeDashboardCallbackException("Native sign-in callback state did not match")
+        }
+        callback.queryParameter("error")?.let {
+            throw NativeDashboardCallbackException(
+                message = "Gateway rejected native sign-in",
+                retryable = false,
+            )
+        }
+        val code = callback.queryParameter("code")
+            ?.takeIf(String::isNotBlank)
+            ?: throw NativeDashboardCallbackException(
+                "Native sign-in callback did not include an authorization code",
+            )
+        val payload = NativeTokenExchange(code = code, codeVerifier = authorization.verifier)
+        return postTokens(
+            path = "/auth/native/token",
+            payload = json.encodeToString(payload),
+            clearOnAuthFailure = false,
+            expectedGeneration = authorization.generation,
+            commitAllowed = commitAllowed,
+        )
+    }
+
+    internal fun cancelAuthorization(authorization: NativeDashboardAuthorization) {
+        NativeTokenRefreshCoordinator.cancelAuthorization(
+            tokenStore.coordinationKey,
+            authorization.generation,
+        )
+    }
+
+    fun clearStoredSession() {
+        clearNativeDashboardTokens(tokenStore)
+    }
+
+    fun refresh(tokens: NativeDashboardTokens? = null): NativeDashboardTokens {
+        return synchronized(NativeTokenRefreshCoordinator.lockFor(tokenStore.coordinationKey)) {
+            val current = tokenStore.load()
+                ?: tokens
+                ?: throw IOException("No native dashboard session is stored")
+            // A sibling client may already have rotated the single-use refresh
+            // token while this caller was waiting. Adopt that winner instead
+            // of replaying the stale token.
+            if (tokens != null && current != tokens) return@synchronized current
+            if (current.refreshToken.isBlank()) {
+                clearIfUnchanged(current)
+                throw IOException("Native dashboard session cannot be refreshed")
+            }
+            val payload = NativeTokenRefresh(current.refreshToken, current.provider)
+            val generation = NativeTokenRefreshCoordinator.currentGeneration(
+                tokenStore.coordinationKey,
+            )
+            try {
+                postTokens(
+                    path = "/auth/native/refresh",
+                    payload = json.encodeToString(payload),
+                    clearOnAuthFailure = false,
+                    expectedGeneration = generation,
+                )
+            } catch (error: NativeDashboardAuthHttpException) {
+                if (error.statusCode == 400 || error.statusCode == 401) {
+                    clearIfUnchanged(current)
+                }
+                throw error
+            }
+        }
+    }
+
+    private fun postTokens(
+        path: String,
+        payload: String,
+        clearOnAuthFailure: Boolean,
+        expectedGeneration: Long,
+        commitAllowed: () -> Boolean = { true },
+    ): NativeDashboardTokens {
+        val url = "$baseUrl$path".toHttpUrlOrNull()
+            ?: throw IOException("Dashboard URL is not a valid http(s) address")
+        val request = Request.Builder()
+            .url(url)
+            .post(payload.toRequestBody(JSON_MEDIA))
+            .build()
+        val tokens = client.newCall(request).execute().use { response ->
+            if (!response.isSuccessful) {
+                if (clearOnAuthFailure && (response.code == 400 || response.code == 401)) {
+                    tokenStore.clear()
+                }
+                throw NativeDashboardAuthHttpException(response.code)
+            }
+            val body = response.body?.string().orEmpty()
+            runCatching { json.decodeFromString<NativeDashboardTokens>(body) }
+                .getOrElse { throw IOException("Dashboard token response was malformed", it) }
+                .also {
+                    if (it.accessToken.isBlank()) {
+                        throw IOException("Dashboard token response did not include an access token")
+                    }
+                }
+        }
+        synchronized(NativeTokenRefreshCoordinator.lockFor(tokenStore.coordinationKey)) {
+            if (!commitAllowed() ||
+                NativeTokenRefreshCoordinator.currentGeneration(tokenStore.coordinationKey) !=
+                expectedGeneration
+            ) {
+                throw IOException("Dashboard sign-in is no longer active")
+            }
+            tokenStore.save(tokens)
+        }
+        return tokens
+    }
+
+    private fun randomBytes(size: Int) = ByteArray(size).also(random::nextBytes).toByteString()
+
+    private fun clearIfUnchanged(expected: NativeDashboardTokens) {
+        if (tokenStore.load() == expected) tokenStore.clear()
+    }
+
+    companion object {
+        fun requireStrictLoopbackRedirect(redirectUri: String) {
+            val url = redirectUri.toHttpUrlOrNull()
+                ?: throw IllegalArgumentException("Native redirect must be a valid loopback HTTP URL")
+            require(url.scheme == "http" && url.host == "127.0.0.1") {
+                "Native redirect must use the 127.0.0.1 loopback address"
+            }
+            require(url.port in 1..65535 && url.encodedPath == CALLBACK_PATH && url.query == null) {
+                "Native redirect must use an ephemeral port and the exact /callback path"
+            }
+        }
+    }
+}
+
+internal class NativeDashboardCallbackException(
+    message: String,
+    val retryable: Boolean = true,
+) : IOException(message)
+
+internal fun isNativeDashboardTransportEligible(baseUrl: String): Boolean {
+    val url = baseUrl.trim().trimEnd('/').toHttpUrlOrNull() ?: return false
+    return url.scheme == "https" ||
+        (url.scheme == "http" && url.host == "127.0.0.1")
+}
+
+/**
+ * Adds the native bearer to dashboard REST calls and rotates it before expiry
+ * or after one 401. Refresh requests use a separate bare client, so neither a
+ * stale bearer nor the authenticator can recurse into token rotation.
+ */
+class DashboardBearerAuth(
+    baseUrl: String,
+    private val tokenStore: NativeDashboardTokenStore,
+    private val clockSeconds: () -> Long = { System.currentTimeMillis() / 1000L },
+) : Interceptor, Authenticator {
+    private val authClient = NativeDashboardAuthClient(baseUrl, tokenStore)
+
+    override fun intercept(chain: Interceptor.Chain): Response {
+        val tokens = usableTokens(forceRefresh = false, failedAccessToken = null)
+        val request = tokens?.let {
+            chain.request().newBuilder()
+                .header("Authorization", "Bearer ${it.accessToken}")
+                .build()
+        } ?: chain.request()
+        return chain.proceed(request)
+    }
+
+    override fun authenticate(route: Route?, response: Response): Request? {
+        if (responseCount(response) >= 2) return null
+        val previous = response.request.header("Authorization") ?: return null
+        val failedAccessToken = previous.removePrefix("Bearer ").takeIf { it != previous }
+        val tokens = usableTokens(
+            forceRefresh = true,
+            failedAccessToken = failedAccessToken,
+        ) ?: return null
+        val next = "Bearer ${tokens.accessToken}"
+        if (next == previous) return null
+        return response.request.newBuilder().header("Authorization", next).build()
+    }
+
+    private fun usableTokens(
+        forceRefresh: Boolean,
+        failedAccessToken: String?,
+    ): NativeDashboardTokens? =
+        synchronized(NativeTokenRefreshCoordinator.lockFor(tokenStore.coordinationKey)) {
+            val current = tokenStore.load() ?: return@synchronized null
+            // A request can receive its 401 after another client already
+            // rotated the token. Retry with the winner; do not rotate again.
+            if (failedAccessToken != null && current.accessToken != failedAccessToken) {
+                return@synchronized current
+            }
+            val nearExpiry = current.expiresAt <= 0L || clockSeconds() >= current.expiresAt - 60L
+            if (!forceRefresh && !nearExpiry) return@synchronized current
+            runCatching { authClient.refresh(current) }.getOrNull()
+        }
+
+    private fun responseCount(response: Response): Int {
+        var count = 1
+        var prior = response.priorResponse
+        while (prior != null) {
+            count += 1
+            prior = prior.priorResponse
+        }
+        return count
+    }
+}
+
+private class NativeDashboardAuthHttpException(
+    val statusCode: Int,
+) : IOException("Dashboard native authentication failed (HTTP $statusCode)")
+
+private object NativeTokenRefreshCoordinator {
+    private val locks = ConcurrentHashMap<String, Any>()
+    private val generations = ConcurrentHashMap<String, Long>()
+
+    fun lockFor(key: String): Any = locks.computeIfAbsent(key) { Any() }
+
+    fun currentGeneration(key: String): Long =
+        synchronized(lockFor(key)) { generations[key] ?: 0L }
+
+    fun beginAuthorization(key: String): Long =
+        synchronized(lockFor(key)) {
+            (generations[key] ?: 0L).plus(1L).also { generations[key] = it }
+        }
+
+    fun cancelAuthorization(key: String, expectedGeneration: Long) {
+        synchronized(lockFor(key)) {
+            if ((generations[key] ?: 0L) == expectedGeneration) {
+                generations[key] = expectedGeneration + 1L
+            }
+        }
+    }
+
+    fun clear(store: NativeDashboardTokenStore) {
+        synchronized(lockFor(store.coordinationKey)) {
+            generations[store.coordinationKey] =
+                (generations[store.coordinationKey] ?: 0L) + 1L
+            store.clear()
+        }
+    }
+}
+
+@Serializable
+private data class NativeTokenExchange(
+    val code: String,
+    @SerialName("code_verifier") val codeVerifier: String,
+)
+
+@Serializable
+private data class NativeTokenRefresh(
+    @SerialName("refresh_token") val refreshToken: String,
+    val provider: String,
+)

app/src/main/kotlin/com/hermesandroid/relay/network/upstream/NativeDashboardSignInCoordinator.kt

@@ -0,0 +1,248 @@
+package com.hermesandroid.relay.network.upstream
+
+import java.io.IOException
+import java.io.InputStream
+import java.net.InetAddress
+import java.net.InetSocketAddress
+import java.net.ServerSocket
+import java.net.Socket
+import java.net.SocketTimeoutException
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.TimeoutCancellationException
+import kotlinx.coroutines.currentCoroutineContext
+import kotlinx.coroutines.ensureActive
+import kotlinx.coroutines.isActive
+import kotlinx.coroutines.withContext
+import kotlinx.coroutines.withTimeout
+
+private const val CALLBACK_PATH = "/callback"
+private const val MAX_REQUEST_LINE_BYTES = 8 * 1024
+private const val MAX_HEADER_BYTES = 16 * 1024
+private const val ACCEPT_POLL_MILLIS = 500
+internal const val DEFAULT_NATIVE_SIGN_IN_TIMEOUT_MILLIS = 2 * 60 * 1000L
+
+internal enum class DashboardRedirectAuthMode {
+    NativePkce,
+    WebView,
+}
+
+internal fun dashboardRedirectAuthMode(authFlows: List<String>): DashboardRedirectAuthMode =
+    if ("native_pkce" in authFlows) {
+        DashboardRedirectAuthMode.NativePkce
+    } else {
+        DashboardRedirectAuthMode.WebView
+    }
+
+/**
+ * Owns one native dashboard sign-in attempt.
+ *
+ * The listener and PKCE authorization are both local to [signIn], so leaving
+ * the screen, cancellation, timeout, or callback completion closes the port
+ * and discards verifier/state. Nothing secret enters Compose or saved state.
+ */
+class NativeDashboardSignInCoordinator(
+    private val authClient: NativeDashboardAuthClient,
+    private val timeoutMillis: Long = DEFAULT_NATIVE_SIGN_IN_TIMEOUT_MILLIS,
+    private val serverSocketFactory: () -> ServerSocket = ::ServerSocket,
+) {
+    suspend fun signIn(
+        provider: String?,
+        launchAuthorization: suspend (String) -> Unit,
+    ): NativeDashboardTokens =
+        try {
+            withContext(Dispatchers.IO) {
+                withTimeout(timeoutMillis) {
+                    serverSocketFactory().use { server ->
+                        server.reuseAddress = false
+                        server.bind(
+                            InetSocketAddress(
+                                InetAddress.getByName("127.0.0.1"),
+                                0,
+                            ),
+                            1,
+                        )
+                        server.soTimeout = ACCEPT_POLL_MILLIS
+                        check(server.inetAddress.hostAddress == "127.0.0.1") {
+                            "Native sign-in listener did not bind to IPv4 loopback"
+                        }
+
+                        val redirectUri = "http://127.0.0.1:${server.localPort}$CALLBACK_PATH"
+                        val authorization = authClient.beginAuthorization(redirectUri, provider)
+                        val attemptContext = currentCoroutineContext()
+                        var completed = false
+                        try {
+                            launchAuthorization(authorization.authorizationUrl)
+                            awaitValidCallback(
+                                server = server,
+                                authorization = authorization,
+                                commitAllowed = { attemptContext.isActive },
+                            ).also { completed = true }
+                        } finally {
+                            if (!completed) {
+                                authClient.cancelAuthorization(authorization)
+                            }
+                        }
+                    }
+                }
+            }
+        } catch (_: TimeoutCancellationException) {
+            throw IOException("Dashboard sign-in timed out")
+        }
+
+    private suspend fun awaitValidCallback(
+        server: ServerSocket,
+        authorization: NativeDashboardAuthorization,
+        commitAllowed: () -> Boolean,
+    ): NativeDashboardTokens {
+        while (true) {
+            val callback = acceptCallback(server)
+            val tokens = callback.use { socket ->
+                if (socket.inetAddress.hostAddress != "127.0.0.1") {
+                    writeResponse(
+                        socket,
+                        status = "403 Forbidden",
+                        body = "This sign-in callback was not accepted.",
+                    )
+                    return@use null
+                }
+                val target = try {
+                    readCallbackTarget(
+                        input = socket.getInputStream(),
+                        expectedPort = server.localPort,
+                    )
+                } catch (_: IOException) {
+                    writeResponse(
+                        socket,
+                        status = "400 Bad Request",
+                        body = "This sign-in callback was not accepted.",
+                    )
+                    return@use null
+                }
+                try {
+                    authClient.exchangeCallback(
+                        authorization,
+                        target,
+                        commitAllowed = commitAllowed,
+                    ).also {
+                        writeResponse(
+                            socket,
+                            status = "200 OK",
+                            body = "Sign-in complete. You can return to Hermes Relay.",
+                        )
+                    }
+                } catch (error: NativeDashboardCallbackException) {
+                    if (error.retryable) {
+                        writeResponse(
+                            socket,
+                            status = "400 Bad Request",
+                            body = "This sign-in callback was not accepted.",
+                        )
+                        return@use null
+                    }
+                    writeResponse(
+                        socket,
+                        status = "400 Bad Request",
+                        body = "Sign-in could not be completed. Return to Hermes Relay and try again.",
+                    )
+                    throw error
+                } catch (error: Exception) {
+                    writeResponse(
+                        socket,
+                        status = "400 Bad Request",
+                        body = "Sign-in could not be completed. Return to Hermes Relay and try again.",
+                    )
+                    throw error
+                }
+            }
+            if (tokens != null) return tokens
+        }
+    }
+
+    private suspend fun acceptCallback(server: ServerSocket): Socket {
+        while (true) {
+            currentCoroutineContext().ensureActive()
+            try {
+                return server.accept().apply { soTimeout = 5_000 }
+            } catch (_: SocketTimeoutException) {
+                // Poll so coroutine cancellation closes the lifecycle-owned listener promptly.
+            }
+        }
+    }
+
+    private fun readCallbackTarget(input: InputStream, expectedPort: Int): String {
+        val requestLine = readAsciiLine(input, MAX_REQUEST_LINE_BYTES)
+            ?: throw IOException("Native sign-in callback was empty")
+        val requestParts = requestLine.split(' ')
+        if (requestParts.size != 3 || requestParts[0] != "GET" ||
+            !requestParts[1].startsWith("/") ||
+            !requestParts[2].startsWith("HTTP/1.")
+        ) {
+            throw IOException("Native sign-in callback request was malformed")
+        }
+
+        var headerBytes = 0
+        var host: String? = null
+        while (true) {
+            val line = readAsciiLine(input, MAX_HEADER_BYTES - headerBytes)
+                ?: throw IOException("Native sign-in callback headers were incomplete")
+            headerBytes += line.length + 2
+            if (line.isEmpty()) break
+            if (line.startsWith("Host:", ignoreCase = true)) {
+                host = line.substringAfter(':').trim()
+            }
+            if (headerBytes >= MAX_HEADER_BYTES) {
+                throw IOException("Native sign-in callback headers were too large")
+            }
+        }
+        if (host != "127.0.0.1:$expectedPort") {
+            throw IOException("Native sign-in callback host was not accepted")
+        }
+        return requestParts[1]
+    }
+
+    private fun readAsciiLine(input: InputStream, limit: Int): String? {
+        if (limit <= 0) throw IOException("Native sign-in callback was too large")
+        val bytes = ArrayList<Byte>(minOf(limit, 128))
+        var previous = -1
+        while (bytes.size < limit) {
+            val current = input.read()
+            if (current == -1) return if (bytes.isEmpty()) null else throw IOException(
+                "Native sign-in callback ended unexpectedly",
+            )
+            if (previous == '\r'.code && current == '\n'.code) {
+                bytes.removeAt(bytes.lastIndex)
+                return bytes.toByteArray().toString(Charsets.US_ASCII)
+            }
+            bytes += current.toByte()
+            previous = current
+        }
+        throw IOException("Native sign-in callback line was too large")
+    }
+
+    private fun writeResponse(socket: Socket, status: String, body: String) {
+        val html = """
+            <!doctype html>
+            <html><head><meta name="viewport" content="width=device-width,initial-scale=1"></head>
+            <body><p>${escapeHtml(body)}</p></body></html>
+        """.trimIndent().toByteArray(Charsets.UTF_8)
+        val headers = buildString {
+            append("HTTP/1.1 ").append(status).append("\r\n")
+            append("Content-Type: text/html; charset=utf-8\r\n")
+            append("Content-Length: ").append(html.size).append("\r\n")
+            append("Cache-Control: no-store\r\n")
+            append("Connection: close\r\n\r\n")
+        }.toByteArray(Charsets.US_ASCII)
+        runCatching {
+            socket.getOutputStream().apply {
+                write(headers)
+                write(html)
+                flush()
+            }
+        }
+    }
+
+    private fun escapeHtml(value: String): String =
+        value.replace("&", "&amp;")
+            .replace("<", "&lt;")
+            .replace(">", "&gt;")
+}

app/src/main/kotlin/com/hermesandroid/relay/network/upstream/PersistedImageReferences.kt

@@ -0,0 +1,93 @@
+package com.hermesandroid.relay.network.upstream
+
+/**
+ * Parsed form of upstream's persisted user-image directives.
+ *
+ * Only canonical, full-line `@image:<absolute-path>` values are recognized.
+ * Unknown or malformed directives stay visible as text. Valid directives are
+ * removed from the bubble so a host-local path is never exposed in the UI.
+ */
+internal data class PersistedImageReferences(
+    val cleanedText: String,
+    val paths: List<String>,
+)
+
+internal object PersistedImageReferenceParser {
+    private const val MAX_INPUT_CHARS = 256 * 1024
+    private const val MAX_PATH_CHARS = 2_048
+    private const val MAX_ATTACHMENTS = 8
+
+    private val imageExtensions = setOf(
+        "avif",
+        "bmp",
+        "gif",
+        "heic",
+        "heif",
+        "jpeg",
+        "jpg",
+        "png",
+        "webp",
+    )
+
+    fun parse(content: String): PersistedImageReferences {
+        if (content.isEmpty() || content.length > MAX_INPUT_CHARS || "@image:" !in content) {
+            return PersistedImageReferences(content, emptyList())
+        }
+
+        val keptLines = ArrayList<String>()
+        val paths = ArrayList<String>()
+
+        for (line in content.lines()) {
+            val path = parseDirectiveLine(line)
+            if (path == null) {
+                keptLines += line
+            } else if (paths.size < MAX_ATTACHMENTS) {
+                paths += path
+            }
+            // Recognized refs beyond the attachment cap are still removed:
+            // exposing a server-local path is worse than omitting an excessive
+            // attachment from a deliberately bounded gallery.
+        }
+
+        return PersistedImageReferences(
+            cleanedText = keptLines.joinToString("\n").trim(),
+            paths = paths,
+        )
+    }
+
+    private fun parseDirectiveLine(line: String): String? {
+        if (!line.startsWith("@image:")) return null
+        val rawValue = line.removePrefix("@image:")
+        if (rawValue.isEmpty() || rawValue.length > MAX_PATH_CHARS) return null
+
+        val path = unwrapCanonicalValue(rawValue) ?: return null
+        if (path.isBlank() || path.any { it == '\u0000' || it == '\r' || it == '\n' }) return null
+        if (!isAbsolutePath(path) || !hasImageExtension(path)) return null
+        return path
+    }
+
+    private fun unwrapCanonicalValue(value: String): String? {
+        val first = value.first()
+        if (first !in charArrayOf('`', '"', '\'')) {
+            return value.takeIf { candidate -> candidate.none { it.isWhitespace() } }
+        }
+        if (value.length < 3 || value.last() != first) return null
+        val inner = value.substring(1, value.lastIndex)
+        return inner.takeIf { first !in it }
+    }
+
+    private fun isAbsolutePath(path: String): Boolean =
+        path.startsWith("/") ||
+            (
+                path.length >= 3 &&
+                    path[0].isLetter() &&
+                    path[1] == ':' &&
+                    (path[2] == '\\' || path[2] == '/')
+                )
+
+    private fun hasImageExtension(path: String): Boolean {
+        val fileName = path.substringAfterLast('/').substringAfterLast('\\')
+        val extension = fileName.substringAfterLast('.', missingDelimiterValue = "").lowercase()
+        return extension in imageExtensions
+    }
+}

app/src/main/kotlin/com/hermesandroid/relay/network/upstream/StandardHermesVoiceClient.kt

@@ -3,6 +3,12 @@ package com.hermesandroid.relay.network.upstream
 import android.content.Context
 import com.hermesandroid.relay.data.VoiceAudioRoute
 import com.hermesandroid.relay.network.shared.VoiceAudioClient
+import com.hermesandroid.relay.network.shared.VoiceSpeechStream
+import com.hermesandroid.relay.network.shared.VoiceSpeechStreamCallbacks
+import com.hermesandroid.relay.network.shared.VoiceSpeechStreamOutcome
+import com.hermesandroid.relay.network.shared.VoiceSpeechStreamStatus
+import kotlinx.coroutines.CancellationException
+import kotlinx.coroutines.CompletableDeferred
 import kotlinx.coroutines.Dispatchers
 import kotlinx.coroutines.withContext
 import kotlinx.serialization.json.Json
@@ -17,6 +23,9 @@ import okhttp3.OkHttpClient
 import okhttp3.Request
 import okhttp3.RequestBody.Companion.toRequestBody
 import okhttp3.Response
+import okhttp3.WebSocket
+import okhttp3.WebSocketListener
+import okio.ByteString
 import java.io.File
 import java.io.IOException
 import java.util.Base64
@@ -32,15 +41,15 @@ import java.util.concurrent.TimeUnit
  * These routes live on `hermes_cli/web_server.py` (:9119 by convention), NOT
  * on the API server (:8642) — current upstream api_server advertises
  * `audio_api: false` and registers no audio routes. Auth is the dashboard
- * cookie session (gated_auth_middleware), so [okHttpClient] must carry the
- * same per-connection cookie jar the Manage tab signs in with; an API bearer
- * header is meaningless on this surface. Revisit when upstream PR #8199
+ * dashboard session (gated_auth_middleware), so [dashboardHttpClientProvider]
+ * must carry the same exact-origin cookie or native bearer session used by
+ * Manage. The API-server bearer is unrelated to this surface. Revisit when upstream PR #8199
  * lands the `/v1/audio` routes on the API server (docs/upstream-contributions.md section 6).
  * (No glob spellings in block comments — Kotlin block comments nest.)
  */
 class StandardHermesVoiceClient(
     private val context: Context,
-    private val okHttpClient: OkHttpClient,
+    private val dashboardHttpClientProvider: (String) -> OkHttpClient,
     private val dashboardUrlProvider: () -> String?,
     // Active chat profile name (null = default/launch). Sent DEFENSIVELY on
     // /api/audio/speak: upstream `TTSSpeakRequest` is text-only and Pydantic
@@ -48,6 +57,7 @@ class StandardHermesVoiceClient(
     // upstream ever adds profile-aware TTS. Until then, standard voice remains
     // the host's global TTS (see VoiceViewModel's standard-voice profile notice).
     private val profileProvider: () -> String? = { null },
+    private val webSocketFactory: ((Request, WebSocketListener) -> WebSocket)? = null,
     private val json: Json = Json {
         ignoreUnknownKeys = true
         isLenient = true
@@ -56,14 +66,10 @@ class StandardHermesVoiceClient(
 ) : VoiceAudioClient {
     override val route: VoiceAudioRoute = VoiceAudioRoute.Standard
 
-    private val callClient: OkHttpClient =
-        okHttpClient.newBuilder()
-            .callTimeout(90, TimeUnit.SECONDS)
-            .build()
-
     override suspend fun transcribe(audioFile: File): Result<String> = withContext(Dispatchers.IO) {
         val baseUrl = dashboardBaseUrl()
             ?: return@withContext Result.failure(IllegalStateException("Hermes dashboard URL not configured"))
+        val callClient = callClient(baseUrl)
         if (!audioFile.exists() || audioFile.length() == 0L) {
             return@withContext Result.failure(IOException("Audio file missing or empty: ${audioFile.name}"))
         }
@@ -94,7 +100,7 @@ class StandardHermesVoiceClient(
             .header("Accept", "application/json")
             .build()
 
-        executeJson(request, "Hermes audio transcribe").mapCatching { root ->
+        executeJson(request, "Hermes audio transcribe", callClient).mapCatching { root ->
             val transcript = root.stringField("transcript")
                 ?: root.stringField("text")
                 ?: root.stringField("message")
@@ -108,6 +114,7 @@ class StandardHermesVoiceClient(
     override suspend fun synthesize(text: String): Result<File> = withContext(Dispatchers.IO) {
         val baseUrl = dashboardBaseUrl()
             ?: return@withContext Result.failure(IllegalStateException("Hermes dashboard URL not configured"))
+        val callClient = callClient(baseUrl)
         val cleanText = text.trim()
         if (cleanText.isBlank()) {
             return@withContext Result.failure(IllegalArgumentException("Cannot synthesize blank text"))
@@ -130,7 +137,7 @@ class StandardHermesVoiceClient(
             .header("Accept", "application/json")
             .build()
 
-        executeJson(request, "Hermes audio speak").mapCatching { root ->
+        executeJson(request, "Hermes audio speak", callClient).mapCatching { root ->
             val dataUrl = root.stringField("data_url") ?: root.stringField("dataUrl")
             if (dataUrl.isNullOrBlank()) {
                 throw IOException("Hermes audio speak returned no audio")
@@ -148,10 +155,54 @@ class StandardHermesVoiceClient(
         }
     }
 
+    override suspend fun openSpeechStream(
+        callbacks: VoiceSpeechStreamCallbacks,
+    ): Result<VoiceSpeechStream?> = withContext(Dispatchers.IO) {
+        try {
+            val baseUrl = dashboardBaseUrl()
+                ?: throw IllegalStateException("Hermes dashboard URL not configured")
+            val callClient = callClient(baseUrl)
+            val ticketUrl = "$baseUrl/api/auth/ws-ticket".toHttpUrlOrNull()
+                ?: throw IOException("Hermes dashboard URL is not a valid address: $baseUrl")
+            val ticketRequest = Request.Builder()
+                .url(ticketUrl)
+                .post(ByteArray(0).toRequestBody(null))
+                .build()
+            val ticket = executeJson(ticketRequest, "Dashboard websocket ticket", callClient)
+                .getOrThrow()
+                .stringField("ticket")
+                ?: throw IOException("Dashboard websocket ticket response missing ticket")
+            val websocketUrl = DashboardApiClient.gatewayWebSocketUrl(
+                baseUrl = baseUrl,
+                ticket = ticket,
+                path = "/api/audio/speak-stream",
+            ) ?: throw IOException("Could not build Hermes speech stream URL")
+            val request = Request.Builder().url(websocketUrl).build()
+            StandardHermesSpeechStream(
+                request = request,
+                callbacks = callbacks,
+                json = json,
+                socketFactory = webSocketFactory ?: callClient::newWebSocket,
+            ).also { it.connect() }
+                .let { Result.success<VoiceSpeechStream?>(it) }
+        } catch (cancelled: CancellationException) {
+            throw cancelled
+        } catch (error: Throwable) {
+            Result.failure(error)
+        }
+    }
+
     private fun dashboardBaseUrl(): String? =
         dashboardUrlProvider()?.trim()?.trimEnd('/')?.takeIf { it.isNotBlank() }
 
-    private fun executeJson(request: Request, operation: String): Result<JsonObject> {
+    private fun callClient(baseUrl: String): OkHttpClient =
+        standardHermesDashboardAudioClient(dashboardHttpClientProvider(baseUrl))
+
+    private fun executeJson(
+        request: Request,
+        operation: String,
+        callClient: OkHttpClient,
+    ): Result<JsonObject> {
         return try {
             callClient.newCall(request).execute().use { response ->
                 if (!response.isSuccessful) {
@@ -242,3 +293,209 @@ class StandardHermesVoiceClient(
         const val MAX_TRANSCRIBE_BYTES = 25L * 1024 * 1024
     }
 }
+
+private class StandardHermesSpeechStream(
+    private val request: Request,
+    private val callbacks: VoiceSpeechStreamCallbacks,
+    private val json: Json,
+    private val socketFactory: (Request, WebSocketListener) -> WebSocket,
+) : VoiceSpeechStream {
+    private val lock = Any()
+    private val outcome = CompletableDeferred<VoiceSpeechStreamOutcome>()
+    private val pendingFrames = ArrayDeque<String>()
+    private var socket: WebSocket? = null
+    private var opened = false
+    private var stopped = false
+    private var finished = false
+    private var audioStarted = false
+    private var sampleRate = DEFAULT_SAMPLE_RATE
+    private var oddByteCarry: Byte? = null
+
+    private val listener = object : WebSocketListener() {
+        override fun onOpen(webSocket: WebSocket, response: Response) {
+            val frames = synchronized(lock) {
+                if (stopped || outcome.isCompleted) {
+                    webSocket.cancel()
+                    return
+                }
+                socket = webSocket
+                opened = true
+                pendingFrames.toList().also { pendingFrames.clear() }
+            }
+            frames.forEach(webSocket::send)
+        }
+
+        override fun onMessage(webSocket: WebSocket, text: String) {
+            val root = runCatching { json.decodeFromString<JsonObject>(text) }.getOrNull() ?: return
+            when (root.stringField("type")) {
+                "start" -> {
+                    val nextRate = (root["sample_rate"] as? JsonPrimitive)?.contentOrNull
+                        ?.toIntOrNull()
+                        ?.takeIf { it > 0 }
+                        ?: DEFAULT_SAMPLE_RATE
+                    val channels = (root["channels"] as? JsonPrimitive)?.contentOrNull
+                        ?.toIntOrNull()
+                        ?.takeIf { it > 0 }
+                        ?: 1
+                    if (channels != 1) {
+                        settle(
+                            status = VoiceSpeechStreamStatus.Fallback,
+                            error = IOException("Hermes speech stream returned $channels channels; mono required"),
+                        )
+                        webSocket.cancel()
+                        return
+                    }
+                    synchronized(lock) { sampleRate = nextRate }
+                    callbacks.onStart(nextRate, channels)
+                }
+                "fallback" -> {
+                    val heardAudio = synchronized(lock) { audioStarted }
+                    settle(
+                        status = if (heardAudio) {
+                            VoiceSpeechStreamStatus.Completed
+                        } else {
+                            VoiceSpeechStreamStatus.Fallback
+                        },
+                    )
+                    webSocket.close(1000, "fallback")
+                }
+                "end" -> {
+                    settle(VoiceSpeechStreamStatus.Completed)
+                    webSocket.close(1000, "complete")
+                }
+            }
+        }
+
+        override fun onMessage(webSocket: WebSocket, bytes: ByteString) {
+            val delivery = synchronized(lock) {
+                if (stopped || outcome.isCompleted) return
+                var incoming = bytes.toByteArray()
+                oddByteCarry?.let { carry ->
+                    incoming = byteArrayOf(carry) + incoming
+                    oddByteCarry = null
+                }
+                val usable = incoming.size - (incoming.size % 2)
+                if (usable < incoming.size) oddByteCarry = incoming.last()
+                if (usable == 0) return
+                audioStarted = true
+                incoming.copyOf(usable) to sampleRate
+            }
+            runCatching { callbacks.onPcm(delivery.first, delivery.second) }
+                .onFailure { error ->
+                    settle(VoiceSpeechStreamStatus.Failed, error)
+                    webSocket.cancel()
+                }
+        }
+
+        override fun onClosing(webSocket: WebSocket, code: Int, reason: String) {
+            settleForDisconnect(IOException("Hermes speech stream closed ($code): $reason"))
+            webSocket.close(code, reason)
+        }
+
+        override fun onClosed(webSocket: WebSocket, code: Int, reason: String) {
+            settleForDisconnect(IOException("Hermes speech stream closed ($code): $reason"))
+        }
+
+        override fun onFailure(webSocket: WebSocket, t: Throwable, response: Response?) {
+            settleForDisconnect(t)
+        }
+    }
+
+    fun connect() {
+        val created = socketFactory(request, listener)
+        synchronized(lock) {
+            if (socket == null) socket = created
+            if (stopped) created.cancel()
+        }
+    }
+
+    override fun append(text: String) {
+        if (text.isEmpty()) return
+        sendFrame(buildJsonObject { put("text", text) })
+    }
+
+    override fun finish() {
+        synchronized(lock) {
+            if (finished || stopped || outcome.isCompleted) return
+            finished = true
+        }
+        sendFrame(buildJsonObject { put("done", true) })
+    }
+
+    override fun stop() {
+        val current = synchronized(lock) {
+            if (stopped) return
+            stopped = true
+            socket
+        }
+        if (current != null) {
+            current.send(json.encodeToString(JsonObject.serializer(), buildJsonObject { put("stop", true) }))
+            current.cancel()
+        }
+        settle(VoiceSpeechStreamStatus.Stopped)
+    }
+
+    override suspend fun awaitOutcome(): VoiceSpeechStreamOutcome = outcome.await()
+
+    private fun sendFrame(frame: JsonObject) {
+        val encoded = json.encodeToString(JsonObject.serializer(), frame)
+        val current = synchronized(lock) {
+            if (stopped || outcome.isCompleted) return
+            if (!opened) {
+                pendingFrames.addLast(encoded)
+                return
+            }
+            socket
+        }
+        if (current?.send(encoded) != true) {
+            settleForDisconnect(IOException("Hermes speech stream send failed"))
+        }
+    }
+
+    private fun settleForDisconnect(error: Throwable) {
+        val heardAudio = synchronized(lock) { audioStarted }
+        settle(
+            status = if (heardAudio) VoiceSpeechStreamStatus.Failed else VoiceSpeechStreamStatus.Fallback,
+            error = error,
+        )
+    }
+
+    private fun settle(status: VoiceSpeechStreamStatus, error: Throwable? = null) {
+        val result = synchronized(lock) {
+            if (outcome.isCompleted) return
+            VoiceSpeechStreamOutcome(
+                status = status,
+                audioStarted = audioStarted,
+                error = error,
+            )
+        }
+        outcome.complete(result)
+    }
+
+    private fun JsonObject.stringField(name: String): String? =
+        ((this[name] as? JsonPrimitive)?.contentOrNull)?.trim()?.takeIf { it.isNotBlank() }
+
+    private companion object {
+        const val DEFAULT_SAMPLE_RATE = 24_000
+    }
+}
+
+internal const val STANDARD_HERMES_DASHBOARD_AUDIO_TIMEOUT_SECONDS = 180L
+
+internal fun standardHermesDashboardAudioTimeoutSeconds(requestedSeconds: Long): Long =
+    requestedSeconds.coerceIn(
+        minimumValue = 180L,
+        maximumValue = 600L,
+    )
+
+internal fun standardHermesDashboardAudioClient(
+    baseClient: OkHttpClient,
+    timeoutSeconds: Long = STANDARD_HERMES_DASHBOARD_AUDIO_TIMEOUT_SECONDS,
+): OkHttpClient {
+    val boundedTimeoutSeconds = standardHermesDashboardAudioTimeoutSeconds(timeoutSeconds)
+    return baseClient.newBuilder()
+        .callTimeout(boundedTimeoutSeconds, TimeUnit.SECONDS)
+        .readTimeout(boundedTimeoutSeconds, TimeUnit.SECONDS)
+        .writeTimeout(boundedTimeoutSeconds, TimeUnit.SECONDS)
+        .build()
+}

app/src/main/kotlin/com/hermesandroid/relay/network/upstream/models/SessionModels.kt

@@ -163,7 +163,8 @@ data class SessionItem(
     @SerialName("message_count") val messageCount: Int? = null,
     @SerialName("tool_call_count") val toolCallCount: Int? = null,
     @SerialName("input_tokens") val inputTokens: Int? = null,
-    @SerialName("output_tokens") val outputTokens: Int? = null
+    @SerialName("output_tokens") val outputTokens: Int? = null,
+    @SerialName("has_model_config") val hasModelConfig: Boolean = false,
 ) {
     val resolvedLastActivity: Double?
         get() = lastActive ?: lastActivity ?: lastActivityAt ?: updatedAt
@@ -259,6 +260,8 @@ data class MessageItem(
     val toolCallId: String? = null,
     val timestamp: Double? = null,
     @SerialName("finish_reason") val finishReason: String? = null,
+    @SerialName("display_kind") val displayKind: String? = null,
+    @SerialName("display_metadata") val displayMetadata: JsonObject? = null,
     // Reasoning persisted with the assistant message (upstream serializes
     // both names; reasoning is the canonical one). Restored into
     // ChatMessage.thinkingContent so the Thought-process block survives a
@@ -389,7 +392,9 @@ data class HermesSseEvent(
     @SerialName("thinking_delta") val thinkingDelta: String? = null,
     val text: String? = null,              // /v1/runs reasoning.available text
     // Usage/token fields (on assistant.completed / run.completed)
-    val usage: UsageInfo? = null
+    val usage: UsageInfo? = null,
+    // Native session routing proof on run.started and terminal events.
+    val runtime: JsonObject? = null,
 ) {
     /** Resolve the event type from whichever field is populated. */
     val resolvedType: String?

app/src/main/kotlin/com/hermesandroid/relay/notifications/InteractionRequestNotifier.kt

@@ -0,0 +1,216 @@
+package com.hermesandroid.relay.notifications
+
+import android.Manifest
+import android.annotation.SuppressLint
+import android.app.Notification
+import android.app.NotificationChannel
+import android.app.NotificationManager
+import android.app.PendingIntent
+import android.content.Context
+import android.content.Intent
+import android.content.pm.PackageManager
+import android.net.Uri
+import android.os.Build
+import android.util.Log
+import androidx.core.app.NotificationCompat
+import androidx.core.app.NotificationManagerCompat
+import androidx.core.content.ContextCompat
+import com.hermesandroid.relay.MainActivity
+import com.hermesandroid.relay.R
+import com.hermesandroid.relay.network.upstream.GatewayAsk
+
+/**
+ * Action-required notifications for Gateway turns blocked on user input.
+ *
+ * Notification copy is deliberately generic. Approval commands, clarification
+ * questions, secret prompts, environment-variable names, and password requests
+ * stay inside the authenticated chat surface and never appear on the lock
+ * screen. A stable tag derived from the durable session and request identity
+ * makes replay/reconnect delivery replace the existing notification.
+ */
+object InteractionRequestNotifier {
+
+    private const val TAG = "InteractionNotifier"
+    internal const val CHANNEL_ID = "chat_interactions"
+    private const val CHANNEL_NAME = "Hermes needs input"
+    private const val GROUP_KEY = "gateway-interactions"
+    internal const val NOTIFICATION_ID = 3823
+    internal const val DEFAULT_PROFILE_ROUTE_VALUE = "__server_default__"
+
+    internal fun shouldPost(
+        alertsEnabled: Boolean,
+        appForeground: Boolean,
+        hasPermission: Boolean,
+    ): Boolean = alertsEnabled && !appForeground && hasPermission
+
+    internal fun requestKey(sessionId: String, ask: GatewayAsk, profile: String? = null): String {
+        val requestIdentity = ask.requestId?.takeIf { it.isNotBlank() } ?: "session"
+        return "${profile ?: DEFAULT_PROFILE_ROUTE_VALUE}:$sessionId:${ask.kind.name}:$requestIdentity"
+    }
+
+    internal fun notificationTag(
+        sessionId: String,
+        ask: GatewayAsk,
+        profile: String? = null,
+    ): String = "gateway-interaction:${requestKey(sessionId, ask, profile)}"
+
+    internal fun chatRoute(sessionId: String, profile: String? = null): String =
+        "chat?sessionId=${Uri.encode(sessionId)}&profile=${Uri.encode(profile ?: DEFAULT_PROFILE_ROUTE_VALUE)}"
+
+    internal fun safeTitle(ask: GatewayAsk): String = when (ask.kind) {
+        GatewayAsk.Kind.APPROVAL -> "Hermes needs approval"
+        GatewayAsk.Kind.CLARIFY -> "Hermes has a question"
+        GatewayAsk.Kind.SUDO,
+        GatewayAsk.Kind.SECRET,
+        -> "Hermes needs sensitive input"
+    }
+
+    internal fun safeBody(ask: GatewayAsk): String = when (ask.kind) {
+        GatewayAsk.Kind.APPROVAL -> "Open Hermes to review the requested action."
+        GatewayAsk.Kind.CLARIFY -> "Open Hermes to answer and continue this turn."
+        GatewayAsk.Kind.SUDO,
+        GatewayAsk.Kind.SECRET,
+        -> "Open Hermes to respond securely."
+    }
+
+    internal fun safeExpandedBody(
+        sessionId: String,
+        ask: GatewayAsk,
+        profile: String? = null,
+    ): String {
+        val action = when (ask.kind) {
+            GatewayAsk.Kind.APPROVAL ->
+                "Review the requested action. Nothing is approved from the notification."
+            GatewayAsk.Kind.CLARIFY -> "Open this conversation to answer Hermes' question."
+            GatewayAsk.Kind.SUDO -> "Open this conversation to respond securely or deny."
+            GatewayAsk.Kind.SECRET -> "Open this conversation to respond securely or skip."
+        }
+        val profileLabel = profile?.takeIf { it.isNotBlank() } ?: "Server default"
+        val sessionLabel = sessionId.takeLast(12)
+        return "$action\nProfile: $profileLabel\nSession: …$sessionLabel"
+    }
+
+    internal fun actionLabel(ask: GatewayAsk): String = when (ask.kind) {
+        GatewayAsk.Kind.APPROVAL -> "Review approval"
+        GatewayAsk.Kind.CLARIFY -> "Answer"
+        GatewayAsk.Kind.SUDO,
+        GatewayAsk.Kind.SECRET,
+        -> "Respond securely"
+    }
+
+    @SuppressLint("MissingPermission", "NotificationPermission")
+    fun notify(
+        context: Context,
+        sessionId: String,
+        ask: GatewayAsk,
+        profile: String? = null,
+        alertsEnabled: Boolean,
+        appForeground: Boolean,
+    ): Boolean {
+        ensureChannel(context)
+        if (!shouldPost(alertsEnabled, appForeground, hasPostNotificationsPermission(context))) {
+            return false
+        }
+
+        val tag = notificationTag(sessionId, ask, profile)
+        val requestKey = requestKey(sessionId, ask, profile)
+        val requestCode = requestKey.hashCode()
+        val tapIntent = Intent(context, MainActivity::class.java).apply {
+            flags = Intent.FLAG_ACTIVITY_NEW_TASK or Intent.FLAG_ACTIVITY_CLEAR_TOP
+            data = Uri.Builder()
+                .scheme("hermes-relay")
+                .authority("interaction")
+                .appendPath(requestKey)
+                .build()
+            putExtra(MainActivity.EXTRA_NAV_ROUTE, chatRoute(sessionId, profile))
+        }
+        val tapPending = PendingIntent.getActivity(
+            context,
+            requestCode,
+            tapIntent,
+            PendingIntent.FLAG_UPDATE_CURRENT or PendingIntent.FLAG_IMMUTABLE,
+        )
+        val title = safeTitle(ask)
+        val body = safeBody(ask)
+        val expandedBody = safeExpandedBody(sessionId, ask, profile)
+        val publicVersion = NotificationCompat.Builder(context, CHANNEL_ID)
+            .setSmallIcon(R.mipmap.ic_launcher)
+            .setContentTitle("Hermes needs your input")
+            .setContentText("Open Hermes to continue.")
+            .setCategory(NotificationCompat.CATEGORY_REMINDER)
+            .build()
+
+        val notification = NotificationCompat.Builder(context, CHANNEL_ID)
+            .setSmallIcon(R.mipmap.ic_launcher)
+            .setContentTitle(title)
+            .setContentText(body)
+            .setStyle(NotificationCompat.BigTextStyle().bigText(expandedBody))
+            .setContentIntent(tapPending)
+            .setAutoCancel(false)
+            .setOnlyAlertOnce(true)
+            .setCategory(NotificationCompat.CATEGORY_REMINDER)
+            .setPriority(NotificationCompat.PRIORITY_HIGH)
+            .setVisibility(NotificationCompat.VISIBILITY_PRIVATE)
+            .setPublicVersion(publicVersion)
+            .setGroup(GROUP_KEY)
+            .addAction(0, actionLabel(ask), tapPending)
+            .build()
+
+        return runCatching {
+            NotificationManagerCompat.from(context).notify(tag, NOTIFICATION_ID, notification)
+            true
+        }.onFailure {
+            Log.w(TAG, "notify failed", it)
+        }.getOrDefault(false)
+    }
+
+    fun cancel(context: Context, sessionId: String, ask: GatewayAsk, profile: String? = null) {
+        runCatching {
+            NotificationManagerCompat.from(context)
+                .cancel(notificationTag(sessionId, ask, profile), NOTIFICATION_ID)
+        }.onFailure {
+            Log.w(TAG, "cancel failed", it)
+        }
+    }
+
+    /**
+     * Clear only this feature's notifications. Android keeps notifications
+     * across process death, so the active-notification scan is also used when
+     * MainActivity returns without an in-memory request registry.
+     */
+    fun cancelAll(context: Context) {
+        val manager = context.getSystemService(NotificationManager::class.java) ?: return
+        runCatching {
+            manager.activeNotifications
+                .filter { it.notification.channelId == CHANNEL_ID }
+                .forEach { manager.cancel(it.tag, it.id) }
+        }.onFailure {
+            Log.w(TAG, "cancelAll failed", it)
+        }
+    }
+
+    private fun ensureChannel(context: Context) {
+        if (Build.VERSION.SDK_INT < Build.VERSION_CODES.O) return
+        val manager = context.getSystemService(NotificationManager::class.java) ?: return
+        if (manager.getNotificationChannel(CHANNEL_ID) != null) return
+        manager.createNotificationChannel(
+            NotificationChannel(
+                CHANNEL_ID,
+                CHANNEL_NAME,
+                NotificationManager.IMPORTANCE_HIGH,
+            ).apply {
+                description = "Alerts when a Hermes turn is waiting for your response."
+                lockscreenVisibility = Notification.VISIBILITY_PRIVATE
+                setShowBadge(true)
+            },
+        )
+    }
+
+    private fun hasPostNotificationsPermission(context: Context): Boolean {
+        if (Build.VERSION.SDK_INT < Build.VERSION_CODES.TIRAMISU) return true
+        return ContextCompat.checkSelfPermission(
+            context,
+            Manifest.permission.POST_NOTIFICATIONS,
+        ) == PackageManager.PERMISSION_GRANTED
+    }
+}

app/src/main/kotlin/com/hermesandroid/relay/ui/RelayApp.kt

@@ -103,10 +103,13 @@ import com.hermesandroid.relay.data.AgentDisplay
 import com.hermesandroid.relay.data.BridgePreferencesRepository
 import com.hermesandroid.relay.data.BridgeSafetyPreferencesRepository
 import com.hermesandroid.relay.data.BuildFlavor
+import com.hermesandroid.relay.data.Connection
 import com.hermesandroid.relay.data.EnhancedVoiceOverrides
+import com.hermesandroid.relay.data.EndpointCandidate
 import com.hermesandroid.relay.data.VoiceAudioRoute
 import com.hermesandroid.relay.data.VoicePreferencesRepository
 import com.hermesandroid.relay.data.VoiceSettings
+import com.hermesandroid.relay.data.capabilities
 import com.hermesandroid.relay.data.displayLabel
 import kotlinx.coroutines.Dispatchers
 import kotlinx.coroutines.flow.map
@@ -128,6 +131,7 @@ import com.hermesandroid.relay.ui.screens.BridgeSafetySettingsScreen
 import com.hermesandroid.relay.ui.screens.ChatScreen
 import com.hermesandroid.relay.ui.screens.ChatSettingsScreen
 import com.hermesandroid.relay.ui.screens.DashboardManagementScreen
+import com.hermesandroid.relay.ui.screens.DashboardSignInScreen
 import com.hermesandroid.relay.ui.screens.DeveloperSettingsScreen
 import com.hermesandroid.relay.ui.screens.MediaSettingsScreen
 import com.hermesandroid.relay.ui.screens.PairedDevicesScreen
@@ -150,13 +154,17 @@ import com.hermesandroid.relay.diagnostics.DiagnosticSeverity
 import com.hermesandroid.relay.diagnostics.DiagnosticsLog
 import com.hermesandroid.relay.network.relay.RelayProfileInspectorClient
 import com.hermesandroid.relay.network.shared.AutoVoiceAudioClient
-import com.hermesandroid.relay.network.upstream.DynamicDashboardCookieJar
+import com.hermesandroid.relay.network.upstream.GatewayAvailability
 import com.hermesandroid.relay.network.relay.RelayVoiceAudioClientAdapter
+import com.hermesandroid.relay.viewmodel.ChatRuntimeStatus
+import com.hermesandroid.relay.viewmodel.ChatTransportPath
+import com.hermesandroid.relay.viewmodel.ChatTransportReadiness
 import com.hermesandroid.relay.viewmodel.ChatViewModel
 import com.hermesandroid.relay.viewmodel.ConnectionViewModel
 import com.hermesandroid.relay.viewmodel.ProfileInspectorViewModel
 import com.hermesandroid.relay.viewmodel.TerminalViewModel
 import com.hermesandroid.relay.viewmodel.VoiceViewModel
+import com.hermesandroid.relay.viewmodel.resolveChatRuntimeStatus
 import com.hermesandroid.relay.audio.VoicePlayer
 import com.hermesandroid.relay.audio.VoiceRecorder
 import com.hermesandroid.relay.audio.VoiceSfxPlayer
@@ -182,6 +190,68 @@ suspend fun SnackbarHostState.showHumanError(err: HumanError) {
     )
 }
 
+/** Startup chrome should wait for either standard chat surface, not Relay. */
+internal fun hasConfiguredStartupChat(connection: Connection?): Boolean =
+    connection?.capabilities?.chatConfigured == true
+
+/**
+ * App-root chat health derived only from the two transports that can carry a
+ * conversation. Optional Relay state is deliberately absent.
+ */
+internal fun resolveAppChatRuntimeStatus(
+    connection: Connection?,
+    gatewayAvailability: GatewayAvailability,
+    apiHealth: ConnectionViewModel.HealthStatus,
+): ChatRuntimeStatus {
+    val capabilities = connection?.capabilities
+    val gateway = when {
+        capabilities?.dashboardGatewayConfigured != true -> ChatTransportReadiness.NotConfigured
+        gatewayAvailability == GatewayAvailability.Ready -> ChatTransportReadiness.Ready
+        gatewayAvailability == GatewayAvailability.Unknown -> ChatTransportReadiness.Connecting
+        else -> ChatTransportReadiness.Unavailable
+    }
+    val api = when {
+        capabilities?.apiServerConfigured != true -> ChatTransportReadiness.NotConfigured
+        apiHealth == ConnectionViewModel.HealthStatus.Reachable -> ChatTransportReadiness.Ready
+        apiHealth == ConnectionViewModel.HealthStatus.Unknown ||
+            apiHealth == ConnectionViewModel.HealthStatus.Probing -> ChatTransportReadiness.Connecting
+        else -> ChatTransportReadiness.Unavailable
+    }
+    return resolveChatRuntimeStatus(gateway = gateway, apiSse = api)
+}
+
+/** Route represented by the app footer's currently usable chat transport. */
+internal fun resolveFooterRouteCandidate(
+    runtimeStatus: ChatRuntimeStatus,
+    activeEndpoint: EndpointCandidate?,
+    connection: Connection?,
+    effectiveDashboardUrl: String,
+): EndpointCandidate? {
+    val connected = runtimeStatus as? ChatRuntimeStatus.Connected ?: return null
+    return when (connected.transport) {
+        ChatTransportPath.Gateway -> {
+            val dashboardUrl = effectiveDashboardUrl.trim().trimEnd('/')
+                .ifBlank { connection?.resolvedDashboardUrl.orEmpty() }
+            if (dashboardUrl.isBlank()) {
+                null
+            } else {
+                val activeDashboardUrl = activeEndpoint?.dashboard?.url
+                    ?.trim()
+                    ?.trimEnd('/')
+                activeEndpoint?.takeIf { activeDashboardUrl == dashboardUrl }
+                    ?: Connection.endpointCandidateFromDashboardUrl(
+                        role = Connection.inferRouteRole(dashboardUrl),
+                        priority = activeEndpoint?.priority ?: 0,
+                        dashboardUrl = dashboardUrl,
+                    )
+            }
+        }
+
+        ChatTransportPath.ApiSse -> activeEndpoint?.takeIf { it.api != null }
+            ?: connection?.routeCandidates?.firstOrNull { it.api != null }
+    }
+}
+
 sealed class Screen(
     val route: String,
     val label: String,
@@ -203,17 +273,44 @@ sealed class Screen(
     // NavHost, and the NavigationBarItem click must navigate via [route]()
     // so no unresolved `{openAgentSheet}` leaks into the destination.
     data object Chat : Screen(
-        "chat?openAgentSheet={openAgentSheet}",
+        "chat?openAgentSheet={openAgentSheet}&sessionId={sessionId}&profile={profile}",
         "Chat",
         Icons.AutoMirrored.Filled.Chat,
     ) {
         const val ARG_OPEN_AGENT_SHEET: String = "openAgentSheet"
-        fun route(openAgentSheet: Boolean = false): String =
-            if (openAgentSheet) "chat?openAgentSheet=true" else "chat"
+        const val ARG_SESSION_ID: String = "sessionId"
+        const val ARG_PROFILE: String = "profile"
+        fun route(
+            openAgentSheet: Boolean = false,
+            sessionId: String? = null,
+            profile: String? = null,
+        ): String {
+            val params = buildList {
+                if (openAgentSheet) add("$ARG_OPEN_AGENT_SHEET=true")
+                sessionId?.takeIf { it.isNotBlank() }?.let {
+                    add("$ARG_SESSION_ID=${android.net.Uri.encode(it)}")
+                }
+                profile?.takeIf { it.isNotBlank() }?.let {
+                    add("$ARG_PROFILE=${android.net.Uri.encode(it)}")
+                }
+            }
+            return if (params.isEmpty()) "chat" else "chat?${params.joinToString("&")}"
+        }
     }
     data object Terminal : Screen("terminal", "Terminal", Icons.Filled.Code)
     data object Bridge : Screen("bridge", "Bridge", Icons.Filled.PhoneAndroid)
     data object Manage : Screen("manage", "Manage", Icons.Filled.Settings)
+    data object DashboardSignIn : Screen(
+        "dashboard_sign_in?source={source}",
+        "Dashboard sign in",
+        Icons.Filled.Settings,
+    ) {
+        const val ARG_SOURCE: String = "source"
+        const val SOURCE_GENERAL: String = "general"
+        const val SOURCE_PAIR: String = "pair"
+        const val SOURCE_ONBOARDING: String = "onboarding"
+        fun route(source: String = SOURCE_GENERAL): String = "dashboard_sign_in?source=$source"
+    }
     data object Settings : Screen("settings", "Settings", Icons.Filled.Settings)
 
     // Non-bottom-nav destinations — reached by explicit navigation, not the
@@ -359,6 +456,12 @@ fun RelayApp() {
     // ConnectionStore's mutations are all suspend fns and we don't want to
     // block the main dispatcher from inside the composable body.
     val connectionSwitchScope = rememberCoroutineScope()
+    // Add-connection preparation may outlive the initiating list frame now
+    // that navigation happens immediately. Keep the job by placeholder id so
+    // an instant Back can wait for creation and then discard it safely.
+    val pendingAddConnectionJobs = remember {
+        mutableMapOf<String, kotlinx.coroutines.Job>()
+    }
 
     // One-time init: the terminal channel ViewModel registers with the shared
     // multiplexer and observes the relay connection state so it can attach/
@@ -434,11 +537,13 @@ fun RelayApp() {
         }
     }
 
-    // Initialize ChatViewModel reactively when the chat-routed API client becomes available
+    // Bind chat state independently of the optional API fallback client.
     val chatApiClient by connectionViewModel.chatApiClient.collectAsState()
+    val chatTransportReady by connectionViewModel.chatReady.collectAsState()
     val lastSessionId by connectionViewModel.lastSessionId.collectAsState()
     val selectedProfile by connectionViewModel.selectedProfile.collectAsState()
     val effectiveSessionProfileName by connectionViewModel.effectiveSessionProfileName.collectAsState()
+    val effectiveDisplayProfile by connectionViewModel.effectiveDisplayProfile.collectAsState()
     val profileSelectionSettled by connectionViewModel.profileSelectionSettled.collectAsState()
     val agentProfiles by connectionViewModel.agentProfiles.collectAsState()
     val profileDisplayAlias by connectionViewModel.profileDisplayAlias.collectAsState()
@@ -493,15 +598,9 @@ fun RelayApp() {
     val standardVoiceClient = remember {
         StandardHermesVoiceClient(
             context = mediaContext,
-            okHttpClient = okhttp3.OkHttpClient.Builder()
-                .cookieJar(
-                    DynamicDashboardCookieJar {
-                        connectionViewModel.activeDashboardCookieStore()
-                    },
-                )
-                .readTimeout(2, java.util.concurrent.TimeUnit.MINUTES)
-                .connectTimeout(15, java.util.concurrent.TimeUnit.SECONDS)
-                .build(),
+            dashboardHttpClientProvider = { dashboardUrl ->
+                connectionViewModel.dashboardHttpClientForActive(dashboardUrl)
+            },
             dashboardUrlProvider = { connectionViewModel.activeDashboardUrl() },
             // Live read (null for the default profile) — sent defensively on
             // /api/audio/speak; upstream ignores it, so standard voice stays the
@@ -633,9 +732,10 @@ fun RelayApp() {
         }
     }
 
-    LaunchedEffect(chatApiClient) {
-        val client = chatApiClient ?: return@LaunchedEffect
+    var boundCatalogConnectionId by remember { mutableStateOf<String?>(null) }
+    LaunchedEffect(chatApiClient, activeConnectionId) {
         val handler = connectionViewModel.chatHandler
+        val connectionChanged = boundCatalogConnectionId != activeConnectionId
         // A route handoff / reconnect rebuilds the API client (new instance)
         // while the chat is unchanged — the bound handler is the same. Take the
         // cheap path: swap the client reference only, no re-init. This is what
@@ -643,11 +743,24 @@ fun RelayApp() {
         // switch or a reconnect. A genuine re-bind (different handler) falls
         // through to the full one-time wiring below.
         if (chatViewModel.boundHandler === handler) {
-            chatViewModel.updateApiClient(client)
+            if (connectionChanged) {
+                chatViewModel.resetConnectionCatalogs()
+                // The active pointer changes before an API target is rebuilt.
+                // Never let the outgoing API client refill the new connection's
+                // catalogs during that window. Dashboard-only (null -> null)
+                // refreshes immediately through the already-installed loader.
+                chatViewModel.updateApiClient(null)
+            } else {
+                chatViewModel.updateApiClient(chatApiClient)
+            }
+            boundCatalogConnectionId = activeConnectionId
             return@LaunchedEffect
         }
 
-        chatViewModel.initialize(client, handler)
+        // The Dashboard/Gateway transport is independently sufficient for
+        // chat, so handler and dashboard callbacks must bind even when no API
+        // fallback client is configured.
+        chatViewModel.initialize(chatApiClient, handler)
 
         // Wire inbound-media dependencies. Idempotent rewire of the
         // ChatHandler callbacks.
@@ -665,6 +778,9 @@ fun RelayApp() {
         chatViewModel.setSelectedProfileProvider {
             connectionViewModel.selectedProfile.value
         }
+        chatViewModel.setIsolatedProfileApiProvider {
+            connectionViewModel.selectedProfileUsesIsolatedApiRoute()
+        }
         chatViewModel.setSessionProfileNameProvider {
             connectionViewModel.effectiveSessionProfileName.value
         }
@@ -675,10 +791,7 @@ fun RelayApp() {
             )
         }
         chatViewModel.setDisplayProfileProvider {
-            AgentDisplay.effectiveDisplayProfile(
-                selectedProfile = connectionViewModel.selectedProfile.value,
-                profiles = connectionViewModel.agentProfiles.value,
-            )
+            connectionViewModel.effectiveDisplayProfile.value
         }
         chatViewModel.setDisplayAliasProvider {
             connectionViewModel.profileDisplayAlias.value
@@ -694,6 +807,12 @@ fun RelayApp() {
         chatViewModel.setProfileMessageLoader { sessionId ->
             connectionViewModel.loadProfileScopedMessages(sessionId)
         }
+        // Personality choices live in Dashboard `/api/config` on a
+        // dashboard-only connection. The setter immediately refreshes after
+        // this callback is installed, covering the null-API initialization.
+        chatViewModel.setDashboardConfigLoader {
+            connectionViewModel.loadActiveDashboardConfig()
+        }
         // …and delete from that same profile's DB so a non-default profile's
         // session can't be resurrected by the next profile-scoped list.
         chatViewModel.profileSessionDeleter = { sessionId ->
@@ -710,6 +829,7 @@ fun RelayApp() {
         chatViewModel.onSessionChanged = { sessionId ->
             connectionViewModel.saveLastSessionId(sessionId)
         }
+        boundCatalogConnectionId = activeConnectionId
     }
 
     // Reload sessions / switch profile context only on a SEMANTIC change
@@ -718,16 +838,15 @@ fun RelayApp() {
     // means a route handoff (which churns the client) no longer triggers a
     // refreshSessions() that would flash/reload the chat. `switchProfileContext`
     // already no-ops when the context key + session are unchanged.
-    val chatClientReady = chatApiClient != null
     LaunchedEffect(
-        chatClientReady,
+        chatTransportReady,
         activeConnectionId,
         selectedProfile?.name,
         effectiveSessionProfileName,
         lastSessionId,
         profileSelectionSettled,
     ) {
-        if (!chatClientReady) return@LaunchedEffect
+        if (!chatTransportReady) return@LaunchedEffect
         // Cold-start profile-isolation guard: hold the first profile-scoped load
         // until the persisted profile selection has SETTLED, so the session
         // drawer (and the restored session context) don't briefly load the
@@ -770,7 +889,7 @@ fun RelayApp() {
         )
     }
 
-    LaunchedEffect(selectedProfile?.name, agentProfiles, profileDisplayAlias) {
+    LaunchedEffect(selectedProfile?.name, effectiveDisplayProfile?.name, agentProfiles, profileDisplayAlias) {
         chatViewModel.refreshAgentDisplayName(relabelGenericMessages = true)
     }
 
@@ -847,10 +966,10 @@ fun RelayApp() {
     // re-runs activeGatewayChatClient(), which RETARGETS the in-flight gateway
     // client to follow the new dashboard route instead of stranding the turn on
     // the dead one.
-    val effectiveApiUrl by connectionViewModel.effectiveApiServerUrl.collectAsState()
+    val effectiveDashboardUrl by connectionViewModel.effectiveDashboardUrl.collectAsState()
     // Debounce a route FLIP before re-acquiring the gateway chat client. The
     // network-layer hysteresis (ConnectionManager) already keeps _activeEndpoint
-    // stable on a transient endpoint-resolution miss, so effectiveApiUrl should
+    // stable on a transient endpoint-resolution miss, so the Dashboard URL should
     // not flap — this is belt-and-suspenders against any residual sub-second
     // LAN⇄Tailscale flip, which would otherwise shutdown the warm gateway socket
     // (when idle) or retarget mid-turn (burning MAX_TURN_REJOINS). The FIRST
@@ -859,9 +978,17 @@ fun RelayApp() {
     // unaffected; only a genuine url change waits for a settle window, and if
     // the url flips back within it the LaunchedEffect cancels + restarts so no
     // rebuild happens.
-    var lastAcquiredApiUrl by remember { mutableStateOf<String?>(null) }
-    LaunchedEffect(streamingEndpoint, serverCapabilities, gatewayAvailability, effectiveApiUrl) {
-        if (lastAcquiredApiUrl != null && lastAcquiredApiUrl != effectiveApiUrl) {
+    var lastAcquiredDashboardUrl by remember { mutableStateOf<String?>(null) }
+    LaunchedEffect(
+        streamingEndpoint,
+        serverCapabilities,
+        gatewayAvailability,
+        effectiveDashboardUrl,
+    ) {
+        if (
+            lastAcquiredDashboardUrl != null &&
+            lastAcquiredDashboardUrl != effectiveDashboardUrl
+        ) {
             delay(750L)
         }
         val resolved = connectionViewModel.resolveStreamingEndpoint(streamingEndpoint)
@@ -870,7 +997,7 @@ fun RelayApp() {
         chatViewModel.updateGatewayClient(
             if (resolved == "gateway") connectionViewModel.activeGatewayChatClient() else null,
         )
-        lastAcquiredApiUrl = effectiveApiUrl
+        lastAcquiredDashboardUrl = effectiveDashboardUrl
     }
 
     // What's New auto-show
@@ -961,7 +1088,6 @@ fun RelayApp() {
         CrashReportGate()
 
         val navController = rememberNavController()
-        var postOnboardingRoute by remember { mutableStateOf<String?>(null) }
 
         // === PHASE3-safety-rails-followup: cross-layer deep-link nav ===
         // Collect navigation requests posted by external launchers (e.g., the
@@ -1026,17 +1152,6 @@ fun RelayApp() {
             }
         }
 
-        LaunchedEffect(onboardingCompleted, postOnboardingRoute) {
-            val route = postOnboardingRoute
-            if (onboardingCompleted && route != null) {
-                postOnboardingRoute = null
-                navController.navigate(route) {
-                    popUpTo(Screen.Onboarding.route) { inclusive = true }
-                    launchSingleTop = true
-                }
-            }
-        }
-
         // startDestination uses the route TEMPLATE so it matches the
         // composable registered below; optional args default to null/false.
         val startDestination = if (onboardingCompleted) Screen.Chat.route else Screen.Onboarding.route
@@ -1127,11 +1242,8 @@ fun RelayApp() {
         // bottom navigation bar so the voice overlay can own the entire screen
         // without the Chat/Terminal/Bridge/Settings tabs peeking through below.
         val voiceUiState by voiceViewModel.uiState.collectAsState()
-        val globalConnectionStatus by connectionViewModel.globalConnectionStatus.collectAsState()
         val postResumeQuiet by connectionViewModel.postResumeQuiet.collectAsState()
-        val apiReachable by connectionViewModel.apiServerReachable.collectAsState()
         val apiHealth by connectionViewModel.apiServerHealth.collectAsState()
-        val relayReady by connectionViewModel.relayReady.collectAsState()
         val activeConnection by connectionViewModel.activeConnection.collectAsState()
         val activeEndpoint by connectionViewModel.activeEndpoint.collectAsState()
         val connectionSecurity by connectionViewModel.connectionSecurity.collectAsState()
@@ -1166,17 +1278,16 @@ fun RelayApp() {
             startupGateTimedOut = true
         }
 
-        val hasStartupConnection = activeConnection?.apiServerUrl?.isNotBlank() == true
-        // A published activeEndpoint counts as "hermes online": the route
-        // resolver only publishes a winner after a successful HEAD /health
-        // probe against that route's API URL. At cold start this evidence
-        // lands within ~1s — long before the client-based health probe,
-        // which can't run until the API client exists (the client build
-        // used to queue behind the Keystore decrypt; see
-        // apiKeyForClientBuild in ConnectionViewModel).
-        val startupApiUp = apiReachable ||
-            apiHealth == ConnectionViewModel.HealthStatus.Reachable ||
-            activeEndpoint != null
+        val hasStartupConnection = hasConfiguredStartupChat(activeConnection)
+        val appChatRuntimeStatus = resolveAppChatRuntimeStatus(
+            connection = activeConnection,
+            gatewayAvailability = gatewayAvailability,
+            apiHealth = apiHealth,
+        )
+        // A Dashboard/Gateway-only connection is a complete standard Hermes
+        // connection. Startup readiness follows the same transport-neutral
+        // priority as the footer instead of waiting for an optional API probe.
+        val startupChatUp = appChatRuntimeStatus is ChatRuntimeStatus.Connected
 
         // An Unreachable verdict only counts after it SURVIVES a settle
         // window: the first health probe often runs against the persisted
@@ -1185,9 +1296,9 @@ fun RelayApp() {
         // first verdict was what flashed the disconnected chat UI at users
         // who were connected-just-waiting. The keyed effect restarts on
         // every health flip, cancelling a pending settle.
-        LaunchedEffect(apiHealth, startupGateReleased) {
+        LaunchedEffect(appChatRuntimeStatus, startupGateReleased) {
             if (startupGateReleased) return@LaunchedEffect
-            if (apiHealth == ConnectionViewModel.HealthStatus.Unreachable) {
+            if (hasStartupConnection && appChatRuntimeStatus is ChatRuntimeStatus.Unavailable) {
                 delay(3_000L)
                 startupUnreachableSettled = true
             } else {
@@ -1211,16 +1322,16 @@ fun RelayApp() {
                         StartupCheckState.Done,
                         "route · ${startupEndpoint.displayLabel()}",
                     )
-                    startupApiUp ->
+                    startupChatUp ->
                         StartupCheck(StartupCheckState.Done, "route · direct")
                     appReady ->
                         StartupCheck(StartupCheckState.Active, "resolving route")
                     else -> StartupCheck(StartupCheckState.Pending, "route")
                 },
                 when {
-                    startupApiUp ->
+                    startupChatUp ->
                         StartupCheck(StartupCheckState.Done, "hermes online")
-                    apiHealth == ConnectionViewModel.HealthStatus.Unreachable ->
+                    appChatRuntimeStatus is ChatRuntimeStatus.Unavailable ->
                         StartupCheck(StartupCheckState.Failed, "hermes unreachable")
                     appReady ->
                         StartupCheck(StartupCheckState.Active, "contacting hermes")
@@ -1232,7 +1343,7 @@ fun RelayApp() {
                 when {
                     chatReady && initialChatSettled ->
                         StartupCheck(StartupCheckState.Done, "conversation ready")
-                    startupApiUp ->
+                    startupChatUp ->
                         StartupCheck(StartupCheckState.Active, "loading conversation")
                     else -> StartupCheck(StartupCheckState.Pending, "conversation")
                 },
@@ -1346,7 +1457,8 @@ fun RelayApp() {
         // the previous run). The pre-warm fills cold keys and refreshes
         // stale (disk-hydrated) ones, then mirrors results back to disk.
         val effectiveDashboardUrl by connectionViewModel.effectiveDashboardUrl.collectAsState()
-        LaunchedEffect(activeConnection?.id, effectiveDashboardUrl) {
+        val effectiveManageProfile by connectionViewModel.effectiveSessionProfileName.collectAsState()
+        LaunchedEffect(activeConnection?.id, effectiveDashboardUrl, effectiveManageProfile) {
             val connection = activeConnection ?: return@LaunchedEffect
             if (effectiveDashboardUrl.isBlank()) return@LaunchedEffect
             val snapshot = connection.dashboardLastStatus ?: return@LaunchedEffect
@@ -1357,12 +1469,13 @@ fun RelayApp() {
             // The VM's cached per-connection store — the prewarm must NOT
             // construct its own (each instance lazily pays a multi-second
             // Keystore keyset build under a process-global Tink lock).
-            val cookieStore = connectionViewModel.activeDashboardCookieStore()
-                ?: return@LaunchedEffect
             prewarmDashboardManage(
-                cookieStore = cookieStore,
+                clientFactory = {
+                    connectionViewModel.dashboardClientForActive(effectiveDashboardUrl)
+                },
                 connectionId = connection.id,
                 dashboardUrl = effectiveDashboardUrl,
+                effectiveProfileName = effectiveManageProfile,
                 cacheDir = hydrateContext.cacheDir,
                 context = hydrateContext,
             )
@@ -1460,7 +1573,7 @@ fun RelayApp() {
         // stays fully silent (the health "Connecting" cue used to flash here for a
         // few seconds and then clear with no "Connected" toast).
         val connectionReconnecting =
-            globalConnectionStatus?.active == true && !postResumeQuiet &&
+            appChatRuntimeStatus is ChatRuntimeStatus.Connecting && !postResumeQuiet &&
                 !suppressGlobalChrome && !showStartupSphere && !voiceUiState.voiceMode
         // === END v0.4.1 polish ===
 
@@ -1600,7 +1713,13 @@ fun RelayApp() {
             snackbarHost = { SnackbarHost(snackbarHostState) },
             bottomBar = {
                 if (!suppressGlobalChrome && !isKeyboardVisible && !showStartupSphere && !voiceUiState.voiceMode) {
-                    val routeLabel = activeEndpoint?.displayLabel()
+                    val footerRoute = resolveFooterRouteCandidate(
+                        runtimeStatus = appChatRuntimeStatus,
+                        activeEndpoint = activeEndpoint,
+                        connection = activeConnection,
+                        effectiveDashboardUrl = effectiveDashboardUrl,
+                    )
+                    val routeLabel = footerRoute?.displayLabel()
                         ?: activeConnection?.label
                         ?: stringResource(R.string.status_no_route)
                     val transportStatus = resolveChatTransportStatus(
@@ -1613,12 +1732,9 @@ fun RelayApp() {
                     } else {
                         routeLabel
                     }
-                    val profileLabel = selectedProfile?.name?.takeIf { it.isNotBlank() }
+                    val profileLabel = AgentDisplay.profileDisplayName(effectiveDisplayProfile)
                         ?: stringResource(R.string.status_profile_default)
-                    val displayProfile = AgentDisplay.effectiveDisplayProfile(
-                        selectedProfile = selectedProfile,
-                        profiles = agentProfiles,
-                    )
+                    val displayProfile = effectiveDisplayProfile
                     val modelLabel = AgentDisplay.displayModelName(gatewayCurrentModel)
                         ?: AgentDisplay.displayModelName(displayProfile?.model)
                         ?: AgentDisplay.displayModelName(serverModelName)
@@ -1701,8 +1817,9 @@ fun RelayApp() {
                             }
                         },
                         onManageSignIn = {
-                            postOnboardingRoute = Screen.Manage.route
-                            connectionViewModel.completeOnboarding()
+                            navController.navigate(
+                                Screen.DashboardSignIn.route(Screen.DashboardSignIn.SOURCE_ONBOARDING),
+                            )
                         },
                         onOpenPermissions = {
                             navController.navigate(Screen.PermissionsSettings.route)
@@ -1717,6 +1834,16 @@ fun RelayApp() {
                             type = NavType.BoolType
                             defaultValue = false
                         },
+                        navArgument(Screen.Chat.ARG_SESSION_ID) {
+                            type = NavType.StringType
+                            nullable = true
+                            defaultValue = null
+                        },
+                        navArgument(Screen.Chat.ARG_PROFILE) {
+                            type = NavType.StringType
+                            nullable = true
+                            defaultValue = null
+                        },
                     ),
                 ) { backStackEntry ->
                     // Responsive bubble width based on screen width. The "Blend"
@@ -1741,6 +1868,48 @@ fun RelayApp() {
                     // sheet.
                     val openAgentSheetArg = backStackEntry.arguments
                         ?.getBoolean(Screen.Chat.ARG_OPEN_AGENT_SHEET, false) == true
+                    val requestedSessionId = backStackEntry.arguments
+                        ?.getString(Screen.Chat.ARG_SESSION_ID)
+                        ?.takeIf { it.isNotBlank() }
+                    val requestedProfileRoute = backStackEntry.arguments
+                        ?.getString(Screen.Chat.ARG_PROFILE)
+                        ?.takeIf { it.isNotBlank() }
+                    LaunchedEffect(
+                        requestedSessionId,
+                        requestedProfileRoute,
+                        profileSelectionSettled,
+                        effectiveSessionProfileName,
+                        agentProfiles,
+                    ) {
+                        val sessionId = requestedSessionId ?: return@LaunchedEffect
+                        if (requestedProfileRoute != null) {
+                            val targetProfile = requestedProfileRoute.takeUnless {
+                                it == com.hermesandroid.relay.notifications
+                                    .InteractionRequestNotifier.DEFAULT_PROFILE_ROUTE_VALUE
+                            }
+                            if (!profileSelectionSettled) return@LaunchedEffect
+                            if (effectiveSessionProfileName != targetProfile) {
+                                val selection = targetProfile?.let { name ->
+                                    agentProfiles.firstOrNull { it.name == name }
+                                }
+                                if (targetProfile == null || selection != null) {
+                                    connectionViewModel.selectProfile(selection)
+                                }
+                                return@LaunchedEffect
+                            }
+                            chatViewModel.switchProfileContext(
+                                contextKey = AgentDisplay.profileContextKey(
+                                    connectionId = activeConnectionId,
+                                    profileName = targetProfile,
+                                ),
+                                sessionId = sessionId,
+                            )
+                        } else if (chatViewModel.currentSessionId.value != sessionId) {
+                            chatViewModel.switchSession(sessionId)
+                        }
+                        backStackEntry.arguments?.putString(Screen.Chat.ARG_SESSION_ID, null)
+                        backStackEntry.arguments?.putString(Screen.Chat.ARG_PROFILE, null)
+                    }
 
                     val screenChatLabel = stringResource(R.string.screen_chat_label)
 
@@ -1832,6 +2001,11 @@ fun RelayApp() {
                         onNavigateToConnections = {
                             navController.navigate(Screen.ConnectionsSettings.route)
                         },
+                        onNavigateToSignIn = {
+                            navController.navigate(Screen.DashboardSignIn.route()) {
+                                launchSingleTop = true
+                            }
+                        },
                         // Standard back: return to wherever Manage was opened
                         // from (Settings → Hermes management, the agent sheet,
                         // etc.). The prior forced navigate(Chat) with
@@ -1865,6 +2039,39 @@ fun RelayApp() {
                     )
                     }
                 }
+                composable(
+                    route = Screen.DashboardSignIn.route,
+                    arguments = listOf(
+                        navArgument(Screen.DashboardSignIn.ARG_SOURCE) {
+                            type = NavType.StringType
+                            defaultValue = Screen.DashboardSignIn.SOURCE_GENERAL
+                        },
+                    ),
+                ) { backStackEntry ->
+                    val source = backStackEntry.arguments
+                        ?.getString(Screen.DashboardSignIn.ARG_SOURCE)
+                        ?: Screen.DashboardSignIn.SOURCE_GENERAL
+                    DashboardSignInScreen(
+                        connectionViewModel = connectionViewModel,
+                        onBack = { navController.popBackStack() },
+                        onAuthenticated = {
+                            when (source) {
+                                Screen.DashboardSignIn.SOURCE_ONBOARDING -> {
+                                    connectionViewModel.completeOnboarding()
+                                    navController.navigate(Screen.Chat.route()) {
+                                        popUpTo(Screen.Onboarding.route) { inclusive = true }
+                                        launchSingleTop = true
+                                    }
+                                }
+                                Screen.DashboardSignIn.SOURCE_PAIR -> {
+                                    navController.popBackStack()
+                                    navController.popBackStack()
+                                }
+                                else -> navController.popBackStack()
+                            }
+                        },
+                    )
+                }
                 composable(Screen.Terminal.route) {
                     if (coldStartAuthState is AuthState.Paired) {
                         TerminalScreen(
@@ -2082,12 +2289,13 @@ fun RelayApp() {
                         voiceClient = voiceClient,
                         connectionId = activeConnectionId,
                         selectedProfile = selectedProfile,
+                        displayProfile = effectiveDisplayProfile,
                         standardVoiceAvailability = standardVoiceAvailability,
                         standardVoiceSignInRouteHint = standardVoiceSignInRouteHint,
                         relayVoiceReady = relayVoiceReady,
                         dashboardUrl = voiceDashboardUrl,
-                        dashboardCookieStoreProvider = {
-                            connectionViewModel.activeDashboardCookieStore()
+                        dashboardClientProvider = { dashboardUrl ->
+                            connectionViewModel.dashboardClientForActive(dashboardUrl)
                         },
                         onOpenManage = {
                             navController.navigate(Screen.Manage.route) {
@@ -2230,18 +2438,20 @@ fun RelayApp() {
                             navController.navigate(Screen.ConnectionDetail.route(id))
                         },
                         onAddConnection = {
-                            connectionSwitchScope.launch {
-                                // Create and switch to the placeholder before
-                                // opening the wizard. Otherwise a fast scan or
-                                // standard save can write into the outgoing
-                                // connection's auth store.
-                                val id = connectionViewModel.beginAddConnection(
-                                    preAllocatedId = java.util.UUID.randomUUID().toString(),
-                                )
-                                navController.navigate(
-                                    Screen.Pair.route(connectionId = id)
-                                )
+                            val id = java.util.UUID.randomUUID().toString()
+                            // Draw step 1 immediately. Placeholder persistence
+                            // and the heavy connection-context switch continue
+                            // underneath the discovery UI instead of blocking
+                            // navigation on encrypted-store/client setup.
+                            navController.navigate(Screen.Pair.route(connectionId = id))
+                            val job = connectionSwitchScope.launch {
+                                try {
+                                    connectionViewModel.beginAddConnection(preAllocatedId = id)
+                                } finally {
+                                    pendingAddConnectionJobs.remove(id)
+                                }
                             }
+                            pendingAddConnectionJobs[id] = job
                         },
                         onBack = { navController.popBackStack() },
                         // Pass the VM so the list cards can read live status
@@ -2283,7 +2493,7 @@ fun RelayApp() {
                         onRepair = { id ->
                             connectionSwitchScope.launch {
                                 connectionViewModel.switchConnection(id).join()
-                                navController.navigate(Screen.Pair.route(id))
+                                navController.navigate(Screen.Pair.route(id, autoStart = "relay"))
                             }
                         },
                         onRevoke = { id ->
@@ -2333,9 +2543,14 @@ fun RelayApp() {
                         ?.getString(Screen.Pair.ARG_CONNECTION_ID)
                     val autoStartArg = backStackEntry.arguments
                         ?.getString(Screen.Pair.ARG_AUTO_START)
+                    val pairConnections by connectionViewModel.connections.collectAsState()
+                    val pairActiveId by connectionViewModel.activeConnectionId.collectAsState()
+                    val pairSetupReady = connectionIdArg == null ||
+                        (pairActiveId == connectionIdArg && pairConnections.any { it.id == connectionIdArg })
                     com.hermesandroid.relay.ui.screens.PairScreen(
                         connectionViewModel = connectionViewModel,
                         autoStart = autoStartArg,
+                        setupReady = pairSetupReady,
                         // Offer demo only on the bare "Connect" entry (the
                         // "No Hermes connection" path) — not on add-connection /
                         // re-pair flows, which have a placeholder connection in
@@ -2354,8 +2569,9 @@ fun RelayApp() {
                             navController.popBackStack()
                         },
                         onManageSignIn = {
-                            navController.popBackStack()
-                            navController.navigate(Screen.Manage.route) {
+                            navController.navigate(
+                                Screen.DashboardSignIn.route(Screen.DashboardSignIn.SOURCE_PAIR),
+                            ) {
                                 launchSingleTop = true
                             }
                         },
@@ -2367,6 +2583,10 @@ fun RelayApp() {
                             // never got a pairedAt stamp.
                             if (connectionIdArg != null) {
                                 connectionSwitchScope.launch {
+                                    // If Back wins the race with background
+                                    // preparation, wait until the placeholder
+                                    // exists before attempting to discard it.
+                                    pendingAddConnectionJobs.remove(connectionIdArg)?.join()
                                     connectionViewModel.discardPlaceholderConnection(connectionIdArg)
                                 }
                             }
@@ -2413,6 +2633,17 @@ fun RelayApp() {
                         onNavigateToRealtimeVoice = {
                             navController.navigate(Screen.RealtimeVoiceTest.route)
                         },
+                        onNavigateToImageGenerationLab = {
+                            terminalAppContext.startActivity(
+                                android.content.Intent().apply {
+                                    setClassName(
+                                        terminalAppContext,
+                                        "com.hermesandroid.relay.ui.screens.ImageGenerationDesignQaActivity",
+                                    )
+                                    addFlags(android.content.Intent.FLAG_ACTIVITY_NEW_TASK)
+                                }
+                            )
+                        },
                     )
                 }
                 composable(Screen.RealtimeVoiceTest.route) {
@@ -2502,9 +2733,9 @@ fun RelayApp() {
                     // doesn't happen to match the one we're inspecting
                     // (shouldn't normally happen since the entry is
                     // keyed off the same Profile).
-                    val selectedProfile by connectionViewModel
-                        .selectedProfile.collectAsState()
-                    val modelLabel = selectedProfile
+                    val inspectorDisplayProfile by connectionViewModel
+                        .effectiveDisplayProfile.collectAsState()
+                    val modelLabel = inspectorDisplayProfile
                         ?.takeIf { it.name == profileNameArg }
                         ?.model
 

app/src/main/kotlin/com/hermesandroid/relay/ui/components/ChatImageContent.kt

@@ -161,14 +161,37 @@ private fun putInlineImage(key: String, bitmap: ImageBitmap, sensitive: Boolean)
 fun extractChatInlineImages(content: String): Pair<String, List<ChatInlineImage>> {
     if (!content.contains("![")) return content to emptyList()
     val images = mutableListOf<ChatInlineImage>()
+    var inlineDataImages = 0
+    var inlineDataBytes = 0L
+    var inlineOverflowNoticeAdded = false
     val stripped = MARKDOWN_IMAGE_REGEX.replace(content) { m ->
         val spoilerWrapped = m.groupValues[1].isNotEmpty() && m.groupValues[4].isNotEmpty()
         val alt = m.groupValues[2].trim()
+        val src = normalizeImageSrc(m.groupValues[3].trim())
+        val isInlineData = src.startsWith("data:image/", ignoreCase = true)
+        val inlineDataSize = inlineImageDecodedSizeUpperBound(src)
+        val exceedsInlineBudget = isInlineData && (
+            inlineDataSize == null || inlineDataSize > INLINE_IMAGE_DATA_MAX_BYTES ||
+                inlineDataImages >= INLINE_IMAGE_DATA_MAX_PER_MESSAGE ||
+                inlineDataBytes + inlineDataSize > INLINE_IMAGE_DATA_MAX_TOTAL_BYTES
+            )
+        if (exceedsInlineBudget) {
+            return@replace if (inlineOverflowNoticeAdded) {
+                ""
+            } else {
+                inlineOverflowNoticeAdded = true
+                "\n\n_Additional inline images omitted for memory safety._\n\n"
+            }
+        }
         images += ChatInlineImage(
             alt = alt,
-            src = normalizeImageSrc(m.groupValues[3].trim()),
+            src = src,
             sensitive = spoilerWrapped || isSensitiveAltText(alt),
         )
+        if (inlineDataSize != null) {
+            inlineDataImages += 1
+            inlineDataBytes += inlineDataSize
+        }
         ""
     }
     if (images.isEmpty()) return content to emptyList()
@@ -208,6 +231,9 @@ private fun ChatInlineImage.isRemote(): Boolean {
     return s.startsWith("http://") || s.startsWith("https://")
 }
 
+private fun ChatInlineImage.isInlineDataImage(): Boolean =
+    src.startsWith("data:image/", ignoreCase = true)
+
 /**
  * An absolute server-side path (e.g. `/home/agent/out.png`) — what the relay's
  * `/media/by-path` route expects. Not a remote URL and not a relative ref.
@@ -232,6 +258,7 @@ fun ChatInlineImages(
         images.forEach { image ->
             when {
                 image.isRemote() -> RemoteChatImage(image, maxWidth)
+                image.isInlineDataImage() -> DataUrlChatImage(image, maxWidth)
                 // A server-local file the agent referenced — fetch it through
                 // /media/by-path and render inline; on failure the notice shows
                 // the ACTUAL reason (for debugging) instead of a generic message.
@@ -253,6 +280,94 @@ fun ChatInlineImages(
     }
 }
 
+private sealed interface DataUrlImagePhase {
+    data object Loading : DataUrlImagePhase
+    data class Loaded(
+        val bitmap: ImageBitmap,
+        val mime: String,
+    ) : DataUrlImagePhase
+    data object Rejected : DataUrlImagePhase
+}
+
+/** Render the bounded data URLs emitted by upstream `_resolve_media_to_data_urls`. */
+@Composable
+private fun DataUrlChatImage(image: ChatInlineImage, maxWidth: Dp) {
+    var phase by remember(image.src) { mutableStateOf<DataUrlImagePhase>(DataUrlImagePhase.Loading) }
+    var viewerOpen by remember(image.src) { mutableStateOf(false) }
+    val blurMode = LocalMediaBlurMode.current
+    var revealed by remember(image.src) { mutableStateOf(false) }
+    LaunchedEffect(image.src) {
+        phase = withInlineImageDecodeLock {
+            val decoded = decodeInlineImageDataUrl(image.src)
+                ?: return@withInlineImageDecodeLock DataUrlImagePhase.Rejected
+            val bounds = BitmapFactory.Options().apply { inJustDecodeBounds = true }
+            BitmapFactory.decodeByteArray(decoded.bytes, 0, decoded.bytes.size, bounds)
+            val sample = inlineImageSampleSize(bounds.outWidth, bounds.outHeight)
+                ?: return@withInlineImageDecodeLock DataUrlImagePhase.Rejected
+            val bitmap = BitmapFactory.decodeByteArray(
+                decoded.bytes,
+                0,
+                decoded.bytes.size,
+                BitmapFactory.Options().apply {
+                    inSampleSize = sample
+                    inPreferredConfig = android.graphics.Bitmap.Config.ARGB_8888
+                },
+            )
+                ?.asImageBitmap() ?: return@withInlineImageDecodeLock DataUrlImagePhase.Rejected
+            DataUrlImagePhase.Loaded(bitmap, decoded.mime)
+        }
+    }
+    when (val current = phase) {
+        DataUrlImagePhase.Loading -> Box(
+            modifier = Modifier
+                .widthIn(max = maxWidth)
+                .height(120.dp)
+                .clip(RoundedCornerShape(12.dp))
+                .background(MaterialTheme.colorScheme.surfaceVariant.copy(alpha = 0.5f)),
+            contentAlignment = Alignment.Center,
+        ) { CircularProgressIndicator(modifier = Modifier.size(22.dp), strokeWidth = 2.dp) }
+        DataUrlImagePhase.Rejected -> UnrenderableImageNotice(
+            image.copy(src = "inline image"),
+            reason = "Unsupported or oversized inline image.",
+        )
+        is DataUrlImagePhase.Loaded -> {
+            if (viewerOpen) {
+                ChatImageViewer(
+                    source = ChatImageViewerSource.Bitmap(
+                        bitmap = current.bitmap,
+                        displayName = image.alt.ifBlank { "image" },
+                        mime = current.mime,
+                        // Decode the already-retained data URL only when the
+                        // user requests Save/Share; don't keep a second 5 MiB
+                        // byte array beside every thumbnail.
+                        bytesProvider = { decodeInlineImageDataUrlOffMain(image.src)?.bytes },
+                    ),
+                    onDismiss = { viewerOpen = false },
+                    sensitive = image.sensitive,
+                    initiallyRevealed = revealed,
+                )
+            }
+            InlineImageColumn(image, maxWidth) {
+                BlurredMedia(
+                    blurred = !revealed && shouldBlurImage(blurMode, image.sensitive),
+                    onReveal = { revealed = true },
+                ) {
+                    androidx.compose.foundation.Image(
+                        bitmap = current.bitmap,
+                        contentDescription = image.alt.ifBlank { "Generated image" },
+                        contentScale = ContentScale.Fit,
+                        modifier = Modifier
+                            .widthIn(max = maxWidth)
+                            .heightIn(max = 360.dp)
+                            .clip(RoundedCornerShape(12.dp))
+                            .clickable { viewerOpen = true },
+                    )
+                }
+            }
+        }
+    }
+}
+
 @Composable
 private fun RemoteChatImage(image: ChatInlineImage, maxWidth: Dp) {
     var viewerOpen by remember { mutableStateOf(false) }

app/src/main/kotlin/com/hermesandroid/relay/ui/components/ChatInputBar.kt

@@ -74,7 +74,7 @@ import kotlinx.coroutines.delay
  * !isStreaming && hasContent      -> SEND    // Send arrow, primary (Relay)
  * !isStreaming                    -> VOICE   // GraphicEq, primary
  * isStreaming && !hasContent      -> STOP    // Stop in a Danger-outlined circle
- * canSteer (gateway transport)    -> STEER   // Send glyph, tertiary (Cyan)
+ * canCorrect (gateway transport)  -> STEER   // Send glyph, tertiary (Cyan)
  * else                            -> QUEUE   // Send glyph + clock badge, tertiary
  * ```
  */
@@ -120,7 +120,7 @@ data class ChatInputPickerControl(
  *    the limit) only when length > [charLimit] - 200 — supportingText
  *    reflows the bar, the overline doesn't.
  *  - [caption] renders a single relayMetadataStyle line above the bar
- *    (steer/queue hinting during streaming-with-text); Cyan when the slot
+ *    (correct/queue hinting during streaming-with-text); Cyan when the slot
  *    is STEER, muted otherwise. Null collapses the row.
  *  - Voice: GraphicEq glyph ("voice session", not "record"); when
  *    ![voiceReady] the button stays FULL alpha with a 6dp Amber dot badge
@@ -191,7 +191,7 @@ fun ChatInputBar(
     }
 
     Column(modifier = modifier.fillMaxWidth()) {
-        // Caption row — steer/queue hinting, single line, no buttons.
+        // Caption row — correct/queue hinting, single line, no buttons.
         AnimatedVisibility(visible = caption != null) {
             Text(
                 text = caption ?: lastCaption.orEmpty(),

app/src/main/kotlin/com/hermesandroid/relay/ui/components/CollapsibleAttachmentGroup.kt

@@ -0,0 +1,172 @@
+package com.hermesandroid.relay.ui.components
+
+import androidx.compose.animation.AnimatedVisibility
+import androidx.compose.animation.animateContentSize
+import androidx.compose.foundation.layout.Arrangement
+import androidx.compose.foundation.layout.Column
+import androidx.compose.foundation.layout.Row
+import androidx.compose.foundation.layout.Spacer
+import androidx.compose.foundation.layout.fillMaxWidth
+import androidx.compose.foundation.layout.padding
+import androidx.compose.foundation.layout.size
+import androidx.compose.foundation.layout.width
+import androidx.compose.material.icons.Icons
+import androidx.compose.material.icons.filled.ExpandLess
+import androidx.compose.material.icons.filled.ExpandMore
+import androidx.compose.material3.Icon
+import androidx.compose.material3.MaterialTheme
+import androidx.compose.material3.Surface
+import androidx.compose.material3.Text
+import androidx.compose.runtime.Composable
+import androidx.compose.runtime.getValue
+import androidx.compose.runtime.mutableStateOf
+import androidx.compose.runtime.saveable.rememberSaveable
+import androidx.compose.runtime.setValue
+import androidx.compose.ui.Alignment
+import androidx.compose.ui.Modifier
+import androidx.compose.ui.platform.testTag
+import androidx.compose.ui.res.pluralStringResource
+import androidx.compose.ui.res.stringResource
+import androidx.compose.ui.semantics.Role
+import androidx.compose.ui.semantics.contentDescription
+import androidx.compose.ui.semantics.role
+import androidx.compose.ui.semantics.semantics
+import androidx.compose.ui.semantics.stateDescription
+import androidx.compose.ui.text.style.TextOverflow
+import androidx.compose.ui.unit.dp
+import com.hermesandroid.relay.R
+import com.hermesandroid.relay.data.Attachment
+import com.hermesandroid.relay.data.AttachmentRenderMode
+
+/**
+ * Stable, presentation-only summary for a message's attachment group.
+ *
+ * Attachment bytes, fetch state, retry callbacks, and persistence remain owned
+ * by the existing attachment pipeline; this helper only chooses the compact
+ * label shown while that pipeline is folded away.
+ */
+internal data class AttachmentGroupSummary(
+    val count: Int,
+    val firstName: String?,
+    val firstType: AttachmentRenderMode,
+    val remainingCount: Int,
+)
+
+internal fun attachmentGroupSummary(attachments: List<Attachment>): AttachmentGroupSummary? {
+    val first = attachments.firstOrNull() ?: return null
+    return AttachmentGroupSummary(
+        count = attachments.size,
+        firstName = first.fileName?.trim()?.takeIf(String::isNotEmpty),
+        firstType = first.renderMode,
+        remainingCount = (attachments.size - 1).coerceAtLeast(0),
+    )
+}
+
+/**
+ * Slack-style disclosure for all attachments belonging to one message.
+ *
+ * The fold state is saveable and keyed by the message's stable Compose
+ * identity, so attachment lifecycle updates do not unexpectedly reopen a
+ * group the user collapsed. The compact header always remains available,
+ * making preview, retry, download, and file actions recoverable with one tap.
+ */
+@Composable
+internal fun CollapsibleAttachmentGroup(
+    messageKey: String,
+    attachments: List<Attachment>,
+    modifier: Modifier = Modifier,
+    content: @Composable () -> Unit,
+) {
+    val summary = attachmentGroupSummary(attachments) ?: return
+    var expanded by rememberSaveable(messageKey) { mutableStateOf(true) }
+    val stateLabel = stringResource(
+        if (expanded) R.string.attachment_group_expanded else R.string.attachment_group_collapsed,
+    )
+    val actionLabel = stringResource(
+        if (expanded) R.string.attachment_group_collapse else R.string.attachment_group_expand,
+    )
+    val typeLabel = stringResource(summary.firstType.labelResource())
+    val detail = when {
+        summary.firstName != null && summary.remainingCount > 0 ->
+            stringResource(
+                R.string.attachment_group_named_more,
+                summary.firstName,
+                typeLabel,
+                summary.remainingCount,
+            )
+        summary.firstName != null ->
+            stringResource(R.string.attachment_group_named, summary.firstName, typeLabel)
+        summary.remainingCount > 0 ->
+            stringResource(R.string.attachment_group_typed_more, typeLabel, summary.remainingCount)
+        else -> typeLabel
+    }
+
+    Column(
+        modifier = modifier
+            .fillMaxWidth()
+            .animateContentSize(),
+        verticalArrangement = Arrangement.spacedBy(4.dp),
+    ) {
+        Surface(
+            onClick = { expanded = !expanded },
+            modifier = Modifier
+                .fillMaxWidth()
+                .testTag("attachment-group-toggle-$messageKey")
+                .semantics(mergeDescendants = true) {
+                    contentDescription = actionLabel
+                    role = Role.Button
+                    stateDescription = stateLabel
+                },
+            shape = MaterialTheme.shapes.small,
+            color = MaterialTheme.colorScheme.surfaceVariant.copy(alpha = 0.55f),
+            contentColor = MaterialTheme.colorScheme.onSurfaceVariant,
+        ) {
+            Row(
+                modifier = Modifier.padding(horizontal = 10.dp, vertical = 7.dp),
+                verticalAlignment = Alignment.CenterVertically,
+            ) {
+                Column(modifier = Modifier.weight(1f)) {
+                    Text(
+                        text = pluralStringResource(
+                            R.plurals.attachment_group_count,
+                            summary.count,
+                            summary.count,
+                        ),
+                        style = MaterialTheme.typography.labelLarge,
+                    )
+                    Text(
+                        text = detail,
+                        style = MaterialTheme.typography.labelSmall,
+                        maxLines = 1,
+                        overflow = TextOverflow.Ellipsis,
+                    )
+                }
+                Spacer(modifier = Modifier.width(8.dp))
+                Icon(
+                    imageVector = if (expanded) Icons.Filled.ExpandLess else Icons.Filled.ExpandMore,
+                    contentDescription = null,
+                    modifier = Modifier.size(20.dp),
+                )
+            }
+        }
+
+        AnimatedVisibility(visible = expanded) {
+            Column(
+                modifier = Modifier
+                    .fillMaxWidth()
+                    .testTag("attachment-group-content-$messageKey"),
+            ) {
+                content()
+            }
+        }
+    }
+}
+
+private fun AttachmentRenderMode.labelResource(): Int = when (this) {
+    AttachmentRenderMode.IMAGE -> R.string.attachment_type_image
+    AttachmentRenderMode.VIDEO -> R.string.attachment_type_video
+    AttachmentRenderMode.AUDIO -> R.string.attachment_type_audio
+    AttachmentRenderMode.PDF -> R.string.attachment_type_pdf
+    AttachmentRenderMode.TEXT -> R.string.attachment_type_text
+    AttachmentRenderMode.GENERIC -> R.string.attachment_type_file
+}

app/src/main/kotlin/com/hermesandroid/relay/ui/components/ConnectionSetupTimeline.kt

@@ -0,0 +1,77 @@
+package com.hermesandroid.relay.ui.components
+
+import androidx.compose.foundation.background
+import androidx.compose.foundation.layout.Arrangement
+import androidx.compose.foundation.layout.Box
+import androidx.compose.foundation.layout.Column
+import androidx.compose.foundation.layout.Row
+import androidx.compose.foundation.layout.Spacer
+import androidx.compose.foundation.layout.fillMaxWidth
+import androidx.compose.foundation.layout.height
+import androidx.compose.foundation.layout.padding
+import androidx.compose.foundation.layout.size
+import androidx.compose.foundation.shape.CircleShape
+import androidx.compose.material.icons.Icons
+import androidx.compose.material.icons.filled.Check
+import androidx.compose.material3.Icon
+import androidx.compose.material3.MaterialTheme
+import androidx.compose.material3.Text
+import androidx.compose.runtime.Composable
+import androidx.compose.ui.Alignment
+import androidx.compose.ui.Modifier
+import androidx.compose.ui.unit.dp
+
+data class ConnectionSetupTimelineStep(
+    val title: String,
+    val detail: String,
+)
+
+/** Compact completed-state timeline shared by connection and auth flows. */
+@Composable
+fun ConnectionSetupTimeline(
+    steps: List<ConnectionSetupTimelineStep>,
+    modifier: Modifier = Modifier,
+) {
+    Column(modifier = modifier.fillMaxWidth()) {
+        steps.forEachIndexed { index, step ->
+            Row(
+                modifier = Modifier.fillMaxWidth(),
+                horizontalArrangement = Arrangement.spacedBy(12.dp),
+                verticalAlignment = Alignment.Top,
+            ) {
+                Column(horizontalAlignment = Alignment.CenterHorizontally) {
+                    Box(
+                        modifier = Modifier
+                            .size(28.dp)
+                            .background(MaterialTheme.colorScheme.primaryContainer, CircleShape),
+                        contentAlignment = Alignment.Center,
+                    ) {
+                        Icon(
+                            imageVector = Icons.Filled.Check,
+                            contentDescription = null,
+                            tint = MaterialTheme.colorScheme.onPrimaryContainer,
+                            modifier = Modifier.size(17.dp),
+                        )
+                    }
+                    if (index != steps.lastIndex) {
+                        Spacer(
+                            modifier = Modifier
+                                .size(width = 2.dp, height = 34.dp)
+                                .background(MaterialTheme.colorScheme.primary.copy(alpha = 0.35f)),
+                        )
+                    }
+                }
+                Column(
+                    modifier = Modifier.padding(bottom = if (index == steps.lastIndex) 0.dp else 10.dp),
+                ) {
+                    Text(step.title, style = MaterialTheme.typography.titleSmall)
+                    Text(
+                        step.detail,
+                        style = MaterialTheme.typography.bodySmall,
+                        color = MaterialTheme.colorScheme.onSurfaceVariant,
+                    )
+                }
+            }
+        }
+    }
+}

app/src/main/kotlin/com/hermesandroid/relay/ui/components/EndpointsCard.kt

@@ -15,6 +15,8 @@ import androidx.compose.foundation.layout.size
 import androidx.compose.foundation.shape.RoundedCornerShape
 import androidx.compose.material.icons.Icons
 import androidx.compose.material.icons.filled.Lan
+import androidx.compose.material.icons.filled.ExpandLess
+import androidx.compose.material.icons.filled.ExpandMore
 import androidx.compose.material.icons.filled.MoreVert
 import androidx.compose.material.icons.filled.Public
 import androidx.compose.material.icons.filled.Shield
@@ -29,6 +31,7 @@ import androidx.compose.material3.Icon
 import androidx.compose.material3.IconButton
 import androidx.compose.material3.MaterialTheme
 import androidx.compose.material3.OutlinedTextField
+import androidx.compose.material3.Surface
 import androidx.compose.material3.Text
 import androidx.compose.material3.TextButton
 import androidx.compose.ui.text.input.KeyboardType
@@ -44,8 +47,10 @@ import androidx.compose.ui.Modifier
 import androidx.compose.ui.draw.clip
 import androidx.compose.ui.graphics.Color
 import androidx.compose.ui.graphics.vector.ImageVector
+import androidx.compose.ui.platform.LocalUriHandler
 import androidx.compose.ui.res.stringResource
 import androidx.compose.ui.text.font.FontFamily
+import androidx.compose.ui.text.style.TextOverflow
 import androidx.compose.ui.unit.dp
 import com.hermesandroid.relay.R
 import com.hermesandroid.relay.data.Connection
@@ -55,9 +60,12 @@ import com.hermesandroid.relay.data.displayLabel
 import com.hermesandroid.relay.data.isEncryptedOverlayRoute
 import com.hermesandroid.relay.data.isKnownRole
 import com.hermesandroid.relay.data.isTlsUrl
+import com.hermesandroid.relay.data.primaryRouteUrl
+import com.hermesandroid.relay.data.routeAuthority
 import com.hermesandroid.relay.network.shared.RouteProbeOutcome
 import com.hermesandroid.relay.viewmodel.ConnectionViewModel
 import kotlinx.coroutines.launch
+import java.net.URI
 
 /**
  * ADR 24 — per-endpoint visibility + override card for the Connection
@@ -72,9 +80,9 @@ import kotlinx.coroutines.launch
  *   on app start, tried first on every resolve; cleared by
  *   [onClearPreferred].
  *
- * Verbose by design — Bailey explicitly asked for per-row visibility, so we
- * do NOT collapse into a master row. The card itself is wrapped in a
- * [SettingsExpandableCard] by the caller for page layout hygiene.
+ * Each route stays visible, while its Dashboard/API/Relay topology uses
+ * progressive disclosure: the active route opens by default and fallback
+ * routes keep a compact surface-and-port summary.
  *
  * Not visible on legacy installs: when [endpoints] is empty we render a
  * helpful one-liner instead of an empty card, so freshly-upgraded users
@@ -106,6 +114,9 @@ fun EndpointsCard(
      * resolver's cache-key scheme.
      */
     outcomeFor: (EndpointCandidate) -> RouteProbeOutcome? = { null },
+    /** Auth state applies only to the currently active Dashboard route. */
+    dashboardAuthenticated: Boolean? = null,
+    dashboardSignInRequired: Boolean = false,
     /**
      * Route management — the standard path's manual equivalent of a v3 QR's
      * `endpoints` array. Null callbacks hide the corresponding affordance.
@@ -170,11 +181,17 @@ fun EndpointsCard(
                 candidate = candidate,
                 isActive = activeEndpoint != null &&
                     activeEndpoint.role.equals(candidate.role, ignoreCase = true) &&
-                    activeEndpoint.api.host.equals(candidate.api.host, ignoreCase = true) &&
-                    activeEndpoint.api.port == candidate.api.port,
+                    activeEndpoint.routeAuthority() == candidate.routeAuthority(),
                 isPreferred = preferredRole?.equals(candidate.role, ignoreCase = true) == true,
                 isProbing = isProbing,
                 outcome = outcomeFor(candidate),
+                dashboardAuthenticated = dashboardAuthenticated.takeIf { activeEndpoint != null &&
+                    activeEndpoint.role.equals(candidate.role, ignoreCase = true) &&
+                    activeEndpoint.routeAuthority() == candidate.routeAuthority()
+                },
+                dashboardSignInRequired = dashboardSignInRequired && activeEndpoint != null &&
+                    activeEndpoint.role.equals(candidate.role, ignoreCase = true) &&
+                    activeEndpoint.routeAuthority() == candidate.routeAuthority(),
                 onUseNow = { onUseNow(candidate) },
                 onPrefer = { onPreferEndpoint(candidate) },
                 onClearPrefer = onClearPreferred,
@@ -219,6 +236,8 @@ private fun EndpointRow(
     isPreferred: Boolean,
     isProbing: Boolean = false,
     outcome: RouteProbeOutcome? = null,
+    dashboardAuthenticated: Boolean? = null,
+    dashboardSignInRequired: Boolean = false,
     onUseNow: () -> Unit,
     onPrefer: () -> Unit,
     onClearPrefer: () -> Unit,
@@ -230,6 +249,7 @@ private fun EndpointRow(
     var menuOpen by remember { mutableStateOf(false) }
     var pinDialogText by remember { mutableStateOf<String?>(null) }
     var confirmRemove by remember { mutableStateOf(false) }
+    var detailsExpanded by remember(isActive) { mutableStateOf(isActive) }
     val scope = rememberCoroutineScope()
     val noPinRecordedText = stringResource(R.string.endpoints_no_pin_recorded)
 
@@ -278,17 +298,6 @@ private fun EndpointRow(
                         )
                     }
                 }
-                // Full URL, scheme included: http vs https decides whether
-                // the health probe TLS-handshakes, so two rows that both
-                // read "host:8642" can behave completely differently. The
-                // scheme must be visible to be debuggable.
-                Text(
-                    text = candidate.api.url +
-                        (candidate.relay.transportHint?.let { " · $it" } ?: ""),
-                    style = MaterialTheme.typography.bodySmall,
-                    color = MaterialTheme.colorScheme.onSurfaceVariant,
-                    fontFamily = FontFamily.Monospace,
-                )
                 when {
                     isProbing -> Text(
                         text = stringResource(R.string.endpoints_checking),
@@ -307,6 +316,47 @@ private fun EndpointRow(
                         color = MaterialTheme.colorScheme.error,
                     )
                 }
+
+                val dashboardSurfaceUrl = candidate.dashboard?.url
+                    ?: candidate.api?.url?.let(Connection::deriveDefaultDashboardUrl)
+                val dashboardLabel = stringResource(R.string.active_section_dashboard)
+                val apiLabel = stringResource(R.string.active_section_api_server)
+                val relayLabel = stringResource(R.string.active_section_relay)
+                val surfaceSummary = listOfNotNull(
+                    dashboardSurfaceUrl?.let { "$dashboardLabel ${displayPort(it)}" },
+                    candidate.api?.url?.let { "$apiLabel ${displayPort(it)}" },
+                    candidate.relay?.url?.let { "$relayLabel ${displayPort(it)}" },
+                ).joinToString("  ·  ")
+                if (surfaceSummary.isNotBlank()) {
+                    Row(
+                        modifier = Modifier
+                            .padding(top = 4.dp)
+                            .clip(RoundedCornerShape(6.dp))
+                            .clickable { detailsExpanded = !detailsExpanded }
+                            .padding(vertical = 4.dp),
+                        verticalAlignment = Alignment.CenterVertically,
+                        horizontalArrangement = Arrangement.spacedBy(4.dp),
+                    ) {
+                        Text(
+                            text = surfaceSummary,
+                            style = MaterialTheme.typography.labelSmall,
+                            color = MaterialTheme.colorScheme.onSurfaceVariant,
+                            modifier = Modifier.weight(1f),
+                            maxLines = 1,
+                            overflow = TextOverflow.Ellipsis,
+                        )
+                        Icon(
+                            imageVector = if (detailsExpanded) {
+                                Icons.Filled.ExpandLess
+                            } else {
+                                Icons.Filled.ExpandMore
+                            },
+                            contentDescription = null,
+                            tint = MaterialTheme.colorScheme.onSurfaceVariant,
+                            modifier = Modifier.size(16.dp),
+                        )
+                    }
+                }
             }
 
             // 3-dot overflow menu — actions per-row so the card stays flat
@@ -392,6 +442,15 @@ private fun EndpointRow(
                 }
             }
         }
+
+        if (detailsExpanded) {
+            RouteSurfaceMap(
+                candidate = candidate,
+                dashboardAuthenticated = dashboardAuthenticated,
+                dashboardSignInRequired = dashboardSignInRequired,
+                modifier = Modifier.padding(start = 26.dp, end = 4.dp, top = 8.dp),
+            )
+        }
     }
 
     if (confirmRemove && onRemove != null) {
@@ -400,7 +459,7 @@ private fun EndpointRow(
             title = { Text(stringResource(R.string.endpoints_remove_route_title, candidate.displayLabel())) },
             text = {
                 Text(
-                    text = stringResource(R.string.endpoints_remove_route_body, "${candidate.api.host}:${candidate.api.port}"),
+                    text = stringResource(R.string.endpoints_remove_route_body, candidate.routeAuthority().orEmpty()),
                     style = MaterialTheme.typography.bodySmall,
                 )
             },
@@ -421,7 +480,7 @@ private fun EndpointRow(
     pinDialogText?.let { body ->
         AlertDialog(
             onDismissRequest = { pinDialogText = null },
-            title = { Text(stringResource(R.string.endpoints_pin_title, candidate.api.host)) },
+            title = { Text(stringResource(R.string.endpoints_pin_title, candidate.routeAuthority().orEmpty())) },
             text = {
                 Text(
                     text = body,
@@ -436,6 +495,106 @@ private fun EndpointRow(
     }
 }
 
+@Composable
+private fun RouteSurfaceMap(
+    candidate: EndpointCandidate,
+    dashboardAuthenticated: Boolean? = null,
+    dashboardSignInRequired: Boolean = false,
+    modifier: Modifier = Modifier,
+) {
+    val dashboardUrl = candidate.dashboard?.url
+        ?: candidate.api?.url?.let(Connection::deriveDefaultDashboardUrl)
+    val apiUrl = candidate.api?.url
+    val relayUrl = candidate.relay?.url
+
+    Surface(
+        color = MaterialTheme.colorScheme.surfaceVariant.copy(alpha = 0.42f),
+        shape = RoundedCornerShape(10.dp),
+        modifier = modifier.fillMaxWidth(),
+    ) {
+        Column(
+            modifier = Modifier.padding(horizontal = 12.dp, vertical = 10.dp),
+            verticalArrangement = Arrangement.spacedBy(9.dp),
+        ) {
+            RouteSurfaceRow(
+                label = stringResource(R.string.active_section_dashboard),
+                url = dashboardUrl,
+                status = when {
+                    dashboardSignInRequired -> stringResource(R.string.active_section_sign_in_required)
+                    dashboardAuthenticated == true -> stringResource(R.string.active_section_signed_in)
+                    dashboardUrl != null -> stringResource(R.string.active_section_configured)
+                    else -> stringResource(R.string.active_section_not_configured)
+                },
+                warning = dashboardSignInRequired,
+            )
+            RouteSurfaceRow(
+                label = stringResource(R.string.active_section_api_server),
+                url = apiUrl,
+                status = stringResource(
+                    if (apiUrl != null) R.string.active_section_configured
+                    else R.string.active_section_not_configured,
+                ),
+            )
+            RouteSurfaceRow(
+                label = stringResource(R.string.active_section_relay),
+                url = relayUrl,
+                status = stringResource(
+                    if (relayUrl != null) R.string.active_section_configured
+                    else R.string.active_section_not_configured,
+                ),
+            )
+        }
+    }
+}
+
+@Composable
+private fun RouteSurfaceRow(
+    label: String,
+    url: String?,
+    status: String,
+    warning: Boolean = false,
+) {
+    Row(
+        modifier = Modifier.fillMaxWidth(),
+        verticalAlignment = Alignment.CenterVertically,
+        horizontalArrangement = Arrangement.spacedBy(10.dp),
+    ) {
+        Column(modifier = Modifier.weight(1f)) {
+            Text(
+                text = label,
+                style = MaterialTheme.typography.labelMedium,
+                color = MaterialTheme.colorScheme.onSurface,
+            )
+            Text(
+                text = url ?: "—",
+                style = MaterialTheme.typography.labelSmall,
+                color = MaterialTheme.colorScheme.onSurfaceVariant,
+                fontFamily = FontFamily.Monospace,
+                maxLines = 1,
+                overflow = TextOverflow.Ellipsis,
+            )
+        }
+        Text(
+            text = status,
+            style = MaterialTheme.typography.labelSmall,
+            color = if (warning) {
+                MaterialTheme.colorScheme.error
+            } else {
+                MaterialTheme.colorScheme.onSurfaceVariant
+            },
+        )
+    }
+}
+
+private fun displayPort(url: String): String {
+    val uri = runCatching { URI(url) }.getOrNull()
+    val port = uri?.port?.takeIf { it > 0 } ?: when (uri?.scheme?.lowercase()) {
+        "https", "wss" -> 443
+        else -> 80
+    }
+    return ":$port"
+}
+
 @Composable
 private fun ActiveChip(label: String) {
     Row(
@@ -521,7 +680,7 @@ private fun roleIcon(role: String): ImageVector = when (role.lowercase()) {
  * be classified independently before it's the active route.
  */
 private fun EndpointCandidate.routeSecurityKind(): SurfaceSecurityKind = when {
-    isTlsUrl(api.url) -> SurfaceSecurityKind.Tls
+    isTlsUrl(primaryRouteUrl().orEmpty()) -> SurfaceSecurityKind.Tls
     isEncryptedOverlayRoute(isTailscaleDetected = false) -> SurfaceSecurityKind.Overlay
     else -> SurfaceSecurityKind.Plain
 }
@@ -531,21 +690,24 @@ private fun EndpointCandidate.routeSecurityKind(): SurfaceSecurityKind = when {
  * v3 pairing QR's `endpoints` array, so standard (no-Relay) connections can
  * set up LAN ↔ Tailscale roaming without the plugin.
  *
- * The relay URL is derived from the API URL (same `:8767` convention the
- * wizard uses); routes that need a custom relay URL still come from a QR.
+ * The editor is host-first: Dashboard/Gateway uses `:9119`, direct API
+ * fallback uses `:8642`, and an already-enabled Relay uses `:8767`.
+ * Routes that need custom per-surface hosts or ports still come from a QR.
  *
  * @param original null = add a new route; non-null = edit (pre-fills role +
  *   URL, keeps the stored priority).
- * @param onSave invoked with (role, apiUrl, resultCallback); the callback
+ * @param onSave invoked with (role, dashboardUrl, resultCallback); the callback
  *   receives a user-facing error string to render inline, or null on
  *   success (the dialog then closes itself).
  */
 @Composable
 fun RouteEditorDialog(
     original: EndpointCandidate?,
-    onSave: (role: String, apiUrl: String, onResult: (String?) -> Unit) -> Unit,
+    relayEnabled: Boolean = false,
+    onSave: (role: String, dashboardUrl: String, onResult: (String?) -> Unit) -> Unit,
     onDismiss: () -> Unit,
 ) {
+    val uriHandler = LocalUriHandler.current
     val knownRoles = listOf("tailscale", "public")
     var selectedRole by remember {
         mutableStateOf(
@@ -561,7 +723,7 @@ fun RouteEditorDialog(
             original?.role?.takeIf { it.lowercase() !in knownRoles }.orEmpty(),
         )
     }
-    var url by remember { mutableStateOf(original?.api?.url.orEmpty()) }
+    var url by remember(original) { mutableStateOf(original?.primaryRouteUrl().orEmpty()) }
     var errorText by remember { mutableStateOf<String?>(null) }
     var saving by remember { mutableStateOf(false) }
 
@@ -615,13 +777,20 @@ fun RouteEditorDialog(
                 // Live preview of what will actually be saved — scheme and
                 // port defaults applied — so "what, which port, http or
                 // https?" is answered before Save, not after a failed probe.
-                val previewCandidate = remember(url, effectiveRole) {
+                val previewCandidate = remember(url, effectiveRole, relayEnabled) {
                     url.takeIf { it.isNotBlank() }?.let {
-                        Connection.endpointCandidateFromApiUrl(
+                        val dashboardUrl = Connection.normalizeDashboardUrlInput(it)
+                        val apiUrl = Connection.deriveDefaultApiUrl(dashboardUrl)
+                        Connection.endpointCandidateFromDashboardUrl(
                             role = effectiveRole.ifBlank { "custom" },
                             priority = original?.priority ?: 1,
-                            apiServerUrl = Connection.normalizeApiUrlInput(it),
-                            relayUrl = "",
+                            dashboardUrl = dashboardUrl,
+                            apiServerUrl = apiUrl,
+                            relayUrl = if (relayEnabled) {
+                                apiUrl?.let(Connection::deriveDefaultRelayUrl)
+                            } else {
+                                null
+                            },
                         )
                     }
                 }
@@ -643,7 +812,7 @@ fun RouteEditorDialog(
                                 url.isBlank() ->
                                     supportingBlank
                                 previewCandidate != null ->
-                                    stringResource(R.string.endpoints_url_supporting_preview, previewCandidate.api.url)
+                                    stringResource(R.string.endpoints_url_supporting_preview, previewCandidate.primaryRouteUrl().orEmpty())
                                 else ->
                                     supportingEnter
                             },
@@ -652,6 +821,21 @@ fun RouteEditorDialog(
                     keyboardOptions = KeyboardOptions(keyboardType = KeyboardType.Uri),
                     modifier = Modifier.fillMaxWidth(),
                 )
+                previewCandidate?.let { candidate ->
+                    RouteSurfaceMap(candidate = candidate)
+                }
+                if (selectedRole == "tailscale") {
+                    Text(
+                        text = stringResource(R.string.endpoints_tailscale_setup_hint),
+                        style = MaterialTheme.typography.bodySmall,
+                        color = MaterialTheme.colorScheme.onSurfaceVariant,
+                    )
+                    TextButton(
+                        onClick = { uriHandler.openUri(REMOTE_ACCESS_DOCS_URL) },
+                    ) {
+                        Text(stringResource(R.string.endpoints_setup_help))
+                    }
+                }
             }
         },
         confirmButton = {
@@ -683,4 +867,7 @@ fun RouteEditorDialog(
     )
 }
 
+private const val REMOTE_ACCESS_DOCS_URL =
+    "https://hermes-relay.dev/docs/guide/remote-access"
+
 private const val CUSTOM_ROLE = "__custom__"

app/src/main/kotlin/com/hermesandroid/relay/ui/components/InlineImageDataUrl.kt

@@ -0,0 +1,127 @@
+package com.hermesandroid.relay.ui.components
+
+import java.util.Base64
+import kotlinx.coroutines.CoroutineDispatcher
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.sync.Mutex
+import kotlinx.coroutines.sync.withLock
+import kotlinx.coroutines.withContext
+
+internal const val INLINE_IMAGE_DATA_MAX_BYTES = 5 * 1024 * 1024
+internal const val INLINE_IMAGE_THUMBNAIL_MAX_DIMENSION = 1_024
+internal const val INLINE_IMAGE_THUMBNAIL_MAX_PIXELS = 1_500_000L
+internal const val INLINE_IMAGE_SOURCE_MAX_DIMENSION = 32_768
+internal const val INLINE_IMAGE_DATA_MAX_PER_MESSAGE = 4
+internal const val INLINE_IMAGE_DATA_MAX_TOTAL_BYTES = 8 * 1024 * 1024
+private const val MAX_HEADER_CHARS = 64
+private val inlineImageDecodeMutex = Mutex()
+private val DATA_IMAGE_HEADER = Regex(
+    "^data:(image/(?:png|jpeg|gif|webp|bmp));base64$",
+    RegexOption.IGNORE_CASE,
+)
+
+internal data class DecodedInlineImageData(
+    val bytes: ByteArray,
+    val mime: String,
+)
+
+/**
+ * Strict decoder for upstream API-server inline images.
+ *
+ * Only the five raster formats upstream emits for this path are accepted. The
+ * encoded input is bounded before allocation, strict base64 is required, and
+ * the decoded magic bytes must agree with the declared MIME type.
+ */
+internal fun decodeInlineImageDataUrl(
+    source: String,
+    maxBytes: Int = INLINE_IMAGE_DATA_MAX_BYTES,
+): DecodedInlineImageData? {
+    if (maxBytes <= 0 || !source.startsWith("data:", ignoreCase = true)) return null
+    val comma = source.indexOf(',')
+    if (comma <= 0 || comma > MAX_HEADER_CHARS) return null
+    val mime = DATA_IMAGE_HEADER.matchEntire(source.substring(0, comma))
+        ?.groupValues?.get(1)?.lowercase() ?: return null
+    val encoded = source.substring(comma + 1)
+    if (encoded.isEmpty()) return null
+    // ceil(maxBytes / 3) * 4 plus at most two trailing padding characters.
+    val maxEncoded = ((maxBytes.toLong() + 2L) / 3L) * 4L
+    if (encoded.length.toLong() > maxEncoded) return null
+    val bytes = runCatching { Base64.getDecoder().decode(encoded) }.getOrNull() ?: return null
+    if (bytes.isEmpty() || bytes.size > maxBytes || !matchesImageMagic(mime, bytes)) return null
+    return DecodedInlineImageData(bytes, mime)
+}
+
+/** Conservative decoded-size estimate that does not allocate a byte array. */
+internal fun inlineImageDecodedSizeUpperBound(source: String): Long? {
+    if (!source.startsWith("data:image/", ignoreCase = true)) return null
+    val comma = source.indexOf(',')
+    if (comma <= 0 || comma > MAX_HEADER_CHARS) return null
+    val encodedLength = source.length.toLong() - comma - 1L
+    if (encodedLength <= 0) return null
+    val padding = when {
+        source.endsWith("==") -> 2L
+        source.endsWith('=') -> 1L
+        else -> 0L
+    }
+    return ((encodedLength + 3L) / 4L) * 3L - padding
+}
+
+/**
+ * Serialize inline-image byte/bitmap work and keep it off the caller (usually
+ * Compose Main) thread. This prevents multiple Base64 and bitmap decode
+ * allocations from overlapping.
+ */
+internal suspend fun <T> withInlineImageDecodeLock(
+    dispatcher: CoroutineDispatcher = Dispatchers.Default,
+    block: () -> T,
+): T = withContext(dispatcher) {
+    inlineImageDecodeMutex.withLock { block() }
+}
+
+internal suspend fun decodeInlineImageDataUrlOffMain(
+    source: String,
+    dispatcher: CoroutineDispatcher = Dispatchers.Default,
+): DecodedInlineImageData? = withInlineImageDecodeLock(dispatcher) {
+    decodeInlineImageDataUrl(source)
+}
+
+private fun matchesImageMagic(mime: String, bytes: ByteArray): Boolean = when (mime) {
+    "image/png" -> bytes.size >= 8 && bytes.sliceArray(0..7).contentEquals(
+        byteArrayOf(0x89.toByte(), 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a),
+    )
+    "image/jpeg" -> bytes.size >= 3 &&
+        bytes[0] == 0xff.toByte() && bytes[1] == 0xd8.toByte() && bytes[2] == 0xff.toByte()
+    "image/webp" -> bytes.size >= 12 &&
+        bytes.copyOfRange(0, 4).contentEquals("RIFF".encodeToByteArray()) &&
+        bytes.copyOfRange(8, 12).contentEquals("WEBP".encodeToByteArray())
+    "image/gif" -> bytes.size >= 6 &&
+        (bytes.copyOfRange(0, 6).contentEquals("GIF87a".encodeToByteArray()) ||
+            bytes.copyOfRange(0, 6).contentEquals("GIF89a".encodeToByteArray()))
+    "image/bmp" -> bytes.size >= 2 && bytes[0] == 'B'.code.toByte() && bytes[1] == 'M'.code.toByte()
+    else -> false
+}
+
+/**
+ * Power-of-two sample factor that bounds the decoded ARGB thumbnail to roughly
+ * 6 MiB and 1024 px on either axis. Null rejects invalid/extreme source bounds.
+ */
+internal fun inlineImageSampleSize(
+    width: Int,
+    height: Int,
+    maxDimension: Int = INLINE_IMAGE_THUMBNAIL_MAX_DIMENSION,
+    maxPixels: Long = INLINE_IMAGE_THUMBNAIL_MAX_PIXELS,
+): Int? {
+    if (width <= 0 || height <= 0 || maxDimension <= 0 || maxPixels <= 0 ||
+        width > INLINE_IMAGE_SOURCE_MAX_DIMENSION || height > INLINE_IMAGE_SOURCE_MAX_DIMENSION
+    ) return null
+    var sample = 1
+    while (true) {
+        val sampledWidth = (width + sample - 1L) / sample
+        val sampledHeight = (height + sample - 1L) / sample
+        if (sampledWidth <= maxDimension && sampledHeight <= maxDimension &&
+            sampledWidth <= maxPixels / sampledHeight
+        ) return sample
+        if (sample >= 1 shl 15) return null
+        sample *= 2
+    }
+}

app/src/main/kotlin/com/hermesandroid/relay/ui/components/MarkdownContent.kt

@@ -41,8 +41,6 @@ import com.mikepenz.markdown.compose.components.MarkdownComponentModel
 import com.mikepenz.markdown.compose.LocalMarkdownColors
 import com.mikepenz.markdown.compose.LocalMarkdownDimens
 import com.mikepenz.markdown.compose.elements.MarkdownDivider
-import com.mikepenz.markdown.compose.elements.MarkdownHighlightedCodeBlock
-import com.mikepenz.markdown.compose.elements.MarkdownHighlightedCodeFence
 import com.mikepenz.markdown.compose.elements.MarkdownTable
 import com.mikepenz.markdown.compose.elements.MarkdownTableHeader
 import com.mikepenz.markdown.compose.elements.MarkdownTableRow
@@ -152,7 +150,7 @@ fun MarkdownContent(
         ),
         components = markdownComponents(
             codeBlock = {
-                MarkdownHighlightedCodeBlock(
+                SafeMarkdownHighlightedCodeBlock(
                     content = it.content,
                     node = it.node,
                     highlightsBuilder = highlightsBuilder,
@@ -160,7 +158,7 @@ fun MarkdownContent(
                 )
             },
             codeFence = {
-                MarkdownHighlightedCodeFence(
+                SafeMarkdownHighlightedCodeFence(
                     content = it.content,
                     node = it.node,
                     highlightsBuilder = highlightsBuilder,

app/src/main/kotlin/com/hermesandroid/relay/ui/components/MessageBubble.kt

@@ -138,6 +138,8 @@ fun MessageBubble(
      * happening.
      */
     recoveringAnswer: Boolean = false,
+    imageGenerationStylePreference: String = "rotate",
+    imageGenerationRotationIndex: Int = 0,
 ) {
     val isUser = message.role == MessageRole.USER
     val isSystem = message.role == MessageRole.SYSTEM
@@ -205,6 +207,28 @@ fun MessageBubble(
             extractChatInlineImages(message.content)
         }
     }
+    val showImageGeneration = shouldShowImageGenerationPlaceholder(
+        toolCalls = message.toolCalls,
+        isStreaming = message.isStreaming,
+        hasMediaResult = message.attachments.isNotEmpty() || inlineImages.isNotEmpty(),
+    )
+    val hasImageGenerationCall = remember(message.toolCalls) {
+        message.toolCalls.any {
+            it.name.trim().lowercase() == "image_generate"
+        }
+    }
+    val imageGenerationStartMillis = remember(message.toolCalls) {
+        imageGenerationStartedAt(message.toolCalls)
+    }
+    val imageGenerationVisualStyle = remember(
+        imageGenerationStylePreference,
+        imageGenerationRotationIndex,
+    ) {
+        resolveImageGenerationVisualStyle(
+            preference = imageGenerationStylePreference,
+            rotationIndex = imageGenerationRotationIndex,
+        )
+    }
 
     // Provide the sensitive-media blur mode to the attachment / inline-image
     // renderers below, sourced as locally as possible (here, not threaded
@@ -291,6 +315,30 @@ fun MessageBubble(
             )
         }
 
+        if (!isUser && !isSystem && showThinking) {
+            message.moaReferences.forEach { reference ->
+                ThinkingBlock(
+                    thinkingContent = if (reference.available) {
+                        reference.text
+                    } else {
+                        "Advisor unavailable."
+                    },
+                    isStreaming = false,
+                    headerText = buildString {
+                        append("Advisor ")
+                        append(reference.index)
+                        reference.count?.let { append("/").append(it) }
+                        append(" · ")
+                        append(reference.label)
+                    },
+                    accessibilityLabel = "Mixture of Agents advisor response",
+                    modifier = Modifier
+                        .widthIn(max = maxBubbleWidth)
+                        .padding(bottom = 4.dp),
+                )
+            }
+        }
+
         // Message bubble.
         //
         // Action bubbles (voice/phone origin) wrap the existing Surface in
@@ -309,6 +357,7 @@ fun MessageBubble(
         val showBubble = isUser || isSystem ||
             message.content.isNotBlank() ||
             message.isStreaming ||
+            showImageGeneration ||
             message.cards.isNotEmpty() ||
             message.attachments.isNotEmpty() ||
             inlineImages.isNotEmpty()
@@ -478,35 +527,78 @@ fun MessageBubble(
                     }
                 }
 
-                // Attachments — two or more loaded images collapse into one
-                // grid + swipe-across gallery. Every other item stays on the
-                // unified InboundAttachmentCard path, and layout items retain
-                // their original ChatMessage.attachments indices so retry /
-                // manual-fetch callbacks cannot drift after grouping.
-                if (message.attachments.isNotEmpty()) {
+                // Image generation owns the bubble's progress slot. Keep the
+                // selected progress treatment mounted under the real result,
+                // then reveal the same collapsible attachment surface without
+                // rebuilding the surrounding message bubble.
+                if (hasImageGenerationCall) {
                     Spacer(modifier = Modifier.height(4.dp))
-                    val attachmentItems = remember(message.attachments) {
-                        attachmentLayoutItems(message.attachments)
-                    }
-                    attachmentItems.forEach { item ->
-                        when (item) {
-                            is AttachmentLayoutItem.Gallery -> AttachmentGallery(
-                                attachments = item.attachmentIndices.map(message.attachments::get),
-                                maxWidth = maxBubbleWidth - 24.dp,
-                                modifier = Modifier.padding(vertical = 2.dp),
-                            )
-                            is AttachmentLayoutItem.Single -> {
-                                val index = item.attachmentIndex
-                                InboundAttachmentCard(
-                                    attachment = message.attachments[index],
-                                    onRetry = { onAttachmentRetry(message.id, index) },
-                                    onManualFetch = { onAttachmentManualFetch(message.id, index) },
-                                    maxWidth = maxBubbleWidth - 24.dp,
-                                    modifier = Modifier.padding(vertical = 2.dp),
-                                )
+                    ImageGenerationResultTransition(
+                        generating = showImageGeneration,
+                        startedAtMillis = imageGenerationStartMillis,
+                        visualStyle = imageGenerationVisualStyle,
+                    ) {
+                        if (message.attachments.isNotEmpty()) {
+                            CollapsibleAttachmentGroup(
+                                messageKey = message.uiKey,
+                                attachments = message.attachments,
+                            ) {
+                                val attachmentItems = attachmentLayoutItems(message.attachments)
+                                attachmentItems.forEach { item ->
+                                    when (item) {
+                                        is AttachmentLayoutItem.Gallery -> AttachmentGallery(
+                                            attachments = item.attachmentIndices.map(message.attachments::get),
+                                            maxWidth = maxBubbleWidth - 24.dp,
+                                            modifier = Modifier.padding(vertical = 2.dp),
+                                        )
+                                        is AttachmentLayoutItem.Single -> {
+                                            val index = item.attachmentIndex
+                                            InboundAttachmentCard(
+                                                attachment = message.attachments[index],
+                                                onRetry = { onAttachmentRetry(message.id, index) },
+                                                onManualFetch = { onAttachmentManualFetch(message.id, index) },
+                                                maxWidth = maxBubbleWidth - 24.dp,
+                                                modifier = Modifier.padding(vertical = 2.dp),
+                                            )
+                                        }
+                                    }
+                                }
                             }
                         }
                     }
+                } else if (message.attachments.isNotEmpty()) {
+                        // Two or more loaded images collapse into one grid +
+                        // swipe-across gallery. Every other item stays on the
+                        // unified attachment path, retaining original indices.
+                        Spacer(modifier = Modifier.height(4.dp))
+                        CollapsibleAttachmentGroup(
+                            messageKey = message.uiKey,
+                            attachments = message.attachments,
+                        ) {
+                            // Two or more loaded images collapse into one grid +
+                            // swipe-across gallery. Every other item stays on the
+                            // unified attachment path, retaining original indices.
+                            val attachmentItems = attachmentLayoutItems(message.attachments)
+                            attachmentItems.forEach { item ->
+                                when (item) {
+                                    is AttachmentLayoutItem.Gallery -> AttachmentGallery(
+                                        attachments = item.attachmentIndices.map(message.attachments::get),
+                                        maxWidth = maxBubbleWidth - 24.dp,
+                                        modifier = Modifier.padding(vertical = 2.dp),
+                                    )
+                                    is AttachmentLayoutItem.Single -> {
+                                        val index = item.attachmentIndex
+                                        InboundAttachmentCard(
+                                            attachment = message.attachments[index],
+                                            onRetry = { onAttachmentRetry(message.id, index) },
+                                            onManualFetch = { onAttachmentManualFetch(message.id, index) },
+                                            maxWidth = maxBubbleWidth - 24.dp,
+                                            modifier = Modifier.padding(vertical = 2.dp),
+                                        )
+                                    }
+                                }
+                            }
+                        }
                 }
 
                 // Streaming indicator — only while awaiting the first token. Once
@@ -514,7 +606,11 @@ fun MessageBubble(
                 // signal, so the pulsing dots stop (Messenger/Telegram drop the
                 // typing bubble the moment content appears) instead of throbbing
                 // under the text for the whole turn.
-                if (message.isStreaming && message.content.isBlank()) {
+                if (
+                    message.isStreaming &&
+                    message.content.isBlank() &&
+                    !showImageGeneration
+                ) {
                     // After a few seconds with no content yet, escalate the bare
                     // dots to a labeled "Still working…" so a slow first token
                     // never reads as a hang on the SSE / sessions paths.

app/src/main/kotlin/com/hermesandroid/relay/ui/components/QrPairingScanner.kt

@@ -219,6 +219,16 @@ data class RelayPairing(
     val transportHint: String? = null,
 )
 
+/** True only when a scoped Relay scan can immediately begin authentication. */
+internal fun HermesPairingPayload.hasUsableRelayPairing(): Boolean {
+    val relay = relay ?: return false
+    if (relay.code.isBlank()) return false
+    val uri = runCatching { URI(relay.url.trim()) }.getOrNull() ?: return false
+    val supportedScheme = uri.scheme.equals("ws", ignoreCase = true) ||
+        uri.scheme.equals("wss", ignoreCase = true)
+    return supportedScheme && !uri.host.isNullOrBlank()
+}
+
 private val json = Json {
     ignoreUnknownKeys = true
     isLenient = true
@@ -258,8 +268,8 @@ private fun parseHermesRelayQr(raw: String): HermesPairingPayload? {
     return try {
         // Quick check: must contain a `host` field and be valid JSON. We no
         // longer reject based on the `hermes` version int — future v4+ QRs
-        // should still parse on this phone so Bailey doesn't have to ship a
-        // whole release to keep up with wire-format growth.
+        // should still parse so wire-format growth does not require an app
+        // release for every compatible payload version.
         val obj = json.decodeFromString<JsonObject>(raw)
         val version = obj["hermes"]?.jsonPrimitive?.intOrNull ?: 1
         if (version < 1) return null
@@ -532,7 +542,8 @@ private fun mapBoxToViewport(
 @Composable
 fun QrPairingScanner(
     onPairingDetected: (HermesPairingPayload) -> Unit,
-    onDismiss: () -> Unit
+    onDismiss: () -> Unit,
+    relayOnly: Boolean = false,
 ) {
     val context = LocalContext.current
     val lifecycleOwner = LocalLifecycleOwner.current
@@ -628,7 +639,10 @@ fun QrPairingScanner(
                     )
                 }
                 Text(
-                    text = stringResource(R.string.qr_scanner_title),
+                    text = stringResource(
+                        if (relayOnly) R.string.qr_scanner_relay_title
+                        else R.string.qr_scanner_title,
+                    ),
                     style = MaterialTheme.typography.titleMedium,
                     color = MaterialTheme.colorScheme.onSurface,
                     modifier = Modifier.align(Alignment.Center)
@@ -740,7 +754,11 @@ fun QrPairingScanner(
                                                     ) {
                                                         val rawValue = barcode.rawValue ?: continue
                                                         val payload = parseHermesPairingQr(rawValue)
-                                                        if (payload != null && hasDetected.compareAndSet(false, true)) {
+                                                        if (
+                                                            payload != null &&
+                                                            (!relayOnly || payload.hasUsableRelayPairing()) &&
+                                                            hasDetected.compareAndSet(false, true)
+                                                        ) {
                                                             lockedPayload = payload
                                                             return@addOnSuccessListener
                                                         }
@@ -798,13 +816,19 @@ fun QrPairingScanner(
                     modifier = Modifier.size(32.dp)
                 )
                 Text(
-                    text = stringResource(R.string.qr_scanner_instruction),
+                    text = stringResource(
+                        if (relayOnly) R.string.qr_scanner_relay_instruction
+                        else R.string.qr_scanner_instruction,
+                    ),
                     style = MaterialTheme.typography.titleMedium,
                     color = MaterialTheme.colorScheme.onSurface,
                     textAlign = TextAlign.Center
                 )
                 Text(
-                    text = stringResource(R.string.qr_scanner_subtext),
+                    text = stringResource(
+                        if (relayOnly) R.string.qr_scanner_relay_subtext
+                        else R.string.qr_scanner_subtext,
+                    ),
                     style = MaterialTheme.typography.bodyMedium,
                     color = MaterialTheme.colorScheme.onSurfaceVariant,
                     textAlign = TextAlign.Center

app/src/main/kotlin/com/hermesandroid/relay/ui/components/SafeMarkdownHighlightedCode.kt

@@ -0,0 +1,145 @@
+package com.hermesandroid.relay.ui.components
+
+import androidx.compose.foundation.horizontalScroll
+import androidx.compose.foundation.layout.fillMaxWidth
+import androidx.compose.foundation.layout.padding
+import androidx.compose.foundation.rememberScrollState
+import androidx.compose.foundation.shape.RoundedCornerShape
+import androidx.compose.runtime.Composable
+import androidx.compose.runtime.getValue
+import androidx.compose.runtime.produceState
+import androidx.compose.ui.Modifier
+import androidx.compose.ui.graphics.Color
+import androidx.compose.ui.text.AnnotatedString
+import androidx.compose.ui.text.SpanStyle
+import androidx.compose.ui.text.TextStyle
+import androidx.compose.ui.text.buildAnnotatedString
+import androidx.compose.ui.text.font.FontWeight
+import androidx.compose.ui.unit.dp
+import com.mikepenz.markdown.compose.LocalMarkdownColors
+import com.mikepenz.markdown.compose.LocalMarkdownDimens
+import com.mikepenz.markdown.compose.LocalMarkdownPadding
+import com.mikepenz.markdown.compose.LocalMarkdownTypography
+import com.mikepenz.markdown.compose.elements.MarkdownCodeBackground
+import com.mikepenz.markdown.compose.elements.MarkdownCodeBlock
+import com.mikepenz.markdown.compose.elements.MarkdownCodeFence
+import com.mikepenz.markdown.compose.elements.material.MarkdownBasicText
+import dev.snipme.highlights.Highlights
+import dev.snipme.highlights.model.BoldHighlight
+import dev.snipme.highlights.model.ColorHighlight
+import dev.snipme.highlights.model.SyntaxLanguage
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.withContext
+import org.intellij.markdown.ast.ASTNode
+
+@Composable
+internal fun SafeMarkdownHighlightedCodeFence(
+    content: String,
+    node: ASTNode,
+    style: TextStyle = LocalMarkdownTypography.current.code,
+    highlightsBuilder: Highlights.Builder,
+    showHeader: Boolean = false,
+) {
+    MarkdownCodeFence(content, node, style) { code, language, codeStyle ->
+        SafeMarkdownHighlightedCode(
+            code = code,
+            language = language,
+            style = codeStyle,
+            highlightsBuilder = highlightsBuilder,
+            showHeader = showHeader,
+        )
+    }
+}
+
+@Composable
+internal fun SafeMarkdownHighlightedCodeBlock(
+    content: String,
+    node: ASTNode,
+    style: TextStyle = LocalMarkdownTypography.current.code,
+    highlightsBuilder: Highlights.Builder,
+    showHeader: Boolean = false,
+) {
+    MarkdownCodeBlock(content, node, style) { code, language, codeStyle ->
+        SafeMarkdownHighlightedCode(
+            code = code,
+            language = language,
+            style = codeStyle,
+            highlightsBuilder = highlightsBuilder,
+            showHeader = showHeader,
+        )
+    }
+}
+
+@Composable
+private fun SafeMarkdownHighlightedCode(
+    code: String,
+    language: String?,
+    style: TextStyle,
+    highlightsBuilder: Highlights.Builder,
+    showHeader: Boolean,
+) {
+    val codeHighlights by produceState(
+        initialValue = AnnotatedString(code),
+        key1 = code,
+        key2 = language,
+        key3 = highlightsBuilder,
+    ) {
+        value = withContext(Dispatchers.Default) {
+            buildSafeHighlightedAnnotatedString(code, language, highlightsBuilder)
+        }
+    }
+
+    val codeBackgroundCornerSize = LocalMarkdownDimens.current.codeBackgroundCornerSize
+    MarkdownCodeBackground(
+        color = LocalMarkdownColors.current.codeBackground,
+        shape = RoundedCornerShape(codeBackgroundCornerSize),
+        modifier = Modifier
+            .fillMaxWidth()
+            .padding(vertical = 8.dp),
+        showHeader = showHeader,
+        language = language,
+        code = code,
+    ) {
+        MarkdownBasicText(
+            text = codeHighlights,
+            style = style,
+            modifier = Modifier
+                .horizontalScroll(rememberScrollState())
+                .padding(LocalMarkdownPadding.current.codeBlock),
+        )
+    }
+}
+
+/**
+ * Converts Highlights ranges into Compose spans without trusting dependency
+ * offsets. Highlights 1.1.0 can return a reversed multiline-comment range
+ * when a multiline-comment closing delimiter precedes its opening delimiter.
+ * Streaming can expose that shape before a code block is complete.
+ */
+internal fun buildSafeHighlightedAnnotatedString(
+    code: String,
+    language: String?,
+    highlightsBuilder: Highlights.Builder,
+): AnnotatedString {
+    val syntaxLanguage = language?.let(SyntaxLanguage::getByName)
+    val highlights = highlightsBuilder
+        .code(code)
+        .let { if (syntaxLanguage != null) it.language(syntaxLanguage) else it }
+        .build()
+        .getHighlights()
+
+    return buildAnnotatedString {
+        append(code)
+        highlights.forEach { highlight ->
+            val start = highlight.location.start.coerceIn(0, code.length)
+            val end = highlight.location.end.coerceIn(0, code.length)
+            if (start >= end) return@forEach
+
+            val style = when (highlight) {
+                is ColorHighlight -> SpanStyle(color = Color(highlight.rgb).copy(alpha = 1f))
+                is BoldHighlight -> SpanStyle(fontWeight = FontWeight.Bold)
+            }
+            addStyle(style = style, start = start, end = end)
+        }
+    }
+}

app/src/main/kotlin/com/hermesandroid/relay/ui/components/SessionSourceBadge.kt

@@ -19,15 +19,15 @@ data class SourceBadge(val label: String, val color: Color)
  * The app's own chats — no badge (they're "your" conversations from this app /
  * desktop / API, not a distinct gateway lane).
  */
-private val OWN_CHAT_SOURCES = setOf("tui", "api_server", "cli", "local", "")
+private val OWN_CHAT_SOURCES = setOf("tui", "api_server", "cli", "local", "webui", "")
 
 /**
  * Map a session `source` to a drawer badge, or null for the app's own chats and
  * the phone **Thread** (which renders its own thread-spool chip). External
  * gateways — discord / telegram / slack / cron / webhook / web / … — each get a
  * small colored chip so the drawer reads like the desktop's per-channel tags.
- * Confirmed live sources: tui, cli, api_server, web, discord, telegram, cron,
- * webhook, phone.
+ * Confirmed live sources: tui, cli, api_server, webui, web, discord, telegram,
+ * cron, webhook, phone.
  */
 fun sourceBadge(source: String?): SourceBadge? {
     val s = source?.trim()?.lowercase() ?: return null

app/src/main/kotlin/com/hermesandroid/relay/ui/components/ThinkingBlock.kt

@@ -39,6 +39,8 @@ fun ThinkingBlock(
     modifier: Modifier = Modifier,
     /** Message timestamp shown right-aligned in the header (null hides it). */
     timestamp: Long? = null,
+    headerText: String? = null,
+    accessibilityLabel: String = "Thinking",
 ) {
     var expanded by remember { mutableStateOf(isStreaming) }
     val locale = LocalLocale.current.platformLocale
@@ -65,13 +67,13 @@ fun ThinkingBlock(
             ) {
                 Icon(
                     imageVector = Icons.Filled.Psychology,
-                    contentDescription = "Thinking",
+                    contentDescription = accessibilityLabel,
                     modifier = Modifier.size(16.dp),
                     tint = MaterialTheme.colorScheme.tertiary
                 )
                 Spacer(modifier = Modifier.width(6.dp))
                 Text(
-                    text = if (isStreaming) "Thinking..." else "Thought process",
+                    text = headerText ?: if (isStreaming) "Thinking..." else "Thought process",
                     style = MaterialTheme.typography.labelSmall,
                     color = MaterialTheme.colorScheme.tertiary
                 )

app/src/main/kotlin/com/hermesandroid/relay/ui/components/VoiceWaveform.kt

@@ -31,6 +31,7 @@ import androidx.compose.ui.graphics.drawscope.Stroke
 import androidx.compose.ui.graphics.drawscope.drawIntoCanvas
 import androidx.compose.ui.tooling.preview.Preview
 import androidx.compose.ui.unit.dp
+import androidx.compose.ui.unit.Dp
 import com.hermesandroid.relay.viewmodel.VoiceState
 import kotlin.math.PI
 import kotlin.math.max
@@ -140,6 +141,8 @@ fun VoiceWaveform(
     amplitude: Float,
     state: VoiceState,
     outputAudioActive: Boolean = false,
+    height: Dp = 56.dp,
+    compactBars: Boolean = false,
     modifier: Modifier = Modifier,
 ) {
     // No downstream smoothing. The VoiceViewModel already runs an
@@ -154,6 +157,7 @@ fun VoiceWaveform(
     // doesn't look abrupt.
     val dim = MaterialTheme.colorScheme.onSurfaceVariant
     val errorColor = MaterialTheme.colorScheme.error
+    val compactColor = MaterialTheme.colorScheme.primary
 
     val targetPrimary = when (state) {
         VoiceState.Idle -> dim.copy(alpha = 0.3f)
@@ -198,16 +202,38 @@ fun VoiceWaveform(
     )
     val spinnerPhase = rememberProcessingSpinnerPhase(processing)
 
-    Canvas(
-        modifier = modifier
-            .fillMaxWidth()
-            .height(56.dp),
-    ) {
+    val canvasModifier = if (compactBars) {
+        modifier.height(height)
+    } else {
+        modifier.fillMaxWidth().height(height)
+    }
+    Canvas(modifier = canvasModifier) {
         val width = size.width
         val height = size.height
         if (width <= 0f || height <= 0f) return@Canvas
 
         val centerY = height / 2f
+
+        if (compactBars) {
+            val barCount = 10
+            val gap = 3.dp.toPx()
+            val barWidth = 2.5.dp.toPx()
+            val totalWidth = barWidth * barCount + gap * (barCount - 1)
+            val startX = ((width - totalWidth) / 2f).coerceAtLeast(0f)
+            repeat(barCount) { index ->
+                val wave = ((sin(phases[0] + index * 0.82f) + 1f) * 0.5f)
+                val activeHeight = height * (0.22f + wave * (0.28f + displayAmplitude * 0.5f))
+                val x = startX + index * (barWidth + gap)
+                drawRoundRect(
+                    color = compactColor.copy(alpha = if (index < 5) 0.96f else 0.22f),
+                    topLeft = Offset(x, centerY - activeHeight / 2f),
+                    size = Size(barWidth, activeHeight),
+                    cornerRadius = androidx.compose.ui.geometry.CornerRadius(barWidth / 2f, barWidth / 2f),
+                )
+            }
+            return@Canvas
+        }
+
         val peakPixels = height * PEAK_FRACTION
         val strokePx = STROKE_WIDTH_DP.dp.toPx()
         val centerX = width / 2f

app/src/main/kotlin/com/hermesandroid/relay/ui/onboarding/OnboardingPage.kt

@@ -1,11 +1,10 @@
 package com.hermesandroid.relay.ui.onboarding
 
 import androidx.compose.foundation.background
-import com.hermesandroid.relay.ui.theme.LocalBrand
+import androidx.compose.foundation.BorderStroke
 import androidx.compose.foundation.layout.Arrangement
 import androidx.compose.foundation.layout.Box
 import androidx.compose.foundation.layout.BoxScope
-import androidx.compose.foundation.layout.BoxWithConstraints
 import androidx.compose.foundation.layout.Column
 import androidx.compose.foundation.layout.ColumnScope
 import androidx.compose.foundation.layout.Spacer
@@ -20,23 +19,21 @@ import androidx.compose.foundation.shape.CircleShape
 import androidx.compose.foundation.shape.RoundedCornerShape
 import androidx.compose.material.icons.Icons
 import androidx.compose.material.icons.automirrored.filled.Chat
-import androidx.compose.material3.Card
-import androidx.compose.material3.CardDefaults
 import androidx.compose.material3.Icon
 import androidx.compose.material3.MaterialTheme
+import androidx.compose.material3.Surface
 import androidx.compose.material3.Text
 import androidx.compose.runtime.Composable
 import androidx.compose.ui.Alignment
 import androidx.compose.ui.Modifier
 import androidx.compose.ui.draw.clip
-import androidx.compose.ui.graphics.Brush
 import androidx.compose.ui.graphics.Color
 import androidx.compose.ui.graphics.vector.ImageVector
 import androidx.compose.ui.text.style.TextAlign
 import androidx.compose.ui.tooling.preview.Preview
 import androidx.compose.ui.unit.dp
+import androidx.compose.ui.unit.sp
 import com.hermesandroid.relay.ui.theme.HermesRelayTheme
-import com.hermesandroid.relay.ui.theme.gradientBorder
 
 @Composable
 fun OnboardingPage(
@@ -44,7 +41,6 @@ fun OnboardingPage(
     title: String,
     description: String,
     modifier: Modifier = Modifier,
-    transparentHero: Boolean = false,
     heroContent: @Composable BoxScope.() -> Unit = {
         FeatureHero(
             icon = icon,
@@ -53,101 +49,44 @@ fun OnboardingPage(
     },
     content: @Composable ColumnScope.() -> Unit = {}
 ) {
-    val isDarkTheme = LocalBrand.current.isDark
-    val heroShape = RoundedCornerShape(30.dp)
-    val bodyShape = RoundedCornerShape(26.dp)
-    val heroBrush = Brush.radialGradient(
-        colors = if (isDarkTheme) {
-            listOf(
-                MaterialTheme.colorScheme.surfaceContainerHighest.copy(alpha = 0.96f),
-                MaterialTheme.colorScheme.surfaceContainer.copy(alpha = 0.92f),
-                MaterialTheme.colorScheme.surfaceContainerLow.copy(alpha = 0.98f),
-            )
-        } else {
-            listOf(
-                MaterialTheme.colorScheme.primaryContainer.copy(alpha = 0.70f),
-                MaterialTheme.colorScheme.surface.copy(alpha = 0.98f),
-                MaterialTheme.colorScheme.secondaryContainer.copy(alpha = 0.60f),
-            )
-        }
-    )
-
-    // Short viewports (small phones, large font scale, split screen) shrink or
-    // drop the hero so the body text fits; the vertical scroll below is the
-    // safety net when even that isn't enough. The enclosing pager Box centers
-    // short content, so no Arrangement.Center here — it conflicts with
-    // verticalScroll when content overflows.
-    BoxWithConstraints(modifier = modifier.fillMaxWidth()) {
-        val heroHeight = when {
-            maxHeight < 480.dp -> 0.dp
-            maxHeight < 620.dp -> 160.dp
-            else -> 232.dp
-        }
-        Column(
+    Column(
+        modifier = modifier
+            .fillMaxWidth()
+            .widthIn(max = 560.dp)
+            .verticalScroll(rememberScrollState())
+            .padding(horizontal = 42.dp, vertical = 8.dp),
+        horizontalAlignment = Alignment.CenterHorizontally,
+        verticalArrangement = Arrangement.spacedBy(12.dp),
+    ) {
+        Box(
             modifier = Modifier
                 .fillMaxWidth()
-                .widthIn(max = 560.dp)
-                .verticalScroll(rememberScrollState())
-                .padding(horizontal = 24.dp, vertical = 12.dp),
-            horizontalAlignment = Alignment.CenterHorizontally
+                .height(210.dp),
+            contentAlignment = Alignment.Center,
         ) {
-            if (heroHeight > 0.dp) {
-                Card(
-                    modifier = Modifier
-                        .fillMaxWidth()
-                        .height(heroHeight)
-                        .gradientBorder(shape = heroShape, isDarkTheme = isDarkTheme),
-                    shape = heroShape,
-                    colors = CardDefaults.cardColors(
-                        containerColor = if (transparentHero) Color.Transparent else MaterialTheme.colorScheme.surfaceContainer
-                    )
-                ) {
-                    val heroModifier = Modifier
-                        .fillMaxWidth()
-                        .height(heroHeight)
-                    Box(
-                        modifier = if (transparentHero) heroModifier else heroModifier.background(heroBrush),
-                        contentAlignment = Alignment.Center
-                    ) {
-                        heroContent()
-                    }
-                }
-
-                Spacer(modifier = Modifier.height(18.dp))
-            }
-
-            Card(
-                modifier = Modifier
-                    .fillMaxWidth()
-                    .gradientBorder(shape = bodyShape, isDarkTheme = isDarkTheme),
-                shape = bodyShape,
-                colors = CardDefaults.cardColors(
-                    containerColor = MaterialTheme.colorScheme.surfaceVariant
-                )
-            ) {
-                Column(
-                    modifier = Modifier.padding(horizontal = 24.dp, vertical = 22.dp),
-                    horizontalAlignment = Alignment.CenterHorizontally,
-                    verticalArrangement = Arrangement.spacedBy(14.dp)
-                ) {
-                    Text(
-                        text = title,
-                        style = MaterialTheme.typography.headlineMedium,
-                        textAlign = TextAlign.Center,
-                        color = MaterialTheme.colorScheme.onSurface
-                    )
-
-                    Text(
-                        text = description,
-                        style = MaterialTheme.typography.bodyLarge,
-                        textAlign = TextAlign.Center,
-                        color = MaterialTheme.colorScheme.onSurfaceVariant
-                    )
-
-                    content()
-                }
-            }
+            heroContent()
         }
+
+        Text(
+            text = title,
+            style = MaterialTheme.typography.headlineLarge.copy(
+                fontSize = 38.sp,
+                lineHeight = 40.sp,
+            ),
+            fontWeight = androidx.compose.ui.text.font.FontWeight.Bold,
+            textAlign = TextAlign.Center,
+            color = MaterialTheme.colorScheme.onSurface,
+        )
+
+        Text(
+            text = description,
+            style = MaterialTheme.typography.bodyLarge.copy(lineHeight = 25.sp),
+            textAlign = TextAlign.Center,
+            color = MaterialTheme.colorScheme.onSurfaceVariant,
+        )
+
+        Spacer(modifier = Modifier.height(8.dp))
+        content()
     }
 }
 
@@ -156,26 +95,45 @@ private fun FeatureHero(
     icon: ImageVector,
     title: String,
 ) {
-    val isDarkTheme = LocalBrand.current.isDark
     Box(
         modifier = Modifier.fillMaxWidth(),
         contentAlignment = Alignment.Center
     ) {
         Box(
             modifier = Modifier
-                .size(136.dp)
+                .size(176.dp)
                 .clip(CircleShape)
                 .background(
-                    MaterialTheme.colorScheme.primary.copy(alpha = if (isDarkTheme) 0.14f else 0.10f)
+                    Color(0xFF7B55F6).copy(alpha = 0.07f)
                 ),
             contentAlignment = Alignment.Center
         ) {
-            Icon(
-                imageVector = icon,
-                contentDescription = title,
-                modifier = Modifier.size(74.dp),
-                tint = MaterialTheme.colorScheme.primary
-            )
+            Box(
+                modifier = Modifier
+                    .size(128.dp)
+                    .clip(CircleShape)
+                    .background(Color(0xFF7B55F6).copy(alpha = 0.10f)),
+                contentAlignment = Alignment.Center,
+            ) {
+                Surface(
+                    modifier = Modifier.size(86.dp),
+                    shape = RoundedCornerShape(24.dp),
+                    color = MaterialTheme.colorScheme.surface.copy(alpha = 0.78f),
+                    border = BorderStroke(
+                        1.dp,
+                        MaterialTheme.colorScheme.outlineVariant.copy(alpha = 0.28f),
+                    ),
+                ) {
+                    Box(contentAlignment = Alignment.Center) {
+                        Icon(
+                            imageVector = icon,
+                            contentDescription = title,
+                            modifier = Modifier.size(46.dp),
+                            tint = Color(0xFF7B55F6),
+                        )
+                    }
+                }
+            }
         }
     }
 }

app/src/main/kotlin/com/hermesandroid/relay/ui/onboarding/OnboardingScreen.kt

@@ -1,10 +1,9 @@
 package com.hermesandroid.relay.ui.onboarding
 
-import android.content.Intent
-import android.net.Uri
-import androidx.compose.animation.AnimatedVisibility
-import androidx.compose.animation.fadeIn
-import androidx.compose.animation.fadeOut
+import android.Manifest
+import android.os.Build
+import androidx.activity.compose.rememberLauncherForActivityResult
+import androidx.activity.result.contract.ActivityResultContracts
 import androidx.compose.foundation.Image
 import androidx.compose.foundation.background
 import androidx.compose.foundation.clickable
@@ -18,19 +17,33 @@ import androidx.compose.foundation.layout.fillMaxWidth
 import androidx.compose.foundation.layout.height
 import androidx.compose.foundation.layout.padding
 import androidx.compose.foundation.layout.size
+import androidx.compose.foundation.layout.statusBarsPadding
 import androidx.compose.foundation.layout.width
+import androidx.compose.foundation.rememberScrollState
 import androidx.compose.foundation.shape.RoundedCornerShape
+import androidx.compose.foundation.shape.CircleShape
+import androidx.compose.foundation.verticalScroll
 import androidx.compose.foundation.pager.HorizontalPager
 import androidx.compose.foundation.pager.rememberPagerState
 import androidx.compose.material.icons.Icons
-import androidx.compose.material.icons.automirrored.outlined.MenuBook
+import androidx.compose.material.icons.automirrored.filled.ArrowBack
+import androidx.compose.material.icons.automirrored.filled.ArrowForward
+import androidx.compose.material.icons.filled.Bolt
+import androidx.compose.material.icons.filled.CheckCircle
+import androidx.compose.material.icons.filled.Dashboard
+import androidx.compose.material.icons.filled.Extension
+import androidx.compose.material.icons.filled.GraphicEq
+import androidx.compose.material.icons.filled.Lock
+import androidx.compose.material.icons.filled.Mic
+import androidx.compose.material.icons.filled.Notifications
+import androidx.compose.material.icons.filled.Person
+import androidx.compose.material.icons.filled.PhoneAndroid
 import androidx.compose.material.icons.filled.Settings
 import androidx.compose.material.icons.filled.Security
+import androidx.compose.material.icons.filled.Tune
 import androidx.compose.material.icons.outlined.Forum
-import androidx.compose.material.icons.outlined.RocketLaunch
 import androidx.compose.material.icons.outlined.Terminal
 import androidx.compose.material3.AlertDialog
-import androidx.compose.material3.Button
 import androidx.compose.material3.Icon
 import androidx.compose.material3.OutlinedButton
 import androidx.compose.material3.MaterialTheme
@@ -45,28 +58,64 @@ import androidx.compose.runtime.rememberCoroutineScope
 import androidx.compose.runtime.saveable.rememberSaveable
 import androidx.compose.runtime.setValue
 import androidx.compose.ui.Alignment
+import androidx.compose.ui.BiasAlignment
 import androidx.compose.ui.Modifier
 import androidx.compose.ui.draw.clip
+import androidx.compose.ui.graphics.Brush
+import androidx.compose.ui.graphics.Color
+import androidx.compose.ui.layout.ContentScale
 import androidx.compose.ui.platform.LocalConfiguration
 import androidx.compose.ui.platform.LocalContext
 import androidx.compose.ui.res.painterResource
 import androidx.compose.ui.res.stringResource
+import androidx.compose.ui.text.SpanStyle
+import androidx.compose.ui.text.buildAnnotatedString
 import androidx.compose.ui.text.font.FontWeight
-import androidx.compose.ui.text.style.TextDecoration
+import androidx.compose.ui.text.style.TextAlign
+import androidx.compose.ui.text.withStyle
 import androidx.compose.ui.tooling.preview.Preview
 import androidx.compose.ui.unit.dp
+import androidx.compose.ui.unit.sp
 import androidx.lifecycle.viewmodel.compose.viewModel
 import com.hermesandroid.relay.R
-import com.hermesandroid.relay.ui.components.SphereState
+import com.hermesandroid.relay.permissions.AppPermissionStatusProbe
 import com.hermesandroid.relay.ui.components.ConnectionWizard
-import com.hermesandroid.relay.ui.components.avatar.AvatarRenderState
-import com.hermesandroid.relay.ui.components.avatar.LocalAgentAvatar
 import com.hermesandroid.relay.ui.theme.HermesRelayTheme
 import com.hermesandroid.relay.viewmodel.ConnectionViewModel
 import kotlinx.coroutines.launch
 
-/** Page identifiers for dynamic onboarding flow. */
-private enum class OnboardingPage { Welcome, Chat, Manage, Power, Connect }
+/** Page identifiers for the standard-first onboarding flow. */
+internal enum class OnboardingPage { Welcome, Chat, Manage, Power, Connect, Permissions }
+
+internal val standardOnboardingPages = listOf(
+    OnboardingPage.Welcome,
+    OnboardingPage.Chat,
+    OnboardingPage.Manage,
+    OnboardingPage.Power,
+    OnboardingPage.Connect,
+    OnboardingPage.Permissions,
+)
+
+internal enum class OnboardingNotificationAction {
+    RequestPermission,
+    Finish,
+}
+
+internal fun onboardingNotificationAction(
+    sdkInt: Int,
+    notificationsPermitted: Boolean,
+): OnboardingNotificationAction {
+    return if (
+        sdkInt >= Build.VERSION_CODES.TIRAMISU &&
+        !notificationsPermitted
+    ) {
+        OnboardingNotificationAction.RequestPermission
+    } else {
+        OnboardingNotificationAction.Finish
+    }
+}
+
+private val OnboardingAccent = Color(0xFF7B55F6)
 
 /**
  * Standard-first onboarding:
@@ -112,21 +161,23 @@ fun OnboardingScreen(
      */
     onTryDemo: () -> Unit = {},
 ) {
-    val pages = remember {
-        buildList {
-            add(OnboardingPage.Welcome)
-            add(OnboardingPage.Chat)
-            add(OnboardingPage.Manage)
-            add(OnboardingPage.Power)
-            add(OnboardingPage.Connect)
-        }
-    }
+    val pages = standardOnboardingPages
     val pageCount = pages.size
     val lastPage = pageCount - 1
 
     val pagerState = rememberPagerState(pageCount = { pageCount })
     val coroutineScope = rememberCoroutineScope()
     var showSkipConfirm by rememberSaveable { mutableStateOf(false) }
+    val context = LocalContext.current
+    var notificationsPermitted by remember {
+        mutableStateOf(AppPermissionStatusProbe.snapshot(context).notificationsPermitted)
+    }
+    val notificationPermissionLauncher = rememberLauncherForActivityResult(
+        ActivityResultContracts.RequestPermission(),
+    ) { granted ->
+        notificationsPermitted =
+            granted || AppPermissionStatusProbe.snapshot(context).notificationsPermitted
+    }
 
     Surface(
         modifier = Modifier.fillMaxSize(),
@@ -156,22 +207,35 @@ fun OnboardingScreen(
         }
 
         Column(modifier = Modifier.fillMaxSize()) {
-            // Top bar with Skip — only on informational pages, not the wizard
-            // (which has its own "Skip for now" affordance).
-            Row(
-                modifier = Modifier
-                    .fillMaxWidth()
-                    .padding(horizontal = 16.dp, vertical = 12.dp),
-                horizontalArrangement = Arrangement.End,
-                verticalAlignment = Alignment.CenterVertically
+            val currentPage = pagerState.currentPage
+            val currentPageType = pages[currentPage]
+
+            // The selected welcome frame has no toolbar. Later information
+            // pages keep quiet navigation without reserving space above it.
+            if (
+                currentPageType == OnboardingPage.Chat ||
+                currentPageType == OnboardingPage.Manage ||
+                currentPageType == OnboardingPage.Power
             ) {
-                if (pages[pagerState.currentPage] != OnboardingPage.Connect) {
+                Row(
+                    modifier = Modifier
+                        .fillMaxWidth()
+                        .statusBarsPadding()
+                        .padding(horizontal = 16.dp, vertical = 4.dp),
+                    horizontalArrangement = Arrangement.SpaceBetween,
+                    verticalAlignment = Alignment.CenterVertically,
+                ) {
+                    TextButton(
+                        onClick = {
+                            coroutineScope.launch { pagerState.animateScrollToPage(currentPage - 1) }
+                        },
+                    ) {
+                        Icon(Icons.AutoMirrored.Filled.ArrowBack, contentDescription = null)
+                        Spacer(Modifier.width(6.dp))
+                        Text(stringResource(R.string.onboarding_back))
+                    }
                     TextButton(onClick = { showSkipConfirm = true }) {
-                        Text(
-                            text = stringResource(R.string.onboarding_skip),
-                            style = MaterialTheme.typography.bodyMedium,
-                            color = MaterialTheme.colorScheme.onSurfaceVariant
-                        )
+                        Text(stringResource(R.string.onboarding_skip))
                     }
                 }
             }
@@ -179,7 +243,13 @@ fun OnboardingScreen(
             // Pager content
             HorizontalPager(
                 state = pagerState,
-                modifier = Modifier.weight(1f)
+                modifier = Modifier.weight(1f),
+                // Connect and permission setup advance only through their
+                // explicit actions. This keeps the post-connect setup page
+                // unreachable until the wizard reports a successful save.
+                userScrollEnabled =
+                    currentPageType != OnboardingPage.Connect &&
+                    currentPageType != OnboardingPage.Permissions,
             ) { pageIndex ->
                 Box(
                     modifier = Modifier.fillMaxSize(),
@@ -194,243 +264,332 @@ fun OnboardingScreen(
                         )
                         OnboardingPage.Connect -> ConnectPage(
                             connectionViewModel = connectionViewModel,
-                            onComplete = onComplete,
+                            onComplete = {
+                                notificationsPermitted =
+                                    AppPermissionStatusProbe.snapshot(context).notificationsPermitted
+                                coroutineScope.launch {
+                                    pagerState.animateScrollToPage(
+                                        pages.indexOf(OnboardingPage.Permissions),
+                                    )
+                                }
+                            },
                             onManageSignIn = onManageSignIn,
                             onSkip = { showSkipConfirm = true },
                             onTryDemo = onTryDemo,
                         )
+                        OnboardingPage.Permissions -> PermissionSetupPage(
+                            notificationAction = onboardingNotificationAction(
+                                sdkInt = Build.VERSION.SDK_INT,
+                                notificationsPermitted = notificationsPermitted,
+                            ),
+                            onEnableNotifications = {
+                                notificationPermissionLauncher.launch(
+                                    Manifest.permission.POST_NOTIFICATIONS,
+                                )
+                            },
+                            onReviewPermissions = onOpenPermissions,
+                            onFinish = onComplete,
+                        )
                     }
                 }
             }
 
             // Bottom navigation only on informational pages — the wizard
             // owns its own back/pair affordances.
-            if (pages[pagerState.currentPage] != OnboardingPage.Connect) {
-                // Short viewports get a tighter footer so more of the pager
-                // content stays above the fold; indicator + Back/Next remain
-                // pinned outside the (scrollable) pager pages either way.
+            if (
+                currentPageType != OnboardingPage.Connect &&
+                currentPageType != OnboardingPage.Permissions
+            ) {
                 val compactHeight = LocalConfiguration.current.screenHeightDp < 620
                 Column(
                     modifier = Modifier
                         .fillMaxWidth()
-                        .padding(horizontal = 32.dp)
-                        .padding(bottom = if (compactHeight) 16.dp else 48.dp),
-                    horizontalAlignment = Alignment.CenterHorizontally
+                        .padding(horizontal = 42.dp)
+                        .padding(bottom = if (compactHeight) 10.dp else 20.dp),
+                    horizontalAlignment = Alignment.CenterHorizontally,
+                    verticalArrangement = Arrangement.spacedBy(if (compactHeight) 8.dp else 12.dp),
                 ) {
-                    PageIndicator(
-                        pageCount = pageCount,
-                        currentPage = pagerState.currentPage
+                    GradientOnboardingButton(
+                        label = when {
+                            currentPage == 0 -> stringResource(R.string.onboarding_get_started)
+                            currentPage == lastPage - 1 -> stringResource(R.string.onboarding_connect)
+                            else -> stringResource(R.string.onboarding_next)
+                        },
+                        onClick = {
+                            coroutineScope.launch {
+                                pagerState.animateScrollToPage((currentPage + 1).coerceAtMost(lastPage))
+                            }
+                        },
                     )
 
-                    Spacer(modifier = Modifier.height(if (compactHeight) 12.dp else 24.dp))
-
-                    Row(
-                        modifier = Modifier.fillMaxWidth(),
-                        horizontalArrangement = Arrangement.SpaceBetween,
-                        verticalAlignment = Alignment.CenterVertically
-                    ) {
-                        AnimatedVisibility(
-                            visible = pagerState.currentPage > 0,
-                            enter = fadeIn(),
-                            exit = fadeOut()
-                        ) {
-                            TextButton(
-                                onClick = {
-                                    coroutineScope.launch {
-                                        pagerState.animateScrollToPage(pagerState.currentPage - 1)
-                                    }
-                                }
-                            ) {
-                                Text(text = stringResource(R.string.onboarding_back))
-                            }
-                        }
-                        if (pagerState.currentPage == 0) {
-                            Spacer(modifier = Modifier.width(1.dp))
-                        }
-
-                        Button(
-                            onClick = {
-                                coroutineScope.launch {
-                                    pagerState.animateScrollToPage(
-                                        (pagerState.currentPage + 1).coerceAtMost(lastPage)
-                                    )
-                                }
-                            }
-                        ) {
+                    if (currentPage == 0) {
+                        TextButton(onClick = onTryDemo) {
                             Text(
-                                text = if (pagerState.currentPage == lastPage - 1) {
-                                    stringResource(R.string.onboarding_connect)
-                                } else {
-                                    stringResource(R.string.onboarding_next)
-                                }
+                                text = stringResource(R.string.chat_try_demo),
+                                color = OnboardingAccent,
+                                style = MaterialTheme.typography.labelLarge,
                             )
                         }
                     }
+
+                    SegmentedOnboardingProgress(
+                        pageCount = pageCount,
+                        currentPage = currentPage,
+                    )
+                    Text(
+                        text = stringResource(R.string.onboarding_step_count, currentPage + 1, pageCount),
+                        style = MaterialTheme.typography.bodySmall,
+                        color = MaterialTheme.colorScheme.onSurfaceVariant.copy(alpha = 0.68f),
+                    )
                 }
             }
         }
     }
 }
 
+@Composable
+private fun GradientOnboardingButton(
+    label: String,
+    onClick: () -> Unit,
+) {
+    Surface(
+        modifier = Modifier
+            .fillMaxWidth()
+            .height(52.dp)
+            .clip(RoundedCornerShape(14.dp))
+            .clickable(onClick = onClick),
+        color = Color.Transparent,
+        shape = RoundedCornerShape(14.dp),
+    ) {
+        Row(
+            modifier = Modifier
+                .fillMaxSize()
+                .background(
+                    Brush.horizontalGradient(
+                        listOf(Color(0xFF7047F5), Color(0xFF6446F0)),
+                    ),
+                )
+                .padding(horizontal = 22.dp),
+            verticalAlignment = Alignment.CenterVertically,
+            horizontalArrangement = Arrangement.Center,
+        ) {
+            Spacer(Modifier.width(24.dp))
+            Text(
+                text = label,
+                style = MaterialTheme.typography.titleMedium,
+                fontWeight = FontWeight.SemiBold,
+                color = Color.White,
+                modifier = Modifier.weight(1f),
+                textAlign = TextAlign.Center,
+            )
+            Icon(
+                imageVector = Icons.AutoMirrored.Filled.ArrowForward,
+                contentDescription = null,
+                tint = Color.White,
+                modifier = Modifier.size(24.dp),
+            )
+        }
+    }
+}
+
+@Composable
+private fun SegmentedOnboardingProgress(
+    pageCount: Int,
+    currentPage: Int,
+) {
+    Row(
+        modifier = Modifier
+            .fillMaxWidth()
+            .padding(horizontal = 36.dp),
+        horizontalArrangement = Arrangement.spacedBy(8.dp),
+    ) {
+        repeat(pageCount) { index ->
+            Box(
+                modifier = Modifier
+                    .weight(1f)
+                    .height(4.dp)
+                    .clip(RoundedCornerShape(999.dp))
+                    .background(
+                        if (index == currentPage) {
+                            OnboardingAccent
+                        } else {
+                            MaterialTheme.colorScheme.onSurfaceVariant.copy(alpha = 0.20f)
+                        },
+                    ),
+            )
+        }
+    }
+}
+
 @Composable
 private fun WelcomePage() {
-    val context = LocalContext.current
-    OnboardingPage(
-        icon = Icons.Outlined.RocketLaunch,
-        title = stringResource(R.string.onboarding_welcome_title),
-        description = stringResource(R.string.onboarding_welcome_description),
-        transparentHero = true,
-        heroContent = {
-            Box(modifier = Modifier.fillMaxSize()) {
-                LocalAgentAvatar.current.Render(
-                    state = AvatarRenderState(
-                        state = SphereState.Idle,
-                        intensity = 0.12f,
-                    ),
-                    modifier = Modifier
-                        .fillMaxSize()
-                        .padding(horizontal = 4.dp, vertical = 2.dp),
-                )
-
-                Box(
-                    modifier = Modifier
-                        .align(Alignment.TopStart)
-                        .padding(16.dp)
-                        .clip(RoundedCornerShape(999.dp))
-                        .background(MaterialTheme.colorScheme.surface.copy(alpha = 0.80f))
-                        .padding(horizontal = 12.dp, vertical = 6.dp)
-                ) {
-                    Text(
-                        text = stringResource(R.string.onboarding_welcome_badge),
-                        style = MaterialTheme.typography.labelLarge,
-                        color = MaterialTheme.colorScheme.onSurface,
-                    )
-                }
-
-                Row(
-                    modifier = Modifier
-                        .align(Alignment.BottomCenter)
-                        .padding(bottom = 6.dp)
-                        .clip(RoundedCornerShape(999.dp))
-                        .background(MaterialTheme.colorScheme.surface.copy(alpha = 0.86f))
-                        .padding(start = 7.dp, end = 12.dp, top = 5.dp, bottom = 5.dp),
-                    verticalAlignment = Alignment.CenterVertically,
-                    horizontalArrangement = Arrangement.spacedBy(8.dp),
-                ) {
-                    Image(
-                        painter = painterResource(R.drawable.ic_launcher_foreground),
-                        contentDescription = stringResource(R.string.onboarding_hermes_logo),
-                        modifier = Modifier.size(30.dp)
-                    )
-                    Text(
-                        text = "Hermes-Relay",
-                        style = MaterialTheme.typography.labelLarge,
-                        fontWeight = FontWeight.SemiBold,
-                        color = MaterialTheme.colorScheme.onSurface,
-                    )
-                }
-            }
-        }
+    val titleParts = stringResource(R.string.onboarding_welcome_title).split("\n", limit = 2)
+    Column(
+        modifier = Modifier
+            .fillMaxSize()
+            .verticalScroll(rememberScrollState())
+            .padding(horizontal = 28.dp),
+        horizontalAlignment = Alignment.CenterHorizontally,
     ) {
-        Column(
-            modifier = Modifier.fillMaxWidth(),
-            verticalArrangement = Arrangement.spacedBy(8.dp),
+        Box(
+            modifier = Modifier
+                .fillMaxWidth()
+                .height(380.dp),
+            contentAlignment = Alignment.Center,
         ) {
-            SetupPathSummary(
-                label = stringResource(R.string.onboarding_chat_manage_label),
-                description = stringResource(R.string.onboarding_chat_manage_description),
-            )
-            SetupPathSummary(
-                label = stringResource(R.string.onboarding_power_tools_label),
-                description = stringResource(R.string.onboarding_power_tools_description),
+            Image(
+                painter = painterResource(R.drawable.onboarding_hero_option1),
+                contentDescription = stringResource(R.string.onboarding_hermes_logo),
+                modifier = Modifier.fillMaxSize(),
+                contentScale = ContentScale.Crop,
+                alignment = BiasAlignment(horizontalBias = 0f, verticalBias = -0.5f),
             )
         }
 
         Text(
-            text = stringResource(R.string.onboarding_setup_guide_hint),
-            style = MaterialTheme.typography.bodySmall,
-            color = MaterialTheme.colorScheme.onSurfaceVariant,
+            text = buildAnnotatedString {
+                append(titleParts.first())
+                if (titleParts.size > 1) append("\n")
+                withStyle(SpanStyle(color = OnboardingAccent)) {
+                    if (titleParts.size > 1) append(titleParts[1])
+                }
+            },
+            color = MaterialTheme.colorScheme.onBackground,
+            fontSize = 38.sp,
+            lineHeight = 40.sp,
+            fontWeight = FontWeight.Bold,
+            textAlign = TextAlign.Center,
         )
-
-        Row(
-            modifier = Modifier.fillMaxWidth(),
-            horizontalArrangement = Arrangement.spacedBy(10.dp)
-        ) {
-            OutlinedButton(
-                onClick = {
-                    context.startActivity(
-                        Intent(Intent.ACTION_VIEW, Uri.parse("https://hermes-relay.dev/docs/guide/getting-started"))
-                    )
-                },
-                modifier = Modifier.weight(1f)
-            ) {
-                Icon(
-                    imageVector = Icons.AutoMirrored.Outlined.MenuBook,
-                    contentDescription = null,
-                    modifier = Modifier.size(16.dp)
-                )
-                Spacer(modifier = Modifier.width(6.dp))
-                Text(stringResource(R.string.onboarding_setup_guide))
-            }
-
-            OutlinedButton(
-                onClick = {
-                    context.startActivity(
-                        Intent(Intent.ACTION_VIEW, Uri.parse("https://hermes-agent.nousresearch.com/docs"))
-                    )
-                },
-                modifier = Modifier.weight(1f)
-            ) {
-                Icon(
-                    imageVector = Icons.AutoMirrored.Outlined.MenuBook,
-                    contentDescription = null,
-                    modifier = Modifier.size(16.dp)
-                )
-                Spacer(modifier = Modifier.width(6.dp))
-                Text(stringResource(R.string.onboarding_hermes_docs))
-            }
-        }
-
+        Spacer(Modifier.height(14.dp))
         Text(
-            text = stringResource(R.string.onboarding_api_server_docs),
-            style = MaterialTheme.typography.bodySmall.copy(
-                textDecoration = TextDecoration.Underline
+            text = stringResource(R.string.onboarding_welcome_description),
+            style = MaterialTheme.typography.bodyLarge.copy(
+                lineHeight = 27.sp,
+                fontWeight = FontWeight.Normal,
             ),
-            color = MaterialTheme.colorScheme.primary,
-            modifier = Modifier.clickable {
-                context.startActivity(Intent(Intent.ACTION_VIEW, Uri.parse("https://hermes-agent.nousresearch.com/docs/user-guide/features/api-server")))
-            }
+            color = MaterialTheme.colorScheme.onSurfaceVariant,
+            textAlign = TextAlign.Center,
         )
+        Spacer(Modifier.height(24.dp))
+        WelcomeCapabilityRow(
+            icon = Icons.Filled.Dashboard,
+            label = stringResource(R.string.onboarding_chat_manage_label),
+            description = stringResource(R.string.onboarding_chat_manage_description),
+        )
+        Spacer(Modifier.height(14.dp))
+        WelcomeCapabilityRow(
+            icon = Icons.Filled.Bolt,
+            label = stringResource(R.string.onboarding_power_tools_label),
+            description = stringResource(R.string.onboarding_power_tools_description),
+        )
+        Spacer(Modifier.height(12.dp))
+    }
+}
+
+@Composable
+private fun WelcomeCapabilityRow(
+    icon: androidx.compose.ui.graphics.vector.ImageVector,
+    label: String,
+    description: String,
+) {
+    Row(
+        modifier = Modifier
+            .fillMaxWidth()
+            .padding(horizontal = 47.dp),
+        verticalAlignment = Alignment.CenterVertically,
+        horizontalArrangement = Arrangement.spacedBy(30.dp),
+    ) {
+        Box {
+            Surface(
+                modifier = Modifier.size(58.dp),
+                shape = RoundedCornerShape(16.dp),
+                color = MaterialTheme.colorScheme.surface.copy(alpha = 0.42f),
+                border = androidx.compose.foundation.BorderStroke(
+                    1.dp,
+                    MaterialTheme.colorScheme.outlineVariant.copy(alpha = 0.24f),
+                ),
+            ) {
+                Box(contentAlignment = Alignment.Center) {
+                    Icon(
+                        imageVector = icon,
+                        contentDescription = null,
+                        modifier = Modifier.size(30.dp),
+                        tint = OnboardingAccent,
+                    )
+                }
+            }
+            Box(
+                modifier = Modifier
+                    .align(Alignment.TopEnd)
+                    .size(8.dp)
+                    .clip(CircleShape)
+                    .background(Color(0xFF57E389)),
+            )
+        }
+        Column(
+            modifier = Modifier.weight(1f),
+            verticalArrangement = Arrangement.spacedBy(3.dp),
+        ) {
+            Text(
+                text = label,
+                style = MaterialTheme.typography.titleMedium,
+                fontWeight = FontWeight.Bold,
+                color = MaterialTheme.colorScheme.onSurface,
+            )
+            Text(
+                text = description,
+                style = MaterialTheme.typography.bodyMedium,
+                color = MaterialTheme.colorScheme.onSurfaceVariant,
+            )
+        }
     }
 }
 
 @Composable
 private fun SetupPathSummary(
+    icon: androidx.compose.ui.graphics.vector.ImageVector,
     label: String,
     description: String,
 ) {
-    Surface(
-        modifier = Modifier.fillMaxWidth(),
-        shape = RoundedCornerShape(16.dp),
-        color = MaterialTheme.colorScheme.surface.copy(alpha = 0.42f),
+    Row(
+        modifier = Modifier
+            .fillMaxWidth()
+            .padding(vertical = 4.dp),
+        verticalAlignment = Alignment.CenterVertically,
+        horizontalArrangement = Arrangement.spacedBy(16.dp),
     ) {
-        Row(
-            modifier = Modifier.padding(horizontal = 14.dp, vertical = 10.dp),
-            verticalAlignment = Alignment.Top,
-            horizontalArrangement = Arrangement.spacedBy(12.dp),
+        Surface(
+            modifier = Modifier.size(48.dp),
+            shape = RoundedCornerShape(14.dp),
+            color = MaterialTheme.colorScheme.surface.copy(alpha = 0.42f),
+            border = androidx.compose.foundation.BorderStroke(
+                1.dp,
+                MaterialTheme.colorScheme.outlineVariant.copy(alpha = 0.22f),
+            ),
+        ) {
+            Box(contentAlignment = Alignment.Center) {
+                Icon(
+                    imageVector = icon,
+                    contentDescription = null,
+                    modifier = Modifier.size(25.dp),
+                    tint = OnboardingAccent,
+                )
+            }
+        }
+        Column(
+            modifier = Modifier.weight(1f),
+            verticalArrangement = Arrangement.spacedBy(2.dp),
         ) {
             Text(
                 text = label,
-                style = MaterialTheme.typography.labelLarge,
-                fontWeight = FontWeight.SemiBold,
-                color = MaterialTheme.colorScheme.primary,
-                modifier = Modifier.width(96.dp),
+                style = MaterialTheme.typography.titleSmall,
+                fontWeight = FontWeight.Bold,
+                color = MaterialTheme.colorScheme.onSurface,
             )
             Text(
                 text = description,
                 style = MaterialTheme.typography.bodySmall,
                 color = MaterialTheme.colorScheme.onSurfaceVariant,
-                modifier = Modifier.weight(1f),
             )
         }
     }
@@ -448,14 +607,17 @@ private fun ChatPage() {
             verticalArrangement = Arrangement.spacedBy(8.dp),
         ) {
             SetupPathSummary(
+                icon = Icons.Filled.Bolt,
                 label = stringResource(R.string.onboarding_streaming_label),
                 description = stringResource(R.string.onboarding_streaming_description),
             )
             SetupPathSummary(
+                icon = Icons.Filled.Person,
                 label = stringResource(R.string.onboarding_profiles_label),
                 description = stringResource(R.string.onboarding_profiles_description),
             )
             SetupPathSummary(
+                icon = Icons.Filled.Mic,
                 label = stringResource(R.string.onboarding_voice_label),
                 description = stringResource(R.string.onboarding_voice_description),
             )
@@ -475,14 +637,17 @@ private fun ManagePage() {
             verticalArrangement = Arrangement.spacedBy(8.dp),
         ) {
             SetupPathSummary(
+                icon = Icons.Filled.Tune,
                 label = stringResource(R.string.onboarding_control_label),
                 description = stringResource(R.string.onboarding_control_description),
             )
             SetupPathSummary(
+                icon = Icons.Filled.Extension,
                 label = stringResource(R.string.onboarding_skills_hub_label),
                 description = stringResource(R.string.onboarding_skills_hub_description),
             )
             SetupPathSummary(
+                icon = Icons.Filled.Lock,
                 label = stringResource(R.string.onboarding_one_sign_in_label),
                 description = stringResource(R.string.onboarding_one_sign_in_description),
             )
@@ -504,14 +669,17 @@ private fun PowerToolsPage(
             verticalArrangement = Arrangement.spacedBy(8.dp),
         ) {
             SetupPathSummary(
+                icon = Icons.Outlined.Terminal,
                 label = stringResource(R.string.onboarding_terminal_label),
                 description = stringResource(R.string.onboarding_terminal_description),
             )
             SetupPathSummary(
+                icon = Icons.Filled.PhoneAndroid,
                 label = stringResource(R.string.onboarding_bridge_label),
                 description = stringResource(R.string.onboarding_bridge_description),
             )
             SetupPathSummary(
+                icon = Icons.Filled.GraphicEq,
                 label = stringResource(R.string.onboarding_realtime_label),
                 description = stringResource(R.string.onboarding_realtime_description),
             )
@@ -531,6 +699,80 @@ private fun PowerToolsPage(
     }
 }
 
+@Composable
+internal fun PermissionSetupPage(
+    notificationAction: OnboardingNotificationAction,
+    onEnableNotifications: () -> Unit,
+    onReviewPermissions: () -> Unit,
+    onFinish: () -> Unit,
+) {
+    OnboardingPage(
+        icon = Icons.Filled.Security,
+        title = stringResource(R.string.onboarding_finish_setup_title),
+        description = stringResource(R.string.onboarding_finish_setup_description),
+    ) {
+        Column(
+            modifier = Modifier.fillMaxWidth(),
+            verticalArrangement = Arrangement.spacedBy(10.dp),
+        ) {
+            SetupPathSummary(
+                icon = Icons.Filled.CheckCircle,
+                label = stringResource(R.string.perms_chat_and_manage),
+                description = stringResource(R.string.onboarding_chat_manage_ready),
+            )
+            SetupPathSummary(
+                icon = Icons.Filled.Notifications,
+                label = stringResource(R.string.onboarding_chat_alerts),
+                description = if (
+                    notificationAction == OnboardingNotificationAction.Finish
+                ) {
+                    stringResource(R.string.onboarding_chat_alerts_ready)
+                } else {
+                    stringResource(R.string.onboarding_chat_alerts_description)
+                },
+            )
+            SetupPathSummary(
+                icon = Icons.Filled.Tune,
+                label = stringResource(R.string.onboarding_optional_features),
+                description = stringResource(R.string.onboarding_optional_features_description),
+            )
+
+            OutlinedButton(
+                onClick = onReviewPermissions,
+                modifier = Modifier.fillMaxWidth(),
+            ) {
+                Icon(
+                    imageVector = Icons.Filled.Security,
+                    contentDescription = null,
+                    modifier = Modifier.size(16.dp),
+                )
+                Spacer(modifier = Modifier.width(6.dp))
+                Text(stringResource(R.string.onboarding_review_optional_permissions))
+            }
+
+            Spacer(Modifier.height(2.dp))
+
+            if (notificationAction == OnboardingNotificationAction.RequestPermission) {
+                GradientOnboardingButton(
+                    label = stringResource(R.string.onboarding_enable_chat_alerts),
+                    onClick = onEnableNotifications,
+                )
+                TextButton(
+                    onClick = onFinish,
+                    modifier = Modifier.fillMaxWidth(),
+                ) {
+                    Text(stringResource(R.string.onboarding_not_now))
+                }
+            } else {
+                GradientOnboardingButton(
+                    label = stringResource(R.string.onboarding_finish),
+                    onClick = onFinish,
+                )
+            }
+        }
+    }
+}
+
 @Composable
 private fun ConnectPage(
     connectionViewModel: ConnectionViewModel,

app/src/main/kotlin/com/hermesandroid/relay/ui/screens/AboutScreen.kt

@@ -206,10 +206,16 @@ fun AboutScreen(
                                 val remaining = 7 - versionTapCount
                                 when {
                                     remaining <= 0 -> {
-                                        scope.launch { FeatureFlags.unlockDevOptions(context) }
-                                        Toast.makeText(context, devUnlockedMsg, Toast.LENGTH_SHORT).show()
                                         versionTapCount = 0
-                                        onUnlockDeveloperOptions()
+                                        scope.launch {
+                                            FeatureFlags.unlockDevOptions(context)
+                                            Toast.makeText(
+                                                context,
+                                                devUnlockedMsg,
+                                                Toast.LENGTH_SHORT,
+                                            ).show()
+                                            onUnlockDeveloperOptions()
+                                        }
                                     }
                                     remaining <= 3 -> {
                                         val tapsMsg = context.getString(R.string.about_taps_to_unlock, remaining)
@@ -432,7 +438,7 @@ fun AboutScreen(
                     // Privacy policy link
                     OutlinedButton(
                         onClick = {
-                            val intent = Intent(Intent.ACTION_VIEW, Uri.parse("https://github.com/Codename-11/hermes-relay/blob/main/docs/privacy.md"))
+                            val intent = Intent(Intent.ACTION_VIEW, Uri.parse("https://hermes-relay.dev/privacy.html"))
                             context.startActivity(intent)
                         },
                         modifier = Modifier.fillMaxWidth()

app/src/main/kotlin/com/hermesandroid/relay/ui/screens/AppearanceSettingsScreen.kt

@@ -460,6 +460,7 @@ fun AppearanceSettingsScreen(
             ) {
                 val animEnabled by connectionViewModel.animationEnabled.collectAsState()
                 val animBehindChat by connectionViewModel.animationBehindChat.collectAsState()
+                val imageGenerationStyle by connectionViewModel.imageGenerationStyle.collectAsState()
 
                 Column(
                     modifier = Modifier.padding(16.dp),
@@ -526,6 +527,48 @@ fun AppearanceSettingsScreen(
                             color = MaterialTheme.colorScheme.onSurfaceVariant
                         )
                     }
+
+                    HorizontalDivider()
+
+                    Text(
+                        text = stringResource(R.string.appearance_image_generation_style),
+                        style = MaterialTheme.typography.bodyMedium,
+                    )
+                    Text(
+                        text = stringResource(R.string.appearance_image_generation_style_desc),
+                        style = MaterialTheme.typography.bodySmall,
+                        color = MaterialTheme.colorScheme.onSurfaceVariant,
+                    )
+                    val imageStyleOptions = listOf(
+                        "rotate" to stringResource(R.string.appearance_image_generation_rotate),
+                        "grid" to stringResource(R.string.appearance_image_generation_grid),
+                        "sphere" to stringResource(R.string.appearance_image_generation_sphere),
+                        "nodes" to stringResource(R.string.appearance_image_generation_nodes),
+                    )
+                    FlowRow(
+                        modifier = Modifier.fillMaxWidth(),
+                        horizontalArrangement = Arrangement.spacedBy(8.dp),
+                        verticalArrangement = Arrangement.spacedBy(8.dp),
+                    ) {
+                        imageStyleOptions.forEach { (id, label) ->
+                            FilterChip(
+                                selected = imageGenerationStyle == id,
+                                onClick = { connectionViewModel.setImageGenerationStyle(id) },
+                                label = { Text(label) },
+                                leadingIcon = if (imageGenerationStyle == id) {
+                                    {
+                                        Icon(
+                                            imageVector = Icons.Filled.Check,
+                                            contentDescription = null,
+                                            modifier = Modifier.size(18.dp),
+                                        )
+                                    }
+                                } else {
+                                    null
+                                },
+                            )
+                        }
+                    }
                 }
             }
 

app/src/main/kotlin/com/hermesandroid/relay/ui/screens/ChatScreen.kt

@@ -115,6 +115,7 @@ import androidx.compose.ui.unit.dp
 import androidx.compose.ui.zIndex
 import com.hermesandroid.relay.R
 import com.hermesandroid.relay.ui.theme.radialNavyBackground
+import com.hermesandroid.relay.network.upstream.ApiModelOption
 import com.hermesandroid.relay.network.upstream.ChatMode
 import com.hermesandroid.relay.network.upstream.GatewayAvailability
 import com.hermesandroid.relay.network.relay.RelayVoiceClient
@@ -195,8 +196,11 @@ import com.hermesandroid.relay.ui.components.ThinkingMatrixColor
 import com.hermesandroid.relay.ui.components.ThinkingMatrixPattern
 import com.hermesandroid.relay.ui.components.SessionDrawerContent
 import com.hermesandroid.relay.ui.components.SlashCommand
+import com.hermesandroid.relay.ui.components.StreamingDots
 import com.hermesandroid.relay.ui.components.SubagentLane
 import com.hermesandroid.relay.ui.components.ToolProgressCard
+import com.hermesandroid.relay.ui.components.isVisibleForToolDisplay
+import com.hermesandroid.relay.ui.components.showsImageGenerationPlaceholder
 import com.hermesandroid.relay.ui.components.VoiceModeOverlay
 import com.hermesandroid.relay.ui.LocalSnackbarHost
 import com.hermesandroid.relay.ui.showHumanError
@@ -208,7 +212,10 @@ import androidx.compose.ui.text.style.TextAlign
 import kotlin.math.roundToInt
 import com.hermesandroid.relay.viewmodel.ChatViewModel
 import com.hermesandroid.relay.viewmodel.ChatConnectState
+import com.hermesandroid.relay.viewmodel.ChatRuntimeStatus
+import com.hermesandroid.relay.viewmodel.ChatTransportReadiness
 import com.hermesandroid.relay.viewmodel.ConnectionViewModel
+import com.hermesandroid.relay.viewmodel.resolveChatRuntimeStatus
 import com.hermesandroid.relay.viewmodel.VoiceViewModel
 import com.hermesandroid.relay.voice.VoiceOverlayHost
 import com.hermesandroid.relay.voice.VoiceOverlaySession
@@ -220,6 +227,23 @@ import kotlinx.coroutines.delay
 import kotlinx.coroutines.launch
 
 private const val DEFAULT_CHAR_LIMIT = 4096
+
+internal fun resolveChatHeaderSubtitle(
+    isStreaming: Boolean,
+    statusText: String,
+    projectName: String?,
+    personalityName: String?,
+    modelName: String?,
+): String = if (isStreaming) {
+    statusText
+} else {
+    listOfNotNull(
+        projectName?.takeIf { it.isNotBlank() },
+        personalityName?.takeIf { it.isNotBlank() },
+        modelName?.takeIf { it.isNotBlank() },
+    ).joinToString(" \u00B7 ").ifBlank { statusText }
+}
+
 /**
  * A same-author run breaks into a new visual group once the gap to the
  * neighboring message exceeds this — so a conversation resumed after a pause
@@ -521,6 +545,7 @@ fun ChatScreen(
     val standardVoiceAvailability by connectionViewModel.standardVoiceAvailability.collectAsState()
     val standardVoiceSignInRouteHint by
         connectionViewModel.standardVoiceSignInRouteHint.collectAsState()
+    val dashboardRouteMovedHint by connectionViewModel.dashboardRouteMovedHint.collectAsState()
     val apiReachable by connectionViewModel.apiServerReachable.collectAsState()
     val chatMode by connectionViewModel.chatMode.collectAsState()
     val error by chatViewModel.error.collectAsState()
@@ -539,6 +564,7 @@ fun ChatScreen(
     // and is consumed by the AgentInfoSheet for the Profile section. The list
     // of available profiles itself now lives entirely inside the sheet.
     val selectedProfile by connectionViewModel.selectedProfile.collectAsState()
+    val effectiveProfile by connectionViewModel.effectiveDisplayProfile.collectAsState()
     // Server-advertised profile catalog — used to locate the "default" profile
     // so the header can render its description/model when no explicit pick
     // has been made (the /api/config fallback is more useful than the bare
@@ -547,11 +573,12 @@ fun ChatScreen(
     val profileDisplayAlias by connectionViewModel.profileDisplayAlias.collectAsState()
     val activeConnection by connectionViewModel.activeConnection.collectAsState()
     val serverModelName by chatViewModel.serverModelName.collectAsState()
-    val availableModels by chatViewModel.availableModels.collectAsState()
+    val apiModelOptions by chatViewModel.apiModelOptions.collectAsState()
     val modelProviders by chatViewModel.modelProviders.collectAsState()
     val modelOptionsRefreshing by chatViewModel.modelOptionsRefreshing.collectAsState()
     val selectedModelOverride by chatViewModel.selectedModelOverride.collectAsState()
     val gatewayCurrentModel by chatViewModel.gatewayCurrentModel.collectAsState()
+    val gatewayProjectName by chatViewModel.gatewayProjectName.collectAsState()
     val selectedReasoningEffort by chatViewModel.selectedReasoningEffort.collectAsState()
     val showThinking by connectionViewModel.showThinking.collectAsState()
     val toolDisplay by connectionViewModel.toolDisplay.collectAsState()
@@ -583,7 +610,7 @@ fun ChatScreen(
     val voiceHintSeen by connectionViewModel.voiceHintSeen.collectAsState()
     // Whether the NEXT turn would ride the gateway transport — gates the
     // "Edit & resend" menu entry (conversation rewind needs the gateway).
-    // Per-turn steerability comes from [steerableTurn], which also covers
+    // Per-turn correction availability comes from [steerableTurn], which also covers
     // the preflight-SSE-fallback window.
     val streamingEndpointPref by connectionViewModel.streamingEndpoint.collectAsState()
     val chatServerCapabilities by connectionViewModel.serverCapabilities.collectAsState()
@@ -636,9 +663,24 @@ fun ChatScreen(
     // Animation settings
     val animationEnabled by connectionViewModel.animationEnabled.collectAsState()
     val animationBehindChat by connectionViewModel.animationBehindChat.collectAsState()
+    val imageGenerationStyle by connectionViewModel.imageGenerationStyle.collectAsState()
     val thinkingIndicatorStyle by connectionViewModel.thinkingIndicatorStyle.collectAsState()
     val thinkingMatrixPattern by connectionViewModel.thinkingMatrixPattern.collectAsState()
     val thinkingMatrixColor by connectionViewModel.thinkingMatrixColor.collectAsState()
+    val imageGenerationOrdinals = remember(messages) {
+        var nextOrdinal = 0
+        buildMap {
+            messages.forEach { message ->
+                val generationCount = message.toolCalls.count {
+                    it.name.trim().equals("image_generate", ignoreCase = true)
+                }
+                if (generationCount > 0) {
+                    put(message.uiKey, nextOrdinal + generationCount - 1)
+                    nextOrdinal += generationCount
+                }
+            }
+        }
+    }
     var ambientMode by remember { mutableStateOf(false) } // clean text-flow mode, hides chat
     // Clean-mode discoverability hint: a persistent pill shown ONLY on the
     // empty / new-chat view (no messages) — it teaches the long-press entry
@@ -809,8 +851,7 @@ fun ChatScreen(
                     provider = activeVoiceProvider,
                     model = activeVoiceModel,
                     voice = activeVoiceName,
-                    profileName = selectedProfile?.description?.takeIf { it.isNotBlank() }
-                        ?: selectedProfile?.name,
+                    profileName = AgentDisplay.profileDisplayName(effectiveProfile),
                     configScope = activeVoiceScope,
                     outputEnabled = activeVoiceEnabled,
                     fallbackEnabled = voiceOutputConfig?.fallback_enabled,
@@ -1379,23 +1420,6 @@ fun ChatScreen(
         }
     }
 
-    // Display profile - the one the header should reflect. Priority:
-    //   1. explicit user pick (selectedProfile)
-    //   2. server-advertised profile named "default"
-    //   3. null (fall back to personality-derived name)
-    //
-    // Computed as a derived state so the header cross-fades when the user
-    // picks a new profile OR when the server's profile catalog finishes
-    // loading and a "default" entry shows up.
-    val effectiveProfile by remember(selectedProfile, agentProfiles) {
-        derivedStateOf {
-            AgentDisplay.effectiveDisplayProfile(
-                selectedProfile = selectedProfile,
-                profiles = agentProfiles,
-            )
-        }
-    }
-
     // Agent display name — used in header and info dialog.
     //
     // Precedence mirrors the messaging-app pattern: show the profile's
@@ -1439,7 +1463,7 @@ fun ChatScreen(
         // drawer itself, so the overlay's pointer scrim alone can't block it.
         gesturesEnabled = !voiceUiState.voiceMode,
         drawerContent = {
-            val drawerTitle = if (selectedProfile != null) {
+            val drawerTitle = if (effectiveProfile != null) {
                 stringResource(R.string.chat_profile_sessions, agentDisplayName)
             } else {
                 stringResource(R.string.chat_server_default_sessions)
@@ -1517,17 +1541,36 @@ fun ChatScreen(
                     }
                 },
                 title = {
-                    val headerApiReachable = apiReachable || isStreaming
-                    val isConnecting = isChatConnecting ||
-                        (!headerApiReachable && chatMode != ChatMode.DISCONNECTED)
+                    // Resolve the same Gateway-first, API-fallback runtime
+                    // model used elsewhere; Relay is intentionally unrelated
+                    // to Chat health.
+                    val chatRuntimeStatus = resolveChatRuntimeStatus(
+                        gateway = when (chatGatewayAvailability) {
+                            GatewayAvailability.Ready -> ChatTransportReadiness.Ready
+                            GatewayAvailability.Unknown -> if (
+                                activeConnection?.resolvedDashboardUrl.isNullOrBlank()
+                            ) ChatTransportReadiness.NotConfigured else ChatTransportReadiness.Connecting
+                            GatewayAvailability.SignInRequired,
+                            GatewayAvailability.Unreachable,
+                            GatewayAvailability.Unsupported -> ChatTransportReadiness.Unavailable
+                        },
+                        apiSse = when {
+                            apiReachable -> ChatTransportReadiness.Ready
+                            activeConnection?.apiServerUrl.isNullOrBlank() -> ChatTransportReadiness.NotConfigured
+                            chatMode != ChatMode.DISCONNECTED -> ChatTransportReadiness.Connecting
+                            else -> ChatTransportReadiness.Unavailable
+                        },
+                    )
+                    val headerChatReady = chatRuntimeStatus is ChatRuntimeStatus.Connected || isStreaming
+                    val isConnecting = isChatConnecting || chatRuntimeStatus is ChatRuntimeStatus.Connecting
                     // Once we've been connected this session, a later drop reads as
                     // "Reconnecting…" (we had it, we're getting it back) rather than
                     // a first-time "Connecting…". Honest wording for the WhatsApp-
                     // style subtitle status.
                     var everConnected by remember { mutableStateOf(false) }
-                    if (headerApiReachable) everConnected = true
+                    if (headerChatReady) everConnected = true
                     val statusText = when {
-                        headerApiReachable -> if (isStreaming) {
+                        headerChatReady -> if (isStreaming) {
                             stringResource(R.string.chat_streaming)
                         } else {
                             stringResource(R.string.chat_connected_label)
@@ -1540,7 +1583,7 @@ fun ChatScreen(
                         else -> stringResource(R.string.chat_disconnected_label)
                     }
                     val statusColor = when {
-                        headerApiReachable -> Color(0xFF4CAF50)
+                        headerChatReady -> Color(0xFF4CAF50)
                         isConnecting -> Color(0xFFFFA726)
                         else -> MaterialTheme.colorScheme.error
                     }
@@ -1578,14 +1621,18 @@ fun ChatScreen(
                     // yet (server config still loading), fall back to the plain
                     // connection status \u2014 never the literal "None"/"Default"
                     // personality label.
-                    val subtitleText = when {
-                        !headerApiReachable -> statusText
-                        else -> listOfNotNull(
-                            nonDefaultPersonality,
-                            modelName?.takeIf { it.isNotBlank() },
-                        ).joinToString(" \u00B7 ").ifBlank { statusText }
+                    val subtitleText = if (!headerChatReady) {
+                        statusText
+                    } else {
+                        resolveChatHeaderSubtitle(
+                            isStreaming = isStreaming,
+                            statusText = statusText,
+                            projectName = gatewayProjectName,
+                            personalityName = nonDefaultPersonality,
+                            modelName = modelName,
+                        )
                     }
-                    val subtitleColor = if (headerApiReachable) {
+                    val subtitleColor = if (headerChatReady) {
                         MaterialTheme.colorScheme.onSurfaceVariant
                     } else {
                         statusColor
@@ -1643,7 +1690,7 @@ fun ChatScreen(
                                 }
                             }
                             ConnectionStatusBadge(
-                                isConnected = headerApiReachable,
+                                isConnected = headerChatReady,
                                 isConnecting = isConnecting,
                                 modifier = Modifier
                                     .size(10.dp)
@@ -1716,6 +1763,10 @@ fun ChatScreen(
                                             transitionSpec = { loadedContentTransform() },
                                             label = "chatHeaderSubtitle",
                                         ) { line ->
+                                        Row(
+                                            verticalAlignment = Alignment.CenterVertically,
+                                            horizontalArrangement = Arrangement.spacedBy(6.dp),
+                                        ) {
                                             Text(
                                                 text = line,
                                                 style = MaterialTheme.typography.bodySmall,
@@ -1723,6 +1774,13 @@ fun ChatScreen(
                                                 maxLines = 1,
                                                 overflow = androidx.compose.ui.text.style.TextOverflow.Ellipsis,
                                             )
+                                            if (isStreaming && animationEnabled) {
+                                                StreamingDots(
+                                                    color = subtitleColor,
+                                                    modifier = Modifier.clearAndSetSemantics { },
+                                                )
+                                            }
+                                        }
                                         }
                                     }
                                 }
@@ -1924,6 +1982,9 @@ fun ChatScreen(
                         chatReady = chatReady,
                         isLoadingHistory = isLoadingHistory,
                         isLoadingSessions = isLoadingSessions,
+                        gatewayAvailability = chatGatewayAvailability,
+                        dashboardRouteMovedHint = dashboardRouteMovedHint,
+                        onNavigateToManage = onNavigateToManage,
                         onNavigateToConnections = onNavigateToConnections,
                         modifier = Modifier.fillMaxSize(),
                     )
@@ -1972,7 +2033,7 @@ fun ChatScreen(
                                     // thread itself (not just the header) -
                                     // the desktop's intro.
                                     ChatConnectState.Ready ->
-                                        if (selectedProfile != null) {
+                                        if (effectiveProfile != null) {
                                             stringResource(R.string.chat_prompt_chat_with, agentDisplayName)
                                         } else {
                                             stringResource(R.string.chat_start_conversation)
@@ -2238,6 +2299,9 @@ fun ChatScreen(
                                     isLastInGroup = isLastInGroup,
                                     retainStreamingLayout = retainLiveLayout,
                                     recoveringAnswer = recoveringAnswer,
+                                    imageGenerationStylePreference = imageGenerationStyle,
+                                    imageGenerationRotationIndex =
+                                        imageGenerationOrdinals[message.uiKey] ?: 0,
                                     onAttachmentRetry = { msgId, idx ->
                                         chatViewModel.manualFetchAttachment(msgId, idx)
                                     },
@@ -2310,7 +2374,7 @@ fun ChatScreen(
                                 )
                             }
 
-                            // Steered sends live inside a server-side tool
+                            // Legacy steered sends live inside a server-side tool
                             // result, not a user message — flag the local
                             // bubble so the scrollback explains itself.
                             if (message.role == MessageRole.USER && message.id.startsWith("steer-")) {
@@ -2327,12 +2391,21 @@ fun ChatScreen(
                                 }
                             }
 
-                            if (toolDisplay != "off" && !hasBackgroundTask) {
+                            if (!hasBackgroundTask) {
                                 // Subagent children (taskIndex != null) group
                                 // into lanes after the top-level tool cards;
                                 // the null group renders exactly as before.
                                 val laneGroups = message.toolCalls.groupBy { it.taskIndex }
                                 laneGroups[null]?.forEach { toolCall ->
+                                    // Image generation renders inside MessageBubble
+                                    // so the progress canvas and final media share
+                                    // one stable Surface and transition in place.
+                                    if (toolCall.showsImageGenerationPlaceholder()) {
+                                        return@forEach
+                                    }
+                                    if (!toolCall.isVisibleForToolDisplay(toolDisplay)) {
+                                        return@forEach
+                                    }
                                     Spacer(modifier = Modifier.height(4.dp))
                                     when (toolDisplay) {
                                         "compact" -> CompactToolCall(toolCall = toolCall)
@@ -2342,12 +2415,14 @@ fun ChatScreen(
                                         )
                                     }
                                 }
-                                laneGroups.keys.filterNotNull().sorted().forEach { taskIndex ->
-                                    Spacer(modifier = Modifier.height(4.dp))
-                                    SubagentLane(
-                                        taskIndex = taskIndex,
-                                        calls = laneGroups.getValue(taskIndex),
-                                    )
+                                if (toolDisplay != "off") {
+                                    laneGroups.keys.filterNotNull().sorted().forEach { taskIndex ->
+                                        Spacer(modifier = Modifier.height(4.dp))
+                                        SubagentLane(
+                                            taskIndex = taskIndex,
+                                            calls = laneGroups.getValue(taskIndex),
+                                        )
+                                    }
                                 }
                             }
                         }
@@ -2675,7 +2750,7 @@ fun ChatScreen(
             }
 
             // Input bar — pill field with ONE trailing slot morphing
-            // Send / Voice / Stop / Steer / Queue. "+" taps the file picker,
+            // Send / Voice / Stop / Correct / Queue. "+" taps the file picker,
             // long-press opens the CommandPalette (the dedicated "/" button
             // is gone — typing "/" still surfaces InlineAutocomplete).
             val hasContent = inputText.isNotBlank() || pendingAttachments.isNotEmpty()
@@ -2702,13 +2777,16 @@ fun ChatScreen(
             val editBusyMessage = stringResource(R.string.chat_edit_busy_snackbar)
             val stoppedMessage = stringResource(R.string.chat_stopped_snackbar)
             val attachmentPlaceholder = stringResource(R.string.chat_attachment_placeholder)
-            val sseModelOptions = remember(availableModels, agentProfiles, selectedModelOverride) {
-                (availableModels.mapNotNull(AgentDisplay::displayModelName) +
-                    agentProfiles.mapNotNull { AgentDisplay.displayModelName(it.model) } +
-                    listOfNotNull(AgentDisplay.displayModelName(selectedModelOverride)))
-                    .distinct()
+            val sseModelOptions = remember(apiModelOptions, agentProfiles, selectedModelOverride) {
+                (apiModelOptions +
+                    agentProfiles.mapNotNull { profile ->
+                        AgentDisplay.requestModelName(profile.model)?.let { ApiModelOption(it) }
+                    } +
+                    listOfNotNull(AgentDisplay.requestModelName(selectedModelOverride)?.let { ApiModelOption(it) }))
+                    .distinctBy { it.id }
             }
-            val currentModelForInput = AgentDisplay.displayModelName(selectedModelOverride)
+            val currentModelForInput = apiModelOptions.firstOrNull { it.id == selectedModelOverride }?.id
+                ?: AgentDisplay.displayModelName(selectedModelOverride)
                 ?: AgentDisplay.displayModelName(gatewayCurrentModel)
                 ?: AgentDisplay.displayModelName(effectiveProfile?.model)
                 ?: AgentDisplay.displayModelName(serverModelName)
@@ -2776,13 +2854,26 @@ fun ChatScreen(
                                     )
                                 }
                             }
+                            val providerModelIds = modelProviders.flatMap { it.models }.toSet()
+                            sseModelOptions.filter { it.id !in providerModelIds }.forEach { model ->
+                                add(
+                                    ChatInputPickerOption(
+                                        label = AgentDisplay.displayModelName(model.id) ?: model.id,
+                                        value = model.id,
+                                        group = "Routes",
+                                        secondary = model.routeDetail,
+                                        selected = selectedModelOverride == model.id,
+                                    ),
+                                )
+                            }
                         } else {
                             sseModelOptions.forEach { model ->
                                 add(
                                     ChatInputPickerOption(
-                                        label = model,
-                                        value = model,
-                                        selected = selectedModelOverride == model,
+                                        label = AgentDisplay.displayModelName(model.id) ?: model.id,
+                                        value = model.id,
+                                        secondary = model.routeDetail,
+                                        selected = selectedModelOverride == model.id,
                                     ),
                                 )
                             }
@@ -2927,7 +3018,11 @@ fun ChatScreen(
                 isDarkTheme = isDarkTheme,
                 modelControl = modelControl,
                 onModelOptionSelected = { option ->
-                    chatViewModel.selectModel(option.value, option.provider)
+                    if (option.provider == null && apiModelOptions.any { it.id == option.value }) {
+                        option.value?.let(chatViewModel::selectApiModel)
+                    } else {
+                        chatViewModel.selectModel(option.value, option.provider)
+                    }
                 },
                 effortControl = effortControl,
                 onEffortOptionSelected = { option ->
@@ -2944,7 +3039,11 @@ fun ChatScreen(
                     onRefresh = { chatViewModel.refreshModelOptions(refresh = true) },
                     onSelect = { option ->
                         showModelSheet = false
-                        chatViewModel.selectModel(option.value, option.provider)
+                        if (option.provider == null && apiModelOptions.any { it.id == option.value }) {
+                            option.value?.let(chatViewModel::selectApiModel)
+                        } else {
+                            chatViewModel.selectModel(option.value, option.provider)
+                        }
                     },
                     onDismiss = { showModelSheet = false },
                 )
@@ -3081,8 +3180,7 @@ fun ChatScreen(
                 voiceOutputProvider = activeVoiceProvider,
                 voiceOutputModel = activeVoiceModel,
                 voiceOutputVoice = activeVoiceName,
-                voiceProfileName = selectedProfile?.description?.takeIf { it.isNotBlank() }
-                    ?: selectedProfile?.name,
+                voiceProfileName = AgentDisplay.profileDisplayName(effectiveProfile),
                 voiceConfigScope = activeVoiceScope,
                 voiceOutputEnabled = activeVoiceEnabled,
                 voiceOutputFallbackEnabled = voiceOutputConfig?.fallback_enabled,
@@ -3222,6 +3320,9 @@ private fun ChatColdStartLoadingState(
     chatReady: Boolean,
     isLoadingHistory: Boolean,
     isLoadingSessions: Boolean,
+    gatewayAvailability: GatewayAvailability,
+    dashboardRouteMovedHint: String?,
+    onNavigateToManage: () -> Unit,
     onNavigateToConnections: () -> Unit,
     modifier: Modifier = Modifier,
 ) {
@@ -3284,14 +3385,51 @@ private fun ChatColdStartLoadingState(
             )
         }
 
-        ChatLoadingCommandPanel(
-            commands = commands,
-            onNavigateToConnections = onNavigateToConnections,
-            modifier = Modifier
-                .align(Alignment.BottomCenter)
-                .fillMaxWidth()
-                .padding(horizontal = 16.dp, vertical = 16.dp),
-        )
+        val dashboardSignInRequired =
+            gatewayAvailability == GatewayAvailability.SignInRequired && !apiReachable
+        if (dashboardSignInRequired) {
+            ElevatedCard(
+                colors = CardDefaults.elevatedCardColors(
+                    containerColor = MaterialTheme.colorScheme.surface.copy(alpha = 0.92f),
+                ),
+                modifier = Modifier
+                    .align(Alignment.BottomCenter)
+                    .fillMaxWidth()
+                    .padding(horizontal = 16.dp, vertical = 16.dp),
+            ) {
+                Column(
+                    modifier = Modifier.padding(16.dp),
+                    verticalArrangement = Arrangement.spacedBy(10.dp),
+                ) {
+                    Text(
+                        text = stringResource(R.string.dashboard_signin_required_title),
+                        style = MaterialTheme.typography.titleMedium,
+                    )
+                    Text(
+                        text = dashboardRouteMovedHint?.let { route ->
+                            stringResource(R.string.dashboard_signin_route_hint, route)
+                        } ?: stringResource(R.string.chat_settings_gateway_needs_signin_desc),
+                        style = MaterialTheme.typography.bodyMedium,
+                        color = MaterialTheme.colorScheme.onSurfaceVariant,
+                    )
+                    Button(
+                        onClick = onNavigateToManage,
+                        modifier = Modifier.fillMaxWidth(),
+                    ) {
+                        Text(stringResource(R.string.voice_settings_sign_in_via_manage))
+                    }
+                }
+            }
+        } else {
+            ChatLoadingCommandPanel(
+                commands = commands,
+                onNavigateToConnections = onNavigateToConnections,
+                modifier = Modifier
+                    .align(Alignment.BottomCenter)
+                    .fillMaxWidth()
+                    .padding(horizontal = 16.dp, vertical = 16.dp),
+            )
+        }
     }
 }
 

app/src/main/kotlin/com/hermesandroid/relay/ui/screens/ChatSettingsScreen.kt

@@ -443,7 +443,7 @@ fun ChatSettingsScreen(
 
                     HorizontalDivider()
 
-                    // Turn-complete notification toggle. First enable on
+                    // Background chat-alert toggle. First enable on
                     // API 33+ runs the POST_NOTIFICATIONS request (the
                     // BridgeScreen master-toggle precedent); if the user
                     // denies, the notifier silently no-ops at post time.

app/src/main/kotlin/com/hermesandroid/relay/ui/screens/ConnectionDetailScreen.kt

@@ -8,12 +8,16 @@ import androidx.compose.foundation.layout.fillMaxSize
 import androidx.compose.foundation.layout.fillMaxWidth
 import androidx.compose.foundation.layout.height
 import androidx.compose.foundation.layout.padding
+import androidx.compose.foundation.layout.size
 import androidx.compose.foundation.rememberScrollState
 import androidx.compose.foundation.shape.RoundedCornerShape
 import androidx.compose.foundation.verticalScroll
 import androidx.compose.material.icons.Icons
 import androidx.compose.material.icons.automirrored.filled.ArrowBack
+import androidx.compose.material.icons.filled.CheckCircle
+import androidx.compose.material.icons.filled.Dashboard
 import androidx.compose.material.icons.filled.MoreVert
+import androidx.compose.material.icons.filled.QrCodeScanner
 import androidx.compose.material3.AlertDialog
 import androidx.compose.material3.Badge
 import androidx.compose.material3.Button
@@ -42,13 +46,14 @@ import androidx.compose.runtime.remember
 import androidx.compose.runtime.setValue
 import androidx.compose.ui.Alignment
 import androidx.compose.ui.Modifier
+import androidx.compose.ui.graphics.Color
 import androidx.compose.ui.platform.LocalContext
 import androidx.compose.ui.res.stringResource
 import androidx.compose.ui.text.style.TextOverflow
 import androidx.compose.ui.unit.dp
 import com.hermesandroid.relay.R
 import com.hermesandroid.relay.data.Connection
-import com.hermesandroid.relay.data.FeatureFlags
+import com.hermesandroid.relay.data.capabilities
 import com.hermesandroid.relay.ui.components.ActiveCardAdvancedSection
 import com.hermesandroid.relay.ui.components.ActiveCardFeaturesSection
 import com.hermesandroid.relay.ui.components.ActiveCardRoutesSection
@@ -60,7 +65,6 @@ import com.hermesandroid.relay.ui.components.SessionInfoSheet
 import com.hermesandroid.relay.ui.theme.LocalBrand
 import com.hermesandroid.relay.viewmodel.ConnectionViewModel
 import com.hermesandroid.relay.viewmodel.RelayUiState
-import com.hermesandroid.relay.viewmodel.statusText
 
 /**
  * Tabbed detail for a single Hermes connection — the level-2 screen the
@@ -105,11 +109,6 @@ fun ConnectionDetailScreen(
     val connections by connectionViewModel.connections.collectAsState()
     val activeConnectionId by connectionViewModel.activeConnectionId.collectAsState()
     val relayUiState by connectionViewModel.relayUiState.collectAsState()
-    val relayRow by connectionViewModel.relayRowState.collectAsState()
-    val relayConfigured by connectionViewModel.relayConfigured.collectAsState()
-    val relayEnabled by FeatureFlags.relayEnabled(context)
-        .collectAsState(initial = FeatureFlags.isDevBuild)
-
     val connection = connections.firstOrNull { it.id == connectionId }
     // Connection was removed (e.g. via the overflow menu) — leave the screen.
     LaunchedEffect(connection == null) {
@@ -200,6 +199,12 @@ fun ConnectionDetailScreen(
                                 menuExpanded = false
                                 onRepair(connectionId)
                             },
+                            leadingIcon = {
+                                Icon(
+                                    imageVector = Icons.Filled.QrCodeScanner,
+                                    contentDescription = null,
+                                )
+                            },
                         )
                         if (connection.pairedAt != null) {
                             DropdownMenuItem(
@@ -265,10 +270,7 @@ fun ConnectionDetailScreen(
                             ActiveOverview(
                                 connectionViewModel = connectionViewModel,
                                 connection = connection,
-                                relayConfigured = relayConfigured,
-                                relayStatusText = relayRow.statusText(connectedLabel = stringResource(R.string.detail_connected)),
                                 relayUiState = relayUiState,
-                                relayEnabled = relayEnabled,
                                 onReconnect = onReconnect,
                                 onRepair = { onRepair(connectionId) },
                                 onOpenApiInfo = { showApiInfoSheet = true },
@@ -289,18 +291,22 @@ fun ConnectionDetailScreen(
                         connectionViewModel = connectionViewModel,
                         connection = connection,
                         liveState = relayUiState,
+                        onEditDashboard = {
+                            selectedTab = tabs.indexOf(DetailTab.Advanced)
+                        },
                     )
 
                     DetailTab.Advanced -> ActiveCardAdvancedSection(
                         connectionViewModel = connectionViewModel,
-                        relayEnabled = relayEnabled,
                         isDarkTheme = isDarkTheme,
+                        onPairRelay = { onRepair(connectionId) },
                         onInsecureAckRequested = { showInsecureAckDialog = true },
                     )
 
                     DetailTab.Security -> ActiveCardSecurityPosture(
                         connectionViewModel = connectionViewModel,
                         onNavigateToPairedDevices = onNavigateToPairedDevices,
+                        onRevokeRelay = { showRevokeConfirm = true },
                     )
                 }
 
@@ -410,10 +416,7 @@ private enum class DetailTab {
 private fun ActiveOverview(
     connectionViewModel: ConnectionViewModel,
     connection: Connection,
-    relayConfigured: Boolean,
-    relayStatusText: String,
     relayUiState: RelayUiState,
-    relayEnabled: Boolean,
     onReconnect: () -> Unit,
     onRepair: () -> Unit,
     onOpenApiInfo: () -> Unit,
@@ -421,48 +424,78 @@ private fun ActiveOverview(
     onOpenRelayInfo: () -> Unit,
     onOpenSessionInfo: () -> Unit,
 ) {
-    val hostname = Connection.extractDefaultLabel(connection.apiServerUrl)
-    val headerLine = if (relayConfigured) relayStatusText else stringResource(R.string.detail_standard_prefix) + hostname
+    val hostname = connection.primaryHost.ifBlank { connection.label }
+    val dashboardReady = connection.dashboardLastStatus?.reachable == true
 
     Surface(
-        color = MaterialTheme.colorScheme.surface.copy(alpha = 0.5f),
+        color = MaterialTheme.colorScheme.surfaceVariant,
         shape = RoundedCornerShape(12.dp),
         modifier = Modifier.fillMaxWidth(),
     ) {
         Column(
-            modifier = Modifier.padding(horizontal = 12.dp, vertical = 10.dp),
-            verticalArrangement = Arrangement.spacedBy(2.dp),
+            modifier = Modifier.padding(16.dp),
+            verticalArrangement = Arrangement.spacedBy(10.dp),
         ) {
-            Text(
-                text = headerLine,
-                style = MaterialTheme.typography.titleSmall,
-                color = MaterialTheme.colorScheme.onSurface,
-                maxLines = 1,
-                overflow = TextOverflow.Ellipsis,
-            )
-            Text(
-                text = hostname,
-                style = MaterialTheme.typography.bodySmall,
-                color = MaterialTheme.colorScheme.onSurfaceVariant,
-                maxLines = 1,
-                overflow = TextOverflow.Ellipsis,
-            )
+            Row(
+                verticalAlignment = Alignment.CenterVertically,
+                horizontalArrangement = Arrangement.spacedBy(12.dp),
+            ) {
+                Icon(
+                    imageVector = Icons.Filled.Dashboard,
+                    contentDescription = null,
+                    tint = MaterialTheme.colorScheme.primary,
+                )
+                Column(modifier = Modifier.weight(1f)) {
+                    Text(
+                        text = stringResource(R.string.detail_dashboard_primary),
+                        style = MaterialTheme.typography.titleMedium,
+                    )
+                    Text(
+                        text = connection.resolvedDashboardUrl.ifBlank { hostname },
+                        style = MaterialTheme.typography.bodySmall,
+                        color = MaterialTheme.colorScheme.onSurfaceVariant,
+                        maxLines = 1,
+                        overflow = TextOverflow.Ellipsis,
+                    )
+                }
+            }
+            HorizontalDivider()
+            Row(
+                verticalAlignment = Alignment.CenterVertically,
+                horizontalArrangement = Arrangement.spacedBy(8.dp),
+            ) {
+                Icon(
+                    imageVector = Icons.Filled.CheckCircle,
+                    contentDescription = null,
+                    tint = if (dashboardReady) Color(0xFF4CAF50) else MaterialTheme.colorScheme.primary,
+                    modifier = Modifier.size(20.dp),
+                )
+                Text(
+                    text = if (dashboardReady) {
+                        stringResource(R.string.detail_core_ready)
+                    } else {
+                        stringResource(R.string.detail_core_configured)
+                    },
+                    style = MaterialTheme.typography.bodyMedium,
+                    color = if (dashboardReady) Color(0xFF4CAF50) else MaterialTheme.colorScheme.onSurface,
+                )
+            }
         }
     }
 
     Text(
-        text = stringResource(R.string.detail_routes_help),
+        text = stringResource(R.string.detail_overview_summary),
         style = MaterialTheme.typography.bodySmall,
         color = MaterialTheme.colorScheme.onSurfaceVariant,
     )
 
     ActiveCardFeaturesSection(
         connectionViewModel = connectionViewModel,
-        relayEnabled = relayEnabled,
         onOpenApiInfo = onOpenApiInfo,
         onOpenDashboard = onOpenDashboard,
         onOpenRelayInfo = onOpenRelayInfo,
         onOpenSessionInfo = onOpenSessionInfo,
+        onPairRelay = onRepair,
     )
 
     Row(
@@ -472,9 +505,6 @@ private fun ActiveOverview(
         if (relayUiState == RelayUiState.Stale) {
             Button(onClick = onReconnect) { Text(stringResource(R.string.detail_reconnect)) }
         }
-        TextButton(onClick = onRepair) {
-            Text(if (connection.pairedAt == null) stringResource(R.string.detail_pair_relay) else stringResource(R.string.detail_repair))
-        }
     }
 }
 
@@ -489,10 +519,10 @@ private fun InactiveOverview(
     onSwitch: () -> Unit,
     onRepair: () -> Unit,
 ) {
-    val hostname = Connection.extractDefaultLabel(connection.apiServerUrl)
+    val hostname = connection.primaryHost.ifBlank { connection.label }
     val statusLine = when {
         connection.pairedAt != null -> stringResource(R.string.detail_paired_relay_configured)
-        connection.apiServerUrl.isNotBlank() -> stringResource(R.string.detail_standard_not_paired)
+        connection.capabilities.chatConfigured -> stringResource(R.string.detail_standard_not_paired)
         else -> stringResource(R.string.detail_not_configured)
     }
 

app/src/main/kotlin/com/hermesandroid/relay/ui/screens/ConnectionsSettingsScreen.kt

@@ -1,6 +1,9 @@
 package com.hermesandroid.relay.ui.screens
 
 import android.content.Context
+import android.text.format.DateUtils
+import androidx.compose.animation.animateColorAsState
+import androidx.compose.foundation.BorderStroke
 import androidx.compose.foundation.background
 import androidx.compose.foundation.clickable
 import androidx.compose.foundation.layout.Arrangement
@@ -21,12 +24,24 @@ import androidx.compose.material.icons.Icons
 import androidx.compose.material.icons.automirrored.filled.ArrowBack
 import androidx.compose.material.icons.automirrored.filled.KeyboardArrowRight
 import androidx.compose.material.icons.filled.Add
+import androidx.compose.material.icons.filled.AccessTime
+import androidx.compose.material.icons.filled.CellTower
+import androidx.compose.material.icons.filled.Chat
+import androidx.compose.material.icons.filled.CheckCircle
+import androidx.compose.material.icons.filled.Dashboard
+import androidx.compose.material.icons.filled.GraphicEq
+import androidx.compose.material.icons.filled.Lan
+import androidx.compose.material.icons.filled.KeyboardArrowDown
 import androidx.compose.material3.Badge
+import androidx.compose.material3.Button
 import androidx.compose.material3.Card
 import androidx.compose.material3.CardDefaults
+import androidx.compose.material3.CircularProgressIndicator
+import androidx.compose.material3.DropdownMenu
+import androidx.compose.material3.DropdownMenuItem
 import androidx.compose.material3.ExperimentalMaterial3Api
-import androidx.compose.material3.ExtendedFloatingActionButton
 import androidx.compose.material3.HorizontalDivider
+import androidx.compose.material3.OutlinedButton
 import androidx.compose.material3.Icon
 import androidx.compose.material3.IconButton
 import androidx.compose.material3.MaterialTheme
@@ -39,21 +54,33 @@ import androidx.compose.runtime.Composable
 import androidx.compose.runtime.LaunchedEffect
 import androidx.compose.runtime.collectAsState
 import androidx.compose.runtime.getValue
+import androidx.compose.runtime.mutableStateOf
+import androidx.compose.runtime.remember
+import androidx.compose.runtime.rememberCoroutineScope
+import androidx.compose.runtime.setValue
 import androidx.compose.ui.Alignment
 import androidx.compose.ui.Modifier
 import androidx.compose.ui.draw.clip
 import androidx.compose.ui.platform.LocalContext
 import androidx.compose.ui.res.stringResource
+import androidx.compose.ui.res.pluralStringResource
+import androidx.compose.ui.graphics.vector.ImageVector
 import androidx.compose.ui.text.style.TextOverflow
 import androidx.compose.ui.unit.dp
 import com.hermesandroid.relay.R
 import com.hermesandroid.relay.data.Connection
+import com.hermesandroid.relay.data.capabilities
+import com.hermesandroid.relay.network.upstream.GatewayAvailability
 import com.hermesandroid.relay.network.relay.RelayUrlDeriver
 import com.hermesandroid.relay.viewmodel.ConnectionViewModel
+import com.hermesandroid.relay.viewmodel.ChatRuntimeStatus
+import com.hermesandroid.relay.viewmodel.ChatTransportReadiness
 import com.hermesandroid.relay.viewmodel.RelayUiState
 import com.hermesandroid.relay.viewmodel.StandardVoiceAvailability
+import com.hermesandroid.relay.viewmodel.resolveChatRuntimeStatus
 import com.hermesandroid.relay.viewmodel.statusText
-import java.util.concurrent.TimeUnit
+import kotlinx.coroutines.delay
+import kotlinx.coroutines.launch
 
 /**
  * Level-1 list of Hermes connections. Reachable via Settings → Connections.
@@ -91,6 +118,15 @@ fun ConnectionsSettingsScreen(
     } else {
         false
     }
+    val startupConnectionId: String? = if (connectionViewModel != null) {
+        val startupId by connectionViewModel.startupConnectionId.collectAsState()
+        startupId
+    } else {
+        null
+    }
+    val scope = rememberCoroutineScope()
+    var switchingConnectionId by remember { mutableStateOf<String?>(null) }
+    var justSwitchedConnectionId by remember { mutableStateOf<String?>(null) }
 
     // Kick a WSS reconnect on entry in case the user landed here from a Stale
     // chip (same intent as the old inline screen).
@@ -101,7 +137,22 @@ fun ConnectionsSettingsScreen(
     Scaffold(
         topBar = {
             TopAppBar(
-                title = { Text(stringResource(R.string.conn_title)) },
+                title = {
+                    Column {
+                        Text(stringResource(R.string.conn_title))
+                        if (connections.isNotEmpty()) {
+                            Text(
+                                text = pluralStringResource(
+                                    R.plurals.conn_server_count,
+                                    connections.size,
+                                    connections.size,
+                                ),
+                                style = MaterialTheme.typography.bodySmall,
+                                color = MaterialTheme.colorScheme.onSurfaceVariant,
+                            )
+                        }
+                    }
+                },
                 navigationIcon = {
                     IconButton(onClick = onBack) {
                         Icon(
@@ -115,13 +166,6 @@ fun ConnectionsSettingsScreen(
                 ),
             )
         },
-        floatingActionButton = {
-            ExtendedFloatingActionButton(
-                onClick = onAddConnection,
-                icon = { Icon(imageVector = Icons.Filled.Add, contentDescription = null) },
-                text = { Text(stringResource(R.string.conn_add_connection)) },
-            )
-        },
     ) { innerPadding ->
         if (connections.isEmpty()) {
             // Shown in practice only during tests / after a wipe; cold start
@@ -149,6 +193,15 @@ fun ConnectionsSettingsScreen(
                 contentPadding = PaddingValues(horizontal = 16.dp, vertical = 16.dp),
                 verticalArrangement = Arrangement.spacedBy(12.dp),
             ) {
+                if (connections.size > 1 && connectionViewModel != null) {
+                    item {
+                        StartupConnectionSelector(
+                            connections = connections,
+                            startupConnectionId = startupConnectionId,
+                            onSelect = connectionViewModel::setStartupConnection,
+                        )
+                    }
+                }
                 items(connections, key = { it.id }) { connection ->
                     val isActive = connection.id == activeConnectionId
                     ConnectionListCard(
@@ -162,10 +215,118 @@ fun ConnectionsSettingsScreen(
                             connection.hasConfiguredRelay()
                         },
                         onClick = { onOpenConnection(connection.id) },
+                        onSwitch = if (!isActive && connectionViewModel != null) {
+                            {
+                                if (switchingConnectionId == null) {
+                                    scope.launch {
+                                        switchingConnectionId = connection.id
+                                        connectionViewModel.switchConnection(connection.id).join()
+                                        switchingConnectionId = null
+                                        if (connectionViewModel.activeConnectionId.value == connection.id) {
+                                            justSwitchedConnectionId = connection.id
+                                            delay(800)
+                                            if (justSwitchedConnectionId == connection.id) {
+                                                justSwitchedConnectionId = null
+                                            }
+                                        }
+                                    }
+                                }
+                            }
+                        } else {
+                            null
+                        },
+                        isSwitching = switchingConnectionId == connection.id,
+                        justSwitched = justSwitchedConnectionId == connection.id,
                     )
                 }
-                // Footer spacer so the last card isn't hidden by the FAB.
-                item { Spacer(modifier = Modifier.height(72.dp)) }
+                item {
+                    Button(
+                        onClick = onAddConnection,
+                        modifier = Modifier
+                            .fillMaxWidth()
+                            .padding(top = 8.dp),
+                    ) {
+                        Icon(imageVector = Icons.Filled.Add, contentDescription = null)
+                        Text(
+                            text = stringResource(R.string.conn_add_connection),
+                            modifier = Modifier.padding(start = 8.dp),
+                        )
+                    }
+                }
+                item { Spacer(modifier = Modifier.height(16.dp)) }
+            }
+        }
+    }
+}
+
+@Composable
+private fun StartupConnectionSelector(
+    connections: List<Connection>,
+    startupConnectionId: String?,
+    onSelect: (String?) -> Unit,
+) {
+    var expanded by remember { mutableStateOf(false) }
+    val selectedLabel = startupConnectionId
+        ?.let { id -> connections.firstOrNull { it.id == id }?.label }
+        ?: stringResource(R.string.conn_startup_last_used)
+
+    Box {
+        Surface(
+            modifier = Modifier
+                .fillMaxWidth()
+                .clickable { expanded = true },
+            color = MaterialTheme.colorScheme.surfaceVariant,
+            shape = RoundedCornerShape(12.dp),
+        ) {
+            Row(
+                modifier = Modifier.padding(horizontal = 16.dp, vertical = 12.dp),
+                verticalAlignment = Alignment.CenterVertically,
+            ) {
+                Icon(
+                    imageVector = Icons.Filled.AccessTime,
+                    contentDescription = null,
+                    tint = MaterialTheme.colorScheme.primary,
+                    modifier = Modifier.padding(end = 12.dp),
+                )
+                Column(modifier = Modifier.weight(1f)) {
+                    Text(
+                        text = stringResource(R.string.conn_startup_title),
+                        style = MaterialTheme.typography.labelMedium,
+                        color = MaterialTheme.colorScheme.onSurfaceVariant,
+                    )
+                    Text(text = selectedLabel, style = MaterialTheme.typography.bodyLarge)
+                }
+                Icon(
+                    imageVector = Icons.Filled.KeyboardArrowDown,
+                    contentDescription = stringResource(R.string.conn_startup_choose),
+                )
+            }
+        }
+        DropdownMenu(expanded = expanded, onDismissRequest = { expanded = false }) {
+            DropdownMenuItem(
+                text = {
+                    Column {
+                        Text(stringResource(R.string.conn_startup_last_used))
+                        Text(
+                            text = stringResource(R.string.conn_startup_recommended),
+                            style = MaterialTheme.typography.bodySmall,
+                            color = MaterialTheme.colorScheme.onSurfaceVariant,
+                        )
+                    }
+                },
+                onClick = {
+                    expanded = false
+                    onSelect(null)
+                },
+            )
+            connections.forEach { connection ->
+                DropdownMenuItem(
+                    text = { Text(connection.label) },
+                    onClick = {
+                        expanded = false
+                        onSelect(connection.id)
+                    },
+                )
             }
         }
     }
@@ -185,16 +346,28 @@ private fun ConnectionListCard(
     activeConnectionViewModel: ConnectionViewModel?,
     relayConfigured: Boolean,
     onClick: () -> Unit,
+    onSwitch: (() -> Unit)?,
+    isSwitching: Boolean,
+    justSwitched: Boolean,
 ) {
     val context = LocalContext.current
     // Active card: muted indigo wash instead of full-strength primaryContainer —
     // a card-sized fill of the brand blue overwhelmed body text (2026-06-10
     // feedback); small accents keep the vivid blue.
-    val containerColor = if (isActive) {
-        com.hermesandroid.relay.ui.theme.RelayRefresh.ElectricMuted.copy(alpha = 0.42f)
+    val targetContainerColor = if (isActive || isSwitching || justSwitched) {
+        com.hermesandroid.relay.ui.theme.RelayRefresh.ElectricMuted.copy(alpha = 0.25f)
     } else {
         MaterialTheme.colorScheme.surfaceVariant
     }
+    val containerColor by animateColorAsState(targetValue = targetContainerColor, label = "connectionCardColor")
+    val borderColor by animateColorAsState(
+        targetValue = if (isSwitching || justSwitched) {
+            MaterialTheme.colorScheme.primary
+        } else {
+            MaterialTheme.colorScheme.outlineVariant.copy(alpha = 0f)
+        },
+        label = "connectionCardBorder",
+    )
 
     Card(
         modifier = Modifier
@@ -202,6 +375,7 @@ private fun ConnectionListCard(
             .clickable(onClick = onClick),
         shape = RoundedCornerShape(12.dp),
         colors = CardDefaults.cardColors(containerColor = containerColor),
+        border = BorderStroke(if (isSwitching || justSwitched) 1.5.dp else 0.dp, borderColor),
     ) {
         Column(
             modifier = Modifier.padding(16.dp),
@@ -209,52 +383,87 @@ private fun ConnectionListCard(
         ) {
             // ── Title row ────────────────────────────────────────────────
             Row(verticalAlignment = Alignment.CenterVertically) {
+                Box(
+                    modifier = Modifier
+                        .size(10.dp)
+                        .clip(RoundedCornerShape(50))
+                        .background(
+                            if (isActive) com.hermesandroid.relay.ui.theme.RelayRefresh.Green
+                            else MaterialTheme.colorScheme.primary,
+                        ),
+                )
                 Text(
                     text = connection.label,
                     style = MaterialTheme.typography.titleMedium,
                     maxLines = 1,
                     overflow = TextOverflow.Ellipsis,
-                    modifier = Modifier.weight(1f),
+                    modifier = Modifier
+                        .weight(1f)
+                        .padding(start = 10.dp),
                 )
                 if (isActive) {
                     Badge(
                         containerColor = MaterialTheme.colorScheme.primary,
                         contentColor = MaterialTheme.colorScheme.onPrimary,
                     ) {
-                        Text(text = stringResource(R.string.conn_active), modifier = Modifier.padding(horizontal = 6.dp))
+                        Text(
+                            text = stringResource(R.string.conn_active).uppercase(),
+                            modifier = Modifier.padding(horizontal = 6.dp),
+                        )
+                    }
+                }
+                if (onSwitch != null || isSwitching || justSwitched) {
+                    OutlinedButton(
+                        onClick = { onSwitch?.invoke() },
+                        enabled = !isSwitching && !justSwitched,
+                    ) {
+                        when {
+                            isSwitching -> {
+                                CircularProgressIndicator(modifier = Modifier.size(16.dp), strokeWidth = 2.dp)
+                                Text(stringResource(R.string.conn_switching), modifier = Modifier.padding(start = 6.dp))
+                            }
+                            justSwitched -> {
+                                Icon(Icons.Filled.CheckCircle, contentDescription = null, modifier = Modifier.size(16.dp))
+                                Text(stringResource(R.string.conn_switched), modifier = Modifier.padding(start = 6.dp))
+                            }
+                            else -> Text(stringResource(R.string.conn_switch))
+                        }
                     }
                 }
-                Icon(
-                    imageVector = Icons.AutoMirrored.Filled.KeyboardArrowRight,
-                    contentDescription = null,
-                    tint = MaterialTheme.colorScheme.onSurfaceVariant,
-                    modifier = Modifier.padding(start = 4.dp),
-                )
             }
 
             // ── Subtitle: hostname + status ──────────────────────────────
-            val hostname = Connection.extractDefaultLabel(connection.apiServerUrl)
-            val hasStandardApi = connection.apiServerUrl.isNotBlank()
-            val pairedStatus = when {
-                liveState != null &&
-                    (connection.pairedAt != null || liveState != RelayUiState.NotConfigured) ->
-                    liveState.statusText(connectedLabel = stringResource(R.string.conn_connected))
-                connection.pairedAt != null -> formatPairedRelative(context, connection.pairedAt)
-                hasStandardApi -> stringResource(R.string.conn_standard_not_paired)
-                else -> stringResource(R.string.conn_not_paired)
-            }
-            val statusColor = if (liveState == RelayUiState.Stale) {
-                MaterialTheme.colorScheme.tertiary
-            } else {
-                MaterialTheme.colorScheme.onSurfaceVariant
+            val hostname = connection.primaryHost.ifBlank { connection.label }
+            val dashboardStatus = connection.dashboardLastStatus
+            val dashboardSignInRequired =
+                dashboardStatus?.authRequired == true && dashboardStatus.authenticated != true
+            val connectionStatus = when {
+                dashboardSignInRequired -> stringResource(R.string.conn_dashboard_sign_in)
+                dashboardStatus?.reachable == true -> stringResource(R.string.conn_dashboard_available)
+                dashboardStatus != null && !dashboardStatus.reachable -> stringResource(R.string.conn_dashboard_offline)
+                connection.resolvedDashboardUrl.isNotBlank() -> stringResource(R.string.conn_dashboard_unchecked)
+                else -> stringResource(R.string.conn_dashboard_missing)
             }
             Text(
-                text = "$hostname • $pairedStatus",
+                text = if (isSwitching) {
+                    stringResource(R.string.conn_connecting_to, connection.label)
+                } else {
+                    "Dashboard · $hostname"
+                },
                 style = MaterialTheme.typography.bodySmall,
-                color = statusColor,
+                color = MaterialTheme.colorScheme.onSurfaceVariant,
                 maxLines = 2,
                 overflow = TextOverflow.Ellipsis,
             )
+            Text(
+                text = if (isActive) {
+                    stringResource(R.string.conn_last_used_now)
+                } else {
+                    connection.lastUsedAt?.let { formatUsedRelative(context, it) } ?: connectionStatus
+                },
+                style = MaterialTheme.typography.bodySmall,
+                color = MaterialTheme.colorScheme.onSurfaceVariant,
+            )
 
             // ── Steps/timeline summary (every card) ──────────────────────
             ConnectionSurfaceSummary(
@@ -267,6 +476,42 @@ private fun ConnectionListCard(
                 // detail — the same destination as the card tap.
                 onOpenDashboard = onClick,
             )
+
+            HorizontalDivider(color = MaterialTheme.colorScheme.outlineVariant.copy(alpha = 0.45f))
+            Row(
+                modifier = Modifier
+                    .fillMaxWidth()
+                    .padding(top = 2.dp),
+                verticalAlignment = Alignment.CenterVertically,
+            ) {
+                Icon(
+                    imageVector = Icons.Filled.Lan,
+                    contentDescription = null,
+                    tint = MaterialTheme.colorScheme.onSurfaceVariant,
+                    modifier = Modifier
+                        .size(18.dp)
+                        .padding(end = 2.dp),
+                )
+                Text(
+                    text = when {
+                        connection.routeCandidates.isNotEmpty() -> connection.routeCandidates
+                            .sortedBy { it.priority }
+                            .joinToString(" · ") { route ->
+                                route.role.replaceFirstChar { it.titlecase() }
+                            }
+                        connection.resolvedDashboardUrl.isNotBlank() -> stringResource(R.string.conn_dashboard_only_route)
+                        else -> stringResource(R.string.conn_no_routes)
+                    },
+                    style = MaterialTheme.typography.bodySmall,
+                    color = MaterialTheme.colorScheme.onSurfaceVariant,
+                    modifier = Modifier.weight(1f),
+                )
+                Icon(
+                    imageVector = Icons.AutoMirrored.Filled.KeyboardArrowRight,
+                    contentDescription = null,
+                    tint = MaterialTheme.colorScheme.onSurfaceVariant,
+                )
+            }
         }
     }
 }
@@ -304,6 +549,12 @@ private fun ConnectionSurfaceSummary(
     } else {
         null
     }
+    val gatewayAvailability: GatewayAvailability? = if (activeConnectionViewModel != null) {
+        val availability by activeConnectionViewModel.gatewayAvailability.collectAsState()
+        availability
+    } else {
+        null
+    }
     val standardVoiceAvailability: StandardVoiceAvailability? =
         if (activeConnectionViewModel != null) {
             val availability by activeConnectionViewModel.standardVoiceAvailability.collectAsState()
@@ -315,17 +566,41 @@ private fun ConnectionSurfaceSummary(
     val dashboardSignInRequired =
         dashboardStatus?.authRequired == true && dashboardStatus.authenticated != true
 
-    val apiText = when {
-        connection.apiServerUrl.isBlank() -> stringResource(R.string.conn_api_missing)
-        activeApiHealth == ConnectionViewModel.HealthStatus.Probing -> stringResource(R.string.conn_api_checking)
-        activeApiReachable == true -> stringResource(R.string.conn_api_ready)
-        isActive && activeApiReachable == false -> stringResource(R.string.conn_api_offline)
-        else -> stringResource(R.string.conn_api_configured)
+    val chatRuntimeStatus: ChatRuntimeStatus? = if (isActive) {
+        resolveChatRuntimeStatus(
+            gateway = when (gatewayAvailability) {
+                GatewayAvailability.Ready -> ChatTransportReadiness.Ready
+                GatewayAvailability.Unknown, null -> ChatTransportReadiness.Connecting
+                GatewayAvailability.SignInRequired,
+                GatewayAvailability.Unreachable,
+                GatewayAvailability.Unsupported -> ChatTransportReadiness.Unavailable
+            },
+            apiSse = when {
+                connection.apiServerUrl.isBlank() -> ChatTransportReadiness.NotConfigured
+                activeApiReachable == true -> ChatTransportReadiness.Ready
+                activeApiHealth == ConnectionViewModel.HealthStatus.Probing -> ChatTransportReadiness.Connecting
+                activeApiHealth == ConnectionViewModel.HealthStatus.Unreachable -> ChatTransportReadiness.Unavailable
+                else -> ChatTransportReadiness.Connecting
+            },
+        )
+    } else {
+        null
     }
-    val apiTone = when {
-        activeApiReachable == true -> SummaryTone.Good
-        connection.apiServerUrl.isBlank() -> SummaryTone.Warning
-        isActive && activeApiReachable == false -> SummaryTone.Warning
+
+    val chatText = when {
+        chatRuntimeStatus is ChatRuntimeStatus.Connected -> stringResource(R.string.conn_api_ready)
+        chatRuntimeStatus == ChatRuntimeStatus.Connecting -> stringResource(R.string.conn_api_checking)
+        gatewayAvailability == GatewayAvailability.SignInRequired -> stringResource(R.string.conn_dashboard_sign_in)
+        dashboardStatus?.reachable == true && !dashboardSignInRequired -> stringResource(R.string.conn_dashboard_available)
+        connection.capabilities.chatConfigured -> stringResource(R.string.conn_api_configured)
+        else -> stringResource(R.string.conn_api_missing)
+    }
+    val chatTone = when {
+        chatRuntimeStatus is ChatRuntimeStatus.Connected -> SummaryTone.Good
+        chatRuntimeStatus == ChatRuntimeStatus.Connecting -> SummaryTone.Info
+        gatewayAvailability == GatewayAvailability.SignInRequired -> SummaryTone.Info
+        dashboardStatus?.reachable == true && !dashboardSignInRequired -> SummaryTone.Good
+        connection.capabilities.chatConfigured -> SummaryTone.Neutral
         else -> SummaryTone.Neutral
     }
 
@@ -374,99 +649,78 @@ private fun ConnectionSurfaceSummary(
         else -> SummaryTone.Neutral
     }
 
-    // A single grouped surface with dot + label + value rows — the
-    // steps/timeline vocabulary shared with the detail's Features list.
-    Surface(
-        color = MaterialTheme.colorScheme.surface.copy(alpha = 0.5f),
-        shape = RoundedCornerShape(12.dp),
+    Row(
         modifier = Modifier.fillMaxWidth(),
+        horizontalArrangement = Arrangement.spacedBy(8.dp),
     ) {
-        Column(modifier = Modifier.padding(horizontal = 4.dp, vertical = 4.dp)) {
-            ConnectionSurfaceRow(label = stringResource(R.string.conn_api_label), value = apiText, tone = apiTone)
-            SurfaceRowDivider()
-            ConnectionSurfaceRow(
-                label = stringResource(R.string.conn_dashboard_label),
-                value = dashboardText,
-                tone = dashboardTone,
-                onClick = if (dashboardSignInRequired) onOpenDashboard else null,
-            )
-            SurfaceRowDivider()
-            ConnectionSurfaceRow(
-                label = stringResource(R.string.conn_voice_label),
-                value = voiceText,
-                tone = voiceTone,
-                onClick = if (standardVoiceAvailability == StandardVoiceAvailability.SignInRequired) onOpenDashboard else null,
-            )
-            SurfaceRowDivider()
-            ConnectionSurfaceRow(label = stringResource(R.string.conn_relay_label), value = relayText, tone = relayTone)
-        }
+        ConnectionStatusChip(Icons.Filled.Chat, stringResource(R.string.conn_chat_label), chatText, chatTone, Modifier.weight(1f))
+        ConnectionStatusChip(
+            Icons.Filled.Dashboard,
+            stringResource(R.string.conn_manage_label),
+            dashboardText,
+            dashboardTone,
+            Modifier.weight(1f),
+            if (dashboardSignInRequired) onOpenDashboard else null,
+        )
+        ConnectionStatusChip(
+            Icons.Filled.GraphicEq,
+            stringResource(R.string.conn_voice_label),
+            voiceText,
+            voiceTone,
+            Modifier.weight(1f),
+            if (standardVoiceAvailability == StandardVoiceAvailability.SignInRequired) onOpenDashboard else null,
+        )
+        ConnectionStatusChip(Icons.Filled.CellTower, stringResource(R.string.conn_relay_label), relayText, relayTone, Modifier.weight(1f))
     }
 }
 
 private enum class SummaryTone { Neutral, Good, Info, Warning }
 
-/** Hairline divider between summary rows — inset so it reads as a list. */
 @Composable
-private fun SurfaceRowDivider() {
-    HorizontalDivider(
-        modifier = Modifier.padding(horizontal = 12.dp),
-        color = MaterialTheme.colorScheme.outlineVariant.copy(alpha = 0.4f),
-    )
-}
-
-/**
- * One health line: status dot + label + value. The dot carries the tone so
- * the value text stays short and the row stays light.
- */
-@Composable
-private fun ConnectionSurfaceRow(
+private fun ConnectionStatusChip(
+    icon: ImageVector,
     label: String,
     value: String,
     tone: SummaryTone,
     modifier: Modifier = Modifier,
     onClick: (() -> Unit)? = null,
 ) {
-    val dotColor = when (tone) {
-        SummaryTone.Good -> com.hermesandroid.relay.ui.theme.RelayRefresh.Green
-        SummaryTone.Info -> MaterialTheme.colorScheme.primary
-        SummaryTone.Warning -> MaterialTheme.colorScheme.error
-        SummaryTone.Neutral -> MaterialTheme.colorScheme.onSurfaceVariant.copy(alpha = 0.5f)
-    }
-    val valueColor = when (tone) {
+    val accent = when (tone) {
         SummaryTone.Good -> com.hermesandroid.relay.ui.theme.RelayRefresh.Green
         SummaryTone.Info -> MaterialTheme.colorScheme.primary
         SummaryTone.Warning -> MaterialTheme.colorScheme.error
         SummaryTone.Neutral -> MaterialTheme.colorScheme.onSurfaceVariant
     }
-    Row(
-        modifier = modifier
-            .fillMaxWidth()
-            .then(if (onClick != null) Modifier.clickable(onClick = onClick) else Modifier)
-            .padding(horizontal = 8.dp, vertical = 9.dp),
-        verticalAlignment = Alignment.CenterVertically,
-        horizontalArrangement = Arrangement.spacedBy(10.dp),
+    Surface(
+        modifier = modifier.then(if (onClick != null) Modifier.clickable(onClick = onClick) else Modifier),
+        color = MaterialTheme.colorScheme.surface.copy(alpha = 0.55f),
+        shape = RoundedCornerShape(10.dp),
     ) {
-        Box(
-            modifier = Modifier
-                .size(8.dp)
-                .clip(RoundedCornerShape(50))
-                .background(dotColor),
-        )
-        Text(
-            text = label,
-            style = MaterialTheme.typography.bodyMedium,
-            color = MaterialTheme.colorScheme.onSurface,
-            modifier = Modifier.weight(1f),
-            maxLines = 1,
-            overflow = TextOverflow.Ellipsis,
-        )
-        Text(
-            text = value,
-            style = MaterialTheme.typography.bodySmall,
-            color = valueColor,
-            maxLines = 1,
-            overflow = TextOverflow.Ellipsis,
-        )
+        Column(
+            modifier = Modifier.padding(horizontal = 6.dp, vertical = 8.dp),
+            horizontalAlignment = Alignment.CenterHorizontally,
+            verticalArrangement = Arrangement.spacedBy(3.dp),
+        ) {
+            Icon(
+                imageVector = icon,
+                contentDescription = null,
+                tint = MaterialTheme.colorScheme.onSurface,
+                modifier = Modifier.size(18.dp),
+            )
+            Text(
+                text = label,
+                style = MaterialTheme.typography.labelMedium,
+                color = MaterialTheme.colorScheme.onSurface,
+                maxLines = 1,
+            )
+            Text(
+                text = value,
+                style = MaterialTheme.typography.labelSmall,
+                color = accent,
+                maxLines = 1,
+                overflow = TextOverflow.Ellipsis,
+            )
+        }
     }
 }
 
@@ -477,21 +731,15 @@ private fun Connection.hasConfiguredRelay(): Boolean {
         !RelayUrlDeriver.isAutoManagedRelayUrl(trimmedRelayUrl, apiServerUrl)
 }
 
-/**
- * Hand-rolled "N minutes ago" formatter for the card subtitle. `DateUtils`
- * returns awkward copy ("in 0 minutes") for small deltas.
- */
-private fun formatPairedRelative(context: Context, pairedAtMillis: Long): String {
-    val deltaMs = System.currentTimeMillis() - pairedAtMillis
-    if (deltaMs < 0) return context.getString(R.string.conn_just_paired)
-    val minutes = TimeUnit.MILLISECONDS.toMinutes(deltaMs)
-    val hours = TimeUnit.MILLISECONDS.toHours(deltaMs)
-    val days = TimeUnit.MILLISECONDS.toDays(deltaMs)
-    return when {
-        minutes < 1L -> context.getString(R.string.conn_just_paired)
-        minutes < 60L -> context.resources.getQuantityString(R.plurals.conn_paired_minutes_ago, minutes.toInt(), minutes)
-        hours < 24L -> context.resources.getQuantityString(R.plurals.conn_paired_hours_ago, hours.toInt(), hours)
-        days < 30L -> context.resources.getQuantityString(R.plurals.conn_paired_days_ago, days.toInt(), days)
-        else -> context.getString(R.string.conn_paired)
+private fun formatUsedRelative(context: Context, usedAtMillis: Long): String {
+    val relative = if (System.currentTimeMillis() - usedAtMillis < DateUtils.MINUTE_IN_MILLIS) {
+        context.getString(R.string.conn_just_now)
+    } else {
+        DateUtils.getRelativeTimeSpanString(
+            usedAtMillis,
+            System.currentTimeMillis(),
+            DateUtils.MINUTE_IN_MILLIS,
+        ).toString()
     }
+    return context.getString(R.string.conn_last_used_format, relative)
 }

app/src/main/kotlin/com/hermesandroid/relay/ui/screens/DashboardManageDiskCache.kt

@@ -44,11 +44,16 @@ internal enum class DashboardActionKind {
     EnableMcp,
     DisableMcp,
     TestMcp,
+    AuthenticateMcp,
     RemoveMcp,
     InstallMcpCatalog,
     ViewProfileSoul,
     ActivateProfile,
     DeleteProfile,
+    EditCustomEndpoint,
+    ValidateCustomEndpoint,
+    ActivateCustomEndpoint,
+    DeleteCustomEndpoint,
 
     // Input-backed kinds — intercepted before runAction and routed to a
     // text-input or model-picker dialog instead of firing immediately.

app/src/main/kotlin/com/hermesandroid/relay/ui/screens/DashboardSignInScreen.kt

@@ -0,0 +1,587 @@
+package com.hermesandroid.relay.ui.screens
+
+import android.webkit.CookieManager
+import android.webkit.WebResourceRequest
+import android.webkit.WebView
+import android.webkit.WebViewClient
+import androidx.compose.foundation.layout.Arrangement
+import androidx.compose.foundation.layout.Column
+import androidx.compose.foundation.layout.fillMaxSize
+import androidx.compose.foundation.layout.fillMaxWidth
+import androidx.compose.foundation.layout.heightIn
+import androidx.compose.foundation.layout.padding
+import androidx.compose.material.icons.Icons
+import androidx.compose.material.icons.automirrored.filled.ArrowBack
+import androidx.compose.material.icons.filled.Close
+import androidx.compose.material.icons.filled.Check
+import androidx.compose.material3.Button
+import androidx.compose.material3.Card
+import androidx.compose.material3.CircularProgressIndicator
+import androidx.compose.material3.ExperimentalMaterial3Api
+import androidx.compose.material3.HorizontalDivider
+import androidx.compose.material3.Icon
+import androidx.compose.material3.IconButton
+import androidx.compose.material3.MaterialTheme
+import androidx.compose.material3.OutlinedTextField
+import androidx.compose.material3.Scaffold
+import androidx.compose.material3.Text
+import androidx.compose.material3.TopAppBar
+import androidx.compose.runtime.Composable
+import androidx.compose.runtime.DisposableEffect
+import androidx.compose.runtime.LaunchedEffect
+import androidx.compose.runtime.collectAsState
+import androidx.compose.runtime.getValue
+import androidx.compose.runtime.mutableStateOf
+import androidx.compose.runtime.remember
+import androidx.compose.runtime.rememberCoroutineScope
+import androidx.compose.runtime.setValue
+import androidx.compose.ui.Modifier
+import androidx.compose.ui.Alignment
+import androidx.compose.ui.platform.LocalContext
+import androidx.compose.ui.res.stringResource
+import androidx.compose.ui.text.input.PasswordVisualTransformation
+import androidx.compose.ui.unit.dp
+import androidx.compose.ui.viewinterop.AndroidView
+import androidx.compose.ui.window.Dialog
+import com.hermesandroid.relay.R
+import com.hermesandroid.relay.ui.components.ConnectionSetupTimeline
+import com.hermesandroid.relay.ui.components.ConnectionSetupTimelineStep
+import com.hermesandroid.relay.network.upstream.DashboardApiClient
+import com.hermesandroid.relay.network.upstream.DashboardAuthProvider
+import com.hermesandroid.relay.network.upstream.DashboardAuthSession
+import com.hermesandroid.relay.network.upstream.DashboardCookieStore
+import com.hermesandroid.relay.network.upstream.EncryptedDashboardCookieStore
+import com.hermesandroid.relay.network.upstream.DashboardRedirectAuthMode
+import com.hermesandroid.relay.network.upstream.NativeDashboardSignInCoordinator
+import com.hermesandroid.relay.network.upstream.dashboardRedirectAuthMode
+import com.hermesandroid.relay.network.upstream.importDashboardCookieHeader
+import com.hermesandroid.relay.network.upstream.isNativeDashboardTransportEligible
+import com.hermesandroid.relay.viewmodel.ConnectionViewModel
+import kotlinx.coroutines.CancellationException
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.Job
+import kotlinx.coroutines.launch
+import kotlinx.coroutines.withContext
+
+/**
+ * Connection-level Dashboard authentication flow. It is deliberately outside
+ * Manage so onboarding, connection setup, Voice, Chat, and Manage can all use
+ * the same cookie/session flow without inheriting Manage's navigation stack.
+ */
+@OptIn(ExperimentalMaterial3Api::class)
+@Composable
+fun DashboardSignInScreen(
+    connectionViewModel: ConnectionViewModel,
+    onBack: () -> Unit,
+    onAuthenticated: () -> Unit,
+) {
+    val context = LocalContext.current
+    val appContext = context.applicationContext
+    val scope = rememberCoroutineScope()
+    val activeConnection by connectionViewModel.activeConnection.collectAsState()
+    val dashboardUrl by connectionViewModel.effectiveDashboardUrl.collectAsState()
+    val routeHint by connectionViewModel.dashboardRouteMovedHint.collectAsState()
+    val connectionId = activeConnection?.id ?: "default"
+    var providers by remember(dashboardUrl, connectionId) {
+        mutableStateOf<List<DashboardAuthProvider>>(emptyList())
+    }
+    var loading by remember(dashboardUrl, connectionId) { mutableStateOf(true) }
+    var actionInFlight by remember { mutableStateOf(false) }
+    var actionMessage by remember { mutableStateOf<String?>(null) }
+    var actionIsError by remember { mutableStateOf(false) }
+    var oauthProvider by remember { mutableStateOf<DashboardAuthProvider?>(null) }
+    var redirectAuthMode by remember(dashboardUrl, connectionId) {
+        mutableStateOf(DashboardRedirectAuthMode.WebView)
+    }
+    var nativeSignInJob by remember(dashboardUrl, connectionId) { mutableStateOf<Job?>(null) }
+    var authenticationComplete by remember { mutableStateOf(false) }
+
+    val cookieStoreFactory = remember(appContext, connectionId) {
+        {
+            connectionViewModel.activeDashboardCookieStore()
+                ?: EncryptedDashboardCookieStore(appContext, connectionId)
+        }
+    }
+    val clientFactory = remember(dashboardUrl, connectionViewModel) {
+        { connectionViewModel.dashboardClientForActive(dashboardUrl) }
+    }
+
+    suspend fun verifyAndRecord(client: DashboardApiClient): DashboardAuthSession? {
+        val status = client.getStatus().getOrNull()
+        val session = client.currentSession().getOrNull()
+        val ticketAvailable = if (session?.authenticated == true) {
+            client.requestWsTicket().isSuccess
+        } else {
+            null
+        }
+        connectionViewModel.recordDashboardStatus(
+            status = status,
+            session = session,
+            reachable = status != null,
+            gatewayTicketAvailable = ticketAvailable,
+        )
+        return session
+    }
+
+    fun finishAuthentication() {
+        scope.launch {
+            invalidateDashboardManageCache(appContext.cacheDir)
+            connectionViewModel.refreshStandardVoice()
+            connectionViewModel.refreshDashboardProfiles()
+            authenticationComplete = true
+        }
+    }
+
+    LaunchedEffect(dashboardUrl, connectionId) {
+        if (dashboardUrl.isBlank()) {
+            loading = false
+            actionMessage = context.getString(R.string.dashboard_no_url_configured)
+            return@LaunchedEffect
+        }
+        val client = clientFactory()
+        try {
+            val status = client.getStatus().getOrElse {
+                actionMessage = it.message ?: context.getString(R.string.dashboard_request_failed)
+                actionIsError = true
+                return@LaunchedEffect
+            }
+            providers = client.getAuthProviders().getOrNull()
+                ?.takeIf { it.isNotEmpty() }
+                ?: status.authProviderDetails
+            redirectAuthMode = dashboardRedirectAuthMode(status.authFlows)
+            val session = if (status.authRequired) client.currentSession().getOrNull() else null
+            connectionViewModel.recordDashboardStatus(
+                status = status,
+                session = session,
+                reachable = true,
+                gatewayTicketAvailable = null,
+            )
+            if (!status.authRequired || session?.authenticated == true) {
+                finishAuthentication()
+            }
+        } finally {
+            loading = false
+            client.shutdown()
+        }
+    }
+
+    fun submitPassword(provider: String, username: String, password: String) {
+        if (actionInFlight || dashboardUrl.isBlank()) return
+        actionInFlight = true
+        actionMessage = null
+        actionIsError = false
+        scope.launch {
+            val client = clientFactory()
+            try {
+                val result = client.loginPassword(provider, username, password)
+                val session = if (result.isSuccess) verifyAndRecord(client) else null
+                if (result.isSuccess && session?.authenticated == true) {
+                    finishAuthentication()
+                } else {
+                    actionMessage = result.exceptionOrNull()?.message
+                        ?: context.getString(R.string.dashboard_signin_no_session)
+                    actionIsError = true
+                }
+            } catch (e: Exception) {
+                actionMessage = e.message ?: context.getString(R.string.dashboard_signin_failed)
+                actionIsError = true
+            } finally {
+                actionInFlight = false
+                client.shutdown()
+            }
+        }
+    }
+
+    fun startRedirectSignIn(provider: DashboardAuthProvider) {
+        if (actionInFlight || dashboardUrl.isBlank()) return
+        if (redirectAuthMode == DashboardRedirectAuthMode.WebView) {
+            oauthProvider = provider
+            return
+        }
+        if (!isNativeDashboardTransportEligible(dashboardUrl)) {
+            actionMessage = context.getString(R.string.dashboard_native_signin_requires_https)
+            actionIsError = true
+            return
+        }
+        val authClient = connectionViewModel.nativeDashboardAuthClientForActive(dashboardUrl)
+        if (authClient == null) {
+            actionMessage = context.getString(R.string.dashboard_native_signin_unavailable)
+            actionIsError = true
+            return
+        }
+
+        actionInFlight = true
+        actionIsError = false
+        actionMessage = context.getString(R.string.dashboard_native_signin_opening)
+        nativeSignInJob = scope.launch {
+            try {
+                NativeDashboardSignInCoordinator(authClient).signIn(provider.name) { authorizationUrl ->
+                    withContext(Dispatchers.Main.immediate) {
+                        launchNativeDashboardAuthorization(context, authorizationUrl)
+                    }
+                }
+                val client = clientFactory()
+                val session = try {
+                    verifyAndRecord(client)
+                } finally {
+                    client.shutdown()
+                }
+                if (session?.authenticated == true) {
+                    actionMessage = session.provider?.let {
+                        context.getString(R.string.dashboard_signed_in_with, it)
+                    } ?: context.getString(R.string.dashboard_signed_in)
+                    actionIsError = false
+                    finishAuthentication()
+                } else {
+                    actionMessage = context.getString(R.string.dashboard_signin_no_session)
+                    actionIsError = true
+                }
+            } catch (cancelled: CancellationException) {
+                throw cancelled
+            } catch (error: Exception) {
+                actionMessage = error.message
+                    ?: context.getString(R.string.dashboard_signin_failed)
+                actionIsError = true
+            } finally {
+                actionInFlight = false
+                nativeSignInJob = null
+            }
+        }
+    }
+
+    DisposableEffect(dashboardUrl, connectionId) {
+        onDispose { nativeSignInJob?.cancel() }
+    }
+
+    oauthProvider
+        ?.takeIf { redirectAuthMode == DashboardRedirectAuthMode.WebView }
+        ?.let { provider ->
+        DashboardOAuthDialog(
+            dashboardUrl = dashboardUrl,
+            provider = provider,
+            cookieStoreFactory = cookieStoreFactory,
+            clientFactory = clientFactory,
+            onDismiss = { oauthProvider = null },
+            onAuthenticated = { session ->
+                oauthProvider = null
+                scope.launch {
+                    val client = clientFactory()
+                    try {
+                        verifyAndRecord(client)
+                    } finally {
+                        client.shutdown()
+                    }
+                    actionMessage = session.provider?.let {
+                        context.getString(R.string.dashboard_signed_in_with, it)
+                    } ?: context.getString(R.string.dashboard_signed_in)
+                    finishAuthentication()
+                }
+            },
+            onError = {
+                actionMessage = it
+                actionIsError = true
+            },
+        )
+    }
+
+    Scaffold(
+        topBar = {
+            TopAppBar(
+                title = { Text(stringResource(R.string.dashboard_sign_in)) },
+                navigationIcon = {
+                    IconButton(onClick = {
+                        nativeSignInJob?.cancel()
+                        onBack()
+                    }) {
+                        Icon(
+                            Icons.AutoMirrored.Filled.ArrowBack,
+                            contentDescription = stringResource(R.string.dashboard_back),
+                        )
+                    }
+                },
+            )
+        },
+    ) { padding ->
+        Column(
+            modifier = Modifier
+                .fillMaxSize()
+                .padding(padding)
+                .padding(20.dp),
+            verticalArrangement = Arrangement.spacedBy(14.dp),
+        ) {
+            if (authenticationComplete) {
+                DashboardAuthenticationComplete(onContinue = onAuthenticated)
+            } else if (loading) {
+                CircularProgressIndicator()
+            } else {
+                DashboardSignInForm(
+                    dashboardUrl = dashboardUrl,
+                    routeHint = routeHint,
+                    providers = providers,
+                    actionInFlight = actionInFlight,
+                    actionMessage = actionMessage,
+                    actionIsError = actionIsError,
+                    nativePkce = redirectAuthMode == DashboardRedirectAuthMode.NativePkce,
+                    nativeSignInInFlight = nativeSignInJob != null,
+                    nativeTransportEligible = isNativeDashboardTransportEligible(dashboardUrl),
+                    onSignIn = ::submitPassword,
+                    onOAuthSignIn = ::startRedirectSignIn,
+                    onCancelNativeSignIn = {
+                        actionMessage = context.getString(R.string.dashboard_native_signin_cancelled)
+                        actionIsError = false
+                        nativeSignInJob?.cancel()
+                    },
+                )
+            }
+        }
+    }
+}
+
+@Composable
+private fun DashboardAuthenticationComplete(onContinue: () -> Unit) {
+    Column(
+        modifier = Modifier.fillMaxWidth(),
+        horizontalAlignment = Alignment.CenterHorizontally,
+        verticalArrangement = Arrangement.spacedBy(16.dp),
+    ) {
+        Text(
+            text = stringResource(R.string.cw_step_3_3),
+            style = MaterialTheme.typography.labelMedium,
+            color = MaterialTheme.colorScheme.onSurfaceVariant,
+        )
+        Icon(
+            imageVector = Icons.Filled.Check,
+            contentDescription = null,
+            tint = MaterialTheme.colorScheme.primary,
+        )
+        Text(
+            text = stringResource(R.string.cw_dashboard_connected_title),
+            style = MaterialTheme.typography.headlineSmall,
+        )
+        Text(
+            text = stringResource(R.string.cw_dashboard_connected_body),
+            style = MaterialTheme.typography.bodyMedium,
+            color = MaterialTheme.colorScheme.onSurfaceVariant,
+        )
+        ConnectionSetupTimeline(
+            steps = listOf(
+                ConnectionSetupTimelineStep(
+                    stringResource(R.string.cw_timeline_discovered),
+                    stringResource(R.string.cw_timeline_discovered_detail),
+                ),
+                ConnectionSetupTimelineStep(
+                    stringResource(R.string.cw_timeline_access),
+                    stringResource(R.string.cw_timeline_authenticated),
+                ),
+                ConnectionSetupTimelineStep(
+                    stringResource(R.string.cw_timeline_ready),
+                    stringResource(R.string.cw_timeline_ready_detail),
+                ),
+            ),
+        )
+        Button(
+            onClick = onContinue,
+            modifier = Modifier.fillMaxWidth(),
+        ) {
+            Text(stringResource(R.string.cw_continue))
+        }
+    }
+}
+
+@Composable
+private fun DashboardSignInForm(
+    dashboardUrl: String,
+    routeHint: String?,
+    providers: List<DashboardAuthProvider>,
+    actionInFlight: Boolean,
+    actionMessage: String?,
+    actionIsError: Boolean,
+    nativePkce: Boolean,
+    nativeSignInInFlight: Boolean,
+    nativeTransportEligible: Boolean,
+    onSignIn: (String, String, String) -> Unit,
+    onOAuthSignIn: (DashboardAuthProvider) -> Unit,
+    onCancelNativeSignIn: () -> Unit,
+) {
+    var username by remember { mutableStateOf("") }
+    var password by remember { mutableStateOf("") }
+    val passwordProvider = providers.firstOrNull { it.supportsPassword }
+    val redirectProviders = providers.filter { it.isRedirectProvider }
+
+    Text(
+        text = stringResource(R.string.dashboard_signin_required_title),
+        style = MaterialTheme.typography.headlineSmall,
+    )
+    Text(
+        text = stringResource(R.string.dashboard_signin_required_body, dashboardUrl),
+        style = MaterialTheme.typography.bodyMedium,
+        color = MaterialTheme.colorScheme.onSurfaceVariant,
+    )
+    routeHint?.let {
+        Text(
+            text = stringResource(R.string.dashboard_signin_route_hint, it),
+            style = MaterialTheme.typography.bodySmall,
+            color = MaterialTheme.colorScheme.onTertiaryContainer,
+        )
+    }
+    redirectProviders.forEach { provider ->
+        Button(
+            onClick = { onOAuthSignIn(provider) },
+            enabled = !actionInFlight && (!nativePkce || nativeTransportEligible),
+            modifier = Modifier.fillMaxWidth(),
+        ) {
+            Text(stringResource(R.string.dashboard_signin_with_provider, provider.displayName ?: provider.name))
+        }
+    }
+    if (nativePkce && !nativeTransportEligible && redirectProviders.isNotEmpty()) {
+        Text(
+            text = stringResource(R.string.dashboard_native_signin_requires_https),
+            style = MaterialTheme.typography.bodySmall,
+            color = MaterialTheme.colorScheme.error,
+        )
+    }
+    if (passwordProvider != null || providers.isEmpty()) {
+        if (redirectProviders.isNotEmpty()) HorizontalDivider()
+        OutlinedTextField(
+            value = username,
+            onValueChange = { username = it },
+            label = { Text(stringResource(R.string.dashboard_username)) },
+            modifier = Modifier.fillMaxWidth(),
+            singleLine = true,
+        )
+        OutlinedTextField(
+            value = password,
+            onValueChange = { password = it },
+            label = { Text(stringResource(R.string.dashboard_password)) },
+            modifier = Modifier.fillMaxWidth(),
+            singleLine = true,
+            visualTransformation = PasswordVisualTransformation(),
+        )
+        Button(
+            onClick = { onSignIn(passwordProvider?.name ?: "basic", username, password) },
+            enabled = !actionInFlight && username.isNotBlank() && password.isNotBlank(),
+            modifier = Modifier.fillMaxWidth(),
+        ) {
+            Text(if (actionInFlight) stringResource(R.string.dashboard_signing_in) else stringResource(R.string.dashboard_sign_in))
+        }
+    }
+    actionMessage?.let {
+        Text(
+            it,
+            style = MaterialTheme.typography.bodySmall,
+            color = if (actionIsError) {
+                MaterialTheme.colorScheme.error
+            } else {
+                MaterialTheme.colorScheme.onSurfaceVariant
+            },
+        )
+    }
+    if (nativeSignInInFlight) {
+        Button(
+            onClick = onCancelNativeSignIn,
+            modifier = Modifier.fillMaxWidth(),
+        ) {
+            Text(stringResource(R.string.dashboard_cancel))
+        }
+    }
+}
+
+@Composable
+private fun DashboardOAuthDialog(
+    dashboardUrl: String,
+    provider: DashboardAuthProvider,
+    cookieStoreFactory: () -> DashboardCookieStore,
+    clientFactory: () -> DashboardApiClient,
+    onDismiss: () -> Unit,
+    onAuthenticated: (DashboardAuthSession) -> Unit,
+    onError: (String) -> Unit,
+) {
+    val context = LocalContext.current
+    val scope = rememberCoroutineScope()
+    val initialStatus = stringResource(R.string.dashboard_oauth_initial_status)
+    val verifyingStatus = stringResource(R.string.dashboard_oauth_verifying)
+    val notAcceptedStatus = stringResource(R.string.dashboard_oauth_not_accepted)
+    val verifyFailedStatus = stringResource(R.string.dashboard_oauth_verify_failed)
+    var statusText by remember(initialStatus) { mutableStateOf(initialStatus) }
+    var checking by remember { mutableStateOf(false) }
+    val loginUrl = remember(dashboardUrl, provider.name) {
+        DashboardApiClient.authLoginUrl(
+            baseUrl = dashboardUrl,
+            provider = provider.name,
+            next = DashboardApiClient.authLandingPath(dashboardUrl),
+        )
+    }
+
+    fun maybeVerify(url: String?) {
+        val loadedUrl = url?.takeIf { it.isNotBlank() } ?: return
+        val root = dashboardUrl.trim().trimEnd('/')
+        val relative = loadedUrl.trim().removePrefix(root)
+        val stillAuthenticating = relative.startsWith("/login", true) ||
+            relative.startsWith("/auth/login", true) ||
+            relative.startsWith("/auth/callback", true)
+        if (!loadedUrl.startsWith(root, true) || stillAuthenticating) return
+        val manager = CookieManager.getInstance()
+        manager.flush()
+        val imported = importDashboardCookieHeader(
+            cookieStoreFactory(),
+            loadedUrl,
+            manager.getCookie(loadedUrl),
+        )
+        if (checking || imported == 0) return
+        checking = true
+        statusText = verifyingStatus
+        scope.launch {
+            val client = clientFactory()
+            try {
+                val session = client.currentSession().getOrNull()
+                if (session?.authenticated == true) onAuthenticated(session) else {
+                    checking = false
+                    statusText = notAcceptedStatus
+                }
+            } catch (e: Exception) {
+                checking = false
+                val message = e.message ?: verifyFailedStatus
+                statusText = message
+                onError(message)
+            } finally {
+                client.shutdown()
+            }
+        }
+    }
+
+    Dialog(onDismissRequest = onDismiss) {
+        Card(modifier = Modifier.fillMaxWidth().heightIn(max = 640.dp)) {
+            Column(
+                modifier = Modifier.padding(12.dp),
+                verticalArrangement = Arrangement.spacedBy(8.dp),
+            ) {
+                IconButton(onClick = onDismiss) {
+                    Icon(Icons.Filled.Close, contentDescription = stringResource(R.string.dashboard_close_signin))
+                }
+                Text(statusText, style = MaterialTheme.typography.bodySmall)
+                AndroidView(
+                    modifier = Modifier.fillMaxWidth().weight(1f),
+                    factory = { viewContext ->
+                        CookieManager.getInstance().setAcceptCookie(true)
+                        WebView(viewContext).apply {
+                            settings.javaScriptEnabled = true
+                            settings.domStorageEnabled = true
+                            webViewClient = object : WebViewClient() {
+                                override fun shouldOverrideUrlLoading(
+                                    view: WebView,
+                                    request: WebResourceRequest,
+                                ): Boolean = false
+
+                                override fun onPageFinished(view: WebView, url: String?) {
+                                    super.onPageFinished(view, url)
+                                    maybeVerify(url)
+                                }
+                            }
+                            loadUrl(loginUrl)
+                        }
+                    },
+                )
+            }
+        }
+    }
+}

app/src/main/kotlin/com/hermesandroid/relay/ui/screens/DeveloperSettingsScreen.kt

@@ -34,13 +34,11 @@ import androidx.compose.material3.Icon
 import androidx.compose.material3.IconButton
 import androidx.compose.material3.MaterialTheme
 import androidx.compose.material3.Scaffold
-import androidx.compose.material3.Switch
 import androidx.compose.material3.Text
 import androidx.compose.material3.TextButton
 import androidx.compose.material3.TopAppBar
 import androidx.compose.material3.TopAppBarDefaults
 import androidx.compose.runtime.Composable
-import androidx.compose.runtime.collectAsState
 import androidx.compose.runtime.getValue
 import androidx.compose.runtime.mutableStateOf
 import androidx.compose.runtime.remember
@@ -64,8 +62,7 @@ import kotlinx.coroutines.launch
 
 /**
  * Dedicated Developer Options screen. Gated behind the tap-version-7x
- * unlock. Hosts feature flags (voice/terminal/bridge/etc.), data management
- * (clear session / wipe caches), and any experimental toggles.
+ * unlock. Hosts experimental labs, test tools, and data-management utilities.
  */
 @OptIn(ExperimentalMaterial3Api::class)
 @Composable
@@ -73,13 +70,12 @@ fun DeveloperSettingsScreen(
     connectionViewModel: ConnectionViewModel,
     onBack: () -> Unit,
     onNavigateToRealtimeVoice: () -> Unit = {},
+    onNavigateToImageGenerationLab: () -> Unit = {},
 ) {
     val context = LocalContext.current
     val scope = rememberCoroutineScope()
     val isDarkTheme = LocalBrand.current.isDark
 
-    val relayEnabled by FeatureFlags.relayEnabled(context).collectAsState(initial = FeatureFlags.isDevBuild)
-
     // Data management local state — unfolded from the private
     // DataManagementSection helper in the old SettingsScreen.
     var showResetDialog by remember { mutableStateOf(false) }
@@ -184,8 +180,17 @@ fun DeveloperSettingsScreen(
                             )
                         }
                         IconButton(onClick = {
-                            connectionViewModel.resetOnboarding()
-                            Toast.makeText(context, context.getString(R.string.dev_settings_onboarding_reset_toast), Toast.LENGTH_SHORT).show()
+                            connectionViewModel.resetOnboarding { success ->
+                                Toast.makeText(
+                                    context,
+                                    if (success) {
+                                        context.getString(R.string.dev_settings_onboarding_reset_toast)
+                                    } else {
+                                        context.getString(R.string.dev_settings_reset_failed)
+                                    },
+                                    Toast.LENGTH_SHORT,
+                                ).show()
+                            }
                         }) {
                             Icon(
                                 imageVector = Icons.Filled.RestartAlt,
@@ -299,42 +304,6 @@ fun DeveloperSettingsScreen(
                     modifier = Modifier.padding(16.dp),
                     verticalArrangement = Arrangement.spacedBy(12.dp)
                 ) {
-                    // Relay features toggle
-                    Row(
-                        modifier = Modifier.fillMaxWidth(),
-                        horizontalArrangement = Arrangement.SpaceBetween,
-                        verticalAlignment = Alignment.CenterVertically
-                    ) {
-                        Column(modifier = Modifier.weight(1f)) {
-                            Row(
-                                verticalAlignment = Alignment.CenterVertically,
-                                horizontalArrangement = Arrangement.spacedBy(6.dp)
-                            ) {
-                                Icon(
-                                    imageVector = Icons.Filled.Science,
-                                    contentDescription = null,
-                                    modifier = Modifier.size(16.dp),
-                                    tint = MaterialTheme.colorScheme.tertiary
-                                )
-                                Text(
-                                    text = stringResource(R.string.dev_settings_relay_features),
-                                    style = MaterialTheme.typography.bodyMedium
-                                )
-                            }
-                            Text(
-                                text = stringResource(R.string.dev_settings_relay_features_desc),
-                                style = MaterialTheme.typography.bodySmall,
-                                color = MaterialTheme.colorScheme.onSurfaceVariant
-                            )
-                        }
-                        Switch(
-                            checked = relayEnabled,
-                            onCheckedChange = { scope.launch { FeatureFlags.setRelayEnabled(context, it) } }
-                        )
-                    }
-
-                    HorizontalDivider()
-
                     Row(
                         modifier = Modifier.fillMaxWidth(),
                         horizontalArrangement = Arrangement.SpaceBetween,
@@ -372,6 +341,47 @@ fun DeveloperSettingsScreen(
 
                     HorizontalDivider()
 
+                    if (FeatureFlags.isDevBuild) {
+                        Row(
+                            modifier = Modifier.fillMaxWidth(),
+                            horizontalArrangement = Arrangement.SpaceBetween,
+                            verticalAlignment = Alignment.CenterVertically,
+                        ) {
+                            Column(modifier = Modifier.weight(1f)) {
+                                Row(
+                                    verticalAlignment = Alignment.CenterVertically,
+                                    horizontalArrangement = Arrangement.spacedBy(6.dp),
+                                ) {
+                                    Icon(
+                                        imageVector = Icons.Filled.Science,
+                                        contentDescription = null,
+                                        modifier = Modifier.size(16.dp),
+                                        tint = MaterialTheme.colorScheme.tertiary,
+                                    )
+                                    Text(
+                                        text = stringResource(R.string.dev_settings_image_generation_lab),
+                                        style = MaterialTheme.typography.bodyMedium,
+                                    )
+                                }
+                                Text(
+                                    text = stringResource(R.string.dev_settings_image_generation_lab_desc),
+                                    style = MaterialTheme.typography.bodySmall,
+                                    color = MaterialTheme.colorScheme.onSurfaceVariant,
+                                )
+                            }
+                            IconButton(onClick = onNavigateToImageGenerationLab) {
+                                Icon(
+                                    imageVector = Icons.Filled.Science,
+                                    contentDescription = stringResource(
+                                        R.string.dev_settings_open_image_generation_lab_cd
+                                    ),
+                                )
+                            }
+                        }
+
+                        HorizontalDivider()
+                    }
+
                     // Lock developer options
                     Row(
                         modifier = Modifier.fillMaxWidth(),
@@ -390,9 +400,15 @@ fun DeveloperSettingsScreen(
                             )
                         }
                         IconButton(onClick = {
-                            scope.launch { FeatureFlags.lockDevOptions(context) }
-                            Toast.makeText(context, context.getString(R.string.dev_settings_locked_toast), Toast.LENGTH_SHORT).show()
-                            onBack()
+                            scope.launch {
+                                FeatureFlags.lockDevOptions(context)
+                                Toast.makeText(
+                                    context,
+                                    context.getString(R.string.dev_settings_locked_toast),
+                                    Toast.LENGTH_SHORT,
+                                ).show()
+                                onBack()
+                            }
                         }) {
                             Icon(
                                 imageVector = Icons.Filled.Lock,
@@ -520,8 +536,16 @@ fun DeveloperSettingsScreen(
                     onClick = {
                         showExportDialog = false
                         connectionViewModel.exportSettings { json ->
-                            backupJson = json
-                            exportLauncher.launch("hermes-relay-sensitive-backup.json")
+                            if (json == null) {
+                                Toast.makeText(
+                                    context,
+                                    context.getString(R.string.dev_settings_export_failed),
+                                    Toast.LENGTH_SHORT,
+                                ).show()
+                            } else {
+                                backupJson = json
+                                exportLauncher.launch("hermes-relay-sensitive-backup.json")
+                            }
                         }
                     }
                 ) {
@@ -577,8 +601,17 @@ fun DeveloperSettingsScreen(
                 TextButton(
                     onClick = {
                         showResetDialog = false
-                        connectionViewModel.resetAppData()
-                        Toast.makeText(context, context.getString(R.string.dev_settings_app_data_reset_toast), Toast.LENGTH_SHORT).show()
+                        connectionViewModel.resetAppData { success ->
+                            Toast.makeText(
+                                context,
+                                if (success) {
+                                    context.getString(R.string.dev_settings_app_data_reset_toast)
+                                } else {
+                                    context.getString(R.string.dev_settings_reset_failed)
+                                },
+                                Toast.LENGTH_SHORT,
+                            ).show()
+                        }
                     }
                 ) {
                     Text(stringResource(R.string.dev_settings_reset_action), color = MaterialTheme.colorScheme.error)

app/src/main/kotlin/com/hermesandroid/relay/ui/screens/DiagnosticsScreen.kt

@@ -37,11 +37,16 @@ import com.hermesandroid.relay.diagnostics.DiagnosticsLog
 import com.hermesandroid.relay.diagnostics.StatusCheck
 import com.hermesandroid.relay.network.relay.RelayHttpClient
 import com.hermesandroid.relay.network.shared.ConnectivityObserver
+import com.hermesandroid.relay.network.upstream.GatewayAvailability
 import com.hermesandroid.relay.network.upstream.ServerCapabilities
 import com.hermesandroid.relay.ui.components.DiagnosticDetailDialog
 import com.hermesandroid.relay.ui.components.DiagnosticsLogPanel
 import com.hermesandroid.relay.ui.components.StatusCheckTimeline
+import com.hermesandroid.relay.viewmodel.ChatRuntimeStatus
+import com.hermesandroid.relay.viewmodel.ChatTransportPath
+import com.hermesandroid.relay.viewmodel.ChatTransportReadiness
 import com.hermesandroid.relay.viewmodel.ConnectionViewModel
+import com.hermesandroid.relay.viewmodel.resolveChatRuntimeStatus
 
 /**
  * Dedicated Diagnostics screen — replaces the old modal bottom sheet. Hosts a
@@ -62,17 +67,21 @@ fun DiagnosticsScreen(
     onBack: () -> Unit,
 ) {
     val network by connectionViewModel.networkStatus.collectAsState()
+    val activeConnection by connectionViewModel.activeConnection.collectAsState()
+    val dashboardUrl by connectionViewModel.effectiveDashboardUrl.collectAsState()
+    val gatewayAvailability by connectionViewModel.gatewayAvailability.collectAsState()
     val apiHealth by connectionViewModel.apiServerHealth.collectAsState()
     val apiUrl by connectionViewModel.apiServerUrl.collectAsState()
     val capabilities by connectionViewModel.serverCapabilities.collectAsState()
     val authState by connectionViewModel.authState.collectAsState()
-    val chatReady by connectionViewModel.chatReady.collectAsState()
     val relayConfigured by connectionViewModel.relayConfigured.collectAsState()
     val relayHealth by connectionViewModel.relayServerHealth.collectAsState()
     val relayReady by connectionViewModel.relayReady.collectAsState()
     val relayUpdateInfo by connectionViewModel.relayUpdateInfo.collectAsState()
     val relayInfo by connectionViewModel.relayInfo.collectAsState()
-    val selectedProfile by connectionViewModel.selectedProfile.collectAsState()
+    val effectiveSessionProfileName by
+        connectionViewModel.effectiveSessionProfileName.collectAsState()
+    val toolsets by connectionViewModel.toolsetInventory.collectAsState()
     val checkedAt by connectionViewModel.diagnosticsCheckedAt.collectAsState()
     val refreshing by connectionViewModel.diagnosticsRefreshing.collectAsState()
     val voiceReady by connectionViewModel.voiceReady.collectAsState()
@@ -82,17 +91,20 @@ fun DiagnosticsScreen(
     val context = androidx.compose.ui.platform.LocalContext.current
 
     val checks = remember(
-        network, apiHealth, apiUrl, capabilities, authState, chatReady,
+        network, activeConnection, dashboardUrl, gatewayAvailability,
+        apiHealth, apiUrl, capabilities, authState,
         relayConfigured, relayHealth, relayReady, relayUpdateInfo,
         voiceReady, relayVoiceReady, entries,
     ) {
         buildStatusChecks(
             network = network,
+            dashboardUrl = dashboardUrl,
+            gatewayAvailability = gatewayAvailability,
+            apiConfigured = activeConnection?.apiServerUrl?.isNotBlank() == true,
             apiHealth = apiHealth,
             apiUrl = apiUrl,
             capabilities = capabilities,
             authState = authState,
-            chatReady = chatReady,
             relayConfigured = relayConfigured,
             relayHealth = relayHealth,
             relayReady = relayReady,
@@ -171,7 +183,19 @@ fun DiagnosticsScreen(
                     style = MaterialTheme.typography.bodySmall,
                     color = MaterialTheme.colorScheme.onSurfaceVariant,
                 )
-                val profileKey = selectedProfile?.name ?: "(default)"
+                info.gatewayHeartbeat?.let { heartbeat ->
+                    val detail = heartbeat.ageSeconds?.let { " · ${it}s" }.orEmpty()
+                    Text(
+                        text = stringResource(R.string.diag_gateway_heartbeat, heartbeat.status, detail),
+                        style = MaterialTheme.typography.bodySmall,
+                        color = if (heartbeat.status in setOf("stale", "malformed", "pid_mismatch", "start_mismatch")) {
+                            MaterialTheme.colorScheme.error
+                        } else {
+                            MaterialTheme.colorScheme.onSurfaceVariant
+                        },
+                    )
+                }
+                val profileKey = effectiveSessionProfileName ?: "(default)"
                 val profileState = info.profiles.firstOrNull { it.name == profileKey }?.relayState
                     ?: stringResource(R.string.diag_check_not_checked)
                 Text(
@@ -180,6 +204,22 @@ fun DiagnosticsScreen(
                     color = MaterialTheme.colorScheme.onSurfaceVariant,
                 )
             }
+            toolsets?.let { inventory ->
+                val enabled = inventory.count { it.enabled }
+                val relayVisible = inventory.any { item ->
+                    item.tools.any { it.startsWith("relay_") || it.startsWith("android_") }
+                }
+                Text(
+                    text = stringResource(
+                        R.string.diag_toolsets_inventory,
+                        enabled,
+                        inventory.size,
+                        if (relayVisible) stringResource(R.string.diag_yes) else stringResource(R.string.diag_no),
+                    ),
+                    style = MaterialTheme.typography.bodySmall,
+                    color = MaterialTheme.colorScheme.onSurfaceVariant,
+                )
+            }
 
             StatusCheckTimeline(
                 checks = checks,
@@ -233,11 +273,13 @@ fun DiagnosticsScreen(
  */
 internal fun buildStatusChecks(
     network: ConnectivityObserver.Status,
+    dashboardUrl: String,
+    gatewayAvailability: GatewayAvailability,
+    apiConfigured: Boolean,
     apiHealth: ConnectionViewModel.HealthStatus,
     apiUrl: String,
     capabilities: ServerCapabilities,
     authState: AuthState,
-    chatReady: Boolean,
     relayConfigured: Boolean,
     relayHealth: ConnectionViewModel.HealthStatus,
     relayReady: Boolean,
@@ -279,37 +321,94 @@ internal fun buildStatusChecks(
             )
     }
 
-    // 2) API server reachability.
-    val apiLabel = context.getString(R.string.diag_check_api_server)
+    // 2) Dashboard/Gateway — the standard upstream Hermes connection.
+    val dashboardLabel = context.getString(R.string.cw_dashboard) + " / " +
+        context.getString(R.string.chat_settings_gateway)
     val reachableAt = context.getString(R.string.diag_check_reachable_at)
     val reachable = context.getString(R.string.diag_check_reachable)
     val notReachableAt = context.getString(R.string.diag_check_not_reachable_at)
     val notReachable = context.getString(R.string.diag_check_not_reachable)
     val probing = context.getString(R.string.diag_check_probing)
     val notChecked = context.getString(R.string.diag_check_not_checked)
+    val dashboardHost = DiagnosticsLog.sanitizeUrl(dashboardUrl)
+    val dashboardErr = recentError(DiagnosticCategory.Endpoint)
+    checks += when {
+        dashboardUrl.isBlank() ->
+            StatusCheck(
+                dashboardLabel, CheckStatus.Unknown,
+                reason = context.getString(R.string.active_section_not_configured),
+                category = DiagnosticCategory.Endpoint,
+            )
+        gatewayAvailability == GatewayAvailability.Ready ->
+            StatusCheck(
+                dashboardLabel, CheckStatus.Pass,
+                reason = dashboardHost?.let {
+                    context.getString(R.string.diag_check_reachable_at, it)
+                } ?: reachable,
+                category = DiagnosticCategory.Endpoint,
+            )
+        gatewayAvailability == GatewayAvailability.SignInRequired ->
+            StatusCheck(
+                dashboardLabel, CheckStatus.Warn,
+                reason = context.getString(R.string.cw_dashboard_sign_in_required),
+                category = DiagnosticCategory.Auth,
+            )
+        gatewayAvailability == GatewayAvailability.Unreachable ->
+            StatusCheck(
+                dashboardLabel, CheckStatus.Fail,
+                reason = dashboardErr?.message()
+                    ?: dashboardHost?.let {
+                        context.getString(R.string.diag_check_not_reachable_at, it)
+                    }
+                    ?: notReachable,
+                category = DiagnosticCategory.Endpoint,
+                timestampMs = dashboardErr?.timestampMs,
+            )
+        gatewayAvailability == GatewayAvailability.Unsupported ->
+            StatusCheck(
+                dashboardLabel, CheckStatus.Fail,
+                reason = context.getString(R.string.diag_check_no_chat_endpoint),
+                category = DiagnosticCategory.Session,
+            )
+        else ->
+            StatusCheck(
+                dashboardLabel, CheckStatus.Unknown,
+                reason = notChecked,
+                category = DiagnosticCategory.Endpoint,
+            )
+    }
+
+    // 3) Optional API-server fallback reachability.
+    val apiLabel = context.getString(R.string.active_section_optional_api_fallback)
     val host = DiagnosticsLog.sanitizeUrl(apiUrl)
     val apiErr = recentError(DiagnosticCategory.Api)
-    checks += when (apiHealth) {
-        ConnectionViewModel.HealthStatus.Reachable ->
+    checks += when {
+        !apiConfigured ->
+            StatusCheck(
+                apiLabel, CheckStatus.Unknown,
+                reason = context.getString(R.string.active_section_not_configured),
+                category = DiagnosticCategory.Api,
+            )
+        apiHealth == ConnectionViewModel.HealthStatus.Reachable ->
             StatusCheck(
                 apiLabel, CheckStatus.Pass,
                 reason = host?.let { context.getString(R.string.diag_check_reachable_at, it) } ?: reachable,
                 category = DiagnosticCategory.Api,
             )
-        ConnectionViewModel.HealthStatus.Unreachable ->
+        apiHealth == ConnectionViewModel.HealthStatus.Unreachable ->
             StatusCheck(
                 apiLabel, CheckStatus.Fail,
                 reason = apiErr?.message() ?: (host?.let { context.getString(R.string.diag_check_not_reachable_at, it) } ?: notReachable),
                 category = DiagnosticCategory.Api,
                 timestampMs = apiErr?.timestampMs,
             )
-        ConnectionViewModel.HealthStatus.Probing ->
+        apiHealth == ConnectionViewModel.HealthStatus.Probing ->
             StatusCheck(
                 apiLabel, CheckStatus.Unknown,
                 reason = probing,
                 category = DiagnosticCategory.Api,
             )
-        ConnectionViewModel.HealthStatus.Unknown ->
+        else ->
             StatusCheck(
                 apiLabel, CheckStatus.Unknown,
                 reason = notChecked,
@@ -317,13 +416,19 @@ internal fun buildStatusChecks(
             )
     }
 
-    // 3) Server capabilities (which chat surfaces the server advertises).
+    // 4) Optional API-server capabilities.
     val capsLabel = context.getString(R.string.diag_check_server_capabilities)
     val capsNoHealthy = context.getString(R.string.diag_check_no_server_yet)
     val capsNativeSessions = context.getString(R.string.diag_check_native_sessions)
     val capsSseFallback = context.getString(R.string.diag_check_sse_fallback)
     val capsNoEndpoint = context.getString(R.string.diag_check_no_chat_endpoint)
     checks += when {
+        !apiConfigured ->
+            StatusCheck(
+                capsLabel, CheckStatus.Unknown,
+                reason = context.getString(R.string.active_section_not_configured),
+                category = DiagnosticCategory.Api,
+            )
         !capabilities.healthy ->
             StatusCheck(
                 capsLabel, CheckStatus.Unknown,
@@ -350,55 +455,96 @@ internal fun buildStatusChecks(
             )
     }
 
-    // 4) Chat transport readiness.
+    // 5) Chat transport readiness.
     val chatLabel = context.getString(R.string.diag_check_chat_transport)
-    val chatReadyFmt = context.getString(R.string.diag_check_ready_with)
     val chatNotReady = context.getString(R.string.diag_check_not_ready)
-    val chatErr = recentError(DiagnosticCategory.Session) ?: recentError(DiagnosticCategory.Api)
-    checks += if (chatReady) {
-        StatusCheck(
-            chatLabel, CheckStatus.Pass,
-            reason = context.getString(R.string.diag_check_ready_with, capabilities.preferredChatEndpoint()),
-            category = DiagnosticCategory.Session,
-        )
-    } else {
-        val degraded = apiHealth == ConnectionViewModel.HealthStatus.Reachable
-        StatusCheck(
-            chatLabel,
-            if (degraded) CheckStatus.Warn else CheckStatus.Fail,
-            reason = chatErr?.message() ?: chatNotReady,
-            category = DiagnosticCategory.Session,
-            timestampMs = chatErr?.timestampMs,
-        )
+    val chatErr = recentError(DiagnosticCategory.Session)
+        ?: recentError(DiagnosticCategory.Endpoint)
+        ?: recentError(DiagnosticCategory.Api)
+    val chatRuntime = resolveChatRuntimeStatus(
+        gateway = when {
+            dashboardUrl.isBlank() -> ChatTransportReadiness.NotConfigured
+            gatewayAvailability == GatewayAvailability.Ready -> ChatTransportReadiness.Ready
+            gatewayAvailability == GatewayAvailability.Unknown -> ChatTransportReadiness.Connecting
+            else -> ChatTransportReadiness.Unavailable
+        },
+        apiSse = when {
+            !apiConfigured -> ChatTransportReadiness.NotConfigured
+            apiHealth == ConnectionViewModel.HealthStatus.Reachable -> ChatTransportReadiness.Ready
+            apiHealth == ConnectionViewModel.HealthStatus.Probing -> ChatTransportReadiness.Connecting
+            else -> ChatTransportReadiness.Unavailable
+        },
+    )
+    checks += when (chatRuntime) {
+        is ChatRuntimeStatus.Connected -> {
+            val route = when (chatRuntime.transport) {
+                ChatTransportPath.Gateway -> context.getString(R.string.chat_settings_gateway)
+                ChatTransportPath.ApiSse -> capabilities.preferredChatEndpoint()
+            }
+            StatusCheck(
+                chatLabel,
+                if (chatRuntime.fallback) CheckStatus.Warn else CheckStatus.Pass,
+                reason = context.getString(R.string.diag_check_ready_with, route),
+                category = DiagnosticCategory.Session,
+            )
+        }
+        ChatRuntimeStatus.Connecting ->
+            StatusCheck(
+                chatLabel, CheckStatus.Unknown,
+                reason = probing,
+                category = DiagnosticCategory.Session,
+            )
+        ChatRuntimeStatus.Unavailable ->
+            StatusCheck(
+                chatLabel,
+                if (gatewayAvailability == GatewayAvailability.SignInRequired) {
+                    CheckStatus.Warn
+                } else {
+                    CheckStatus.Fail
+                },
+                reason = if (gatewayAvailability == GatewayAvailability.SignInRequired) {
+                    context.getString(R.string.cw_dashboard_sign_in_required)
+                } else {
+                    chatErr?.message() ?: chatNotReady
+                },
+                category = DiagnosticCategory.Session,
+                timestampMs = chatErr?.timestampMs,
+            )
     }
 
-    // 5) Relay / pairing auth.
+    // 6) Optional Relay / pairing auth.
     val authLabel = context.getString(R.string.diag_check_pairing_auth)
     val authRelayActive = context.getString(R.string.diag_check_relay_active)
     val authPairingProg = context.getString(R.string.diag_check_pairing_progress)
     val authNotPaired = context.getString(R.string.diag_check_not_paired)
     val authErr = recentError(DiagnosticCategory.Auth)
-    checks += when (authState) {
-        is AuthState.Paired ->
+    checks += when {
+        !relayConfigured ->
+            StatusCheck(
+                authLabel, CheckStatus.Unknown,
+                reason = context.getString(R.string.active_section_optional),
+                category = DiagnosticCategory.Auth,
+            )
+        authState is AuthState.Paired ->
             StatusCheck(
                 authLabel, CheckStatus.Pass,
                 reason = authRelayActive,
                 category = DiagnosticCategory.Auth,
             )
-        is AuthState.Pairing ->
+        authState is AuthState.Pairing ->
             StatusCheck(
                 authLabel, CheckStatus.Warn,
                 reason = authPairingProg,
                 category = DiagnosticCategory.Auth,
             )
-        is AuthState.Failed ->
+        authState is AuthState.Failed ->
             StatusCheck(
                 authLabel, CheckStatus.Fail,
                 reason = authState.reason,
                 category = DiagnosticCategory.Auth,
                 timestampMs = authErr?.timestampMs,
             )
-        is AuthState.Unpaired ->
+        else ->
             StatusCheck(
                 authLabel, CheckStatus.Unknown,
                 reason = authNotPaired,
@@ -406,8 +552,8 @@ internal fun buildStatusChecks(
             )
     }
 
-    // 6) Relay server (optional — Unknown when not paired/configured).
-    val relayLabel = context.getString(R.string.diag_check_relay_server)
+    // 7) Relay server (optional — Unknown when not paired/configured).
+    val relayLabel = context.getString(R.string.active_section_optional_relay)
     val relayNotConfigured = context.getString(R.string.diag_check_relay_not_configured)
     val relayConnected = context.getString(R.string.diag_check_connected)
     val relayReachableNotReady = context.getString(R.string.diag_check_reachable_not_ready)
@@ -442,7 +588,7 @@ internal fun buildStatusChecks(
             )
     }
 
-    // 7) Relay plugin version + release availability. The update route is
+    // 8) Relay plugin version + release availability. The update route is
     // optional on older plugin versions, so a connected relay with no result is
     // explicitly Unknown rather than incorrectly reported as current.
     val pluginLabel = context.getString(R.string.diag_check_relay_plugin)
@@ -494,7 +640,7 @@ internal fun buildStatusChecks(
             )
     }
 
-    // 8) Voice readiness.
+    // 9) Voice readiness.
     val voiceLabel = context.getString(R.string.diag_check_voice)
     val voiceRelayReady = context.getString(R.string.diag_check_voice_relay)
     val voiceStandardReady = context.getString(R.string.diag_check_voice_standard)

app/src/main/kotlin/com/hermesandroid/relay/ui/screens/NativeDashboardBrowserLauncher.kt

@@ -0,0 +1,33 @@
+package com.hermesandroid.relay.ui.screens
+
+import android.app.Activity
+import android.content.ActivityNotFoundException
+import android.content.Context
+import android.content.Intent
+import android.net.Uri
+import androidx.browser.customtabs.CustomTabsIntent
+
+internal fun launchNativeDashboardAuthorization(
+    context: Context,
+    authorizationUrl: String,
+) {
+    val uri = Uri.parse(authorizationUrl)
+    val customTab = CustomTabsIntent.Builder()
+        .setShowTitle(true)
+        .setShareState(CustomTabsIntent.SHARE_STATE_OFF)
+        .build()
+        .also {
+            if (context !is Activity) {
+                it.intent.addFlags(Intent.FLAG_ACTIVITY_NEW_TASK)
+            }
+        }
+    try {
+        customTab.launchUrl(context, uri)
+    } catch (_: ActivityNotFoundException) {
+        context.startActivity(
+            Intent(Intent.ACTION_VIEW, uri).apply {
+                if (context !is Activity) addFlags(Intent.FLAG_ACTIVITY_NEW_TASK)
+            },
+        )
+    }
+}

app/src/main/kotlin/com/hermesandroid/relay/ui/screens/PairScreen.kt

@@ -32,10 +32,9 @@ import com.hermesandroid.relay.viewmodel.ConnectionViewModel
  * button), and pops back to wherever it came from on complete or cancel.
  *
  * [autoStart] lets the caller deep-link into a specific pair method. When
- * set to `"scan"`, the wizard jumps straight to camera-permission-request
- * → scanner on first composition. Null (default) shows the full Method
- * chooser so users can pick Standard API/dashboard setup or a Relay pairing
- * method.
+ * set to `"scan"`, the wizard jumps straight to the scanner. `"relay"`
+ * opens the connection-scoped Relay method chooser without exposing the
+ * new-server flow. Null shows the full connection chooser.
  */
 @OptIn(ExperimentalMaterial3Api::class)
 @Composable
@@ -45,6 +44,7 @@ fun PairScreen(
     onCancel: () -> Unit,
     onManageSignIn: (() -> Unit)? = null,
     autoStart: String? = null,
+    setupReady: Boolean = true,
     /**
      * Optional offline "Try the demo" entry, forwarded to [ConnectionWizard].
      * Wired by [RelayApp] only for the bare Connect entry (no placeholder
@@ -65,7 +65,14 @@ fun PairScreen(
     Scaffold(
         topBar = {
             TopAppBar(
-                title = { Text(stringResource(R.string.pair_connect_to_hermes)) },
+                title = {
+                    Text(
+                        stringResource(
+                            if (autoStart == "relay") R.string.detail_pair_relay
+                            else R.string.pair_connect_to_hermes,
+                        ),
+                    )
+                },
                 navigationIcon = {
                     IconButton(onClick = onCancel) {
                         Icon(
@@ -93,6 +100,7 @@ fun PairScreen(
                 onManageSignIn = onManageSignIn,
                 showSkip = false,
                 autoStart = autoStart,
+                setupReady = setupReady,
                 onTryDemo = onTryDemo,
             )
         }

app/src/main/kotlin/com/hermesandroid/relay/ui/screens/PairedDevicesScreen.kt

@@ -64,6 +64,7 @@ import com.hermesandroid.relay.R
 import com.hermesandroid.relay.auth.PairedDeviceInfo
 import com.hermesandroid.relay.data.EndpointCandidate
 import com.hermesandroid.relay.data.displayLabel
+import com.hermesandroid.relay.data.routeAuthority
 import com.hermesandroid.relay.ui.components.SessionTtlPickerDialog
 import com.hermesandroid.relay.ui.components.TransportSecurityBadge
 import com.hermesandroid.relay.ui.components.TransportSecuritySize
@@ -872,8 +873,7 @@ private fun EndpointsSubList(
         for (candidate in endpoints) {
             val isActive = activeEndpoint != null &&
                 activeEndpoint.role.equals(candidate.role, ignoreCase = true) &&
-                activeEndpoint.api.host.equals(candidate.api.host, ignoreCase = true) &&
-                activeEndpoint.api.port == candidate.api.port
+                activeEndpoint.routeAuthority() == candidate.routeAuthority()
             Row(
                 modifier = Modifier
                     .fillMaxWidth()
@@ -899,7 +899,7 @@ private fun EndpointsSubList(
                     },
                 )
                 Text(
-                    text = "${candidate.api.host}:${candidate.api.port}",
+                    text = candidate.routeAuthority().orEmpty(),
                     style = MaterialTheme.typography.labelSmall,
                     color = MaterialTheme.colorScheme.onSurfaceVariant,
                     fontFamily = FontFamily.Monospace,

app/src/main/kotlin/com/hermesandroid/relay/ui/screens/SettingsScreen.kt

@@ -1,5 +1,10 @@
 package com.hermesandroid.relay.ui.screens
 
+import android.Manifest
+import android.content.pm.PackageManager
+import android.os.Build
+import androidx.activity.compose.rememberLauncherForActivityResult
+import androidx.activity.result.contract.ActivityResultContracts
 import androidx.compose.foundation.BorderStroke
 import androidx.compose.foundation.border
 import androidx.compose.foundation.clickable
@@ -91,15 +96,19 @@ import com.hermesandroid.relay.data.AgentDisplay
 import com.hermesandroid.relay.data.BuildFlavor
 import com.hermesandroid.relay.data.FeatureFlags
 import com.hermesandroid.relay.data.Profile
+import com.hermesandroid.relay.network.upstream.GatewayAvailability
 import com.hermesandroid.relay.ui.components.AgentAvatarFace
 import com.hermesandroid.relay.ui.components.AgentInfoSheet
 import com.hermesandroid.relay.ui.components.LocalAgentIconPath
 import com.hermesandroid.relay.ui.components.ProfileInspectorCard
 import com.hermesandroid.relay.ui.theme.RelayRefresh
 import com.hermesandroid.relay.ui.theme.gradientBorder
+import com.hermesandroid.relay.viewmodel.ChatRuntimeStatus
+import com.hermesandroid.relay.viewmodel.ChatTransportReadiness
 import com.hermesandroid.relay.viewmodel.ChatViewModel
 import com.hermesandroid.relay.viewmodel.ConnectionViewModel
 import com.hermesandroid.relay.viewmodel.RelayUiState
+import com.hermesandroid.relay.viewmodel.resolveChatRuntimeStatus
 
 /**
  * Root Settings destination. After the 2026-04-11 split, Settings is a
@@ -176,6 +185,7 @@ fun SettingsScreen(
     // ring-accent, and subtitle.
     val selectedProfile by connectionViewModel.selectedProfile.collectAsState()
     val agentProfiles by connectionViewModel.agentProfiles.collectAsState()
+    val effectiveProfile by connectionViewModel.effectiveDisplayProfile.collectAsState()
     val profileDisplayAlias by connectionViewModel.profileDisplayAlias.collectAsState()
     val selectedPersonality by chatViewModel.selectedPersonality.collectAsState()
     val defaultPersonality by chatViewModel.defaultPersonality.collectAsState()
@@ -183,27 +193,45 @@ fun SettingsScreen(
     val relayUiState by connectionViewModel.relayUiState.collectAsState()
     val apiServerReachable by connectionViewModel.apiServerReachable.collectAsState()
     val apiServerHealth by connectionViewModel.apiServerHealth.collectAsState()
+    val gatewayAvailability by connectionViewModel.gatewayAvailability.collectAsState()
     val devOptionsUnlocked by FeatureFlags.devOptionsUnlocked(context)
         .collectAsState(initial = FeatureFlags.isDevBuild)
     val relayPaired = authState is AuthState.Paired
-    val dashboardStatus = activeConnection?.dashboardLastStatus
-    val dashboardSignInRequired =
-        dashboardStatus?.authRequired == true && dashboardStatus.authenticated != true
+    val chatRuntimeStatus = resolveChatRuntimeStatus(
+        gateway = when (gatewayAvailability) {
+            GatewayAvailability.Ready -> ChatTransportReadiness.Ready
+            GatewayAvailability.Unknown -> ChatTransportReadiness.Connecting
+            GatewayAvailability.SignInRequired,
+            GatewayAvailability.Unreachable,
+            GatewayAvailability.Unsupported -> ChatTransportReadiness.Unavailable
+        },
+        apiSse = when {
+            activeConnection?.apiServerUrl.isNullOrBlank() -> ChatTransportReadiness.NotConfigured
+            apiServerReachable -> ChatTransportReadiness.Ready
+            apiServerHealth == ConnectionViewModel.HealthStatus.Probing -> ChatTransportReadiness.Connecting
+            apiServerHealth == ConnectionViewModel.HealthStatus.Unreachable -> ChatTransportReadiness.Unavailable
+            else -> ChatTransportReadiness.Connecting
+        },
+    )
     // Status pills are exception-only: a pill appears only when the surface
     // needs attention (missing / checking / offline / sign-in). When it's
     // healthy the pill is null so the card + agent summary stay clean.
-    val apiPill: SettingsStatusPillModel? = when {
-        activeConnection?.apiServerUrl.isNullOrBlank() -> SettingsStatusPillModel(
-            label = stringResource(R.string.settings_api_missing),
-            tone = SettingsStatusTone.Warning,
-        )
-        apiServerHealth == ConnectionViewModel.HealthStatus.Probing -> SettingsStatusPillModel(
-            label = stringResource(R.string.settings_api_checking),
+    // Chat is transport-level: Gateway is primary and API is only fallback.
+    // A healthy transport suppresses warnings from the other optional surface.
+    val chatPill: SettingsStatusPillModel? = when {
+        chatRuntimeStatus is ChatRuntimeStatus.Connected -> null
+        chatRuntimeStatus == ChatRuntimeStatus.Connecting -> null
+        gatewayAvailability == GatewayAvailability.SignInRequired -> SettingsStatusPillModel(
+            label = stringResource(R.string.settings_dashboard_sign_in),
             tone = SettingsStatusTone.Info,
         )
-        apiServerReachable -> null
-        apiServerHealth == ConnectionViewModel.HealthStatus.Unreachable -> SettingsStatusPillModel(
-            label = stringResource(R.string.settings_api_offline),
+        activeConnection?.resolvedDashboardUrl.isNullOrBlank() -> SettingsStatusPillModel(
+            label = stringResource(R.string.settings_dashboard_missing),
+            tone = SettingsStatusTone.Warning,
+        )
+        gatewayAvailability == GatewayAvailability.Unreachable ||
+            gatewayAvailability == GatewayAvailability.Unsupported -> SettingsStatusPillModel(
+            label = stringResource(R.string.settings_dashboard_offline),
             tone = SettingsStatusTone.Warning,
         )
         else -> null
@@ -213,38 +241,18 @@ fun SettingsScreen(
             label = stringResource(R.string.settings_dashboard_missing),
             tone = SettingsStatusTone.Warning,
         )
-        dashboardStatus == null -> null
-        !dashboardStatus.reachable -> SettingsStatusPillModel(
-            label = stringResource(R.string.settings_dashboard_offline),
-            tone = SettingsStatusTone.Warning,
-        )
-        dashboardSignInRequired -> SettingsStatusPillModel(
+        gatewayAvailability == GatewayAvailability.Ready -> null
+        gatewayAvailability == GatewayAvailability.SignInRequired -> SettingsStatusPillModel(
             label = stringResource(R.string.settings_dashboard_sign_in),
             tone = SettingsStatusTone.Info,
         )
-        dashboardStatus.authenticated == true -> null
+        gatewayAvailability == GatewayAvailability.Unreachable ||
+            gatewayAvailability == GatewayAvailability.Unsupported -> SettingsStatusPillModel(
+            label = stringResource(R.string.settings_dashboard_offline),
+            tone = SettingsStatusTone.Warning,
+        )
         else -> null
     }
-    val relayPill: SettingsStatusPillModel? = when (relayUiState) {
-        RelayUiState.Connected -> null
-        RelayUiState.Connecting -> SettingsStatusPillModel(
-            label = stringResource(R.string.settings_relay_reconnecting),
-            tone = SettingsStatusTone.Info,
-        )
-        RelayUiState.Stale -> SettingsStatusPillModel(
-            label = stringResource(R.string.settings_relay_stale),
-            tone = SettingsStatusTone.Warning,
-        )
-        RelayUiState.Expired -> SettingsStatusPillModel(
-            label = stringResource(R.string.settings_pairing_expired),
-            tone = SettingsStatusTone.Warning,
-        )
-        RelayUiState.Disconnected -> SettingsStatusPillModel(
-            label = if (relayPaired) stringResource(R.string.settings_relay_offline) else stringResource(R.string.settings_requires_pairing),
-            tone = SettingsStatusTone.Warning,
-        )
-        RelayUiState.NotConfigured -> null
-    }
     // The Power tools below all ride the relay plugin. Rather than stamp an
     // identical badge on every card (noise, not signal), the dependency is
     // surfaced ONCE on the section header as a single plugin-state badge.
@@ -323,10 +331,6 @@ fun SettingsScreen(
             // + one-line `connection · model · personality` subtitle).
             // Tapping opens AgentInfoSheet inline so users can change
             // Connection / Profile / Personality without leaving Settings.
-            val effectiveProfile = AgentDisplay.effectiveDisplayProfile(
-                selectedProfile = selectedProfile,
-                profiles = agentProfiles,
-            )
             ActiveAgentCard(
                 agentName = AgentDisplay.agentName(
                     profile = effectiveProfile,
@@ -342,7 +346,7 @@ fun SettingsScreen(
                     defaultPersonality = defaultPersonality,
                 ),
                 isCustomized = selectedProfile != null || selectedPersonality != "default",
-                statusPills = listOfNotNull(apiPill, dashboardPill, relayPill),
+                statusPills = listOfNotNull(chatPill),
                 onClick = { showAgentSheet = true },
                 isDarkTheme = isDarkTheme,
             )
@@ -354,8 +358,7 @@ fun SettingsScreen(
             // `default` profile — the relay always advertises one, and
             // it IS the effective agent. Still falls back to disabled
             // when no profiles have loaded yet (unpaired / pre-auth).
-            val inspectorTarget = selectedProfile
-                ?: agentProfiles.firstOrNull { it.name == "default" }
+            val inspectorTarget = effectiveProfile
                 ?: agentProfiles.firstOrNull()
             ProfileInspectorCard(
                 activeProfile = inspectorTarget,
@@ -438,7 +441,7 @@ fun SettingsScreen(
                 icon = Icons.AutoMirrored.Filled.Chat,
                 title = stringResource(R.string.settings_chat),
                 subtitle = stringResource(R.string.settings_chat_desc),
-                badge = apiPill,
+                badge = chatPill,
                 onClick = onNavigateToChatSettings,
                 isDarkTheme = isDarkTheme,
             )
@@ -814,6 +817,20 @@ private fun QuickControlsCard(
 ) {
     val gatewayKeepAlive by connectionViewModel.gatewayKeepAlive.collectAsState()
     val notifyTurnComplete by connectionViewModel.notifyTurnComplete.collectAsState()
+    val context = LocalContext.current
+    val notificationPermissionLauncher = rememberLauncherForActivityResult(
+        ActivityResultContracts.RequestPermission(),
+    ) { /* Posting re-checks the grant. */ }
+    val requestNotificationPermission = {
+        if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.TIRAMISU &&
+            androidx.core.content.ContextCompat.checkSelfPermission(
+                context,
+                Manifest.permission.POST_NOTIFICATIONS,
+            ) != PackageManager.PERMISSION_GRANTED
+        ) {
+            notificationPermissionLauncher.launch(Manifest.permission.POST_NOTIFICATIONS)
+        }
+    }
     Card(
         modifier = Modifier
             .fillMaxWidth()
@@ -846,7 +863,10 @@ private fun QuickControlsCard(
                     stringResource(R.string.settings_connect_on_demand)
                 },
                 checked = gatewayKeepAlive,
-                onCheckedChange = { connectionViewModel.setGatewayKeepAlive(it) },
+                onCheckedChange = { enabled ->
+                    connectionViewModel.setGatewayKeepAlive(enabled)
+                    if (enabled && notifyTurnComplete) requestNotificationPermission()
+                },
             )
             // Doze: even with the keep-alive service running, a specialUse FGS
             // still gets its network deferred in deep sleep unless the app is
@@ -865,7 +885,10 @@ private fun QuickControlsCard(
                     stringResource(R.string.settings_turn_complete_alerts_off)
                 },
                 checked = notifyTurnComplete,
-                onCheckedChange = { connectionViewModel.setNotifyTurnComplete(it) },
+                onCheckedChange = { enabled ->
+                    connectionViewModel.setNotifyTurnComplete(enabled)
+                    if (enabled) requestNotificationPermission()
+                },
             )
         }
     }

app/src/main/kotlin/com/hermesandroid/relay/util/RelayErrorClassifier.kt

@@ -227,6 +227,18 @@ private fun classifyErrorInternal(t: Throwable?, context: String?, ctx: Context?
 
     val msg = t.message.orEmpty().lowercase()
 
+    // Upstream rejects new API work with this stable code while an intentional
+    // shutdown/external drain is in progress. Keep it distinct from provider
+    // 503s: the server is healthy and will accept work after the drain clears.
+    if (msg.startsWith("api error 503: gateway_draining:")) {
+        return HumanError(
+            title = "Hermes is restarting",
+            body = "Hermes is draining active work. Wait a moment, then retry this message.",
+            retryable = true,
+            actionLabel = ctx?.getString(R.string.error_classify_retry) ?: "Retry",
+        )
+    }
+
     // Typed exceptions are checked first because an IOException message scan
     // would otherwise swallow SSL/timeout/connect errors whose messages
     // happen to contain HTTP-ish substrings. Only fall through to the

app/src/main/kotlin/com/hermesandroid/relay/viewmodel/ChatRuntimeStatus.kt

@@ -0,0 +1,52 @@
+package com.hermesandroid.relay.viewmodel
+
+/** Runtime readiness for one independently optional chat transport. */
+enum class ChatTransportReadiness {
+    NotConfigured,
+    Connecting,
+    Ready,
+    Unavailable,
+}
+enum class ChatTransportPath {
+    Gateway,
+    ApiSse,
+}
+
+/**
+ * Transport-neutral UI state for chat connectivity. Relay is intentionally
+ * absent: it is an optional bridge surface and cannot make chat unhealthy.
+ */
+sealed interface ChatRuntimeStatus {
+    data class Connected(
+        val transport: ChatTransportPath,
+        val fallback: Boolean,
+    ) : ChatRuntimeStatus
+
+    data object Connecting : ChatRuntimeStatus
+
+    data object Unavailable : ChatRuntimeStatus
+}
+
+/**
+ * Resolve chat health in product priority order:
+ * Gateway primary, API/SSE fallback, pending connection, then unavailable.
+ */
+fun resolveChatRuntimeStatus(
+    gateway: ChatTransportReadiness,
+    apiSse: ChatTransportReadiness,
+): ChatRuntimeStatus = when {
+    gateway == ChatTransportReadiness.Ready -> ChatRuntimeStatus.Connected(
+        transport = ChatTransportPath.Gateway,
+        fallback = false,
+    )
+
+    apiSse == ChatTransportReadiness.Ready -> ChatRuntimeStatus.Connected(
+        transport = ChatTransportPath.ApiSse,
+        fallback = true,
+    )
+
+    gateway == ChatTransportReadiness.Connecting ||
+        apiSse == ChatTransportReadiness.Connecting -> ChatRuntimeStatus.Connecting
+
+    else -> ChatRuntimeStatus.Unavailable
+}