fix(dashboard): scope Relay auth probe health

fix(android): keep relay ingress on authenticated route
fix(pairing): omit inactive Tailscale API routes
2026-08-30 21:05:58 -04:00 · 2026-08-30 21:02:24 -04:00 · 2026-08-30 20:15:42 -04:00 · 2026-08-30 20:14:16 -04:00 · 2026-08-30 20:01:19 -04:00 · 2026-08-30 19:58:00 -04:00
487 changed files with 59046 additions and 7573 deletions
@@ -0,0 +1,47 @@
+## Summary
+
+<!-- Describe the user/developer outcome and why this change is needed. Link related issues, e.g. Closes #123. -->
+
+## Changes
+
+<!-- List the focused implementation changes. Avoid repeating the commit log. -->
+
+-
+
+## Verification
+
+<!-- List exact commands and results. Say explicitly when a check was not run or when device/UI proof remains outstanding. -->
+
+-
+
+## Screenshots
+
+<!-- UI change: include screenshots/video plus device, viewport, or emulator details. Otherwise write: No visual change. -->
+
+## Compatibility / risk
+
+<!-- Note Standard Hermes/upstream compatibility, migrations/state changes, security/privacy impact, rollout/rollback, or write N/A. -->
+
+## Lineage / contributor credit
+
+<!-- Preserve prior contributor work when replacing, salvaging, or rebuilding another PR. -->
+
+- Source PR(s): N/A
+- Attribution preserved by: N/A
+
+## Checklist
+
+<!-- Check an item when satisfied or when its N/A rationale is stated above. -->
+
+- [ ] Target branch is `dev`, unless this is a `dev` → `main` release PR or a focused production-tag hotfix PR to `main`
+- [ ] Scope is focused and related issues/PRs are linked
+- [ ] Android changes: lint and focused tests ran, or rationale is listed above
+- [ ] Translation changes: locale validation/review ran, or N/A is listed above
+- [ ] Server/plugin changes: focused tests ran, or N/A/rationale is listed above
+- [ ] Desktop changes: build/tests ran, or N/A/rationale is listed above
+- [ ] Docs/site changes: build or link/route checks ran, or N/A/rationale is listed above
+- [ ] UI changes were tested on a relevant device/emulator/desktop surface, or the missing proof is stated above
+- [ ] Commit messages follow [Conventional Commits](https://www.conventionalcommits.org/)
+- [ ] `CHANGELOG.md` is updated for user-visible changes, or N/A is listed above
+- [ ] Public writing hygiene checked: no secrets, private infrastructure, personal names, or AI/process narration
+- [ ] Salvaged/replacement work links source PRs and preserves contributor authorship, or N/A is listed above
@@ -3,8 +3,11 @@
 function classifyCiPaths(paths) {
  const forceAll = paths.some((path) => [
    '.github/workflows/ci-required.yml',
+    '.github/workflows/release-backmerge.yml',
    '.github/scripts/classify-ci-paths.cjs',
    '.github/scripts/classify-ci-paths.test.cjs',
+    'scripts/plan_release_backmerge.py',
+    'scripts/tests/plan_release_backmerge_test.py',
  ].includes(path));
  const exact = (values) => paths.some((path) => values.includes(path));
  const under = (prefixes) => paths.some((path) => prefixes.some((prefix) => path.startsWith(prefix)));
@@ -13,7 +16,10 @@ function classifyCiPaths(paths) {
    android: forceAll || under(['app/', 'relay-core/', 'relay-ui/', 'ui-preview/', 'quest/', 'gradle/']) || exact([
      'build.gradle.kts', 'settings.gradle.kts', 'gradle.properties', 'gradlew', 'gradlew.bat',
      'scripts/check-android-locales.py', 'scripts/android-locale-harness.py',
-      'scripts/check-android-collection-apis.py', '.github/workflows/ci-android.yml',
+      'scripts/check-android-collection-apis.py', 'scripts/check-android-native-compat.py',
+      'scripts/check-android-release-notes.py',
+      'scripts/tests/check_android_native_compat_test.py',
+      'scripts/tests/check_android_release_notes_test.py', '.github/workflows/ci-android.yml',
      '.github/workflows/play-preflight-android.yml',
      '.github/workflows/approve-release-android.yml',
      '.github/workflows/release-android.yml',
@@ -15,6 +15,9 @@ const none = {
 assert.deepEqual(classifyCiPaths(['README.md']), none);
 assert.deepEqual(classifyCiPaths(['desktop/src/cli.ts']), { ...none, desktop: true });
 assert.deepEqual(classifyCiPaths(['relay-core/src/main/kotlin/Wire.kt']), { ...none, android: true });
+assert.deepEqual(classifyCiPaths(['scripts/check-android-release-notes.py']), { ...none, android: true });
+assert.deepEqual(classifyCiPaths(['scripts/check-android-native-compat.py']), { ...none, android: true });
+assert.deepEqual(classifyCiPaths(['scripts/tests/check_android_native_compat_test.py']), { ...none, android: true });
 assert.deepEqual(classifyCiPaths(['plugin/relay/server.py']), { ...none, plugin: true });
 assert.deepEqual(classifyCiPaths(['plugin/dashboard/src/App.tsx']), { ...none, dashboard: true });
 assert.deepEqual(classifyCiPaths(['user-docs/index.md']), { ...none, docs: true });
@@ -30,5 +33,13 @@ assert.deepEqual(classifyCiPaths(['.github/workflows/ci-required.yml']), {
  contract: true,
  docs: true,
 });
+assert.deepEqual(classifyCiPaths(['.github/workflows/release-backmerge.yml']), {
+  android: true,
+  desktop: true,
+  plugin: true,
+  dashboard: true,
+  contract: true,
+  docs: true,
+});

 console.log('CI path classification tests passed.');
@@ -33,6 +33,10 @@ on:
      - "scripts/check-android-locales.py"
      - "scripts/android-locale-harness.py"
      - "scripts/check-android-collection-apis.py"
+      - "scripts/check-android-native-compat.py"
+      - "scripts/check-android-release-notes.py"
+      - "scripts/tests/check_android_native_compat_test.py"
+      - "scripts/tests/check_android_release_notes_test.py"
      - ".github/workflows/ci-android.yml"
      - ".github/workflows/play-preflight-android.yml"
      - ".github/workflows/approve-release-android.yml"
@@ -73,6 +77,14 @@ jobs:
      - name: Reject unsafe Android collection APIs
        run: python3 scripts/check-android-collection-apis.py

+      - name: Validate Android release notes
+        run: |
+          python3 scripts/check-android-release-notes.py
+          python3 -m unittest scripts.tests.check_android_release_notes_test
+
+      - name: Test Android native compatibility checker
+        run: python3 -m unittest scripts.tests.check_android_native_compat_test
+
      - name: Run Android lint
        run: ./gradlew lint --console=plain

@@ -102,6 +114,12 @@ jobs:
      - name: Build debug APK
        run: ./gradlew assembleDebug --console=plain

+      - name: Verify packaged ONNX Runtime compatibility
+        run: |
+          python3 scripts/check-android-native-compat.py \
+            app/build/outputs/apk/googlePlay/debug/*.apk \
+            app/build/outputs/apk/sideload/debug/*.apk
+
      - name: Upload debug APK
        uses: actions/upload-artifact@v7
        if: ${{ github.ref == 'refs/heads/main' }}
@@ -218,3 +236,9 @@ jobs:
          python3 scripts/check-android-collection-apis.py \
            --apk app/build/outputs/apk/googlePlay/release/*.apk \
            --apk app/build/outputs/apk/sideload/release/*.apk
+
+      - name: Verify packaged ONNX Runtime compatibility
+        run: |
+          python3 scripts/check-android-native-compat.py \
+            app/build/outputs/apk/googlePlay/release/*.apk \
+            app/build/outputs/apk/sideload/release/*.apk
@@ -11,6 +11,9 @@

 name: CI — Upstream Contract

+permissions:
+  contents: read
+
 on:
  workflow_call:
  push:
@@ -40,45 +43,64 @@ jobs:
    steps:
      - name: Checkout hermes-relay
        uses: actions/checkout@v7
+        with:
+          persist-credentials: false

      - name: Resolve upstream ref
        id: ref
+        env:
+          REQUESTED_REF: ${{ github.event.inputs.upstream_ref }}
        run: |
+          set -euo pipefail
          # PR/push runs use a known-good NousResearch/hermes-agent commit so
          # normal CI is stable. The weekly schedule below intentionally tracks
          # main as the upstream-drift siren.
          DEFAULT_REF="ef4b897a1843cd32c4f141f55db60f0f0602cc98"
          if [ "${{ github.event_name }}" = "schedule" ]; then
            REF="main"                                   # weekly drift siren
-          elif [ -n "${{ github.event.inputs.upstream_ref }}" ]; then
-            REF="${{ github.event.inputs.upstream_ref }}" # manual override
+          elif [ -n "$REQUESTED_REF" ]; then
+            REF="$REQUESTED_REF"                          # manual override
          else
            REF="$DEFAULT_REF"
          fi
+
+          # The ref is passed to git below, so reject option-like or malformed
+          # values before it reaches that boundary. Full commit IDs and normal
+          # branch/tag names remain supported for manual contract checks.
+          if [[ "$REF" == -* ]] ||
+             ! git check-ref-format --allow-onelevel "$REF" >/dev/null; then
+            echo "FAIL: invalid upstream branch or tag name." >&2
+            exit 1
+          fi
+
          echo "ref=$REF" >> "$GITHUB_OUTPUT"
          echo "Checking standard-path route contract against upstream ref: $REF"

-      - name: Checkout vanilla upstream (no plugin, no bootstrap)
-        uses: actions/checkout@v7
-        with:
-          repository: NousResearch/hermes-agent
-          ref: ${{ steps.ref.outputs.ref }}
-          path: _upstream
-          fetch-depth: 1
+      - name: Extract trusted upstream contract sources
+        env:
+          UPSTREAM_REF: ${{ steps.ref.outputs.ref }}
+        run: |
+          set -euo pipefail
+          UPSTREAM_GIT="$RUNNER_TEMP/hermes-agent-contract.git"
+          git init --bare "$UPSTREAM_GIT"
+          git -C "$UPSTREAM_GIT" remote add origin \
+            "https://github.com/NousResearch/hermes-agent.git"
+          git -C "$UPSTREAM_GIT" fetch --no-tags --depth=1 origin -- "$UPSTREAM_REF"
+          UPSTREAM_COMMIT="$(git -C "$UPSTREAM_GIT" rev-parse 'FETCH_HEAD^{commit}')"
+
+          mkdir -p _upstream/gateway/platforms _upstream/hermes_cli
+          git -C "$UPSTREAM_GIT" show \
+            "$UPSTREAM_COMMIT:gateway/platforms/api_server.py" \
+            > _upstream/gateway/platforms/api_server.py
+          git -C "$UPSTREAM_GIT" show \
+            "$UPSTREAM_COMMIT:hermes_cli/web_server.py" \
+            > _upstream/hermes_cli/web_server.py
+          echo "Extracted contract sources from upstream commit: $UPSTREAM_COMMIT"

      - name: Set up Python 3.11
        uses: actions/setup-python@v7
        with:
          python-version: "3.11"

-      - name: Assert upstream checkout is vanilla (no relay bootstrap/plugin)
-        run: |
-          if [ -e "_upstream/hermes_relay_bootstrap" ] || \
-             [ -e "_upstream/plugin/hermes_relay_bootstrap" ] || \
-             find _upstream -name "hermes_relay_bootstrap.pth" 2>/dev/null | grep -q .; then
-            echo "FAIL: upstream checkout contains a relay bootstrap — not vanilla."; exit 1
-          fi
-          echo "OK: upstream checkout carries no relay plugin/bootstrap."
-
      - name: Run route-surface contract
        run: python scripts/check-upstream-route-contract.py "_upstream"
@@ -38,6 +38,10 @@ jobs:
        working-directory: plugin/dashboard
        run: npm run build

+      - name: Test dashboard source
+        working-directory: plugin/dashboard
+        run: npm test
+
      - name: Setup Python
        uses: actions/setup-python@v7
        with:
@@ -54,7 +58,11 @@ jobs:
        run: pip install -r relay_server/requirements.txt fastapi httpx requests

      - name: Run dashboard API tests
-        run: python -m unittest plugin.dashboard.test_plugin_api
+        run: >-
+          python -m unittest
+          plugin.dashboard.test_plugin_api
+          plugin.dashboard.test_git_api
+          plugin.dashboard.test_mobile_plugin_api

      - name: Verify dashboard bundle outputs
        run: |
@@ -106,4 +106,8 @@ jobs:
            plugin/tests/test_session_grants.py \
            plugin/tests/test_native_layout_imports.py \
            plugin/tests/test_profile_discovery.py \
-            plugin/tests/test_profiles_updated_broadcast.py
+            plugin/tests/test_profiles_updated_broadcast.py \
+            plugin/tests/test_git_state.py \
+            plugin/tests/test_git_state_write.py \
+            plugin/tests/test_git_state_extras.py \
+            plugin/tests/test_mobile_plugin_store.py
@@ -10,6 +10,16 @@ on:
  pull_request:
    branches: [main, dev]
    types: [opened, synchronize, reopened, ready_for_review]
+  workflow_dispatch:
+    inputs:
+      base_sha:
+        description: "Exact base commit for a trusted release-backmerge candidate"
+        required: true
+        type: string
+      head_sha:
+        description: "Exact candidate commit to check"
+        required: true
+        type: string

 permissions:
  contents: read
@@ -31,22 +41,63 @@ jobs:
      contract: ${{ steps.filter.outputs.contract }}
      docs: ${{ steps.filter.outputs.docs }}
    steps:
-      - name: Checkout repository
+      - name: Checkout pull request merge
+        if: github.event_name == 'pull_request'
        uses: actions/checkout@v7
        with:
          fetch-depth: 2

+      - name: Checkout exact dispatched candidate
+        if: github.event_name == 'workflow_dispatch'
+        uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+          ref: ${{ inputs.head_sha }}
+
      - name: Test path classifier
        run: node .github/scripts/classify-ci-paths.test.cjs

      - name: Classify changed files
        id: filter
        uses: actions/github-script@v8
+        env:
+          DISPATCH_BASE_SHA: ${{ inputs.base_sha }}
+          DISPATCH_HEAD_SHA: ${{ inputs.head_sha }}
        with:
          script: |
+            let diffArgs;
+            if (context.eventName === 'workflow_dispatch') {
+              const base = process.env.DISPATCH_BASE_SHA || '';
+              const head = process.env.DISPATCH_HEAD_SHA || '';
+              const shaPattern = /^[0-9a-f]{40}$/;
+              if (!shaPattern.test(base) || !shaPattern.test(head)) {
+                core.setFailed('Exact-tree dispatch requires full 40-character base/head SHAs.');
+                return;
+              }
+              const { stdout: checkedOut } = await exec.getExecOutput(
+                'git',
+                ['rev-parse', 'HEAD'],
+              );
+              if (checkedOut.trim() !== head) {
+                core.setFailed(`Checked out ${checkedOut.trim()}, expected ${head}.`);
+                return;
+              }
+              const ancestry = await exec.exec(
+                'git',
+                ['merge-base', '--is-ancestor', base, head],
+                { ignoreReturnCode: true },
+              );
+              if (ancestry !== 0) {
+                core.setFailed(`Candidate ${head} does not descend from base ${base}.`);
+                return;
+              }
+              diffArgs = ['diff', '--name-only', base, head];
+            } else {
+              diffArgs = ['diff', '--name-only', 'HEAD^1', 'HEAD^2'];
+            }
            const { stdout } = await exec.getExecOutput(
              'git',
-              ['diff', '--name-only', 'HEAD^1', 'HEAD^2'],
+              diffArgs,
            );
            const paths = stdout.split(/\r?\n/).filter(Boolean);
            const { classifyCiPaths } = require(
@@ -81,10 +81,10 @@ jobs:
      - name: Validate release metadata and source compatibility
        run: |
          python3 scripts/check-version-tracks.py
+          python3 scripts/check-android-release-notes.py
          python3 scripts/check-privacy-policy.py --live
          python3 scripts/check-android-locales.py
          python3 scripts/check-android-collection-apis.py
-          python3 -m json.tool app/src/main/assets/changelog.json >/dev/null

      - name: Decode release keystore
        env:
@@ -150,6 +150,7 @@ jobs:
      - name: Validate release metadata and Android API compatibility
        run: |
          python3 scripts/check-version-tracks.py
+          python3 scripts/check-android-release-notes.py
          python3 scripts/check-privacy-policy.py
          python3 scripts/check-android-locales.py
          python3 scripts/check-android-collection-apis.py
@@ -262,6 +263,19 @@ jobs:
          python3 scripts/check-android-collection-apis.py \
            --apk app/build/outputs/apk/sideload/candidate/*.apk

+      - name: Verify stable packaged ONNX Runtime compatibility
+        if: ${{ needs.validate.outputs.prerelease != 'true' }}
+        run: |
+          python3 scripts/check-android-native-compat.py \
+            app/build/outputs/apk/googlePlay/release/*.apk \
+            app/build/outputs/apk/sideload/release/*.apk
+
+      - name: Verify candidate packaged ONNX Runtime compatibility
+        if: ${{ needs.validate.outputs.prerelease == 'true' }}
+        run: |
+          python3 scripts/check-android-native-compat.py \
+            app/build/outputs/apk/sideload/candidate/*.apk
+
      - name: List produced artifacts (debug aid)
        run: |
          echo "=== APK outputs ==="
@@ -365,3 +379,22 @@ jobs:
          find app/build/outputs/apk -name '*.apk' -exec ls -la {} + >> "$GITHUB_STEP_SUMMARY" 2>/dev/null || true
          find app/build/outputs/bundle -name '*.aab' -exec ls -la {} + >> "$GITHUB_STEP_SUMMARY" 2>/dev/null || true
          echo '```' >> "$GITHUB_STEP_SUMMARY"
+
+  request-backmerge:
+    name: Request stable release backmerge
+    needs: [validate, release]
+    if: needs.validate.outputs.prerelease != 'true'
+    permissions:
+      actions: write
+      contents: read
+    runs-on: ubuntu-latest
+    steps:
+      - name: Dispatch fail-closed release reconciliation
+        env:
+          GH_TOKEN: ${{ github.token }}
+          RELEASE_TAG: android-v${{ needs.validate.outputs.version }}
+        run: |
+          gh workflow run release-backmerge.yml \
+            --repo "$GITHUB_REPOSITORY" \
+            --ref main \
+            -f release_tag="$RELEASE_TAG"
@@ -0,0 +1,267 @@
+# Reconcile a completed stable hotfix into dev without adding a ceremonial PR
+# merge commit. Normal dev -> main releases are detected and intentionally no-op.
+# A conflicted merge, failed exact-tree CI, stale dev ref, or denied branch update
+# stops without mutating dev and falls back to the normal reconciliation PR path.
+
+name: Release Backmerge
+
+on:
+  workflow_dispatch:
+    inputs:
+      release_tag:
+        description: "Published stable tag to reconcile (android-v*, server-v*, or desktop-v*)"
+        required: true
+        type: string
+
+permissions:
+  contents: read
+
+concurrency:
+  group: release-backmerge-dev
+  cancel-in-progress: false
+
+jobs:
+  prepare:
+    name: Prepare exact backmerge candidate
+    permissions:
+      contents: write
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    outputs:
+      outcome: ${{ steps.prepare.outputs.outcome }}
+      base_dev_sha: ${{ steps.prepare.outputs.base_dev_sha }}
+      candidate_branch: ${{ steps.prepare.outputs.candidate_branch }}
+      candidate_sha: ${{ steps.prepare.outputs.candidate_sha }}
+      release_commit: ${{ steps.prepare.outputs.release_commit }}
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+          ref: main
+
+      - name: Validate release and prepare merge commit
+        id: prepare
+        env:
+          GH_TOKEN: ${{ github.token }}
+          RELEASE_TAG: ${{ inputs.release_tag }}
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          if [[ ! "$RELEASE_TAG" =~ ^(android|server|desktop)-v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+            echo "::error::Release Backmerge accepts stable SemVer production tags only; got $RELEASE_TAG"
+            exit 1
+          fi
+
+          git fetch origin \
+            "+refs/heads/main:refs/remotes/origin/main" \
+            "+refs/heads/dev:refs/remotes/origin/dev" \
+            "+refs/tags/${RELEASE_TAG}:refs/tags/${RELEASE_TAG}"
+          release_commit="$(git rev-parse "${RELEASE_TAG}^{commit}")"
+          base_dev_sha="$(git rev-parse origin/dev)"
+          echo "release_commit=$release_commit" >> "$GITHUB_OUTPUT"
+          echo "base_dev_sha=$base_dev_sha" >> "$GITHUB_OUTPUT"
+
+          if ! git merge-base --is-ancestor "$release_commit" origin/main; then
+            echo "::error::$RELEASE_TAG ($release_commit) is not contained in origin/main"
+            exit 1
+          fi
+
+          read -r is_draft is_prerelease < <(
+            gh release view "$RELEASE_TAG" --json isDraft,isPrerelease \
+              --jq '[.isDraft, .isPrerelease] | @tsv'
+          )
+          if [ "$is_draft" != "false" ] || [ "$is_prerelease" != "false" ]; then
+            echo "::error::$RELEASE_TAG is not a published stable GitHub release"
+            exit 1
+          fi
+
+          plan="$(
+            python3 scripts/plan_release_backmerge.py \
+              --release-commit "$release_commit" \
+              --dev-commit "$base_dev_sha"
+          )"
+          case "$plan" in
+            already-contained)
+              echo "outcome=noop" >> "$GITHUB_OUTPUT"
+              echo "## Release backmerge not needed" >> "$GITHUB_STEP_SUMMARY"
+              echo "\`$RELEASE_TAG\` is already contained in \`dev\`." >> "$GITHUB_STEP_SUMMARY"
+              exit 0
+              ;;
+            normal-release)
+              echo "outcome=noop" >> "$GITHUB_OUTPUT"
+              echo "## Normal release: no backmerge" >> "$GITHUB_STEP_SUMMARY"
+              echo "The released merge's integration parent is already contained in \`dev\`." >> "$GITHUB_STEP_SUMMARY"
+              exit 0
+              ;;
+            hotfix) ;;
+            *)
+              echo "::error::Unknown release-backmerge plan: $plan"
+              exit 1
+              ;;
+          esac
+
+          candidate_branch="chore/release-backmerge/${RELEASE_TAG}-${GITHUB_RUN_ID}"
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git switch --detach "$base_dev_sha"
+
+          set +e
+          git merge --no-ff -m "chore: back-merge ${RELEASE_TAG}" "$release_commit"
+          merge_status=$?
+          set -e
+          if [ "$merge_status" -ne 0 ]; then
+            conflicts="$(git diff --name-only --diff-filter=U | paste -sd ', ' -)"
+            echo "outcome=conflict" >> "$GITHUB_OUTPUT"
+            echo "::error::Automatic backmerge conflicts: ${conflicts:-unknown}. Open a reconciliation PR."
+            echo "## Manual reconciliation PR required" >> "$GITHUB_STEP_SUMMARY"
+            echo "\`$RELEASE_TAG\` conflicts with current \`dev\`: ${conflicts:-unknown}." >> "$GITHUB_STEP_SUMMARY"
+            git merge --abort || true
+            exit 1
+          fi
+
+          candidate_sha="$(git rev-parse HEAD)"
+          first_parent="$(git rev-parse HEAD^1)"
+          second_parent="$(git rev-parse HEAD^2)"
+          if [ "$first_parent" != "$base_dev_sha" ] || [ "$second_parent" != "$release_commit" ]; then
+            echo "::error::Candidate parents do not match dev + release commit"
+            exit 1
+          fi
+
+          git push origin "$candidate_sha:refs/heads/$candidate_branch"
+          echo "outcome=candidate" >> "$GITHUB_OUTPUT"
+          echo "candidate_branch=$candidate_branch" >> "$GITHUB_OUTPUT"
+          echo "candidate_sha=$candidate_sha" >> "$GITHUB_OUTPUT"
+
+          echo "## Backmerge candidate prepared" >> "$GITHUB_STEP_SUMMARY"
+          echo "- Release: \`$RELEASE_TAG\` (\`$release_commit\`)" >> "$GITHUB_STEP_SUMMARY"
+          echo "- Dev base: \`$base_dev_sha\`" >> "$GITHUB_STEP_SUMMARY"
+          echo "- Candidate: \`$candidate_sha\`" >> "$GITHUB_STEP_SUMMARY"
+          echo "- Temporary ref: \`$candidate_branch\`" >> "$GITHUB_STEP_SUMMARY"
+
+  gate:
+    name: Run exact-tree required checks
+    needs: prepare
+    if: needs.prepare.outputs.outcome == 'candidate'
+    permissions:
+      actions: write
+      contents: read
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+    outputs:
+      check_run_id: ${{ steps.gate.outputs.check_run_id }}
+    steps:
+      - name: Dispatch and await Required checks
+        id: gate
+        env:
+          GH_TOKEN: ${{ github.token }}
+          BASE_DEV_SHA: ${{ needs.prepare.outputs.base_dev_sha }}
+          CANDIDATE_BRANCH: ${{ needs.prepare.outputs.candidate_branch }}
+          CANDIDATE_SHA: ${{ needs.prepare.outputs.candidate_sha }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          gh workflow run ci-required.yml \
+            --repo "$GITHUB_REPOSITORY" \
+            --ref "$CANDIDATE_BRANCH" \
+            -f base_sha="$BASE_DEV_SHA" \
+            -f head_sha="$CANDIDATE_SHA"
+
+          check_run_id=""
+          for _ in {1..20}; do
+            check_run_id="$(
+              gh run list \
+                --repo "$GITHUB_REPOSITORY" \
+                --workflow ci-required.yml \
+                --branch "$CANDIDATE_BRANCH" \
+                --event workflow_dispatch \
+                --limit 20 \
+                --json databaseId,headSha \
+                --jq ".[] | select(.headSha == \"$CANDIDATE_SHA\") | .databaseId" \
+                | head -n 1
+            )"
+            if [ -n "$check_run_id" ]; then
+              break
+            fi
+            sleep 3
+          done
+          if [ -z "$check_run_id" ]; then
+            echo "::error::Required checks dispatch was not observed for $CANDIDATE_SHA"
+            exit 1
+          fi
+
+          echo "check_run_id=$check_run_id" >> "$GITHUB_OUTPUT"
+          gh run watch "$check_run_id" --repo "$GITHUB_REPOSITORY" --exit-status
+
+  promote:
+    name: Compare-and-swap dev
+    needs: [prepare, gate]
+    if: needs.prepare.outputs.outcome == 'candidate' && needs.gate.result == 'success'
+    permissions:
+      contents: write
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+          ref: main
+
+      - name: Fast-forward dev to the tested candidate
+        env:
+          BASE_DEV_SHA: ${{ needs.prepare.outputs.base_dev_sha }}
+          CANDIDATE_BRANCH: ${{ needs.prepare.outputs.candidate_branch }}
+          CANDIDATE_SHA: ${{ needs.prepare.outputs.candidate_sha }}
+          RELEASE_COMMIT: ${{ needs.prepare.outputs.release_commit }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          git fetch origin --no-tags \
+            "+refs/heads/dev:refs/remotes/origin/dev" \
+            "+refs/heads/$CANDIDATE_BRANCH:refs/remotes/origin/$CANDIDATE_BRANCH"
+          current_dev="$(git rev-parse origin/dev)"
+          remote_candidate="$(git rev-parse "origin/$CANDIDATE_BRANCH")"
+
+          if [ "$current_dev" != "$BASE_DEV_SHA" ]; then
+            echo "::error::dev moved from $BASE_DEV_SHA to $current_dev; rerun or open a reconciliation PR"
+            exit 1
+          fi
+          if [ "$remote_candidate" != "$CANDIDATE_SHA" ]; then
+            echo "::error::Candidate ref moved from $CANDIDATE_SHA to $remote_candidate"
+            exit 1
+          fi
+          if [ "$(git rev-parse "$CANDIDATE_SHA^1")" != "$BASE_DEV_SHA" ] || \
+             [ "$(git rev-parse "$CANDIDATE_SHA^2")" != "$RELEASE_COMMIT" ]; then
+            echo "::error::Candidate ancestry changed after verification"
+            exit 1
+          fi
+
+          # The explicit lease is the atomic stale-base guard. The update is a
+          # fast-forward from BASE_DEV_SHA; no unrelated history can be replaced.
+          git push \
+            --force-with-lease="refs/heads/dev:$BASE_DEV_SHA" \
+            origin "$CANDIDATE_SHA:refs/heads/dev"
+
+          git push origin --delete "$CANDIDATE_BRANCH" || \
+            echo "::warning::Could not remove temporary branch $CANDIDATE_BRANCH"
+
+          echo "## Release backmerge complete" >> "$GITHUB_STEP_SUMMARY"
+          echo "Fast-forwarded \`dev\` from \`$BASE_DEV_SHA\` to tested merge \`$CANDIDATE_SHA\`." >> "$GITHUB_STEP_SUMMARY"
+
+  fallback:
+    name: Report PR fallback
+    needs: [prepare, gate, promote]
+    if: always() && needs.prepare.outputs.outcome == 'candidate' && needs.promote.result != 'success'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Preserve safe fallback instructions
+        env:
+          CANDIDATE_BRANCH: ${{ needs.prepare.outputs.candidate_branch }}
+          CANDIDATE_SHA: ${{ needs.prepare.outputs.candidate_sha }}
+          CHECK_RUN_ID: ${{ needs.gate.outputs.check_run_id }}
+        run: |
+          echo "## Automatic backmerge stopped" >> "$GITHUB_STEP_SUMMARY"
+          echo "\`dev\` was not updated. Open or refresh a reconciliation PR after addressing the failed/stale gate." >> "$GITHUB_STEP_SUMMARY"
+          echo "- Candidate ref: \`${CANDIDATE_BRANCH:-not-created}\`" >> "$GITHUB_STEP_SUMMARY"
+          echo "- Candidate SHA: \`${CANDIDATE_SHA:-n/a}\`" >> "$GITHUB_STEP_SUMMARY"
+          echo "- Required-check run: \`${CHECK_RUN_ID:-n/a}\`" >> "$GITHUB_STEP_SUMMARY"
@@ -117,6 +117,9 @@ jobs:
      - name: Build Linux x64
        run: npm run build:bin:linux

+      - name: Build Linux arm64
+        run: npm run build:bin:linux-arm
+
      - name: Build macOS x64
        run: npm run build:bin:mac-x64

@@ -138,19 +141,27 @@ jobs:

      - name: Smoke-test Linux binary
        run: |
-          set -e
+          set -euo pipefail
          chmod +x dist/bin/hermes-relay-linux-x64
          for cmd in --version --help doctor; do
-            out=$(./dist/bin/hermes-relay-linux-x64 "$cmd" 2>&1 || true)
+            set +e
+            out=$(./dist/bin/hermes-relay-linux-x64 "$cmd" 2>&1)
            exit_code=$?
-            if [ -z "$out" ] || [ ${#out} -lt 10 ]; then
-              echo "SMOKE FAIL: './hermes-relay-linux-x64 $cmd' produced no output (exit=$exit_code)"
+            set -e
+            if [ "$exit_code" -ne 0 ] || [ -z "$out" ] || [ ${#out} -lt 10 ]; then
+              echo "SMOKE FAIL: './hermes-relay-linux-x64 $cmd' failed or produced no output (exit=$exit_code)"
              echo "Raw output was: [$out]"
              exit 1
            fi
            echo "  smoke OK: $cmd -> $(echo "$out" | head -1)"
          done

+      - name: Verify Linux arm64 artifact architecture
+        run: |
+          set -euo pipefail
+          file dist/bin/hermes-relay-linux-arm64 | tee /tmp/hermes-relay-linux-arm64.file
+          grep -Eq 'ELF 64-bit.*(ARM aarch64|ARM64)' /tmp/hermes-relay-linux-arm64.file
+
      - name: Upload CLI release assets
        uses: actions/upload-artifact@v4
        with:
@@ -158,6 +169,7 @@ jobs:
          path: |
            desktop/dist/bin/hermes-relay-win-x64.exe
            desktop/dist/bin/hermes-relay-linux-x64
+            desktop/dist/bin/hermes-relay-linux-arm64
            desktop/dist/bin/hermes-relay-darwin-x64
            desktop/dist/bin/hermes-relay-darwin-arm64
          retention-days: 7
@@ -196,6 +208,60 @@ jobs:
            throw "Windows CLI smoke left $(@($leftovers).Count) process(es) behind"
          }

+  smoke-macos-cli-release-asset:
+    name: Smoke exact macOS CLI release asset
+    runs-on: macos-latest
+    needs:
+      - validate-release
+      - build-cli-binaries
+    steps:
+      - uses: actions/download-artifact@v8
+        with:
+          name: cli-binaries
+          path: release-assets
+
+      - name: Launch native release asset and inspect both architectures
+        env:
+          EXPECTED_DESKTOP_VERSION: ${{ needs.validate-release.outputs.version }}
+        run: |
+          set -euo pipefail
+          case "$(uname -m)" in
+            x86_64) native_asset=hermes-relay-darwin-x64 ;;
+            arm64) native_asset=hermes-relay-darwin-arm64 ;;
+            *) echo "Unsupported macOS runner architecture: $(uname -m)" >&2; exit 1 ;;
+          esac
+          chmod +x "release-assets/$native_asset"
+          version_output=$("release-assets/$native_asset" --version)
+          test "$version_output" = "hermes-relay $EXPECTED_DESKTOP_VERSION"
+          "release-assets/$native_asset" --help | grep -Fq 'Usage:'
+          file release-assets/hermes-relay-darwin-x64 | grep -Fq 'x86_64'
+          file release-assets/hermes-relay-darwin-arm64 | grep -Eq '(arm64|arm64e)'
+
+  smoke-linux-arm64-cli-release-asset:
+    name: Smoke exact Linux arm64 CLI release asset
+    runs-on: ubuntu-24.04-arm
+    needs:
+      - validate-release
+      - build-cli-binaries
+    steps:
+      - uses: actions/download-artifact@v8
+        with:
+          name: cli-binaries
+          path: release-assets
+
+      - name: Launch native arm64 release asset
+        env:
+          EXPECTED_DESKTOP_VERSION: ${{ needs.validate-release.outputs.version }}
+        run: |
+          set -euo pipefail
+          asset=release-assets/hermes-relay-linux-arm64
+          test "$(uname -m)" = "aarch64"
+          chmod +x "$asset"
+          version_output=$("$asset" --version)
+          test "$version_output" = "hermes-relay $EXPECTED_DESKTOP_VERSION"
+          "$asset" --help | grep -Fq 'Usage:'
+          file "$asset" | grep -Eq 'ELF 64-bit.*(ARM aarch64|ARM64)'
+
  build-windows-tray-installer:
    name: Build Windows tray installer
    runs-on: windows-latest
@@ -419,6 +485,8 @@ jobs:
    needs:
      - build-cli-binaries
      - smoke-windows-cli-release-asset
+      - smoke-macos-cli-release-asset
+      - smoke-linux-arm64-cli-release-asset
      - build-windows-tray-installer
    steps:
      # Needed so CLI_RELEASE_NOTES.md is available to render into the release body
@@ -466,7 +534,27 @@ jobs:
          files: |
            release-assets/cli-binaries/hermes-relay-win-x64.exe
            release-assets/cli-binaries/hermes-relay-linux-x64
+            release-assets/cli-binaries/hermes-relay-linux-arm64
            release-assets/cli-binaries/hermes-relay-darwin-x64
            release-assets/cli-binaries/hermes-relay-darwin-arm64
            release-assets/cli-windows-installer/hermes-relay-windows-x64-setup.exe
            release-assets/SHA256SUMS.txt
+
+  request-backmerge:
+    name: Request stable release backmerge
+    needs: [validate-release, publish-release]
+    if: ${{ !contains(needs.validate-release.outputs.version, '-') }}
+    permissions:
+      actions: write
+      contents: read
+    runs-on: ubuntu-latest
+    steps:
+      - name: Dispatch fail-closed release reconciliation
+        env:
+          GH_TOKEN: ${{ github.token }}
+          RELEASE_TAG: desktop-v${{ needs.validate-release.outputs.version }}
+        run: |
+          gh workflow run release-backmerge.yml \
+            --repo "$GITHUB_REPOSITORY" \
+            --ref main \
+            -f release_tag="$RELEASE_TAG"
@@ -138,3 +138,22 @@ jobs:
            dist/*.whl
            dist/*.tar.gz
            dist/SHA256SUMS.txt
+
+  request-backmerge:
+    name: Request stable release backmerge
+    needs: [validate, package]
+    if: ${{ !contains(needs.validate.outputs.version, '-') }}
+    permissions:
+      actions: write
+      contents: read
+    runs-on: ubuntu-latest
+    steps:
+      - name: Dispatch fail-closed release reconciliation
+        env:
+          GH_TOKEN: ${{ github.token }}
+          RELEASE_TAG: server-v${{ needs.validate.outputs.version }}
+        run: |
+          gh workflow run release-backmerge.yml \
+            --repo "$GITHUB_REPOSITORY" \
+            --ref main \
+            -f release_tag="$RELEASE_TAG"
@@ -95,3 +95,4 @@ keystore.properties
 desktop/tray/ui/vendor/
 # Generated from assets/screenshots/02_chat.png before docs dev/build.
 /user-docs/public/chat-demo.png
+/user-docs/public/product/desktop-ui/
@@ -28,7 +28,7 @@ not redefine the branch, release, or hotfix policy here and in `RELEASE.md`.
 | Staging source | An exact tested `dev` SHA or release-candidate tag; staging is an environment, never a branch |
 | Production source | Immutable `android-v*`, `server-v*`, or `desktop-v*` tags, selected by surface |
 | Hotfix base | The immutable production tag for the affected surface |
-| Back-merge target | `dev`; merge `main` back immediately after every hotfix |
+| Back-merge target | `dev`; stable hotfixes reconcile automatically when the exact tested merge is conflict-free, otherwise through a PR |

 Feature completion means merged and verified on `dev`; it does not mean
 released. A release train is separate work owned by a Forge release
@@ -37,6 +37,14 @@ open the `dev` → `main` release PR, tag the resulting `main` tip, publish the
 surface artifacts, deploy or roll out, and verify the live result. Never create
 a staging branch.

+A normal `dev` → `main` release needs no back-merge: the released integration
+parent is already in `dev`. A production-tag hotfix is different. After its
+stable release succeeds, `Release Backmerge` prepares a `dev`-first merge
+commit, runs the same path-aware required checks on that exact SHA, verifies
+that `dev` has not moved, and fast-forwards `dev`. Conflicts, failed checks,
+stale refs, or denied branch updates fail closed and require a reconciliation
+PR; never resolve those cases by choosing a side automatically.
+
 ### Local integration discipline

 - Fetch `origin/dev` before creating a task branch or worktree; do not base new
@@ -76,6 +84,11 @@ a staging branch.
  production tags are cut only from `main`.
 - **Android:** Jetpack Compose only (no XML), kotlinx.serialization (no Gson),
  OkHttp (no Ktor), `wss://` only. Run `./gradlew lint` before pushing Kotlin.
+  For interactive device-review loops, run focused tests plus the affected
+  assemble/install task; run the full affected-variant lint once when the
+  combined candidate is final, or earlier only for lint-sensitive resource,
+  manifest, dependency, or build-configuration changes. Do not repeat full
+  variant lint after every small Kotlin iteration.
 - **Plugin (Python 3.11+):** aiohttp + asyncio (no threading), type hints
  everywhere, structured `logging` (no `print`). **Desktop CLI (Node ≥21):**
  zero runtime deps, strict TS + ES modules, ship compiled `dist/`. Full
@@ -94,6 +107,40 @@ a staging branch.
 - Prioritize findings that warrant holding the merge. State the impacted path
  and the concrete failure mode.

+## Automated public issue triage
+
+New public issues may receive one clearly labeled **Hermes-Relay automated
+triage** reply. That first response may classify the report with existing
+type/area labels, point to related issues or current code/docs, ask for safe
+sanitized diagnostics, and flag the thread for maintainer review.
+
+GitHub attributes that reply to the repository-scoped
+`hermes-relay-triage[bot]` App, never to a maintainer's personal account.
+
+The automated lane may assign only the fixed maintainer account `Codename-11`
+as follow-up ownership; that assignment does not imply acceptance, priority,
+implementation, or a release commitment. It never closes, milestones,
+prioritizes, promises a fix/release/timeline, chooses another assignee, or
+continues replying after its first response. A related issue is not
+automatically a duplicate. Human maintainer comments and decisions remain
+authoritative; read the complete live thread before acting on an issue.
+
+## Automated public PR intake
+
+New external-contributor, non-draft pull requests may receive one clearly
+labeled **Hermes-Relay automated PR intake** reply from
+`hermes-relay-triage[bot]`. Owner-authored `Codename-11` PRs and bot PRs are
+dropped before model dispatch. For eligible PRs, the intake compares the live PR
+metadata/body and changed-path list with trusted `origin/dev` policy and
+`.github/pull_request_template.md` without checking out or executing contributor
+code. It may add genuine area labels plus `documentation`, `ci`, or
+`needs-maintainer-review` and point out missing intake evidence.
+
+The automated lane never approves, requests changes, merges, closes, assigns,
+requests reviewers, milestones, prioritizes, pushes commits, edits PR text,
+reruns workflows, applies `review-candidate`, or claims code correctness. Human
+maintainer review and CI remain authoritative.
+
 ## Public-repo writing hygiene

 Everything committed is public. In CHANGELOG, DEVLOG, README, docs, and release
@@ -8,16 +8,101 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/), and this

 ### Added

+- **Android can preview delegated agent work without leaving the parent chat.** The current-chat activity sheet shows bounded lifecycle, progress, and tool previews for concurrent children, opens vanilla Hermes child history read-only when the Gateway exposes it, and stays explicit when reconnect gaps or older routes leave details unavailable.
+- **Android presents Relay Git as a first-class native workspace.** A compact optional Chat rail opens repository status, line totals, filters, diffs, branches, staging, commits, and remotes; the full workspace remains available from Settings when Chat controls are hidden.
+- **Hermes-Relay Plugin provides a bounded Git workspace API for authenticated Dashboard clients.** Configured repository roots, path validation, tracked line totals, scoped write grants, and explicit confirmation protect repository reads and mutations.
+
+### Changed
+
+- **Hermes-Relay Dashboard management is organized around operator tasks.** Overview, Devices, Activity, Remote Access, Git, and Settings now have separate native Dashboard surfaces; pairing is QR-first, paired clients use responsive cards, and token-backed media is labeled as a bounded diagnostic instead of a health counter.
+- **New Relay pairing uses each Dashboard origin as the network ingress.** Dashboard, CLI, and TUI QR flows advertise the same-origin Relay transport for LAN, Tailscale, and public HTTPS routes. Recommended Tailscale uses dedicated HTTPS `:10443` for local Dashboard `:9119`, avoiding conflicts with an existing Traefik, Caddy, or nginx listener on `:443`; old `:443`/`:9119` routes and direct `:8767` remain explicit migration compatibility while `:8642` stays an optional API fallback.
+- **Dashboard pairing now explains and verifies route security before exposing an invite.** Endpoint receipts show Dashboard, Relay, and API URLs with priority and per-surface probe status, distinguish tailnet encryption from application TLS, and block malformed or plaintext public candidates.
+- **Android What's New leads with one curated release highlight without interrupting startup.** A timed post-update toast can be swiped or closed, previews additional feature/fix counts when a release has meaningful secondary items, expands into the centered highlight view on request, and keeps the full technical history available. Each release can present one plain-language summary, up to three primary benefits, and up to two quieter improvements, while release checks keep the structured entry, fallback, Play copy, and public release records aligned.
+
+### Fixed
+
+- **Android wake-word detection now loads a compatible native ONNX Runtime.** Packaged sherpa and Java JNI consumers are checked against the shared runtime for every supported ABI before release.
+- **Android Continuous voice waits for barge-in microphone teardown before listening again.** Multi-turn hands-free conversations no longer lose the microphone after a response finishes with barge-in enabled. (#464)
+- **Opening Android no longer claims or interrupts a turn already running in Hermes Desktop/TUI.** Passive foreground and session browsing now use read-only Gateway status plus profile-scoped history; live-session resume remains reserved for explicit Android actions and exact Android-owned recovery.
+- **Android provisional Threads can be removed without touching server history.** The drawer now offers a local-only removal action, reconciles promoted phone sessions without duplicate rows, and keeps Thread routing isolated to the active saved connection.
+- **Android Clarify cards make custom answers explicit and keyboard-friendly.** Choice prompts label their Other answer field, submit trimmed text from the keyboard, and do not restore an authoritatively expired prompt after session navigation.
+- **The visible Android Sphere keeps its smooth procedural motion across startup and chat.** Backgrounded and motion-disabled surfaces remain still without reducing foreground animation to a stepped ambient pulse.
+- **Android Voice Focus keeps Stop and immediate spoken steering available across every interaction mode.** Hold-to-talk now interrupts Thinking and Transcribing turns before capturing the replacement direction, remains operable through TalkBack, Switch Access, and keyboard controls, preserves pointer press-and-release behavior across floating controls, and Google Play no longer offers the sideload-only system overlay action.
+- **Android Assistant sessions explain when no speech was captured instead of appearing stuck at Ready.** Retry feedback survives the separate system overlay process, recreated session UI requests the current turn state, and locked sessions keep transcript, response, and technical error text private.
+- **Android New Chat keeps the current profile and stays fresh across profile switches.** Starting from All Profiles no longer forces the literal default profile, choosing another profile from an empty draft no longer reopens that profile's previous session after route settlement or restart, and leaving a provisional phone Thread cannot route the next turn to its old chat under the new profile.
+- **Android self-hosted OIDC keeps sign-in on one trusted Dashboard origin.** Android follows upstream `native_pkce` capability for every interactive provider and falls back to exact-host cookies only when needed. Private and Tailscale routes can discover a provider-declared callback, verify the same installation, and ask before retaining a different authenticated Dashboard/Gateway origin; public origins require HTTPS while reviewed local or overlay HTTP remains compatible. Routes presents that origin separately from optional network paths and no longer exposes internal roles as a VPN. (#399)
+- **Android Dashboard connections and profile drawers no longer wait on unavailable optional routes.** Dashboard, API fallback, and Relay probes run independently; API/Relay never gate a normal Dashboard connection, Gateway auth/ticket failures are not blindly retried, and authenticated session history remains available without a live Gateway socket. Concurrent route probes are shared and generation-safe, healthy same-priority routes win immediately, superseded session reads cancel their HTTP calls, and optional PR decoration stays outside the session-list critical path.
+
+### Removed
+
+- **Android Chat no longer includes the hidden clean-focus presentation.** The long-press gesture, overlapping instructional pill, reduced composer, and alternate fading transcript were removed so Chat keeps one complete interaction model. Voice Focus remains available.
+
+## [Android 1.13.2] - 2026-08-25
+
+### Added
+
+- **Android Supervised Mode presents a parent-controlled, profile-pinned chat surface.** Parents can limit attachments, Standard voice, generated media, conversation history, actions, and technical metadata while device authentication protects full settings. Hermes-Relay can identify and revoke a paired supervised client without becoming the policy enforcement boundary.
+
+### Fixed
+
+- **Android session rows stay neutral when optional live activity is unavailable or still loading.** Directory refreshes no longer restore a persistent Checking state, and full-row activity borders are reserved for actual Starting or Working turns.
+- **Returning from parent settings keeps Supervised Chat rendered.** Parent access now relocks without rebuilding the active navigation graph, and full Settings keeps a prominent shortcut back to Supervised Mode controls.
+
+## [Android 1.13.1] - 2026-08-25
+
+### Fixed
+
+- **Android session activity now follows live Hermes runtime truth.** Working, Starting, Needs input, Idle, Checking, Unavailable, and Background work no longer come from the Dashboard's five-minute recency hint, and only complete, unambiguously resolved live snapshots clear stale state.
+
+## [Android 1.13.0] - 2026-08-25
+
+### Added
+
+- **Provider usage and limits are available from top-level Settings.** Codex credential pools, Nous balances, and OpenCode Go account windows share one provider-neutral screen with Summary, Expanded, and Hidden presentation modes. Provider credentials remain on the Hermes host.
+- **Android Bot Mode provides one messenger-style workspace across saved Hermes gateways.** Bots and read-only group rooms aggregate without changing the foreground connection, Bot Chats retain exact gateway/profile ownership, and unavailable gateways keep clearly marked last-known roster entries.
 - **Android Assistant screen context.** Compatible unlocked assistant-button invocations can open Hermes, begin listening, and include bounded visible text plus an available screenshot in the first Standard voice turn. Ordinary wake and keyguard invocations remain screen-context free.

 ### Changed

- **Release and candidate names use one public product hierarchy.** Future releases use `Hermes-Relay Android`, `Hermes-Relay Plugin`, or `Hermes-Relay CLI+UI` display names, while isolated Android review and release-candidate installs use `HR Candidate`, without changing immutable tags, package identities, updater contracts, or artifact filenames.
- **Review candidates are an explicit PR opt-in with one trusted handoff comment.** Maintainers can apply `review-candidate` for exact-head Android and Relay bundles; a separate reporter updates the PR with the artifact, expiry, source SHA, and bounded review instructions without executing fork code with write permission.
- **Unlabeled PR updates no longer receive false candidate-failure comments.** The trusted reporter ignores skipped review-bundle workflow shells before reading artifacts or writing to a PR.
+- **Android releases and review candidates use clear public product names.** Stable builds use `Hermes-Relay Android`, while isolated review installs use `HR Candidate` without changing package identities or update contracts.
+- **Review candidates are explicit and source-pinned.** Maintainers can opt a PR into a matched Android and Relay bundle with checksums, expiry, source SHA, and bounded review instructions.

 ### Fixed

+- **Unlabeled PR updates no longer receive false candidate-failure comments.** The trusted reporter ignores skipped review-bundle workflow shells before reading artifacts or writing to a PR.
+- **Android chats no longer retain a stale busy composer.** A completed Gateway bubble settles automatically when its exact session has no live or detached turn, new-chat navigation clears stale visible ownership, and Stop remains an immediate escape hatch. (#416, #418)
+- **README and Google Play onboarding now match the Dashboard-first product path.** Public setup copy names the two separate Dashboard QR actions, treats the API server as an advanced fallback, explains the encouraged Hermes-Relay extension without implying Play includes Device Control, and ships one current deterministic Android screenshot set.
+- **The Android Sphere remains gently animated while visibly idle.** New chats and the ambient Sphere behind messages now use a low-cost layer breath, while hidden/backgrounded and motion-disabled surfaces stay still and active agent/voice states retain their full procedural animation.
+- **Android retries Windows-hosted `MEDIA:` attachments through Relay's by-path route.** A document deferred on cellular no longer treats `C:\...` as an opaque media token and reports it as expired.
+
+## [Plugin 1.10.0] - 2026-08-25
+
+### Added
+
+- **Relay provides normalized provider usage without exposing credentials.** The authenticated Dashboard route resolves the active Codex pool entry, structured Nous balances, and OpenCode Go windows on the Hermes host; explicitly enabled paired clients receive the same provider-neutral schema.
+
+### Changed
+
+- **Plugin releases use the `Hermes-Relay Plugin` public name.** The display name is aligned with Android and CLI+UI while the `server-v*` compatibility tag remains unchanged.
+
+### Fixed
+
+- **Relay profile discovery follows `HERMES_HOME` by default.** Custom Hermes installations surface their real default profile and persist Relay sessions beside the active config while retaining the explicit `RELAY_HERMES_CONFIG` override.
+
+## [0.4.0-beta.5] - 2026-08-25
+
+### Added
+
+- **Desktop releases now include a Linux ARM64 CLI artifact.** The one-line installer, updater, checksums, release publication, architecture validation, and platform documentation all recognize the same `linux-arm64` binary.
+- **The public site now shows the real Windows CLI UI and guides each surface through first use.** Deterministic public-safe screenshots cover connection, host access, activity, computer control, and updates.
+
+### Changed
+
+- **Desktop releases use the `Hermes-Relay CLI+UI` public name.** The beta keeps its existing `desktop-v*` tag and updater contract.
+
+### Fixed
+
+- **Desktop install and update discovery remains reliable in a multi-surface release repository.** Every resolver paginates GitHub releases before choosing the SemVer maximum, Windows cooperative updates clean their released backup, unsigned preview installers retain the normal SmartScreen warning, and release smoke tests preserve real exit codes.
 - **Desktop daemon connections recover instead of exiting after an interrupted Relay socket.** Healthy daemons retry through Relay restarts and repeated failed reconnect attempts, oversized desktop-tool results fail within a bounded response instead of closing the shared WebSocket, and terminal failures leave an accurate stopped status for the tray.
 - **Desktop computer control follows Hermes' current CUA Driver contract.** CUA Driver 0.20 and newer are accepted when their manifest, daemon/MCP arguments, required tools, and canonical path remain compatible, and Windows sessions use the manifest-declared direct standard-mode runtime instead of a potentially stale machine-wide daemon. Current 0.21 installations no longer fall back solely because of an obsolete upper version pin or daemon contract.

@@ -73,7 +158,6 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/), and this
 - **Android screen-on idle no longer continuously redraws the ASCII sphere.** Idle holds a stable frame while thinking, streaming, and voice states retain full-rate motion; inactive voice waveforms and closed session drawers also stop their frame loops.
 - **Android capture and audio effects release power-sensitive resources at their actual lifecycle boundaries.** Screen capture attaches its MediaProjection surface only for a requested frame, unattended Bridge wake locks release when the command finishes, and barge-in AEC/noise suppression attach to the microphone capture session instead of playback.
 - **Experimental wake-word listening reuses its PCM normalization buffer.** Continuous opt-in listening no longer allocates a new float frame for every inference call.
-
 ## [1.10.0] - 2026-08-18

 ### Added
@@ -1,17 +1,33 @@
 # Hermes-Relay CLI+UI v__VERSION__

-**Release Date:** 2026-08-15
+**Release Date:** 2026-08-25

-This patch keeps the Windows management UI usable when the Relay daemon is stopped or its status cannot be read.
+This beta makes the Desktop connector resilient through Relay interruptions,
+aligns Windows computer control with current CUA Driver releases, adds a native
+Linux ARM64 build, and hardens installation and update discovery.

-**Beta phase.** Assets remain unsigned, so Windows SmartScreen and macOS Gatekeeper may warn on first launch. Standalone CLI binaries ship for Windows x64, Linux x64, and macOS x64/arm64; the management UI is Windows-only.
+**Beta phase.** Assets remain unsigned, so Windows SmartScreen and macOS Gatekeeper may warn on first launch. Standalone CLI binaries ship for Windows x64, Linux x64/arm64, and macOS x64/arm64; the management UI is Windows-only.

 ## What's changed

+### Added
+
+- **Linux ARM64 is a first-class release target.** The one-line installer,
+  updater, checksums, and release artifacts now cover both Linux x64 and arm64.
+- **The public site shows the real Windows CLI UI.** Deterministic screenshots
+  cover connections, host access, activity, computer control, and updates.
+
+### Changed
+
+- **Public naming is aligned.** Releases use `Hermes-Relay CLI+UI` while the
+  beta keeps its existing `desktop-v*` tag and updater contract.
+
 ### Fixed

- **Stopped daemons no longer block the management UI.** Missing, stale, malformed, or temporarily unavailable daemon status falls back to an explicit stopped state while hosts, settings, activity, CLI details, diagnostics, and daemon controls continue loading normally.
- **Starting the daemon restores live status without reopening the UI.** A valid running status continues through the same bounded, single-flight snapshot path introduced in beta.3.
+- **The daemon reconnects instead of exiting after an interrupted Relay socket.** Relay restarts and repeated transient replacement failures stay on bounded automatic backoff, and terminal failures persist an accurate stopped reason for the UI.
+- **Oversized desktop-tool output no longer closes the shared connection.** PowerShell output and every serialized desktop response stay inside the Relay WebSocket budget.
+- **Current CUA Driver releases remain compatible by contract.** Driver 0.20 and newer are accepted when their manifest and required tools match Hermes, and Windows uses the manifest-declared direct standard-mode runtime instead of a stale machine-wide daemon.
+- **Install and update discovery paginates the multi-surface release history.** Desktop releases remain discoverable after more Android and Server releases, Windows cooperative updates clean their released backup, and unsigned installers retain the normal SmartScreen warning.

 ## Install

@@ -42,6 +58,7 @@ hermes-relay --version
 hermes-relay hosts list --json
 hermes-relay daemon start
 hermes-relay daemon status --json
+hermes-relay computer-use status --json
 ```

 On Windows, click the Hermes-Relay CLI UI notification-area icon to open the management popup directly above it.
@@ -104,6 +104,24 @@ The legacy `relay_server/` directory is a thin compatibility shim around `plugin
 | **CI/CD** | GitHub Actions (lint, build, test, signed APK artifacts) |
 | **Min SDK** | 26 (Android 8.0) / Target SDK 36 |

+## Issues and automated triage
+
+New issues may receive one first response headed **Hermes-Relay automated
+triage**. It reads the live report against current code, documentation, related
+issues, and public release state; it may add existing type/area labels and ask
+for a focused, safe diagnostic such as the app version, interaction mode, or a
+sanitized log excerpt.
+
+GitHub displays the response as authored by `hermes-relay-triage[bot]`, a
+repository-scoped App rather than a maintainer's personal account.
+
+That reply is an acknowledgement and initial analysis, not a maintainer
+decision. The automated path may assign `Codename-11` as the fixed owner for
+follow-up, but assignment does not mean acceptance, priority, implementation,
+or a release commitment. It does not close issues, choose another assignee, set
+milestones or priority, promise a fix or release, or continue the conversation.
+A maintainer will follow up on the thread.
+
 ## Running the Relay Locally

 Only needed if you're working on the bridge, voice, notifications, or media features. Chat alone doesn't need the relay.
@@ -145,6 +163,23 @@ documentation fixes.
 `main` is release history, not the normal contribution target; it receives
 approved release PRs from `dev` and focused hotfix PRs based on production tags.

+Pull requests use [the repository template](.github/pull_request_template.md).
+Keep the body grounded: describe the outcome and focused changes, list exact
+verification, include visual evidence when applicable, state compatibility or
+risk, and preserve contributor lineage when replacing or salvaging prior work.
+Check an item when it is satisfied or when its N/A rationale is written in the
+body; do not use checked boxes as a substitute for evidence.
+
+New external-contributor, non-draft pull requests may receive one
+**Hermes-Relay automated PR intake** reply from `hermes-relay-triage[bot]`.
+Owner-authored `Codename-11` PRs and bot PRs skip this lane. For eligible PRs,
+the bot checks the live body, base branch, changed-path areas, template
+completeness, stated verification, visual proof, and lineage without checking
+out or executing contributor code. It may add bounded area/intake labels and
+identify missing evidence, but it does not review code correctness, approve,
+request changes, merge, close, assign, request reviewers, push commits, edit the
+PR, rerun workflows, or select review bundles.
+
 `origin/dev` is the canonical integration ref. Keep local `dev` as a clean,
 fast-forward-only mirror and create each task in its own branch/worktree from the
 current `origin/dev`. Do not accumulate unpublished commits on local `dev`. If a
@@ -1,5 +1,103 @@
 # Hermes-Relay — Dev Log

+## 2026-08-27 — Fixed issue ownership and bounded PR intake
+
+The automated issue first-response lane now assigns only `Codename-11` when the
+maintainer is absent. The assignee is fixed in the write wrapper rather than
+chosen by webhook or model output, and represents follow-up ownership only—not
+acceptance, priority, implementation, or a release promise.
+
+A separate pull-request route now handles external-contributor, non-bot,
+non-draft `opened`, `reopened`, and `ready_for_review` events. Owner-authored
+`Codename-11` PRs are dropped before model dispatch. Eligible PRs are read from
+live metadata plus trusted `dev` policy/template without executing contributor
+code; the route applies only bounded area/intake labels and posts one
+App-authored intake reply. It cannot approve, request changes, merge, close,
+assign, request reviewers, push, edit PR text, rerun CI, select
+`review-candidate`, or claim correctness. The external-contributor production
+canary retained its exact head/base/open state and proved marker idempotency.
+
+## 2026-08-26 — Canonical pull request intake contract
+
+The repository now supplies one pull request template derived from the structure
+already used by successful Android, plugin, desktop, docs, release, and salvage
+PRs. It asks for a concise summary, focused changes, exact verification, visual
+evidence when applicable, compatibility/risk notes, contributor lineage, and the
+existing cross-surface checklist.
+
+Checkboxes require evidence or an explicit N/A rationale. The template does not
+turn every surface into a mandatory test lane, does not replace CI or maintainer
+review, and keeps normal work targeting `dev` while preserving the documented
+release/hotfix exceptions.
+
+## 2026-08-26 — Android OIDC origin continuity and route latency
+
+Dashboard authentication now follows upstream `/api/status.auth_flows`:
+interactive redirect and password providers use native PKCE when advertised,
+with exact-host cookies retained only for older gateways or client-local native
+failure. A different provider-declared callback is fenced by installation
+identity and explicit review before becoming the authenticated Dashboard/Gateway
+origin. Public origins require HTTPS; reviewed literal LAN, Tailscale, and
+loopback HTTP retains upstream compatibility. Cookies are never copied between
+hosts, API and Relay ownership remain separate, unsafe callbacks are rejected,
+and third-party cookies are enabled only for the short-lived compatibility
+WebView.
+
+The saved authenticated origin is now modeled as connection-level
+Dashboard/Gateway state rather than as a synthetic network candidate. The
+Routes screen presents a dedicated Dashboard & Gateway card with edit and
+re-check actions, keeps LAN, Tailscale, API, and Relay under Network routes, and
+does not expose internal role keys or describe arbitrary routes as VPNs. Changing
+the Dashboard origin clears origin-bound cookies and bearer state before the new
+address is verified. The compact footer shows the active surface and transport
+without allowing long model or profile names to displace the route label.
+
+For self-hosted OIDC, authorization and callback use one exact Dashboard
+address. Split DNS remains the preferred public-HTTPS/local-performance shape,
+but a second public URL is not a universal onboarding field. Android does not
+treat the identity origin as ownership of optional API or Relay paths.
+
+Optional API discovery no longer blocks a healthy Dashboard/Gateway route.
+Concurrent probes are shared, negative results are cached for a bounded window,
+same-priority routes race by completion, and connection generations prevent a
+late old route from overwriting a new one. Invalidated probes cannot publish a
+stale unreachable result or diagnostic. Dashboard session and message reads
+now cancel with their coroutine, one bounded budget covers the complete session
+list, WebSocket-ticket minting is bounded, and optional pull-request decoration
+falls off the critical path while preserving exact profile-scoped rows.
+Gateway ticket/auth failures receive one bounded classified attempt rather than
+two serialized waits. A pre-ready WebSocket close settles immediately, while
+optional API and Relay work remains background capability discovery.
+
+Focused auth, Dashboard, resolver, route, and native-sign-in coverage passed
+135 tests on the final `origin/dev` merge, followed by Android lint and sideload
+assembly. The matching Android 16 sideload was installed in place with app data
+preserved. Cold-route evidence showed Dashboard selection completing in hundreds
+of milliseconds, unavailable API fallback work continuing in the background,
+and unauthenticated ticket failures returning immediately instead of stalling.
+An upstream-compatible live-writer certification separately kept five full
+profile-roster RPCs below one second while concurrent ticket mints stayed in
+single-digit milliseconds. Final interactive provider consent/callback remains
+a human gate because the test device was locked after deployment.
+
+## 2026-08-26 — Bounded public issue triage contract
+
+New GitHub issues may receive one clearly identified Hermes-Relay automated
+triage response grounded in the live report, current code and documentation,
+related open/closed issues, and verified public release state. The lane may add
+existing type/area labels, request focused sanitized diagnostics, and flag a
+thread for maintainer review.
+
+The automated path is intentionally not an issue-lifecycle owner: it cannot
+close, assign, milestone, prioritize, promise a fix/release/timeline, or continue
+replying after the first response. Replies identify themselves as automated and
+explicitly hand the remaining decision to a maintainer. Contributor guidance and
+agent instructions carry the same boundary.
+
+Public labels and comments are attributed to the repository-scoped
+`hermes-relay-triage[bot]` GitHub App rather than a maintainer's personal
+account. The App identity does not expand the bounded action contract.
+
 ## 2026-08-24 — Single dev integration authority

 `origin/dev` is the sole integration authority. Primary local `dev` checkouts are
@@ -62,6 +160,18 @@ automotive device verified foreground preservation, AssistStructure and screensh
 delivery, immediate listening, contextual response, and one-shot consumption;
 broader firmware certification remains tracked in `TODO.md`.

+## 2026-08-23 — Windows attachment retry and Hermes-home resolution
+
+Android now recognizes Windows absolute paths during manual inbound-media retry.
+Cellular-deferred `MEDIA:C:\...` documents use Relay's authenticated
+`/media/by-path` route instead of being sent to the opaque-token route and
+misreported as expired. A Robolectric/MockWebServer regression covers a spaced
+Markdown filename and asserts the exact route and decoded path query.
+
+Relay configuration now derives its default `config.yaml` and session-persistence
+paths from `HERMES_HOME` when present. `RELAY_HERMES_CONFIG` remains the explicit
+override. Focused Python tests cover both resolution paths.
+
 ## 2026-08-23 — GitHub Discussions community surface

 GitHub Discussions is enabled as the repository's lightweight community surface.
@@ -1,21 +1,26 @@
 # Hermes-Relay Plugin v__VERSION__

-**Release Date:** August 21, 2026
+**Release Date:** August 25, 2026

 ## Summary

-This release makes delayed phone delivery and active Bridge access easier to understand. Relay now identifies messages flushed after reconnect, emits one completion signal for the backlog, and reports permanent, timed, and unlimited phone capabilities through status surfaces.
+This release adds a provider-neutral account-usage surface for Android and Dashboard clients. Relay resolves Codex credential pools, structured Nous balances, and OpenCode Go windows on the Hermes host without returning provider credentials.

 Standard chat, session history, and Vanilla Hermes voice remain upstream-owned and do not require this plugin.

 ## Added

- **Reconnect backlog context.** Messages flushed from the bounded offline queue carry an explicit delayed-delivery marker, followed by one ordered completion event with the delivered count.
- **Granular phone capability status.** Relay status and `android_phone_status` report permanent, timed, and unlimited Bridge capabilities alongside existing Android permissions and safety state.
+- **Provider-neutral usage snapshots.** Authenticated Dashboard clients can resolve the exact active Codex pool entry, Nous balances, and OpenCode Go account windows through one normalized schema.
+- **Bounded paired-client fallback.** Operators may explicitly enable the Relay usage route for paired standalone clients while credentials remain host-side.

 ## Changed

- **Phone surfacing semantics are explicit.** Default delivery persists to Threads and notifies, Inbox delivery remains silent, and Session delivery targets an available active conversation before falling back to a notification.
+- **Usage capabilities are explicit.** Responses identify Relay-enhanced credential pools, structured balances, and provider adapters instead of implying unsupported upstream data.
+- **Public product naming is aligned.** Releases use `Hermes-Relay Plugin` while retaining the `server-v*` tag and installation contract.
+
+## Fixed
+
+- **Custom Hermes homes resolve correctly.** Relay profile discovery and session persistence follow `HERMES_HOME` by default while preserving the explicit `RELAY_HERMES_CONFIG` override.

 ## Install / update

@@ -17,7 +17,7 @@
  <a href="https://developer.android.com/about/versions/oreo"><img src="https://img.shields.io/badge/Android-8.0%2B-3DDC84.svg?logo=android&logoColor=white" alt="Android 8.0+"></a>
  <a href="https://github.com/Codename-11/hermes-relay/actions/workflows/ci-android.yml"><img src="https://github.com/Codename-11/hermes-relay/actions/workflows/ci-android.yml/badge.svg" alt="Android CI"></a>
  <a href="https://github.com/Codename-11/hermes-relay/releases"><img src="https://img.shields.io/github/v/release/Codename-11/hermes-relay?filter=android-v*&label=release&color=8B5CF6" alt="Latest release"></a>
-  <a href="https://github.com/Codename-11/hermes-relay/tree/main/desktop"><img src="https://img.shields.io/badge/CLI-alpha-orange.svg" alt="CLI (alpha)"></a>
+  <a href="https://github.com/Codename-11/hermes-relay/tree/main/desktop"><img src="https://img.shields.io/badge/CLI-beta-756cff.svg" alt="CLI (beta)"></a>
 </p>

 <p align="center">
@@ -36,12 +36,12 @@
 Hermes-Relay puts your [Hermes agent](https://github.com/NousResearch/hermes-agent) on the devices you actually carry. The brain stays on your own machine — Hermes-Relay is how you reach it.

 - **📱 Android app** — streaming chat, hands-free voice, native plugin pages, and the full Hermes dashboard (models, keys, skills, profiles), rebuilt native. Add a floating Petdex companion or optionally make Hermes your Android assistant; sideload builds can also let the agent read and act on your screen.
- **⌨️ Hermes-Relay CLI** *(alpha)* — a single binary that gives the agent **hands on any machine you pair**: files, terminal, search, screenshots — consent-gated.
+- **⌨️ Hermes-Relay CLI** *(beta)* — a single binary that gives the agent **hands on any machine you pair**: files, terminal, search, screenshots — consent-gated.

-A vanilla [hermes-agent](https://github.com/NousResearch/hermes-agent) install is enough — chat, management, voice, Petdex, and ordinary installed-plugin pages need **no Relay plugin**. Add the optional Relay only when you want terminal, phone control, agent-created page drafts, or the CLI's tools. **Pair once from either surface; both work.**
+A vanilla [hermes-agent](https://github.com/NousResearch/hermes-agent) install is enough for the upstream standard path: chat, management, voice, Petdex, and ordinary installed-plugin pages. The Hermes-Relay plugin is optional for that base but encouraged for the complete current experience: Terminal/TUI, notifications, media, desktop tools, enhanced voice, Relay sessions, page drafts, and optional Device Control. Hermes-Relay prefers compatible upstream surfaces as they become available instead of keeping duplicate extension paths. **Connect Hermes first, then grant Hermes-Relay separately; the same one-time invite contract pairs Android or the Desktop CLI.**

 <p align="center">
-  <img src="docs/diagrams/architecture-homepage.png" alt="How Hermes-Relay connects — Vanilla Hermes (Chat, Manage, Voice) runs with no plugin; the optional Relay plugin adds Terminal, Bridge, relay voice and desktop tools to the app and CLI; Device Control needs the sideload build." width="900">
+  <img src="docs/diagrams/architecture-homepage.png" alt="How Hermes-Relay connects — upstream Hermes owns Chat, Manage, and standard Voice; the encouraged Relay extension fills current gaps for Terminal, notifications, media, enhanced voice, sessions, desktop tools, and optional Device Control." width="900">
 </p>

 ## Quick Start (Android)
@@ -50,7 +50,7 @@ Install → connect → talk, in about two minutes.

 ### 1 · Install the app

- **Google Play** *(easiest — auto-updates)* — [**install from Google Play**](https://play.google.com/store/apps/details?id=com.axiomlabs.hermesrelay). Chat, voice, Manage, terminal/TUI, media, notifications, and relay sessions.
+- **Google Play** *(easiest — auto-updates)* — [**install from Google Play**](https://play.google.com/store/apps/details?id=com.axiomlabs.hermesrelay). Chat, voice, sessions, and Manage work with standard Hermes; pairing the Hermes-Relay plugin adds Terminal/TUI, media, notifications, and Relay sessions.
 - **APK** *(full phone-control feature set)* — download the file ending in **`-sideload-release.apk`** from the newest `android-v*` release on [GitHub Releases](https://github.com/Codename-11/hermes-relay/releases) and open it (allow your browser to install unknown apps the first time). Integrity verification, signing fingerprint, and per-build details are in the [Sideload guide](https://hermes-relay.dev/docs/guide/getting-started.html#sideload-apk).

 Sideload builds check GitHub for updates and show a one-tap banner when you're behind; Play builds update through the Store. See [Release tracks](https://hermes-relay.dev/docs/guide/release-tracks) for the capability matrix.
@@ -71,27 +71,21 @@ an HTTPS reverse proxy. The [full walkthrough](https://hermes-relay.dev/docs/gui
 covers Windows, remote access, and dashboard authentication. You do not need to
 enable the separate API server or invent an API key for the standard path.

-For plugin-enabled setups, optional **Hermes Secure Link** presents Relay, API,
-and Dashboard routes through one pairing-pinned TLS origin. It protects traffic
-to the paired endpoint while each service keeps its own authentication; it does
-not provide reachability or independently identify the physical host. You still
-use LAN routing, Tailscale or another VPN, or an operator-managed public route
-to reach the listener. Secure Link is off by default and requires a fresh QR
-pairing after it is enabled. See the
-[remote-access guide](https://hermes-relay.dev/docs/guide/remote-access/).
-
-**Hermes Reach** is an experimental, advanced outbound-broker route. It remains
-available for development and self-hosted evaluation, but it is disabled by
-default, ordered after supported routes, and not recommended for normal remote
-access. Use Tailscale for the easiest supported remote setup, or a public TLS
-domain / Direct Secure Link when you want to own the complete network path.
+Start on a trusted LAN. For away-from-home access, Tailscale is the recommended
+path. Secure Link, public TLS, and experimental routing options are covered in
+the [remote-access guide](https://hermes-relay.dev/docs/guide/remote-access/).

 ### 3 · Connect and talk

-Open the app, choose **Connect to Hermes**, and enter or discover the dashboard
-address (conventionally `http://<host>:9119`). Sign in through the dashboard's
-configured provider when prompted. The app probes the available upstream
-capabilities and finishes with a connection summary.
+For a plugin-enabled host, open the Web Dashboard's **Relay** page, click
+**Connect mobile app**, and scan that tokenless QR from Android **Connect → Scan
+Hermes setup QR**. It contains only the Dashboard address and configures the
+upstream Chat, sessions, Manage, sign-in, and standard voice connection.
+
+Without the Dashboard plugin, use **Find Hermes on LAN** or enter the Dashboard
+address manually (conventionally `http://<host>:9119`). Sign in through the
+Dashboard's configured provider when prompted. The app probes the available
+upstream capabilities and finishes with a connection summary.

 The separate API server can be discovered automatically or added later under
 **Advanced** as a chat fallback or for a headless compatibility setup. Its API
@@ -106,49 +100,47 @@ The wizard probes everything and finishes with a capability card:
 | **Manage** | Models, keys, skills, and profiles are available from the phone |
 | **Voice** | Speech ready via your server (or one Manage sign-in away) |
 | **API fallback** | Optional API route available/unavailable |
-| **Relay** | Optional extensions — fine to leave unpaired |
+| **Relay** | Recommended extensions paired/unpaired; never blocks the upstream path |

 One dashboard sign-in unlocks Chat, Manage, sessions, and standard voice. That's
 the whole Vanilla Hermes setup.

-> **Going places?** Add the Dashboard's Tailscale address — for example `http://100.x.y.z:9119` or a separately published `https://host.ts.net` URL — under **Settings → Connections → Routes**. Android tests it as a Dashboard route; no API server or API key is required. The app uses LAN at home and switches routes automatically when you leave. See [Remote access](https://hermes-relay.dev/docs/guide/remote-access).
+> **Going places?** Add the Dashboard's Tailscale address — for example `http://100.x.y.z:9119` or a separately published `https://host.ts.net` URL — under **Settings → Gateways → Routes**. Android tests it as a Dashboard route; no API server or API key is required. The app uses LAN at home and switches routes automatically when you leave. See [Remote access](https://hermes-relay.dev/docs/guide/remote-access).

-### 4 · Optional: install Relay for power tools
+### 4 · Recommended: pair Relay for the complete experience

-Install the Relay plugin on the server only when you want Terminal, Bridge phone control, relay sessions, media routes, the realtime voice engine, or approval-gated agent-created plugin-page drafts:
+Install Relay for Terminal/TUI, notifications, media handoff, desktop tools,
+enhanced voice, Relay sessions, approval-gated page drafts, and optional Device
+Control:

 ```bash
 hermes plugins install Codename-11/hermes-relay/plugin --enable
 hermes relay doctor
 hermes relay start --no-ssl
-hermes pair
 ```

-Use the legacy installer instead if you also want the systemd user service,
-shell shims, and the full clone/update workflow:
+Use `--no-ssl` only on a trusted LAN or VPN. Use the
+[remote-access guide](https://hermes-relay.dev/docs/guide/remote-access/) before
+exposing any Hermes surface beyond that network.
+
+Refresh or restart the Dashboard/Gateway, open **Relay → Pair new device**, and
+scan the one-time QR from Android **Settings → Gateways → Access → Pair Relay**.
+Leave mode on **Auto** for the recommended route discovery. The same dialog
+shows a copyable invite for Desktop CLI clients:

 ```bash
-curl -fsSL https://raw.githubusercontent.com/Codename-11/hermes-relay/main/install.sh | bash
+hermes-relay pair --pair-qr "hermes-relay://pair?payload=…" --grant-tools
 ```

-Installed Hermes plugins can expose bounded, host-rendered pages to Android
-through the authenticated Dashboard without running plugin code on the phone.
-Relay 1.5.0 additionally supports approval-gated agent-created page drafts. The
-plugin-manager install owns the plugin code, dashboard tab, CLI commands, and
-agent tools. `hermes relay compat status/install/remove` manages only the
-optional legacy API compatibility hook when an older Hermes build needs it. Scan
-the QR from the phone's Connections screen — or use
-`hermes pair --register-code ABCD12` with the manual code from Android
-**Settings → Connections → Advanced**.
+As alternatives, `hermes pair` renders the same Android QR and pasteable invite
+in a terminal, while URL + six-character code and `--register-code` remain
+manual fallbacks when QR or clipboard transfer is unavailable.

- **Plugin-manager uninstall:** `hermes relay compat remove --all` if you installed the optional hook, then `hermes plugins remove hermes-relay`.
- **Legacy installer update:** `hermes-relay-update` (idempotent) — or re-run the install one-liner.
- **Legacy installer uninstall:** `bash ~/.hermes/hermes-relay/uninstall.sh` — removes the service, shims, clone, external skill path, editable package, and compat hook. It never touches shared Hermes state. Flags: `--dry-run`, `--keep-clone`, `--remove-secret`.
- **Dashboard plugin:** installs with the same symlink — restart the gateway and a **Relay** tab (paired devices, bridge activity, media tokens) appears in the web UI.
+**Next:** [Android + Hermes-Relay Quick Start](https://hermes-relay.dev/docs/guide/quick-start) ·
+[Desktop CLI pairing](https://hermes-relay.dev/docs/desktop/pairing) ·
+[server, TLS, legacy install, and uninstall reference](https://hermes-relay.dev/docs/reference/relay-server)

-Full server setup, TLS, and systemd details: [docs/relay-server.md](docs/relay-server.md).
-
-**Requirements:** Android 8.0+ (SDK 26) · current upstream [hermes-agent](https://github.com/NousResearch/hermes-agent) with the Dashboard/Gateway enabled · Python 3.11+ on the server. The API server and Relay are optional.
+**Requirements:** Android 8.0+ (SDK 26) · current upstream [hermes-agent](https://github.com/NousResearch/hermes-agent) with the Dashboard/Gateway enabled · Python 3.11+ when installing the Hermes-Relay plugin. The API fallback is optional; the Hermes-Relay plugin is encouraged for the complete experience.

 ## Screenshots

@@ -162,11 +154,16 @@ Full server setup, TLS, and systemd details: [docs/relay-server.md](docs/relay-s
  <tr>
    <td align="center" width="25%"><img src="assets/screenshots/05_themes.png" alt="App themes" width="100%"><br><sub><b>App themes</b></sub></td>
    <td align="center" width="25%"><img src="assets/screenshots/06_manage.png" alt="Manage your agent" width="100%"><br><sub><b>Manage your agent</b></sub></td>
-    <td align="center" width="25%"><img src="assets/screenshots/07_connections.png" alt="Connections and routes" width="100%"><br><sub><b>Connections &amp; routes</b></sub></td>
+    <td align="center" width="25%"><img src="assets/screenshots/07_connections.png" alt="Gateways and routes" width="100%"><br><sub><b>Gateways &amp; routes</b></sub></td>
    <td align="center" width="25%"><img src="assets/screenshots/08_appearance.png" alt="Agent avatar &amp; skins" width="100%"><br><sub><b>Avatars &amp; skins</b></sub></td>
  </tr>
 </table>

+<p align="center">
+  <img src="assets/screenshots/supplemental/15_git_workspace.png" alt="Native Git workspace showing repository changes, an inline diff, and staging controls" width="260"><br>
+  <sub><b>Native Git workspace</b> — optional Hermes-Relay plugin</sub>
+</p>
+
 ### Simplified Chinese

 <table>
@@ -193,16 +190,16 @@ tracked independently so community corrections remain easy to contribute.
 - **Hands-free voice** — talk on a vanilla install: speech rides your server's configured providers, unlocked by the same Manage sign-in. Relay-paired setups add per-profile voice and an opt-in provider-native Realtime Agent with background task handoff.
 - **Works away from home** — add a Tailscale or public URL and the app roams automatically (LAN at home, fallback elsewhere). An unreachable server gets a diagnosis, not just a red dot.
 - **Multi-Connection + profiles** — pair multiple Hermes servers (home + work, dev + prod) and switch in one tap; overlay a profile's model + `SOUL.md` per chat.
- **Phone control (bridge)** — with Relay paired, the agent reads the screen and acts: tap, type, swipe, scroll, screenshots, clipboard, media keys, batched macros. Guarded by per-app blocklist (banking/2FA blocked by default), destructive-verb confirmation, idle auto-disable, and a full activity log.
+- **Device Control (Sideload + Hermes-Relay required)** — the agent can read the screen and act: tap, type, swipe, scroll, screenshots, clipboard, media keys, and batched macros. This is not included in the Google Play build. It is guarded by a per-app blocklist (banking/2FA blocked by default), destructive-verb confirmation, idle auto-disable, and a full activity log.
 - **Notification companion** — opt-in access so the agent can triage, summarize, and route incoming notifications.
 - **Security & pairing** — QR pairing, Android Keystore session storage (StrongBox-preferred), TOFU cert pinning, per-channel time-bound grants, user-chosen session TTL.
 - **Stats for Nerds** — local-only analytics: TTFT, token usage, stream health, peak-time charts.

 > Sideload builds add direct SMS, contact search, one-tap dialing, and location awareness — handy for fully hands-free intents like *"text Sam I'll be 10 minutes late."* See [Release tracks](https://hermes-relay.dev/docs/guide/release-tracks).

-## Hands on any machine — the Hermes-Relay CLI&nbsp;<sub>(alpha)</sub>
+## Hands on any machine — the Hermes-Relay CLI&nbsp;<sub>(beta)</sub>

-> **Alpha.** Self-contained CLI binaries ship for Windows x64, Linux x64, and macOS x64/arm64 — no Node required. Windows also has an optional compact management tray. Assets are unsigned during the experimental phase, so SmartScreen / Gatekeeper warnings are expected.
+> **Beta.** Self-contained CLI binaries ship for Windows x64, Linux x64/arm64, and macOS x64/arm64 — no Node required. Windows also has an optional compact management tray. Assets are unsigned during the experimental phase, so SmartScreen / Gatekeeper warnings are expected.

 The agent's brain stays on the host; the CLI lets it call tools **on your machine** over the same WSS relay — `read_file`, `write_file`, `terminal`, `search_files`, `screenshot`, `clipboard`, `open_in_editor`, and more — behind a one-time consent gate, interactive diff approval for patches, and a `--no-tools` kill-switch.

@@ -220,6 +217,14 @@ It pairs against the **same relay and credential store** as the Android app —

 On Windows, the default installer adds the optional compact **Hermes-Relay CLI UI** tray popup for host selection and pairing, connection and daemon state, per-host Ask/Trusted/Full Access, local grant dialogs, authorized-client revocation, activity, settings, and emergency stop. It is a management surface only—chat, TUI, plugins, voice, and agent sessions remain CLI/upstream concerns.

+<table>
+  <tr>
+    <td align="center" width="33%"><img src="assets/screenshots/desktop-ui/overview.png" alt="Hermes-Relay CLI UI connected overview" width="100%"><br><sub><b>Connection &amp; activity</b></sub></td>
+    <td align="center" width="33%"><img src="assets/screenshots/desktop-ui/host-access.png" alt="Hermes-Relay CLI UI host access presets" width="100%"><br><sub><b>Per-host access</b></sub></td>
+    <td align="center" width="33%"><img src="assets/screenshots/desktop-ui/settings.png" alt="Hermes-Relay CLI UI computer control and updates" width="100%"><br><sub><b>Control &amp; maintenance</b></sub></td>
+  </tr>
+</table>
+
 Structured Windows computer control prefers a compatible local CUA Driver
 runtime for window-targeted background actions and virtual per-session agent
 cursors. It remains behind Hermes host policy, grants, targeting, audit, and
@@ -348,7 +353,7 @@ hermes-relay/

 <br>

-End users should install via the [one-liner](#4--optional-install-relay-for-power-tools) above. For local development:
+End users should follow the [recommended Hermes-Relay setup](#4--recommended-pair-relay-for-the-complete-experience) above. For local development:

 ```bash
 hermes relay start --no-ssl          # if you installed the plugin
@@ -200,6 +200,11 @@ never create a staging branch. Stable production tags are cut only from the new
 10. Build and publish that surface's artifacts, roll out or deploy from the
    immutable tag, and verify the release and live environment.

+Do not back-merge a normal release. The `main` release merge already has the
+released `dev` tip as its integration parent, so merging it back only adds
+history noise. The release-backmerge workflow detects this topology and exits
+successfully without changing `dev`.
+
 ### Branch names

 | Prefix | When | Example |
@@ -258,7 +263,9 @@ The intended settings are:
 - **`main`** — PRs required; `Required checks` required and current; force push
  and deletion blocked. Normal work does not target this branch.
 - **`dev`** — PRs and `Required checks` required; force push and deletion
-  blocked. This is the normal contribution target.
+  blocked. This is the normal contribution target. The release-backmerge
+  workflow is the sole exception: its automation identity may compare-and-swap
+  `dev` to an exact checked merge commit after a stable hotfix release.
 - **Merge policy** — merge commits allowed; squash and rebase merges disabled so
  the no-ff contract cannot be bypassed in the GitHub UI.
 - **Default branch** — `main`, which remains the release-history branch and the
@@ -523,10 +530,16 @@ the new app version and a higher `appVersionCode`.
  run Android's retrace tool with the matching flavor mapping:
  `retrace <mapping.txt> <obfuscated-trace.txt>`. Play reports can additionally
  use the mapping bundled into the uploaded AAB through Play Console.
- `app/src/main/assets/whats_new.txt` — in-app "What's New" content
-  shown in the settings/about screen. Update with the version number
-  and a brief feature summary. Gets stale silently if forgotten
-  (v0.4.0 shipped with 0.1.0 content until caught post-release).
+- `app/src/main/assets/changelog.json` — curated source for the in-app
+  **What's New** dialog and Android release history. Prepend the newest entry
+  with one explicit `highlight` (`title`, plain-language `summary`, and 1–3
+  user-benefit bullets), up to two quieter `improvements`, Android-only
+  `playNotes`, a `toastDigest` with counts and 0–2 short previews for noteworthy
+  items beyond the hero, and the existing technical `sections` used by older clients.
+  Do not derive the highlight mechanically from `CHANGELOG.md`; choosing the
+  release's main reason to care is an editorial release-prep decision.
+- `app/src/main/assets/whats_new.txt` — legacy in-app fallback generated from
+  the newest structured entry. Do not edit it independently.
 - `app/src/googlePlay/play/release-notes/en-US/default.txt` — the Play
  Console **"What's new"** text, which gradle-play-publisher reads at
  upload to fill the Production-draft release notes. This is **separate**
@@ -534,19 +547,60 @@ the new app version and a higher `appVersionCode`.
  this file is missing or stale, the Play draft ships with empty/wrong
  notes (shipped empty in v1.1.0 until caught post-release). Keep it
  **≤500 chars per language**, user-facing, Android-only.
- `docs/play-store-listing.md` — Play Store listing copy. Update
-  the version reference and the "Release Notes" section that gets
-  pasted into the Play Console "What's new" field. Keep the Play
-  "What's new" within **500 characters** and framed around the
-  release's themes, not a feature dump. Compare its **Foreground service
+- `docs/play-store-listing.md` — Play Store listing copy. Its release-note
+  block and the Gradle Play Publisher note are generated from `playNotes`.
+  After editing the newest structured entry, run
+  `python scripts/check-android-release-notes.py --write`, then run it again
+  without `--write` to validate the 1–3 / 0–2 editorial limits, current Android
+  version, GitHub-release/changelog headings, derived files, and Play's
+  **500-character** limit. Frame Play copy around the release's themes, not a
+  feature dump. Compare its **Foreground service
  permissions** section with the merged `googlePlayRelease` manifest and
  complete Play Console declarations for every declared service type before
  approval; the Publisher API can upload a draft and still reject promotion
  when an App content declaration is missing.

+#### Generate release copy from the verified changes
+
+When release copy is generated with an agent, this section is the canonical
+authoring contract; do not maintain a separate prompt file.
+
+1. Read the exact Android version/SHA, the Android-only entries selected from
+   `[Unreleased]`, the implemented behavior, and any compatibility or security
+   boundary that users must understand. Do not generate from commit titles or
+   a mixed-surface changelog block alone.
+2. Before editing release files, show a temporary coverage ledger in the task
+   output. Map every selected source change to exactly one placement:
+   `hero`, `secondary`, or `full-only`. Include the change kind (`feature`,
+   `change`, or `fix`) and a short reason. The ledger is review evidence, not a
+   committed public artifact; no selected source item may disappear silently.
+3. Choose exactly one `hero`: the strongest user-facing reason to care about
+   the release. Its summary is one plain-language outcome, and its 1–3 bullets
+   are distinct user benefits rather than implementation steps or filler.
+4. Use `secondary` for other important user-visible features and fixes. The
+   `toastDigest` counts only these items, excluding the hero. Preview the
+   strongest 1–2 secondary items in short phrases. If there are no legitimate
+   secondary items, set both counts to `0` and `preview` to `[]`; the app hides
+   the footer. Never invent an item to satisfy the layout.
+5. Use `full-only` for technically relevant details that belong in
+   `RELEASE_NOTES.md` or `CHANGELOG.md` but would make the collapsed update card
+   noisy. Preserve user-relevant trust and compatibility limits; omit branches,
+   worktrees, CI mechanics, debugging history, and private/operator context.
+6. Write each surface for its audience:
+   - `RELEASE_NOTES.md`: concise Summary plus Added/Changed/Fixed; keep the
+     deterministic Download and Install/Verify scaffolding intact.
+   - `CHANGELOG.md`: complete, crisp public history for the released surface.
+   - `changelog.json`: curated hero, optional improvements, digest, Play copy,
+     and compatibility `sections` for older clients.
+   - `playNotes`: Android-only themes within the rendered 500-character limit.
+7. Before presenting the draft, check that wording begins with user outcomes,
+   avoids unexplained implementation terminology, uses exact public product
+   names, makes no unverified device claim, and passes the public-distribution
+   scrub below.
+
 #### Scrub for public distribution

-This is a **public repo** and these four files are user-facing. Before
+This is a **public repo** and these release-note files are user-facing. Before
 promoting the `[Unreleased]` block and writing the notes, scrub the
 versioned CHANGELOG block and all three release-notes artifacts for
 wording that shouldn't ship publicly. The CHANGELOG accumulates in a
@@ -632,7 +686,9 @@ git checkout dev
 git pull --ff-only origin dev

 git add gradle/libs.versions.toml RELEASE_NOTES.md CHANGELOG.md \
-        app/src/main/assets/whats_new.txt docs/play-store-listing.md
+        app/src/main/assets/changelog.json app/src/main/assets/whats_new.txt \
+        app/src/googlePlay/play/release-notes/en-US/default.txt \
+        docs/play-store-listing.md
 git commit -m "release(android): android-v0.6.2"
 git push origin dev

@@ -922,8 +978,23 @@ When production has a bug, use the same invariant for every surface:
 4. Open the focused hotfix PR into `main` and merge with a merge commit/no-ff.
 5. Tag the new `main` tip with the affected surface's patch tag.
 6. Verify the artifacts and production rollout or deployment.
-7. Merge `main` back into `dev` immediately so integration inherits the fix and
-   version history.
+7. Let the stable release workflow dispatch `Release Backmerge`. A
+   conflict-free candidate runs the same path-aware `Required checks` against
+   its exact SHA, then compare-and-swaps `dev` only if the base ref is unchanged.
+   Conflicts, failed checks, stale refs, or a denied update require a normal
+   reconciliation PR.
+
+`Release Backmerge` accepts only published stable `android-v*`, `server-v*`, or
+`desktop-v*` SemVer tags contained in `main`. It exits without mutation for a
+normal release whose integration parent is already in `dev`. For a selective
+hotfix, it pushes a temporary merge ref, dispatches `Required checks` with full
+base/head SHAs, and updates `dev` with an explicit force-with-lease only after
+that exact candidate passes. The lease is a compare-and-swap guard, not
+permission to rewrite history: the candidate's first parent must be the
+unchanged `dev` tip and its second parent the released commit. The repository
+ruleset must allow this workflow's automation identity to perform that one
+checked branch update; if it does not, the workflow fails closed and the
+reconciliation uses a PR.

 For an Android app hotfix:

@@ -938,21 +1009,21 @@ For an Android app hotfix:
 6. `git tag android-v0.6.2` from the new `main` tip and `git push origin android-v0.6.2`
   so Android release CI builds and publishes.
 7. Verify the automated Play submission, GitHub artifacts, and rollout.
-8. Merge `main` back into `dev` (`git checkout dev && git merge --no-ff main`)
-   so `dev` picks up the hotfix and the versionCode bump. Without this,
-   `dev`'s `appVersionCode` lags behind `main` and the next app release
-   bump collides.
+8. Verify the automated release backmerge completed. If it stopped, open a
+   reconciliation PR so `dev` picks up the hotfix and versionCode bump. Without
+   reconciliation, `dev`'s `appVersionCode` lags behind `main` and the next app
+   release bump collides.

 For a Plugin hotfix, branch from the affected `server-v*` tag, apply
 the fix, run `bash scripts/bump-plugin-version.sh <next-version>`, merge to
-`main`, tag `server-v<next-version>`, verify the package/deployment, and merge
-`main` back to `dev`. Do not touch
+`main`, tag `server-v<next-version>`, verify the package/deployment, and verify
+the automated release backmerge. Do not touch
 `gradle/libs.versions.toml` unless an Android app release is also shipping.

 For a CLI+UI hotfix, branch from the affected `desktop-v*` tag, update only
 `desktop/package.json` and its generated lock/runtime/tray metadata, merge to
 `main`, tag `desktop-v<next-version>`, verify all binaries and the installer,
-then merge `main` back to `dev`.
+then verify the automated release backmerge or use the PR fallback.

 ## Troubleshooting

@@ -1,10 +1,10 @@
-# Hermes-Relay Android v1.12.1
+# Hermes-Relay Android v1.13.2

-**Release Date:** August 22, 2026
+**Release Date:** August 25, 2026

 ## Download

-> Installing on your phone? Download `hermes-relay-1.12.1-sideload-release.apk` and tap it for the full feature set, or install the conservative build from [Google Play](https://play.google.com/store/apps/details?id=com.axiomlabs.hermesrelay).
+> Installing on your phone? Download `hermes-relay-1.13.2-sideload-release.apk` and tap it for the full feature set, or install the conservative build from [Google Play](https://play.google.com/store/apps/details?id=com.axiomlabs.hermesrelay).

 The `.aab` file is a Play Console upload bundle and cannot be installed by tapping it on a phone.

@@ -12,18 +12,20 @@ Verify the download against `SHA256SUMS.txt`. See the [sideload guide](https://h

 ## Summary

-This patch makes Android sharing and recovery dependable. Shared links, text, images, and files open as complete reviewable drafts; connection renewal no longer stalls; offline and history failures are visible; and secure-storage recovery appears in Diagnostics.
+This release adds a parent-configured Supervised Mode and improves its return from full settings. It also keeps session rows neutral until live activity is confirmed.
+
+## Added
+
+- Use a profile-pinned Supervised Mode with parent-controlled attachments, Standard voice, generated media, history, actions, and technical details. Device authentication protects full settings; this remains a client-side restricted view rather than a server-enforced account boundary.

 ## Fixed

- Open shared links, text, images, files, and mixed or multi-item shares as a fresh reviewable draft without sending automatically.
- Keep Add and Renew connection setup on the correct connection-scoped authentication store, with bounded Retry or Cancel recovery instead of an indefinite preparation screen.
- Surface unavailable chat routes and profile-history failures clearly instead of silently dropping Send or presenting missing history as an empty conversation.
- Report Android Keystore fallback, encrypted-store recovery, and temporary credential storage in Diagnostics without exposing credentials.
+- Keep session rows neutral while optional live activity is unavailable or still loading, and reserve full-row activity borders for actual Starting or Working turns.
+- Keep Supervised Chat rendered when parent access relocks after visiting full settings.

 ## Install / Verify

- App version: **1.12.1** (versionCode **48**).
+- App version: **1.13.2** (versionCode **51**).
 - Standard Chat, sessions, Manage, sharing, profile switching, and Vanilla Hermes voice continue to work against unmodified upstream Hermes.
 - Granular Device Control remains sideload-only; the Google Play build continues to ship Hermes Bridge Core without AccessibilityService Device Control.
- The optional Relay plugin is not required for standard Android chat, sharing, session continuity, or Gateway recovery.
+- The optional Relay plugin remains unnecessary for standard Android chat, sessions, Manage, and Vanilla Hermes voice.
@@ -6,6 +6,64 @@ For shipped work, see `DEVLOG.md`. For architectural decisions, see `docs/decisi

 ---

+## Upstream a public Dashboard plugin WebSocket admission seam
+
+The same-origin Relay ingress follows current upstream's bundled Dashboard
+plugin pattern but must feature-detect private
+`hermes_cli.web_server._ws_request_is_allowed` and `_ws_auth_ok` helpers.
+Propose one public helper that combines Host/Origin policy, single-use ticket
+authentication, and runtime plugin-enabled gating for `APIRouter` WebSockets.
+After it is available in the supported Hermes baseline, replace the private
+imports and remove the Relay plugin's local runtime-disable polling. Until
+then, missing helpers fail closed and direct Relay remains an advanced
+compatibility route.
+
+---
+
+## Certify Android session activity across lifecycle and profile boundaries
+
+The contract fixture now covers every upstream live status, complete-snapshot
+disappearance, client-side ownership of duplicate durable ids across profiles,
+and older Gateways without `session.active_list`. Before calling the status
+model device-certified:
+
+- Exercise working, quiet tool-heavy work, each pending-input surface, normal
+  completion, Stop, reconnect, app restart, and process recreation against
+  current vanilla upstream.
+- Verify All Profiles with duplicate session ids across two profiles and two
+  saved connections; no late snapshot or old socket generation may mark the
+  wrong row live.
+- Confirm failed/unsupported refresh becomes Unavailable, restart revalidation
+  remains Checking, ambiguous or partially
+  resolved process-wide snapshots infer no absence, a complete empty snapshot
+  settles every unambiguously owned scope, and REST `is_active=true` never
+  renders as Working.
+- Run a background process that outlives its parent turn and verify Background
+  work remains separate from the conversation's Idle state.
+- On a physical phone, open and repeatedly foreground Android while the same
+  session is working in official Desktop/TUI; verify Android sends no live
+  attach/interrupt RPC, the producer completes, and final history appears.
+- Pursue an upstream `session.active_list` profile field/filter or an aggregate
+  activity route with explicit profile ownership so multi-profile clients do
+  not need to resolve process-wide rows from durable keys.
+
+---
+
+## Bot Mode follow-ups after multi-gateway aggregation
+
+Android Bot Mode now has an all-gateway roster, typed `(connectionId, profile)`
+ownership, install-identity collapse, source-qualified handles, offline cache,
+route-pooled Gateway clients, and dedicated owner-routed Bot Chats without a
+foreground connection switch. Keep autonomous cross-gateway delivery on
+upstream peer/server authority rather than making Android an unreliable
+background courier. Writable group rooms stay blocked until upstream publishes
+one canonical room read/write/control contract; do not reproduce Desktop's
+local orchestrator in the phone. Route-scoped outbound attachments, Relay media,
+voice, and proactive completion notifications can be added independently when
+their credential and lifecycle ownership is explicit.
+
+---
+
 ## Certify Android assistant screen context on physical firmware

 Host-side coverage and one Android 15 automotive device prove the primary flow.
@@ -715,8 +773,10 @@ cancels). Ranked next increments, in value-per-complexity order:

 Plan: `docs/plans/2026-07-06-open-issue-resolution.md` (13 open issues triaged;
 fix-state claims verified against tags with `git merge-base --is-ancestor`).
-**Automation never posts to GitHub** — every comment/close/label below is an
-owner action, deliberately queued here:
+This historical batch remains owner-controlled. The bounded new-issue triage
+lane may post one clearly identified first response and basic type/area labels,
+but it does not execute backlog actions. Every comment, close, relabel, and
+milestone below remains an owner action deliberately queued here:

 - [ ] **#131** — close: fixed by `3573ba8` (PR #136), shipped android-v1.2.5
      (reporter was on 1.2.3). Optionally re-check Play vitals for the
@@ -1105,16 +1165,19 @@ The gateway-platform model is the *correct + sufficient architecture* (the phone

 ### Session drawer audit follow-ups

- **Persist and server-back Pin/Archive behavior.** The drawer currently keeps
-  both sets in composable memory. They reset when the drawer/app is recreated,
-  and Archive does not call the existing upstream profile-scoped archive API or
-  load archived rows. Either wire Archive end to end and persist Pin locally,
-  or remove the misleading actions until those contracts are complete.
- **Paginate large session stores.** Android requests only the 200 most-recent
-  rows and filters/searches them locally. Older sessions are therefore
-  undiscoverable on long-lived profiles even though upstream list APIs support
-  `offset`. Add incremental paging (and server search where capability-backed)
-  without regressing profile scoping or compression-tip projection.
+- **Certify first-open latency against a large profile store.** Verify a cold
+  launch, immediate drawer open, repeated close/open, and profile switches on a
+  real high-row-count Dashboard. The first bounded page must not wait on
+  Gateway socket readiness; cached rows must remain visible; a timeout must end
+  without another long automatic read; and the final failure must be retryable
+  **Unavailable**, never "No sessions." Capture both client timing and the
+  server's session-list request duration before calling the path fixed.
+- **Certify progressive paging on large stores.** Android loads 50 visible-source
+  recents first and appends 50-row `offset` pages near the end of the drawer.
+  Exercise repeated near-end triggers, a profile/route switch during page load,
+  hidden-source preference changes, terminal short pages, and server search
+  without regressing ownership, cached rows, pin/archive state, or compression
+  tips.

 The client-side mitigations shipped (see DEVLOG 2026-06-27): the `updateSessions` clobber guard, the post-turn title reconcile (gateway), and the subtle "not auto-named here" drawer note on SSE. These two are the larger follow-ups:

@@ -1257,7 +1320,12 @@ and whether the agent is waiting on the user.
  permissions; exercise compact, expanded, collapsed, and full-Voice handoff
  states, background tap-through, rotation and insets, cancel/back, microphone
  denial, network failure, process kill/recreation, and wake→voice→wake
-  resumption. Measure idle battery drain because third-party assistants do not
+  resumption. For background and keyguard capture, record `AudioRecord`, AppOps,
+  and foreground-service state: the user-installed app owns capture outside the
+  separate session process, so confirm whether the selected Assistant role is
+  sufficient on each target OS or whether activation needs an explicit,
+  activation-scoped microphone foreground-service lease. Measure idle battery
+  drain because third-party assistants do not
  receive Google's dedicated low-power hotword hardware.

 - **Audio quality guardrails** — normalize output volume across realtime and
@@ -1411,5 +1479,5 @@ Follow-ups:
  - **On-device import/delete smoke.** Import `/sdcard/Download/lucy.zip` via Add a pet → confirm Lucy appears, selects, and animates all states; then remove it and confirm the avatar falls back to the Sphere.
 - **Pet behavior model — richer state association (spec'd 2026-06-19, `docs/pet-spec.md` "Agent states &amp; pet behavior").** Shipped: the honesty clamp (declared reactivity ∩ `PET_RENDERER_CAPABILITIES`), the friendly `writing` alias, the `**working`/tool-use overlay** (pet-local sub-state from `toolCallBurst`; opt-in `working` clip drives both the swap and the Tools badge), the **one-shot reaction layer** (`greet`/`wake` on appear, `done`/`celebrate` on turn-finish — opt-in, play-once-then-revert, transition-derived; `ONE_SHOT_MAX_MS` backstop), and `**intensity` modulation** (opt-in `reactive.intensity` → live playback speedup ≤1.6× via `rememberUpdatedState`; un-clamps the Activity badge). Voice · Tools · Activity reactivity is now complete. Remaining:
  - `**attention` one-shot (only deferred behavior).** A reaction on notification arrival — needs a host event the avatar doesn't yet receive (unlike `greet`/`done`, which ride state transitions). Would plumb a notification edge into `AvatarRenderState` (or a side channel) + a `PetOneShot.Attention`. Low priority: the avatar is rarely on-screen when notifications land (backgrounded) — see the value analysis; revisit only if the avatar becomes an always-on surface (persistent overlay / Quest port).
-  - **On-device verification (working + one-shots + intensity).** Best seen in clean mode (`AgentTextFlow` feeds `toolCallBurst` + `streamingIntensity` + state transitions). Confirm: a `working` clip swaps in during a tool run and releases ~600ms after (`WORKING_BURST_THRESHOLD` 0.5); a `done` clip plays once on reply completion then returns to idle; a `greet` clip plays once when the avatar appears; with `intensity:true`, a writing/working loop visibly quickens while streaming. Confirm each decoded clip swap holds the previous complete visual until the new state is ready.
+  - **On-device verification (working + one-shots + intensity).** Use the normal Chat background visualization, which receives `toolCallBurst`, `streamingIntensity`, and state transitions. Confirm: a `working` clip swaps in during a tool run and releases ~600ms after (`WORKING_BURST_THRESHOLD` 0.5); a `done` clip plays once on reply completion then returns to idle; a `greet` clip plays once when the avatar appears; with `intensity:true`, a writing/working loop visibly quickens while streaming. Confirm each decoded clip swap holds the previous complete visual until the new state is ready.
 - **Undecodable-but-present image appears valid (audit 2026-06-19).** A file that exists but isn't a decodable image passes the loader's `isFile` check, so the pet shows in the picker but renders blank. Documented as a caveat; consider a cheap header sniff at load time if false-valid pets become a support issue.
@@ -95,7 +95,7 @@ class OnboardingFlowTest {
        composeTestRule.onNodeWithText("Connect").performClick()
        composeTestRule.waitForIdle()

-        composeTestRule.onNodeWithText("Connect to Hermes").assertIsDisplayed()
+        composeTestRule.onNodeWithText("Add gateway").assertIsDisplayed()
    }

    @Test
@@ -121,16 +121,22 @@ class OnboardingFlowTest {
    }

    @Test
-    fun connectPage_recommendsGeneralSetupQr() {
+    fun addGatewayPage_leadsWithStandardGatewayMethods() {
        setOnboardingContent()
        navigateToPage(4)

+        composeTestRule
+            .onNodeWithText("Hermes nearby")
+            .assertIsDisplayed()
+        composeTestRule
+            .onNodeWithText("Remote gateway")
+            .assertIsDisplayed()
        composeTestRule
            .onNodeWithText("Scan Hermes setup QR")
            .assertIsDisplayed()
        composeTestRule
            .onNodeWithText("Recommended")
-            .assertIsDisplayed()
+            .assertDoesNotExist()
    }

    @Test
@@ -138,7 +144,7 @@ class OnboardingFlowTest {
        setOnboardingContent()
        navigateToPage(4)

-        composeTestRule.onNodeWithText("Server or VPS").performClick()
+        composeTestRule.onNodeWithText("Remote gateway").performClick()
        composeTestRule.waitForIdle()

        composeTestRule
@@ -151,7 +157,7 @@ class OnboardingFlowTest {
        setOnboardingContent()
        navigateToPage(4)

-        composeTestRule.onNodeWithText("Server or VPS").performClick()
+        composeTestRule.onNodeWithText("Remote gateway").performClick()
        composeTestRule.waitForIdle()

        composeTestRule
@@ -176,7 +182,7 @@ class OnboardingFlowTest {
    }

    @Test
-    fun connectPage_keepsPairingOptional() {
+    fun addGatewayPage_keepsPairingOptional() {
        setOnboardingContent()
        navigateToPage(4)

@@ -203,7 +209,7 @@ class OnboardingFlowTest {
    }

    @Test
-    fun skipButton_visibleOnIntroPages_andWizardSkipOnConnectPage() {
+    fun skipButton_visibleOnIntroPages_andWizardSkipOnAddGatewayPage() {
        setOnboardingContent()

        repeat(4) {
@@ -239,6 +239,60 @@ class GatewayForegroundRecoveryInstrumentedTest {
        assertEquals(0, fixture.requestsTo("/v1/chat/completions"))
    }

+    @Test
+    fun desktopOwnedTurn_remainsReadOnlyAcrossAndroidForegroundLifecycle() {
+        viewModel.setChatVisible(false)
+        viewModel.updateGatewayClient(null)
+        gatewayClient.shutdown()
+        gatewayScope.cancel()
+
+        val controlMethods = setOf(
+            "session.resume",
+            "session.activate",
+            "session.interrupt",
+            "prompt.submit",
+        )
+        val baseline = controlMethods.associateWith(fixture::rpcCount)
+        val baselineActiveList = fixture.rpcCount("session.active_list")
+        fixture.activeSessionStatus = "working"
+        gatewayScope = CoroutineScope(SupervisorJob() + Dispatchers.IO)
+        val okHttp = OkHttpClient()
+        gatewayClient = GatewayChatClient(
+            initialDashboardClient = DashboardApiClient(
+                baseUrl = fixture.server.url("/").toString().trimEnd('/'),
+                okHttpClient = okHttp,
+            ),
+            okHttpClient = okHttp,
+            callbackDispatcher = { block -> Handler(Looper.getMainLooper()).post(block) },
+            scope = gatewayScope,
+            reconnectJitterUnit = { 0.0 },
+        )
+        viewModel.setChatTurnCheckpointStore(null)
+        viewModel.updateGatewayClient(gatewayClient)
+
+        viewModel.setChatVisible(true)
+        compose.activityRule.scenario.moveToState(Lifecycle.State.STARTED)
+        compose.activityRule.scenario.moveToState(Lifecycle.State.RESUMED)
+        viewModel.setChatVisible(false)
+        viewModel.setChatVisible(true)
+        fixture.awaitRpcCount("session.active_list", baselineActiveList + 1)
+
+        controlMethods.forEach { method ->
+            assertEquals(
+                "passive lifecycle sent $method",
+                baseline.getValue(method),
+                fixture.rpcCount(method),
+            )
+        }
+        viewModel.updateGatewayClient(null)
+        gatewayClient.shutdown()
+        assertEquals(
+            "observer teardown interrupted the Desktop turn",
+            baseline.getValue("session.interrupt"),
+            fixture.rpcCount("session.interrupt"),
+        )
+    }
+
    private companion object {
        const val STORED_SESSION_ID = "20260821_120000_fixture"
        const val LIVE_SESSION_ID = "fixture-live-1"
@@ -263,6 +317,9 @@ internal class AndroidGatewayContractFixture {
    @Volatile
    var recoveryRunning = false

+    @Volatile
+    var activeSessionStatus: String? = null
+
    private val listener = object : WebSocketListener() {
        override fun onOpen(webSocket: WebSocket, response: Response) {
            sockets.add(webSocket)
@@ -282,6 +339,18 @@ internal class AndroidGatewayContractFixture {
                "session.activate" -> sessionSnapshot(
                    (params["session_id"] as? JsonPrimitive)?.contentOrNull ?: "fixture-live-1",
                )
+                "session.active_list" -> buildJsonObject {
+                    put("sessions", kotlinx.serialization.json.buildJsonArray {
+                        activeSessionStatus?.let { status ->
+                            add(buildJsonObject {
+                                put("id", LIVE_SESSION_ID)
+                                put("session_key", STORED_SESSION_ID)
+                                put("status", status)
+                                put("last_active", 1.0)
+                            })
+                        }
+                    })
+                }
                "prompt.submit", "session.interrupt" -> buildJsonObject { put("ok", true) }
                else -> JsonObject(emptyMap())
            }
@@ -345,6 +414,15 @@ internal class AndroidGatewayContractFixture {
        error("Gateway RPC $method not observed; saw ${rpcLog.map { it.first }}")
    }

+    fun awaitRpcCount(method: String, count: Int) {
+        val deadline = System.nanoTime() + TimeUnit.SECONDS.toNanos(5)
+        while (System.nanoTime() < deadline) {
+            if (rpcCount(method) >= count) return
+            Thread.sleep(20)
+        }
+        error("Gateway RPC $method count $count not observed; saw ${rpcLog.map { it.first }}")
+    }
+
    fun requestsTo(path: String): Int = requestPaths.count { it.startsWith(path) }

    fun rpcCount(method: String): Int = rpcLog.count { it.first == method }
@@ -353,4 +431,9 @@ internal class AndroidGatewayContractFixture {
        allSockets.forEach { socket -> runCatching { socket.close(1001, "teardown") } }
        runCatching { server.shutdown() }
    }
+
+    private companion object {
+        const val STORED_SESSION_ID = "20260821_120000_fixture"
+        const val LIVE_SESSION_ID = "fixture-live-1"
+    }
 }
@@ -1,62 +1,59 @@
-Hermes-Relay is the native Android client for the Hermes agent platform. Point it at your own Hermes instance and chat with your agent, talk to it hands-free, and manage models, keys, skills, and profiles from anywhere.
+Hermes-Relay is the native Android companion for the Hermes agent you run. Chat, talk hands-free, continue sessions, and manage models, keys, skills, profiles, and automations from your phone.

-It is not a hosted AI service. It is a companion app for the Hermes agent you run, and it talks only to the instances you configure.
+It is not a hosted AI service. Your Hermes agent stays on infrastructure you control, and the app talks only to instances you configure.

 QUICK START

-1. Run hermes-agent with its API server and dashboard enabled on your computer or home server.
-2. Install Hermes-Relay and enter your server address, for example http://192.168.1.100:8642.
-3. The setup wizard checks what your server supports and shows a readiness card, then you are ready to chat.
+1. Start the Hermes Dashboard/Gateway on your computer or home server with hermes dashboard.
+2. Install Hermes-Relay from Google Play.
+3. For the recommended full setup, install the Hermes-Relay plugin on the host and refresh the Web Dashboard. A Relay page will appear.
+4. Scan Connect mobile app from Android Connect. Then scan Pair new device from Android Settings > Connections.

-A plain Hermes install is enough. Chat, management, and voice work with no plugin or extra service.
+The QR codes are separate on purpose. Connect mobile app adds the standard Dashboard/Gateway connection. Pair new device grants a time-limited Hermes-Relay session for the additional capabilities you approve.
+
+Standard Hermes without the plugin is supported. Choose Find Hermes on LAN or enter the Dashboard address you open in a browser, normally http://<host>:9119. Pair the Hermes-Relay plugin later when you want the full experience.

 HOW IT WORKS

-Chat streams directly from your Hermes API Server or dashboard gateway in real time. Manage and voice use your Hermes dashboard with one sign-in. Run the optional relay service and the app can pair by QR code to add power tools: remote terminal, notification companion, media handoff, relay-session management, and additional voice engines.
+Chat, sessions, Manage, sign-in, and standard voice use the unmodified Hermes Dashboard/Gateway. The separate Hermes API server is an optional fallback for advanced or headless setups; it is not required for the normal Android connection.

-GOOGLE PLAY BUILD
+The encouraged Hermes-Relay plugin adds Terminal/TUI, notifications, media handoff, enhanced voice, Relay sessions, desktop-tool handoff, and time-limited per-feature grants. When upstream Hermes provides a compatible capability, Hermes-Relay prefers it instead of duplicating it.

-The Google Play build ships Hermes Bridge Core only. It has no AccessibilityService Device Control: it cannot read your screen, tap, type, swipe, screenshot, send SMS, place calls, or access contacts or location. Device Control is reserved for sideload builds distributed outside Google Play.
+GOOGLE PLAY AND SIDELOAD
+
+The Google Play build includes Chat, voice, sessions, Manage, profiles, notifications, media, and Terminal/TUI when the Hermes-Relay plugin is paired.
+
+Google Play does not include Android Device Control. It cannot read the phone screen, tap, type, swipe, take device screenshots, send SMS, place calls, or access contacts or location.
+
+Device Control is available only in the signed Sideload build on this project's GitHub Releases. It requires the Sideload app, a paired Hermes-Relay plugin, explicit Android accessibility permission, and the app's safety controls.

 FEATURES

- Streaming Chat: real-time responses with reasoning, markdown, tool-call visibility, attachments, mid-turn steering, edit-and-resend, and a searchable command palette.
-
- Manage Your Agent: use your Hermes dashboard from your phone to switch models, manage provider keys, edit profiles, and browse, install, and update skills.
-
- Voice Mode: talk hands-free using your server's speech providers. Relay-paired setups add per-profile voices and an experimental realtime engine.
-
- Works Away From Home: add LAN, Tailscale, or public routes and the app chooses the best available path on connect.
-
- Sessions: create, switch, rename, and delete chats. Message history loads on demand.
-
- Multiple Servers and Profiles: connect to more than one server and switch in a tap; overlay an agent profile or personality per conversation.
-
- Relay Power Tools: optional QR pairing for remote terminal, relay-session management, media handoff, and per-feature grants.
-
- Notification Companion: optionally forward notification metadata to your paired relay so your assistant can summarize it. Toggle it anytime in system settings.
-
- Stats for Nerds: local-only counters for response timing, token usage, cost, and stream health.
-
- Material You: Material 3 dynamic color, light/dark/system themes, and haptics.
+- Streaming Chat with reasoning, markdown, tool progress, attachments, mid-turn steering, edit-and-resend, and searchable commands.
+- Manage models and provider keys, edit profiles, and browse, install, or update skills through the Hermes Dashboard.
+- Hands-free voice through your server's speech providers. Hermes-Relay pairing adds per-profile voices and an experimental realtime engine.
+- Create, switch, search, rename, pin, archive, and continue sessions.
+- Connect multiple Hermes servers and switch in one tap; add LAN, Tailscale, or public routes.
+- Pair the Hermes-Relay plugin for Terminal/TUI, notifications, media, enhanced voice, Relay sessions, and per-feature grants.
+- Inspect connection readiness, routes, response timing, token usage, and stream health without exposing credentials.

 SECURITY AND PRIVACY

- API keys and relay tokens are stored in encrypted Android storage.
- HTTPS is enforced for remote connections; cleartext is limited to localhost or LAN setups.
+- Dashboard sessions and Hermes-Relay tokens use encrypted Android storage.
+- Cleartext is limited to trusted local-network setups. Use a VPN or HTTPS remotely.
 - No telemetry, ads, tracking, or third-party analytics SDKs.
- Notification access and the microphone are optional and user-controlled.
- All app traffic goes only to servers you configure.
+- Notification and microphone access are optional and user-controlled.
+- App traffic goes only to servers you configure.

 REQUIREMENTS

 - Android 8.0 or later.
- A running Hermes agent for chat, management, and voice.
- Optional Hermes relay service for power tools such as terminal, notifications, and media.
- Network access to your server by local network, VPN, or internet.
+- A reachable Hermes Dashboard/Gateway.
+- The Hermes-Relay plugin is encouraged for the complete experience but never blocks standard Hermes.
+- Network access through a local network, VPN, or operator-managed internet route.

 OPEN SOURCE

-Hermes-Relay is MIT licensed. Source, docs, and issue tracking are on GitHub.
+Hermes-Relay is MIT licensed. Source, setup guides, downloads, and issue tracking are on GitHub.

-This app is a community project and is not affiliated with or endorsed by NousResearch.
+This community project is not affiliated with or endorsed by NousResearch.
@@ -1 +1 @@
-Your Hermes AI agent, in your pocket - chat, voice, and control.
+Your Hermes agent on Android — chat, voice, sessions, and Manage.
@@ -1 +1,3 @@
-Shared links, text, images, and files now open as complete reviewable drafts without sending automatically. Add and Renew connection setup no longer stalls. Offline chat and profile-history failures surface clear recovery guidance instead of doing nothing or showing empty history. Diagnostics now reports secure-storage fallback and recovery without exposing credentials.
+v1.13.2 - Supervised Mode and clearer activity
+
+Supervised Mode creates a simpler, profile-focused chat with device-protected parent settings and control over attachments, Standard voice, generated media, history, actions, and technical details. Activity indicators now appear only while Hermes is genuinely working, and returning from parent settings keeps Supervised Chat open.
@@ -1 +1 @@
-共享链接、文本、图片和文件现在会作为完整、可检查的草稿打开，不会自动发送。添加或续订连接时不再卡在准备阶段。离线聊天和配置文件历史记录失败会显示明确的恢复提示，而不是无响应或显示空历史记录。诊断现在会报告安全存储降级与恢复，且不会暴露凭据。
+新增监督模式：家长可配置并固定到指定配置文件，设置受设备身份验证保护。家长可限制附件、标准语音、生成媒体、历史记录、操作和技术详情。实时活动不可用时会话行保持中性显示，从家长设置返回时监督聊天也不再空白。
@@ -1,5 +1,90 @@
 {
+ "schema": 2,
 "versions": [
+  {
+   "version": "1.13.2",
+   "title": "Supervised Mode and clearer activity",
+   "date": "2026-08-25",
+   "highlight": {
+    "title": "Supervised Mode",
+    "summary": "Create a simpler, profile-focused chat and choose which features remain available.",
+    "bullets": [
+     "Protect parent settings with your phone's device authentication.",
+     "Choose access to attachments, Standard voice, generated media, history, actions, and technical details.",
+     "Keep Supervised Chat open when returning from parent settings."
+    ]
+   },
+   "improvements": [
+    "Activity indicators now appear only while Hermes is genuinely working."
+   ],
+   "toastDigest": {
+    "additionalFeatureCount": 0,
+    "fixCount": 2,
+    "preview": [
+     "Accurate activity",
+     "safer return"
+    ]
+   },
+   "playNotes": "Supervised Mode creates a simpler, profile-focused chat with device-protected parent settings and control over attachments, Standard voice, generated media, history, actions, and technical details. Activity indicators now appear only while Hermes is genuinely working, and returning from parent settings keeps Supervised Chat open.",
+   "sections": [
+    {
+     "header": "Use a supervised chat",
+     "bullets": [
+      "Configure a profile-pinned restricted chat with parent-controlled attachments, voice, media, history, actions, and technical details.",
+      "Protect full settings with device authentication and keep Supervised Chat visible when parent access relocks."
+     ]
+    },
+    {
+     "header": "Show only confirmed activity",
+     "bullets": [
+      "Keep session rows neutral while optional live activity is unavailable or still loading.",
+      "Show full-row activity borders only during actual Starting or Working turns."
+     ]
+    }
+   ]
+  },
+  {
+   "version": "1.13.1",
+   "title": "Accurate session activity",
+   "date": "2026-08-25",
+   "sections": [
+    {
+     "header": "Follow live Hermes state",
+     "bullets": [
+      "Show Working, Starting, Needs input, Idle, Checking, Unavailable, and Background work from live runtime state instead of a recent-activity estimate.",
+      "Keep stale activity visible until a complete, unambiguous snapshot safely clears it."
+     ]
+    }
+   ]
+  },
+  {
+   "version": "1.13.0",
+   "title": "Bots, usage, and reliable chat",
+   "date": "2026-08-25",
+   "sections": [
+    {
+     "header": "Talk across saved gateways",
+     "bullets": [
+      "Use Bot Mode as one messenger-style workspace for bots and read-only groups across saved Hermes gateways.",
+      "Keep every Bot Chat bound to its exact gateway and profile without changing the foreground connection."
+     ]
+    },
+    {
+     "header": "Understand account limits",
+     "bullets": [
+      "Review Codex credential pools, Nous balances, and OpenCode Go windows from one provider-neutral Usage and limits screen.",
+      "Choose Summary, Expanded, or Hidden presentation while provider credentials remain on the Hermes host."
+     ]
+    },
+    {
+     "header": "Keep chat and voice in context",
+     "bullets": [
+      "Settle orphaned Gateway busy state automatically while preserving another session's active or detached turn.",
+      "Include bounded visible text and an available screenshot in the first compatible Assistant voice turn."
+     ]
+    }
+   ]
+  },
  {
   "version": "1.12.1",
   "title": "Sharing and recovery that work",
@@ -1,6 +1,9 @@
-v1.12.1 - Sharing and recovery that work
+v1.13.2 - Supervised Mode and clearer activity

-* Open shared links, text, images, and files as a reviewable draft without auto-sending.
-* Add or renew a connection without getting stuck during secure setup.
-* See clear recovery guidance when chat or profile history is unavailable.
-* Find secret-free secure-storage fallback and recovery evidence in Diagnostics.
+Supervised Mode
+* Protect parent settings with your phone's device authentication.
+* Choose access to attachments, Standard voice, generated media, history, actions, and technical details.
+* Keep Supervised Chat open when returning from parent settings.
+
+Also improved
+* Activity indicators now appear only while Hermes is genuinely working.
@@ -39,14 +39,38 @@ enum class AssistantSessionPhase {
    Closed,
 }

+enum class AssistantSessionNotice {
+    NoSpeech,
+}
+
 data class AssistantSessionSnapshot(
    val phase: AssistantSessionPhase = AssistantSessionPhase.Launching,
    val transcript: String? = null,
    val response: String = "",
+    val notice: AssistantSessionNotice? = null,
    val error: String? = null,
    val screenContextSupported: Boolean = false,
 )

+internal fun assistantSnapshotForPresentation(
+    snapshot: AssistantSessionSnapshot,
+    locked: Boolean,
+): AssistantSessionSnapshot = if (locked) {
+    snapshot.copy(
+        transcript = null,
+        response = "",
+        error = null,
+        screenContextSupported = false,
+    )
+} else {
+    snapshot
+}
+
+internal fun assistantSnapshotMatchesActivation(
+    expectedActivationId: String?,
+    receivedActivationId: String?,
+): Boolean = expectedActivationId != null && expectedActivationId == receivedActivationId
+
 object AssistantRole {
    fun status(context: Context): AssistantRoleStatus {
        val component = ComponentName(context, HermesVoiceInteractionService::class.java)
@@ -209,6 +233,7 @@ object AssistantSessionProtocol {
            onFailure = { failure ->
                publish(
                    application,
+                    activation.id,
                    AssistantSessionSnapshot(
                        phase = AssistantSessionPhase.Error,
                        error = failure.message ?: "Hermes voice could not start",
@@ -219,13 +244,19 @@ object AssistantSessionProtocol {
        return true
    }

-    fun publish(context: Context, snapshot: AssistantSessionSnapshot) {
+    fun publish(
+        context: Context,
+        activationId: String,
+        snapshot: AssistantSessionSnapshot,
+    ) {
        context.sendBroadcast(
            Intent(context, AssistantSessionStateReceiver::class.java).apply {
                action = ACTION_STATUS
+                putExtra(EXTRA_ACTIVATION_ID, activationId)
                putExtra(EXTRA_PHASE, snapshot.phase.name)
                putExtra(EXTRA_TRANSCRIPT, snapshot.transcript)
                putExtra(EXTRA_RESPONSE, snapshot.response)
+                putExtra(EXTRA_NOTICE, snapshot.notice?.name)
                putExtra(EXTRA_ERROR, snapshot.error)
                putExtra(EXTRA_SCREEN_CONTEXT_SUPPORTED, snapshot.screenContextSupported)
            }
@@ -238,10 +269,6 @@ object AssistantSessionProtocol {
        }
    }

-    fun publish(context: Context, state: VoiceUiState) {
-        publish(context, snapshotFromVoiceState(state))
-    }
-
    internal fun snapshotFromVoiceState(state: VoiceUiState): AssistantSessionSnapshot {
        val phase = when {
            !state.voiceMode -> AssistantSessionPhase.Closed
@@ -256,7 +283,10 @@ object AssistantSessionProtocol {
            phase = phase,
            transcript = state.transcribedText?.take(MAX_SESSION_TEXT_CHARS),
            response = state.responseText.take(MAX_SESSION_TEXT_CHARS),
-            error = state.error?.take(MAX_SESSION_ERROR_CHARS),
+            notice = state.assistantNotice,
+            error = state.error
+                ?.takeIf { phase == AssistantSessionPhase.Error }
+                ?.take(MAX_SESSION_ERROR_CHARS),
        )
    }

@@ -350,6 +380,9 @@ object AssistantSessionProtocol {
            phase = phase,
            transcript = intent.getStringExtra(EXTRA_TRANSCRIPT),
            response = intent.getStringExtra(EXTRA_RESPONSE).orEmpty(),
+            notice = intent.getStringExtra(EXTRA_NOTICE)?.let { raw ->
+                runCatching { AssistantSessionNotice.valueOf(raw) }.getOrNull()
+            },
            error = intent.getStringExtra(EXTRA_ERROR),
            screenContextSupported = intent.getBooleanExtra(
                EXTRA_SCREEN_CONTEXT_SUPPORTED,
@@ -360,24 +393,33 @@ object AssistantSessionProtocol {

    private const val MAX_SESSION_TEXT_CHARS = 4_000
    private const val MAX_SESSION_ERROR_CHARS = 1_000
+    private const val EXTRA_NOTICE = "notice"
 }

 object AssistantSessionState {
    private val _snapshot = MutableStateFlow(AssistantSessionSnapshot())
    val snapshot: StateFlow<AssistantSessionSnapshot> = _snapshot.asStateFlow()
+    @Volatile private var activationId: String? = null

-    internal fun update(snapshot: AssistantSessionSnapshot) {
+    internal fun update(receivedActivationId: String?, snapshot: AssistantSessionSnapshot) {
+        if (!assistantSnapshotMatchesActivation(activationId, receivedActivationId)) return
        _snapshot.value = snapshot
    }

-    internal fun reset() {
+    internal fun reset(activationId: String) {
+        this.activationId = activationId
        _snapshot.value = AssistantSessionSnapshot()
    }
 }

 class AssistantSessionStateReceiver : BroadcastReceiver() {
    override fun onReceive(context: Context, intent: Intent) {
-        AssistantSessionState.update(AssistantSessionProtocol.readSnapshot(intent))
+        AssistantSessionState.update(
+            receivedActivationId = intent.getStringExtra(
+                AssistantSessionProtocol.EXTRA_ACTIVATION_ID
+            ),
+            snapshot = AssistantSessionProtocol.readSnapshot(intent),
+        )
    }
 }

@@ -423,6 +465,7 @@ class AssistantSessionLifecycleReceiver : BroadcastReceiver() {
                onFailure = { failure ->
                    AssistantSessionProtocol.publish(
                        application,
+                        id,
                        AssistantSessionSnapshot(
                            phase = AssistantSessionPhase.Error,
                            error = failure.message ?: "Hermes voice could not start",
@@ -430,6 +473,7 @@ class AssistantSessionLifecycleReceiver : BroadcastReceiver() {
                    )
                },
            )
+            application.runtime.republishAssistantSnapshot(id)
            return
        }
        if (AssistantSessionProtocol.isStartAction(intent.action)) {
@@ -3,6 +3,11 @@ package com.hermesandroid.relay.assistant
 import android.graphics.Bitmap
 import android.graphics.BitmapFactory
 import android.graphics.drawable.ColorDrawable
+import android.app.KeyguardManager
+import android.content.BroadcastReceiver
+import android.content.Context
+import android.content.Intent
+import android.content.IntentFilter
 import android.os.Bundle
 import android.service.voice.VoiceInteractionSession
 import android.service.voice.VoiceInteractionSessionService
@@ -67,6 +72,7 @@ import androidx.compose.ui.res.stringResource
 import androidx.compose.ui.text.font.FontWeight
 import androidx.compose.ui.text.style.TextOverflow
 import androidx.compose.ui.unit.dp
+import androidx.core.content.ContextCompat
 import androidx.lifecycle.Lifecycle
 import androidx.lifecycle.LifecycleOwner
 import androidx.lifecycle.LifecycleRegistry
@@ -108,6 +114,11 @@ internal fun shouldCancelVoiceWhenSessionUiEnds(
    presentation: AssistantSessionPresentation,
 ): Boolean = presentation == AssistantSessionPresentation.Overlay

+internal fun assistantPresentationLocked(
+    currentKeyguardLocked: Boolean?,
+    fallbackLocked: Boolean,
+): Boolean = currentKeyguardLocked ?: fallbackLocked
+
 private class HermesVoiceInteractionSession(
    private val service: HermesVoiceInteractionSessionService,
 ) : VoiceInteractionSession(service) {
@@ -118,12 +129,19 @@ private class HermesVoiceInteractionSession(
    private var surfaceExpanded by mutableStateOf(false)
    private var activationId: String? = null
    private var manualMic = false
+    private var keyguardLocked by mutableStateOf(false)
    private var expectScreenContext: Boolean? = null
    private var pendingSemantic = AssistantSemanticContext()
    private var pendingScreenshot: ByteArray? = null
    private var screenContextUi by mutableStateOf(AssistantScreenContextUi())
    private val contextStore = assistantContextStore(service)
    private var heartbeatJob: Job? = null
+    private var keyguardReceiverRegistered = false
+    private val keyguardReceiver = object : BroadcastReceiver() {
+        override fun onReceive(context: Context?, intent: Intent?) {
+            refreshKeyguardState()
+        }
+    }

    init {
        scope.launch {
@@ -139,6 +157,17 @@ private class HermesVoiceInteractionSession(

    override fun onCreate() {
        super.onCreate()
+        ContextCompat.registerReceiver(
+            service,
+            keyguardReceiver,
+            IntentFilter().apply {
+                addAction(Intent.ACTION_SCREEN_OFF)
+                addAction(Intent.ACTION_SCREEN_ON)
+                addAction(Intent.ACTION_USER_PRESENT)
+            },
+            ContextCompat.RECEIVER_NOT_EXPORTED,
+        )
+        keyguardReceiverRegistered = true
        window.window?.apply {
            setBackgroundDrawable(ColorDrawable(android.graphics.Color.TRANSPARENT))
            clearFlags(WindowManager.LayoutParams.FLAG_DIM_BEHIND)
@@ -155,6 +184,7 @@ private class HermesVoiceInteractionSession(
            PersistedHermesRelayTheme {
                AssistantSessionSurface(
                    expanded = surfaceExpanded,
+                    locked = keyguardLocked,
                    screenContext = screenContextUi,
                    onExpandedChange = { surfaceExpanded = it },
                    onCancel = { finishSession(cancelVoice = true) },
@@ -183,11 +213,22 @@ private class HermesVoiceInteractionSession(

    override fun onShow(args: Bundle?, showFlags: Int) {
        super.onShow(args, showFlags)
-        if (args?.getBoolean(HermesVoiceInteractionService.EXTRA_FROM_KEYGUARD, false) == true) {
+        refreshKeyguardState(
+            fallbackLocked = args?.getBoolean(
+                HermesVoiceInteractionService.EXTRA_FROM_KEYGUARD,
+                false,
+            ) == true,
+        )
+        if (keyguardLocked) {
            window.window?.addFlags(
                WindowManager.LayoutParams.FLAG_SHOW_WHEN_LOCKED or
                    WindowManager.LayoutParams.FLAG_TURN_SCREEN_ON
            )
+        } else {
+            window.window?.clearFlags(
+                WindowManager.LayoutParams.FLAG_SHOW_WHEN_LOCKED or
+                    WindowManager.LayoutParams.FLAG_TURN_SCREEN_ON
+            )
        }
        setUiEnabled(true)
        val startsNewLifecycle = presentation == AssistantSessionPresentation.Inactive
@@ -195,10 +236,10 @@ private class HermesVoiceInteractionSession(
        if (!startsNewLifecycle) return

        surfaceExpanded = false
-        AssistantSessionState.reset()
        screenContextUi = AssistantScreenContextUi()
        activationId = args?.getString(AssistantSessionProtocol.EXTRA_ACTIVATION_ID)
            ?: UUID.randomUUID().toString()
+        AssistantSessionState.reset(activationId!!)
        manualMic = args?.getBoolean(AssistantSessionProtocol.EXTRA_MANUAL_MIC, false) ?: false
        expectScreenContext = args?.getBoolean(
            AssistantSessionProtocol.EXTRA_EXPECT_SCREEN_CONTEXT,
@@ -300,6 +341,10 @@ private class HermesVoiceInteractionSession(
        pendingSemantic = AssistantSemanticContext()
        pendingScreenshot = null
        screenContextUi = AssistantScreenContextUi()
+        if (keyguardReceiverRegistered) {
+            runCatching { service.unregisterReceiver(keyguardReceiver) }
+            keyguardReceiverRegistered = false
+        }
        viewOwner.stop()
        scope.cancel()
        super.onDestroy()
@@ -319,6 +364,7 @@ private class HermesVoiceInteractionSession(
            )
        }.onFailure {
            AssistantSessionState.update(
+                activationId,
                AssistantSessionSnapshot(
                    phase = AssistantSessionPhase.Error,
                    error = it.message ?: "Hermes could not open the voice session.",
@@ -337,6 +383,7 @@ private class HermesVoiceInteractionSession(
            setUiEnabled(false)
        }.onFailure {
            AssistantSessionState.update(
+                activationId,
                AssistantSessionSnapshot(
                    phase = AssistantSessionPhase.Error,
                    error = it.message ?: "Hermes could not open full voice.",
@@ -377,6 +424,14 @@ private class HermesVoiceInteractionSession(
        }
    }

+    private fun refreshKeyguardState(fallbackLocked: Boolean = keyguardLocked) {
+        keyguardLocked = assistantPresentationLocked(
+            currentKeyguardLocked = service.getSystemService(KeyguardManager::class.java)
+                ?.isKeyguardLocked,
+            fallbackLocked = fallbackLocked,
+        )
+    }
+
    @RequiresApi(android.os.Build.VERSION_CODES.Q)
    private fun stageAssistState(state: AssistState) {
        stageAssistData(state.assistStructure, state.assistContent)
@@ -463,6 +518,7 @@ private class AssistantSessionViewOwner :
@Composable
 private fun AssistantSessionSurface(
    expanded: Boolean,
+    locked: Boolean,
    screenContext: AssistantScreenContextUi,
    onExpandedChange: (Boolean) -> Unit,
    onCancel: () -> Unit,
@@ -471,7 +527,8 @@ private fun AssistantSessionSurface(
    onOpenFullVoice: () -> Unit,
    onSurfaceBoundsChanged: (android.graphics.Rect) -> Unit,
 ) {
-    val snapshot by AssistantSessionState.snapshot.collectAsState()
+    val rawSnapshot by AssistantSessionState.snapshot.collectAsState()
+    val snapshot = assistantSnapshotForPresentation(rawSnapshot, locked)
    val status = assistantStatus(snapshot.phase)
    val transmittedScreenContext = if (snapshot.screenContextSupported) {
        screenContext
@@ -650,6 +707,13 @@ private fun ExpandedAssistantSurface(
                color = MaterialTheme.colorScheme.onSurface,
            )
        }
+        snapshot.notice?.let { notice ->
+            Text(
+                text = assistantNoticeText(notice),
+                color = MaterialTheme.colorScheme.onSurfaceVariant,
+                style = MaterialTheme.typography.bodyMedium,
+            )
+        }
        snapshot.error?.let { error ->
            Text(
                text = error,
@@ -896,5 +960,11 @@ private fun assistantStatus(phase: AssistantSessionPhase): String = when (phase)
 private fun compactAssistantText(snapshot: AssistantSessionSnapshot): String =
    snapshot.transcript?.takeIf { it.isNotBlank() }
        ?: snapshot.response.takeIf { it.isNotBlank() }
+        ?: snapshot.notice?.let { assistantNoticeText(it) }
        ?: snapshot.error?.takeIf { it.isNotBlank() }
        ?: assistantStatus(snapshot.phase)
+
+@Composable
+private fun assistantNoticeText(notice: AssistantSessionNotice): String = when (notice) {
+    AssistantSessionNotice.NoSpeech -> stringResource(R.string.voice_no_speech_try_again)
+}
@@ -11,6 +11,7 @@ import com.hermesandroid.relay.data.replaceHermesReachCredential
 import com.hermesandroid.relay.data.sameBrokerAuthority
 import com.hermesandroid.relay.data.PairingPreferences
 import com.hermesandroid.relay.data.Profile
+import com.hermesandroid.relay.data.SupervisedModePolicy
 import com.hermesandroid.relay.data.isSafeProfileUiMeta
 import com.hermesandroid.relay.network.relay.ChannelMultiplexer
 import com.hermesandroid.relay.network.relay.models.Envelope
@@ -18,6 +19,8 @@ import com.hermesandroid.relay.network.shared.InvalidCredentialException
 import com.hermesandroid.relay.network.shared.normalizeCredentialForHeader
 import kotlinx.coroutines.CoroutineScope
 import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.Job
+import kotlinx.coroutines.delay
 import kotlinx.coroutines.flow.MutableStateFlow
 import kotlinx.coroutines.flow.StateFlow
 import kotlinx.coroutines.flow.asSharedFlow
@@ -53,6 +56,39 @@ sealed class AuthState {
    data class Failed(val reason: String) : AuthState()
 }

+internal fun relaySupervisedModePayload(policy: SupervisedModePolicy): JsonObject {
+    if (!policy.isActive) return buildJsonObject { put("active", false) }
+    val capabilities = buildList {
+        add("text_chat")
+        if (policy.capabilities.newChat) add("new_chat")
+        if (policy.capabilities.cancelResponse) add("cancel")
+        if (policy.capabilities.steerResponse) add("steer")
+        if (policy.capabilities.attachments) add("attachments")
+        if (policy.capabilities.voice) add("voice")
+        if (policy.capabilities.generatedImages) add("generated_images")
+        if (policy.capabilities.shareGeneratedImages) add("share_images")
+        if (policy.capabilities.copyResponses) add("copy")
+        if (policy.capabilities.retryResponse) add("retry")
+        if (policy.capabilities.quoteReplies) add("quote_reply")
+        if (policy.visibility.resolved().showTimestamps) add("timestamps")
+    }.take(12)
+    return buildJsonObject {
+        put("active", true)
+        put("profile_label", policy.pinnedProfileName.orEmpty().take(80))
+        put("capabilities", JsonArray(capabilities.map(::JsonPrimitive)))
+    }
+}
+
+internal fun relaySupervisedModeUpdateEnvelope(
+    policy: SupervisedModePolicy,
+): Envelope = Envelope(
+    channel = "system",
+    type = "supervised.update",
+    payload = buildJsonObject {
+        put("supervised_mode", relaySupervisedModePayload(policy))
+    },
+)
+
@Serializable
 data class ConnectionAuthSecrets(
    val sessionToken: String? = null,
@@ -120,6 +156,60 @@ class AuthManager(
    private val eagerHydrate: Boolean = true,
 ) : ChannelMultiplexer.ChannelHandler {

+    @Volatile
+    private var supervisedMode: SupervisedModePolicy = SupervisedModePolicy()
+
+    @Volatile
+    private var supervisedMetadataReconnectFallback: (() -> Unit)? = null
+    private var pendingSupervisedUpdateId: String? = null
+    private var supervisedUpdateFallbackJob: Job? = null
+
+    /**
+     * Update the public client-mode tag sent on Relay auth. This does not grant
+     * authority: Relay labels enforcement_owner=android_client and the Android
+     * policy remains the enforcing surface.
+     */
+    fun updateSupervisedMode(policy: SupervisedModePolicy) {
+        if (supervisedMode == policy) return
+        supervisedMode = policy
+        if (_authState.value is AuthState.Paired) sendSupervisedModeUpdate()
+    }
+
+    /**
+     * Install the narrow compatibility path used when an older Relay ignores
+     * `system/supervised.update`. Reopening the authenticated socket causes
+     * the current policy to travel through the legacy `system/auth` payload.
+     */
+    fun setSupervisedMetadataReconnectFallback(callback: () -> Unit) {
+        supervisedMetadataReconnectFallback = callback
+    }
+
+    private fun sendSupervisedModeUpdate() {
+        val envelope = relaySupervisedModeUpdateEnvelope(supervisedMode)
+        pendingSupervisedUpdateId = envelope.id
+        supervisedUpdateFallbackJob?.cancel()
+        multiplexer.send(envelope)
+        supervisedUpdateFallbackJob = scope.launch {
+            delay(SUPERVISED_UPDATE_ACK_TIMEOUT_MS)
+            if (pendingSupervisedUpdateId == envelope.id) {
+                pendingSupervisedUpdateId = null
+                Log.i(TAG, "supervised.update unsupported or unacknowledged; refreshing Relay socket")
+                supervisedMetadataReconnectFallback?.invoke()
+            }
+        }
+    }
+
+    private fun settleSupervisedModeUpdate(envelope: Envelope, unsupported: Boolean) {
+        if (envelope.id != pendingSupervisedUpdateId) return
+        pendingSupervisedUpdateId = null
+        supervisedUpdateFallbackJob?.cancel()
+        supervisedUpdateFallbackJob = null
+        if (unsupported) {
+            Log.i(TAG, "supervised.update rejected; refreshing Relay socket for compatibility")
+            supervisedMetadataReconnectFallback?.invoke()
+        }
+    }
+
    companion object {
        private const val TAG = "AuthManager"
        private const val KEY_SESSION_TOKEN = "session_token"
@@ -134,6 +224,7 @@ class AuthManager(
        // migration has run, so we never rebuild the legacy keyset to re-check.
        private const val KEY_LEGACY_MIGRATED = "legacy_migrated"
        private const val PAIRING_CODE_LENGTH = 6
+        private const val SUPERVISED_UPDATE_ACK_TIMEOUT_MS = 2_000L
        private val PAIRING_CODE_CHARS = ('A'..'Z') + ('0'..'9')

        /**
@@ -835,6 +926,10 @@ class AuthManager(
        put("device_form_factor", "phone")
    }

+    private fun JsonObjectBuilder.putSupervisedMode() {
+        put("supervised_mode", relaySupervisedModePayload(supervisedMode))
+    }
+
    private fun relayDeviceName(): String {
        val configured = runCatching {
            Settings.Global.getString(context.contentResolver, "device_name")
@@ -890,6 +985,7 @@ class AuthManager(
                        put("device_id", deviceId)
                        putRelayDeviceIdentity()
                        putRelayClientSupports()
+                        putSupervisedMode()
                    }
                }
                else -> {
@@ -898,7 +994,7 @@ class AuthManager(
                    val serverSource = if (serverIssuedCode != null) "QR" else "local-fallback"
                    Log.i(
                        TAG,
-                        "authenticate: sending pairing_code=$codeToSend source=$serverSource " +
+                        "authenticate: sending pairing credential source=$serverSource " +
                            "ttl=$pendingTtlSeconds grants=${pendingGrants?.keys}"
                    )
                    buildJsonObject {
@@ -906,6 +1002,7 @@ class AuthManager(
                        put("device_id", deviceId)
                        putRelayDeviceIdentity()
                        putRelayClientSupports()
+                        putSupervisedMode()
                        pendingTtlSeconds?.let { put("ttl_seconds", it) }
                        pendingGrants?.let { grants ->
                            val obj = buildJsonObject {
@@ -966,7 +1063,8 @@ class AuthManager(
        _currentPairedSession.value = null
        Log.i(
            TAG,
-            "applyServerIssuedCodeAndReset: code=$normalized relayUrl=$relayUrl " +
+            "applyServerIssuedCodeAndReset: credential=present " +
+                "relayConfigured=${!relayUrl.isNullOrBlank()} " +
                "prevState=${prevState::class.simpleName} → Unpaired"
        )
        scope.launch {
@@ -985,6 +1083,8 @@ class AuthManager(
        when (envelope.type) {
            "auth.ok" -> handleAuthOk(envelope)
            "auth.fail" -> handleAuthFail(envelope)
+            "supervised.updated" -> settleSupervisedModeUpdate(envelope, unsupported = false)
+            "error" -> settleSupervisedModeUpdate(envelope, unsupported = true)
            // `profiles.updated` push — sent by the v0.7.1+ relay on
            // the "pairing" channel whenever its in-memory profile
            // snapshot changes (file-watcher, SIGHUP, or a manual
@@ -1129,6 +1229,11 @@ class AuthManager(
        get() = _authState.value is AuthState.Paired

    private fun handleAuthOk(envelope: Envelope) {
+        // A successful auth always carries the latest client report, including
+        // after the compatibility reconnect used for older Relay versions.
+        pendingSupervisedUpdateId = null
+        supervisedUpdateFallbackJob?.cancel()
+        supervisedUpdateFallbackJob = null
        scope.launch {
            try {
                val payload = envelope.payload
@@ -10,6 +10,16 @@ package com.hermesandroid.relay.data
 */
 object AgentDisplay {
    const val SERVER_DEFAULT_PROFILE_KEY: String = "__server_default__"
+    private const val PROFILE_CONTEXT_SEPARATOR = "::"
+
+    data class ProfileContextIdentity(
+        val connectionId: String,
+        val profileKey: String,
+    ) {
+        /** Null means the upstream request must inherit Server Default. */
+        val requestProfileName: String?
+            get() = profileRequestName(profileKey)
+    }
    private val GENERIC_MODEL_ALIASES = setOf(
        "hermes-agent",
        "hermes_agent",
@@ -163,7 +173,25 @@ object AgentDisplay {
        profileRequestName(profileName) ?: SERVER_DEFAULT_PROFILE_KEY

    fun profileContextKey(connectionId: String?, profileName: String?): String =
-        "${connectionId.orEmpty()}::${profileSessionKey(profileName)}"
+        "${connectionId.orEmpty()}$PROFILE_CONTEXT_SEPARATOR${profileSessionKey(profileName)}"
+
+    /**
+     * Parse the canonical profile/context identity used by persisted chat state.
+     *
+     * Legacy or malformed opaque keys deliberately return null: recovery may
+     * still use the exact key for ownership, but must not invent an upstream
+     * profile override from it. The first separator is authoritative so legal
+     * profile names containing `::` remain round-trippable.
+     */
+    fun parseProfileContextKey(contextKey: String?): ProfileContextIdentity? {
+        val raw = contextKey?.trim().orEmpty()
+        val separator = raw.indexOf(PROFILE_CONTEXT_SEPARATOR)
+        if (separator <= 0 || separator + PROFILE_CONTEXT_SEPARATOR.length >= raw.length) return null
+        val connectionId = raw.substring(0, separator).trim()
+        val profileKey = raw.substring(separator + PROFILE_CONTEXT_SEPARATOR.length).trim()
+        if (connectionId.isEmpty() || profileKey.isEmpty()) return null
+        return ProfileContextIdentity(connectionId, profileKey)
+    }

    fun localDisplayAlias(value: String?): String? =
        value
@@ -0,0 +1,122 @@
+package com.hermesandroid.relay.data
+
+data class BotGatewayRouteKey(
+    val connectionId: String,
+    val profileName: String,
+) {
+    init {
+        require(connectionId.isNotBlank()) { "connectionId must not be blank" }
+        require(profileName.isNotBlank()) { "profileName must not be blank" }
+    }
+}
+
+class BotGatewayRoute(
+    val key: BotGatewayRouteKey,
+    val connectionLabel: String,
+    val installId: String? = null,
+) {
+    val connectionId: String get() = key.connectionId
+    val profileName: String get() = key.profileName
+
+    override fun equals(other: Any?): Boolean = other is BotGatewayRoute && key == other.key
+    override fun hashCode(): Int = key.hashCode()
+    override fun toString(): String = "BotGatewayRoute(key=$key, label=$connectionLabel)"
+}
+
+/** Bounded session summary published by upstream `profiles.list`. */
+data class BotSessionSummary(
+    val id: String,
+    val resolvedId: String = id,
+    val title: String = "",
+    val rootTitle: String = "",
+    val preview: String = "",
+    val startedAtMs: Long = 0L,
+    val lastActiveAtMs: Long = 0L,
+    val messageCount: Int = 0,
+)
+
+data class BotRosterEntry(
+    val profile: Profile,
+    val displayName: String,
+    val route: BotGatewayRoute? = null,
+    val handle: String = profile.name,
+    val stale: Boolean = false,
+    val botTitle: String = "",
+    val hidden: Boolean = false,
+    val lastSession: BotSessionSummary? = null,
+    val workerSession: BotSessionSummary? = null,
+    val canonicalSession: BotSessionSummary? = null,
+) {
+    val latestActivityAtMs: Long
+        get() = maxOf(
+            canonicalSession?.lastActiveAtMs ?: 0L,
+            lastSession?.lastActiveAtMs ?: 0L,
+        )
+
+    val presenceActivityAtMs: Long
+        get() = maxOf(latestActivityAtMs, workerSession?.lastActiveAtMs ?: 0L)
+
+    val latestPreview: String
+        get() = canonicalSession?.preview?.takeIf(String::isNotBlank)
+            ?: lastSession?.preview.orEmpty()
+}
+
+data class BotGroupMember(
+    val name: String,
+    val handle: String? = null,
+    val connectionId: String? = null,
+    val connectionLabel: String? = null,
+)
+
+data class BotGroupMessage(
+    val id: String? = null,
+    val senderName: String,
+    val senderKind: String,
+    val senderSource: String? = null,
+    val text: String,
+    val atMs: Long,
+)
+
+data class BotGroupRoom(
+    val key: String,
+    val roomId: String? = null,
+    val name: String,
+    val revision: Long = 0L,
+    val members: List<BotGroupMember> = emptyList(),
+    val messages: List<BotGroupMessage> = emptyList(),
+    val sourceConnectionIds: Set<String> = emptySet(),
+    val stale: Boolean = false,
+) {
+    val latestMessage: BotGroupMessage? get() = messages.maxByOrNull(BotGroupMessage::atMs)
+    val latestActivityAtMs: Long get() = latestMessage?.atMs ?: 0L
+}
+
+data class BotModeRoster(
+    val bots: List<BotRosterEntry> = emptyList(),
+    val groups: List<BotGroupRoom> = emptyList(),
+    val botModeProtocolSupported: Boolean = false,
+)
+
+data class BotGatewayRosterStatus(
+    val connectionId: String,
+    val label: String,
+    val installId: String? = null,
+    val loading: Boolean = false,
+    val stale: Boolean = false,
+    val error: String? = null,
+    val botCount: Int = 0,
+)
+
+data class BotChatTarget(
+    /** Durable registry-row identity. */
+    val storedSessionId: String,
+    /** Compression-lineage tip that should be resumed. */
+    val resolvedSessionId: String = storedSessionId,
+)
+
+data class BotModeState(
+    val loading: Boolean = false,
+    val roster: BotModeRoster = BotModeRoster(),
+    val gateways: List<BotGatewayRosterStatus> = emptyList(),
+    val error: String? = null,
+)
@@ -33,6 +33,8 @@ class ChatInputPreferencesRepository(
            stringPreferencesKey("physical_keyboard_enter_behavior")
        internal val KEY_CONVERT_LARGE_PASTES =
            booleanPreferencesKey("convert_large_pastes_to_attachments")
+        internal val KEY_SHOW_GIT_WORKSPACE_IN_CHAT =
+            booleanPreferencesKey("show_git_workspace_in_chat")
    }

    val physicalKeyboardEnterBehavior: Flow<PhysicalKeyboardEnterBehavior> = dataStore.data
@@ -47,6 +49,10 @@ class ChatInputPreferencesRepository(
        .map { preferences -> preferences[KEY_CONVERT_LARGE_PASTES] ?: true }
        .distinctUntilChanged()

+    val showGitWorkspaceInChat: Flow<Boolean> = dataStore.data
+        .map { preferences -> preferences[KEY_SHOW_GIT_WORKSPACE_IN_CHAT] ?: true }
+        .distinctUntilChanged()
+
    suspend fun setPhysicalKeyboardEnterBehavior(behavior: PhysicalKeyboardEnterBehavior) {
        dataStore.edit { preferences ->
            preferences[KEY_PHYSICAL_KEYBOARD_ENTER] = behavior.storedValue
@@ -58,4 +64,10 @@ class ChatInputPreferencesRepository(
            preferences[KEY_CONVERT_LARGE_PASTES] = enabled
        }
    }
+
+    suspend fun setShowGitWorkspaceInChat(enabled: Boolean) {
+        dataStore.edit { preferences ->
+            preferences[KEY_SHOW_GIT_WORKSPACE_IN_CHAT] = enabled
+        }
+    }
 }
@@ -451,7 +451,8 @@ data class ChatSession(
    val outputTokens: Int = 0,
    val actualCostUsd: Double? = null,
    val estimatedCostUsd: Double? = null,
-    val isActive: Boolean = false,
+    /** Upstream REST five-minute recency hint; never evidence that a turn is running. */
+    val recentlyActive: Boolean = false,
    val updatedAt: Long = 0L,
    val startedAt: Long = 0L,
    val lastActivityAt: Long = 0L,
@@ -23,6 +23,8 @@ import kotlinx.serialization.json.Json
 data class ChatTurnCheckpoint(
    val schemaVersion: Int = CURRENT_SCHEMA,
    val contextKey: String,
+    /** Explicit persisted profile identity; null only for legacy checkpoints. */
+    val profileKey: String? = null,
    val sessionId: String,
    val liveSessionId: String? = null,
    val transport: String,
@@ -1,6 +1,8 @@
 package com.hermesandroid.relay.data

 import kotlinx.serialization.Serializable
+import java.net.Inet6Address
+import java.net.InetAddress
 import java.net.URI

@Serializable
@@ -65,6 +67,14 @@ data class Connection(
     * "derive from [apiServerUrl] using the conventional same-host :9119".
     */
    val dashboardUrl: String? = null,
+    /**
+     * Credential-free origin that most recently completed Dashboard
+     * authentication for this connection. Public origins require HTTPS;
+     * loopback/private-overlay HTTP retains upstream's trusted-network mode.
+     * Dashboard/Gateway consumers prefer this origin, while [routeCandidates]
+     * continue to own only network route selection for API and Relay.
+     */
+    val authenticatedDashboardOrigin: String? = null,
    val dashboardAuthRequired: Boolean? = null,
    val dashboardAuthProviders: List<String> = emptyList(),
    val dashboardLastStatus: DashboardConnectionStatus? = null,
@@ -77,6 +87,11 @@ data class Connection(
    val routeCandidates: List<EndpointCandidate> = emptyList(),
    /** Optional user preference such as "lan" or "tailscale"; null means Auto. */
    val preferredRouteRole: String? = null,
+    /**
+     * Explicit per-installation consent for Relay Git repository discovery.
+     * Missing legacy values remain off; route/profile changes do not broaden it.
+     */
+    val gitRepoScanningEnabled: Boolean = false,
    /** Epoch milliseconds. Pass `System.currentTimeMillis()`; do not pass seconds. */
    val pairedAt: Long? = null,
    /** Last time the user explicitly selected this connection. */
@@ -86,21 +101,27 @@ data class Connection(
    /** Epoch milliseconds. The auth.ok `expires_at` field is seconds — multiply by 1000 at the call site. */
    val expiresAt: Long? = null,
 ) {
-    /**
-     * Effective Dashboard/Gateway endpoint. Legacy records did not persist a
-     * dashboard URL, so they retain the conventional same-host `:9119`
-     * derivation from the API server. Dashboard-only records persist an
-     * explicit URL and may leave [apiServerUrl] and [relayUrl] blank.
-     */
-    val resolvedDashboardUrl: String
+    /** Saved Dashboard/Gateway route before any authenticated-origin override. */
+    val configuredDashboardUrl: String
        get() = dashboardUrl
            ?.trim()
            ?.takeIf { it.isNotBlank() }
            ?: deriveDefaultDashboardUrl(apiServerUrl).orEmpty()

+    /**
+     * Effective Dashboard/Gateway endpoint. A verified authenticated origin
+     * wins without rewriting the saved network route. Legacy records retain
+     * the conventional same-host `:9119` derivation through
+     * [configuredDashboardUrl].
+     */
+    val resolvedDashboardUrl: String
+        get() = authenticatedDashboardOrigin
+            ?.let(::normalizeCredentialFreeAuthenticatedDashboardOrigin)
+            ?: configuredDashboardUrl
+
    /** Stable display/host identity that does not depend on the API surface. */
    val primaryEndpointUrl: String
-        get() = resolvedDashboardUrl.takeIf { it.isNotBlank() }
+        get() = configuredDashboardUrl.takeIf { it.isNotBlank() }
            ?: apiServerUrl.trim().takeIf { it.isNotBlank() }
            ?: relayUrl.trim()

@@ -506,6 +527,12 @@ data class Connection(
            )
        }

+        /**
+         * Normalize a hand-typed Dashboard/Gateway address. Bare private,
+         * LAN, and Tailscale hosts use upstream's `http://…:9119` default;
+         * bare public hosts use `https://` on the standard HTTPS port.
+         * Explicit schemes and ports are preserved for precise validation.
+         */
        fun normalizeDashboardUrlInput(
            raw: String,
            defaultPort: Int = DEFAULT_DASHBOARD_PORT,
@@ -513,7 +540,10 @@ data class Connection(
            val trimmed = raw.trim().trimEnd('/')
            if (trimmed.isEmpty()) return trimmed
            if (SCHEME_REGEX.containsMatchIn(trimmed)) return trimmed
-            val withScheme = "http://$trimmed"
+            val provisionalHttpUrl = "http://$trimmed"
+            val publicAddress = inferRouteRole(provisionalHttpUrl) == "public"
+            val withScheme = if (publicAddress) "https://$trimmed" else provisionalHttpUrl
+            if (publicAddress) return withScheme
            val uri = runCatching { URI(withScheme) }.getOrNull()
            val canAppendPort = uri != null &&
                !uri.host.isNullOrBlank() &&
@@ -528,16 +558,41 @@ data class Connection(
                .getOrNull()
                ?.lowercase()
                ?: return "custom"
+            val normalizedHost = host.removePrefix("[").removeSuffix("]")
+            if (normalizedHost.contains(':')) {
+                val address = runCatching { InetAddress.getByName(normalizedHost) }
+                    .getOrNull() as? Inet6Address
+                    ?: return "public"
+                return when {
+                    isTailscaleIpv6(address) -> "tailscale"
+                    address.isAnyLocalAddress ||
+                        address.isLoopbackAddress ||
+                        address.isLinkLocalAddress ||
+                        isUniqueLocalIpv6(address) -> "lan"
+                    else -> "public"
+                }
+            }
            return when {
-                host.endsWith(".ts.net") || isTailscaleIpv4(host) -> "tailscale"
-                host == "localhost" ||
-                    host == "127.0.0.1" ||
-                    host == "::1" ||
-                    isPrivateLanIpv4(host) -> "lan"
+                normalizedHost.endsWith(".ts.net") || isTailscaleIpv4(normalizedHost) -> "tailscale"
+                normalizedHost == "localhost" ||
+                    normalizedHost == "127.0.0.1" ||
+                    normalizedHost.endsWith(".local") ||
+                    normalizedHost.endsWith(".lan") ||
+                    !normalizedHost.contains('.') ||
+                    isPrivateLanIpv4(normalizedHost) -> "lan"
                else -> "public"
            }
        }

+        private fun isTailscaleIpv6(address: Inet6Address): Boolean {
+            val bytes = address.address
+            val prefix = intArrayOf(0xfd, 0x7a, 0x11, 0x5c, 0xa1, 0xe0)
+            return prefix.indices.all { index -> bytes[index].toInt() and 0xff == prefix[index] }
+        }
+
+        private fun isUniqueLocalIpv6(address: Inet6Address): Boolean =
+            address.address.first().toInt() and 0xfe == 0xfc
+
        private fun isTailscaleIpv4(host: String): Boolean {
            val parts = host.split('.').mapNotNull { it.toIntOrNull() }
            if (parts.size != 4) return false
@@ -557,3 +612,45 @@ data class Connection(
        }
    }
 }
+
+/** Normalize an absolute, credential-free HTTPS origin for authenticated Dashboard use. */
+internal fun normalizeCredentialFreeHttpsOrigin(raw: String): String? {
+    val parsed = runCatching { URI(raw.trim()) }.getOrNull() ?: return null
+    if (!parsed.scheme.equals("https", ignoreCase = true)) return null
+    if (parsed.host.isNullOrBlank() || parsed.userInfo != null) return null
+    if (parsed.query != null || parsed.fragment != null) return null
+    if (parsed.port > 65_535) return null
+    return parsed.normalize().toASCIIString().trimEnd('/').takeIf { it.isNotBlank() }
+}
+
+/**
+ * Normalize a reviewed Dashboard credential owner. Public origins require
+ * HTTPS; cleartext is accepted only for literal loopback, RFC1918/link-local,
+ * or Tailscale CGNAT addresses.
+ */
+internal fun normalizeCredentialFreeAuthenticatedDashboardOrigin(raw: String): String? {
+    normalizeCredentialFreeHttpsOrigin(raw)?.let { return it }
+    val parsed = runCatching { URI(raw.trim()) }.getOrNull() ?: return null
+    if (!parsed.scheme.equals("http", ignoreCase = true)) return null
+    val host = parsed.host
+        ?.lowercase()
+        ?.removePrefix("[")
+        ?.removeSuffix("]")
+        ?.takeIf { it.isNotBlank() }
+        ?: return null
+    if (parsed.userInfo != null || parsed.query != null || parsed.fragment != null) return null
+    if (parsed.port > 65_535) return null
+    val trustedHost = host == "localhost" || host == "127.0.0.1" || host == "::1" ||
+        host.split('.').mapNotNull(String::toIntOrNull).let { octets ->
+            octets.size == 4 && octets.all { it in 0..255 } && when {
+                octets[0] == 10 -> true
+                octets[0] == 172 && octets[1] in 16..31 -> true
+                octets[0] == 192 && octets[1] == 168 -> true
+                octets[0] == 169 && octets[1] == 254 -> true
+                octets[0] == 100 && octets[1] in 64..127 -> true
+                else -> false
+            }
+        }
+    if (!trustedHost) return null
+    return parsed.normalize().toASCIIString().trimEnd('/').takeIf { it.isNotBlank() }
+}
@@ -18,6 +18,9 @@ package com.hermesandroid.relay.data
 */
 enum class SurfaceSecurityKind { Tls, Overlay, Plain }

+/** Whether a configured surface currently contributes traffic to the connection. */
+enum class SurfaceUseState { InUse, Available, Unavailable }
+
 /** Connection-level rollup across the surfaces actually in use. */
 enum class ConnectionSecurityLevel { Tls, Overlay, Mixed, Plain, Unknown }

@@ -28,6 +31,7 @@ data class SurfaceSecurity(
    /** Human mechanism: "TLS", "Tailscale", "WireGuard", "Proxy", "Plain". */
    val mechanism: String,
    val url: String,
+    val useState: SurfaceUseState = SurfaceUseState.InUse,
 )

 data class ConnectionSecurity(
@@ -86,6 +90,7 @@ fun classifySurfaceSecurity(
    url: String,
    activeEndpoint: EndpointCandidate?,
    isTailscaleDetected: Boolean,
+    useState: SurfaceUseState = SurfaceUseState.InUse,
 ): SurfaceSecurity {
    val secureLinkProtected = activeEndpoint.secureLinkProtects(label, url)
    val (kind, mechanism) = when {
@@ -96,7 +101,13 @@ fun classifySurfaceSecurity(
            SurfaceSecurityKind.Overlay to activeEndpoint.overlayMechanism(isTailscaleDetected)
        else -> SurfaceSecurityKind.Plain to "Plain"
    }
-    return SurfaceSecurity(label = label, kind = kind, mechanism = mechanism, url = url)
+    return SurfaceSecurity(
+        label = label,
+        kind = kind,
+        mechanism = mechanism,
+        url = url,
+        useState = useState,
+    )
 }

 private fun EndpointCandidate?.secureLinkProtects(label: String, url: String): Boolean {
@@ -112,8 +123,8 @@ private fun EndpointCandidate?.secureLinkProtects(label: String, url: String): B
        } ?: return false
    val normalized = url.trim().trimEnd('/')
    val service = when (label) {
-        "Chat & Manage" -> "dashboard"
-        "API / sessions" -> "api"
+        "Chat & Manage", "Dashboard & Gateway" -> "dashboard"
+        "API / sessions", "API fallback" -> "api"
        "Relay tools" -> "relay"
        else -> return false
    }
@@ -137,23 +148,67 @@ fun computeConnectionSecurity(
    relayConfigured: Boolean,
    activeEndpoint: EndpointCandidate?,
    isTailscaleDetected: Boolean,
+    dashboardInUse: Boolean = true,
+    apiInUse: Boolean = true,
+    apiAvailable: Boolean = apiInUse,
+    relayInUse: Boolean = relayConfigured,
+    apiEndpoint: EndpointCandidate? = activeEndpoint,
+    relayEndpoint: EndpointCandidate? = activeEndpoint,
 ): ConnectionSecurity {
    val surfaces = buildList {
        dashboardUrl.trim().takeIf { it.isNotBlank() }?.let {
-            add(classifySurfaceSecurity("Chat & Manage", it, activeEndpoint, isTailscaleDetected))
+            add(
+                classifySurfaceSecurity(
+                    label = "Dashboard & Gateway",
+                    url = it,
+                    activeEndpoint = activeEndpoint,
+                    isTailscaleDetected = isTailscaleDetected,
+                    useState = if (dashboardInUse) SurfaceUseState.InUse else SurfaceUseState.Unavailable,
+                )
+            )
        }
        apiUrl.trim().takeIf { it.isNotBlank() }?.let {
-            add(classifySurfaceSecurity("API / sessions", it, activeEndpoint, isTailscaleDetected))
+            add(
+                classifySurfaceSecurity(
+                    label = "API fallback",
+                    url = it,
+                    activeEndpoint = apiEndpoint,
+                    isTailscaleDetected = isTailscaleDetected,
+                    useState = when {
+                        apiInUse -> SurfaceUseState.InUse
+                        apiAvailable -> SurfaceUseState.Available
+                        else -> SurfaceUseState.Unavailable
+                    },
+                )
+            )
        }
        if (relayConfigured) {
            relayUrl.trim().takeIf { it.isNotBlank() }?.let {
-                add(classifySurfaceSecurity("Relay tools", it, activeEndpoint, isTailscaleDetected))
+                add(
+                    classifySurfaceSecurity(
+                        label = "Relay tools",
+                        url = it,
+                        activeEndpoint = relayEndpoint,
+                        isTailscaleDetected = isTailscaleDetected,
+                        useState = if (relayInUse) SurfaceUseState.InUse else SurfaceUseState.Unavailable,
+                    )
+                )
            }
        }
    }
    if (surfaces.isEmpty()) return ConnectionSecurity.UNKNOWN

-    val kinds = surfaces.map { it.kind }.toSet()
+    // Configured-but-unavailable fallbacks remain visible in the breakdown,
+    // but do not make the active transport look insecure.
+    val activeSurfaces = surfaces.filter { it.useState == SurfaceUseState.InUse }
+    if (activeSurfaces.isEmpty()) {
+        return ConnectionSecurity(
+            level = ConnectionSecurityLevel.Unknown,
+            mechanism = "",
+            surfaces = surfaces,
+        )
+    }
+    val kinds = activeSurfaces.map { it.kind }.toSet()
    val hasPlain = SurfaceSecurityKind.Plain in kinds
    val hasSecure = kinds.any { it != SurfaceSecurityKind.Plain }

@@ -167,7 +222,7 @@ fun computeConnectionSecurity(
    val mechanism = when (level) {
        ConnectionSecurityLevel.Tls -> "TLS"
        ConnectionSecurityLevel.Overlay ->
-            surfaces.firstOrNull { it.kind == SurfaceSecurityKind.Overlay }?.mechanism ?: "Encrypted"
+            activeSurfaces.firstOrNull { it.kind == SurfaceSecurityKind.Overlay }?.mechanism ?: "Encrypted"
        ConnectionSecurityLevel.Mixed -> "Mixed"
        ConnectionSecurityLevel.Plain -> when (activeEndpoint?.role?.lowercase()) {
            "lan" -> "LAN"
@@ -149,15 +149,15 @@ class ConnectionStore private constructor(
                // between the two names — `{"id": ..., "label": ..., ...}` —
                // so no per-record migration is needed.
                if (newJson == null && oldJson != null) {
+                    val restored = decodeConnections(oldJson)
                    dataStore.edit { p ->
-                        p[KEY_CONNECTIONS] = oldJson
+                        p[KEY_CONNECTIONS] = encodeConnections(restored)
                        p.remove(KEY_LEGACY_PROFILES)
                        if (activeNew == null && activeOld != null) {
                            p[KEY_ACTIVE_CONNECTION_ID] = activeOld
                            p.remove(KEY_LEGACY_ACTIVE_PROFILE_ID)
                        }
                    }
-                    val restored = decodeConnections(oldJson)
                    val validStartupId = startupId?.takeIf { id -> restored.any { it.id == id } }
                    _connections.value = restored
                    _startupConnectionId.value = validStartupId
@@ -168,6 +168,12 @@ class ConnectionStore private constructor(
                    )
                } else {
                    val restored = decodeConnections(newJson)
+                    if (newJson != null) {
+                        val normalizedJson = encodeConnections(restored)
+                        if (normalizedJson != newJson) {
+                            dataStore.edit { p -> p[KEY_CONNECTIONS] = normalizedJson }
+                        }
+                    }
                    val validStartupId = startupId?.takeIf { id -> restored.any { it.id == id } }
                    _connections.value = restored
                    _startupConnectionId.value = validStartupId
@@ -571,7 +577,17 @@ class ConnectionStore private constructor(
 internal fun Connection.withDashboardDefaults(): Connection {
    val derivedDashboardUrl = Connection.deriveDefaultDashboardUrl(apiServerUrl)
    val effectiveDashboardUrl = dashboardUrl?.takeIf { it.isNotBlank() } ?: derivedDashboardUrl
-    val storedOrDefaultRoutes = routeCandidates.ifEmpty {
+    val legacyAuthenticatedRoute = routeCandidates.firstOrNull {
+        it.role.equals(LEGACY_AUTHENTICATED_DASHBOARD_ROUTE_ROLE, ignoreCase = true)
+    }
+    val migratedAuthenticatedOrigin = authenticatedDashboardOrigin
+        ?.let(::normalizeCredentialFreeAuthenticatedDashboardOrigin)
+        ?: legacyAuthenticatedRoute?.dashboard?.url
+            ?.let(::normalizeCredentialFreeAuthenticatedDashboardOrigin)
+    val routesWithoutLegacyAuthentication = routeCandidates.filterNot {
+        it.role.equals(LEGACY_AUTHENTICATED_DASHBOARD_ROUTE_ROLE, ignoreCase = true)
+    }
+    val storedOrDefaultRoutes = routesWithoutLegacyAuthentication.ifEmpty {
        Connection.buildRouteCandidates(
            apiServerUrl = apiServerUrl,
            relayUrl = relayUrl,
@@ -582,16 +598,18 @@ internal fun Connection.withDashboardDefaults(): Connection {
        dashboardUrl = effectiveDashboardUrl,
        candidates = storedOrDefaultRoutes,
    )
-    val normalizedPreferredRouteRole = preferredRouteRole?.takeIf { preferred ->
-        normalizedRoutes.any { it.role.equals(preferred, ignoreCase = true) }
-    }
+    val normalizedPreferredRouteRole = preferredRouteRole
+        ?.takeUnless { it.equals(LEGACY_AUTHENTICATED_DASHBOARD_ROUTE_ROLE, ignoreCase = true) }
+        ?.takeIf { preferred -> normalizedRoutes.any { it.role.equals(preferred, ignoreCase = true) } }
    return if (
        dashboardUrl != effectiveDashboardUrl ||
+        authenticatedDashboardOrigin != migratedAuthenticatedOrigin ||
        normalizedRoutes != routeCandidates ||
        normalizedPreferredRouteRole != preferredRouteRole
    ) {
        copy(
            dashboardUrl = effectiveDashboardUrl,
+            authenticatedDashboardOrigin = migratedAuthenticatedOrigin,
            routeCandidates = normalizedRoutes,
            preferredRouteRole = normalizedPreferredRouteRole,
        )
@@ -599,3 +617,5 @@ internal fun Connection.withDashboardDefaults(): Connection {
        this
    }
 }
+
+internal const val LEGACY_AUTHENTICATED_DASHBOARD_ROUTE_ROLE = "authenticated_dashboard"
@@ -25,7 +25,7 @@ import java.net.URI
 *
 * **Semantics (locked by ADR 24):**
 *  - [role] is an open string. Known values `lan` / `tailscale` / `public`
- *    get styled labels; anything else renders generically (`Custom VPN (<role>)`).
+ *    get styled labels; anything else renders generically (`Custom route (<role>)`).
 *    No enum, no normalization — the raw role string must round-trip exactly
 *    so HMAC canonicalization holds.
 *  - [priority] is strict, `0 = highest`. Reachability never promotes a lower
@@ -145,18 +145,19 @@ data class BrokerEndpoint(
 *
 * Unknown roles (`"wireguard"`, `"zerotier"`, `"netbird-eu"`, operator-defined
 * labels) return false so the UI can fall back to [displayLabel]'s generic
- * "Custom VPN" treatment.
+ * "Custom route" treatment.
 */
 fun EndpointCandidate.isKnownRole(): Boolean {
    return when (role.lowercase()) {
-        "lan", "tailscale", "public", "plugin_proxy", "plugin-proxy", "outbound_broker", "https" -> true
+        "lan", "tailscale", "public", "plugin_proxy", "plugin-proxy", "outbound_broker", "https",
+        "dashboard", "authenticated_dashboard" -> true
        else -> false
    }
 }

 /**
 * Human-readable label for the UI. Known roles get fixed-case styled labels;
- * unknown roles render as `"Custom VPN (<role>)"` with the raw role preserved
+ * unknown roles render as `"Custom route (<role>)"` with the raw role preserved
 * so an operator can see exactly what they labeled it.
 *
 * The raw [role] on the [EndpointCandidate] is NOT modified — it stays in its
@@ -172,12 +173,27 @@ fun EndpointCandidate.displayLabel(): String {
            "Public"
        }
        "https" -> "HTTPS"
+        "dashboard", "authenticated_dashboard" -> if (
+            primaryRouteUrl()?.startsWith("https://", ignoreCase = true) == true
+        ) {
+            "HTTPS Dashboard"
+        } else {
+            "Dashboard"
+        }
        "plugin_proxy", "plugin-proxy" -> "Hermes Secure Link"
        "outbound_broker", "broker", "relay_broker" -> "Hermes Reach · Experimental"
-        else -> "Custom VPN ($role)"
+        else -> displayName?.trim()?.takeIf { it.isNotBlank() } ?: "Custom route ($role)"
    }
 }

+/**
+ * True for a route created only to keep Dashboard/Gateway authentication on
+ * its canonical origin. It is a service address, not another selectable
+ * whole-connection or VPN route.
+ */
+fun EndpointCandidate.isDashboardOnlyRoute(): Boolean =
+    api == null && relay == null && proxy == null && broker == null && dashboard != null
+
 /** Dashboard-first URL identity for routing, diagnostics, and UI labels. */
 fun EndpointCandidate.primaryRouteUrl(): String? =
    dashboard?.url?.trim()?.trimEnd('/')?.takeIf { it.isNotBlank() }
@@ -185,6 +201,11 @@ fun EndpointCandidate.primaryRouteUrl(): String? =
        ?: relay?.url?.trim()?.trimEnd('/')?.takeIf { it.isNotBlank() }
        ?: proxy?.url?.trim()?.trimEnd('/')?.takeIf { it.isNotBlank() }

+/** Dashboard/Gateway identity only; Relay and broker transports are extensions. */
+fun EndpointCandidate.gatewayRouteUrl(): String? =
+    dashboard?.url?.trim()?.trimEnd('/')?.takeIf { it.isNotBlank() }
+        ?: api?.url?.let(Connection::deriveDefaultDashboardUrl)
+
 /** Stable host/port identity without assuming that an API surface exists. */
 fun EndpointCandidate.routeAuthority(): String? {
    val rawUrl = primaryRouteUrl() ?: return null
@@ -0,0 +1,163 @@
+package com.hermesandroid.relay.data
+
+import com.hermesandroid.relay.network.upstream.DashboardApiClient
+import com.hermesandroid.relay.plugins.runtime.ScopedPluginApiClient
+import kotlinx.serialization.json.Json
+import kotlinx.serialization.json.JsonPrimitive
+import kotlinx.serialization.json.buildJsonArray
+import kotlinx.serialization.json.buildJsonObject
+import kotlinx.serialization.json.decodeFromJsonElement
+import kotlinx.serialization.json.put
+
+// Read + write client for the Hermes-Relay Git State endpoints.
+// All requests are confined to the ``hermes-relay`` plugin namespace and the
+// ``git/*`` sub-path via ScopedPluginApiClient, which rejects traversal and
+// encodes query values.
+
+private fun pathsArray(paths: List<String>) = buildJsonArray { paths.forEach { add(JsonPrimitive(it)) } }
+
+class GitStateApiClient(
+    dashboard: DashboardApiClient,
+) {
+    private val scoped = ScopedPluginApiClient("hermes-relay", dashboard)
+    private val json = Json { ignoreUnknownKeys = true }
+
+    suspend fun repos(): Result<List<GitRepo>> = scoped
+        .get("git/repos")
+        .mapCatching { element ->
+            json.decodeFromJsonElement<ReposResponse>(element).repos
+        }
+
+    suspend fun status(repo: String): Result<GitStatus> = scoped
+        .get("git/status", mapOf("repo" to repo))
+        .mapCatching { element -> json.decodeFromJsonElement<GitStatus>(element) }
+
+    suspend fun branches(repo: String): Result<List<GitBranch>> = scoped
+        .get("git/branches", mapOf("repo" to repo))
+        .mapCatching { element ->
+            json.decodeFromJsonElement<BranchesResponse>(element).branches
+        }
+
+    suspend fun diff(repo: String, path: String, kind: String): Result<GitDiff> = scoped
+        .get("git/diff", mapOf("repo" to repo, "path" to path, "kind" to kind))
+        .mapCatching { element -> json.decodeFromJsonElement<GitDiff>(element) }
+
+    suspend fun file(repo: String, path: String): Result<GitFile> = scoped
+        .get("git/file", mapOf("repo" to repo, "path" to path))
+        .mapCatching { element -> json.decodeFromJsonElement<GitFile>(element) }
+
+    // ── Write operations ───────────────────────────────────────────────────
+    // Every write requires the plugin.api.write grant, which the app enforces
+    // (see GitStateViewModel: a POST is never sent without the grant). The
+    // server additionally enforces per-use confirmation strings for destructive
+    // ops (discard/push/dirty-checkout) — the caller passes the echoed token.
+
+    suspend fun stage(repo: String, paths: List<String>): Result<GitMutationResult> =
+        scoped.post("git/stage", buildJsonObject {
+            put("repo", repo)
+            put("paths", pathsArray(paths))
+        }).mapCatching { json.decodeFromJsonElement<GitMutationResult>(it) }
+
+    suspend fun unstage(repo: String, paths: List<String>): Result<GitMutationResult> =
+        scoped.post("git/unstage", buildJsonObject {
+            put("repo", repo)
+            put("paths", pathsArray(paths))
+        }).mapCatching { json.decodeFromJsonElement<GitMutationResult>(it) }
+
+    suspend fun discard(
+        repo: String,
+        paths: List<String>,
+        confirmation: String,
+        deleteUntracked: Boolean = false,
+    ): Result<GitMutationResult> = scoped.post("git/discard", buildJsonObject {
+        put("repo", repo)
+        put("paths", pathsArray(paths))
+        put("confirmation", confirmation)
+        put("delete_untracked", deleteUntracked)
+    }).mapCatching { json.decodeFromJsonElement<GitMutationResult>(it) }
+
+    suspend fun commit(repo: String, message: String): Result<GitMutationResult> =
+        scoped.post("git/commit", buildJsonObject {
+            put("repo", repo)
+            put("message", message)
+        }).mapCatching { json.decodeFromJsonElement<GitMutationResult>(it) }
+
+    suspend fun commitSelected(
+        repo: String,
+        message: String,
+        paths: List<String>,
+    ): Result<GitMutationResult> = scoped.post("git/commit_selected", buildJsonObject {
+        put("repo", repo)
+        put("message", message)
+        put("paths", pathsArray(paths))
+    }).mapCatching { json.decodeFromJsonElement<GitMutationResult>(it) }
+
+    suspend fun fetch(repo: String, remote: String = "origin"): Result<GitMutationResult> =
+        scoped.post("git/fetch", buildJsonObject {
+            put("repo", repo)
+            put("remote", remote)
+        }).mapCatching { json.decodeFromJsonElement<GitMutationResult>(it) }
+
+    suspend fun pull(repo: String, remote: String = "origin", branch: String = ""): Result<GitMutationResult> =
+        scoped.post("git/pull", buildJsonObject {
+            put("repo", repo)
+            put("remote", remote)
+            put("branch", branch)
+        }).mapCatching { json.decodeFromJsonElement<GitMutationResult>(it) }
+
+    suspend fun push(
+        repo: String,
+        confirmation: String,
+        remote: String = "origin",
+        branch: String = "",
+    ): Result<GitMutationResult> = scoped.post("git/push", buildJsonObject {
+        put("repo", repo)
+        put("remote", remote)
+        put("branch", branch)
+        put("confirmation", confirmation)
+    }).mapCatching { json.decodeFromJsonElement<GitMutationResult>(it) }
+
+    suspend fun checkout(
+        repo: String,
+        ref: String,
+        confirmation: String? = null,
+        newBranch: String = "",
+        track: Boolean = false,
+    ): Result<GitMutationResult> = scoped.post("git/checkout", buildJsonObject {
+        put("repo", repo)
+        put("ref", ref)
+        if (confirmation != null) put("confirmation", confirmation)
+        if (newBranch.isNotEmpty()) put("new_branch", newBranch)
+        put("track", track)
+    }).mapCatching { json.decodeFromJsonElement<GitMutationResult>(it) }
+
+    // ── Phase 3 extras ─────────────────────────────────────────────────────
+
+    /** Generate a commit-message suggestion from the staged diff. */
+    suspend fun commitMessage(repo: String): Result<GitCommitMessage> =
+        scoped.post("git/commit_message", buildJsonObject {
+            put("repo", repo)
+        }).mapCatching { json.decodeFromJsonElement<GitCommitMessage>(it) }
+
+    /** Generate a commit-message suggestion from the given paths' staged diff. */
+    suspend fun commitMessageSelected(
+        repo: String,
+        paths: List<String>,
+    ): Result<GitCommitMessage> = scoped.post("git/commit_message_selected", buildJsonObject {
+        put("repo", repo)
+        put("paths", pathsArray(paths))
+    }).mapCatching { json.decodeFromJsonElement<GitCommitMessage>(it) }
+
+    /** Checkout that auto-stashes a dirty tree first. */
+    suspend fun stashCheckout(
+        repo: String,
+        ref: String,
+        newBranch: String = "",
+        track: Boolean = false,
+    ): Result<GitStashCheckoutResult> = scoped.post("git/stash_checkout", buildJsonObject {
+        put("repo", repo)
+        put("ref", ref)
+        if (newBranch.isNotEmpty()) put("new_branch", newBranch)
+        put("track", track)
+    }).mapCatching { json.decodeFromJsonElement<GitStashCheckoutResult>(it) }
+}
@@ -0,0 +1,107 @@
+package com.hermesandroid.relay.data
+
+import kotlinx.serialization.SerialName
+import kotlinx.serialization.Serializable
+
+/** A repository discovered by the plugin's /git/repos endpoint. */
+@Serializable
+data class GitRepo(
+    val id: String,
+    val name: String,
+    val root: String,
+    @SerialName("current_branch") val currentBranch: String? = null,
+    val dirty: Boolean = false,
+)
+
+/** Working-tree status from /git/status. */
+@Serializable
+data class GitStatus(
+    val counts: GitStatusCounts = GitStatusCounts(),
+    val staged: List<GitStatusEntry> = emptyList(),
+    val modified: List<GitStatusEntry> = emptyList(),
+    val untracked: List<GitStatusEntry> = emptyList(),
+    val truncated: Boolean = false,
+)
+
+@Serializable
+data class GitStatusCounts(
+    val staged: Int = 0,
+    val modified: Int = 0,
+    val untracked: Int = 0,
+    /** Unique changed paths. -1 means an older plugin did not provide it. */
+    val changes: Int = -1,
+    val additions: Int = 0,
+    val deletions: Int = 0,
+)
+
+@Serializable
+data class GitStatusEntry(
+    val path: String,
+    val additions: Int? = null,
+    val deletions: Int? = null,
+)
+
+/** A branch from /git/branches. */
+@Serializable
+data class GitBranch(
+    val name: String,
+    val upstream: String? = null,
+    val ahead: Int = 0,
+    val behind: Int = 0,
+    @SerialName("is_current") val isCurrent: Boolean = false,
+)
+
+/** A per-file diff from /git/diff. */
+@Serializable
+data class GitDiff(
+    val path: String,
+    val kind: String,
+    val diff: String,
+    val truncated: Boolean = false,
+)
+
+/** A tracked-file read from /git/file. */
+@Serializable
+data class GitFile(
+    val path: String,
+    val content: String,
+    val truncated: Boolean = false,
+)
+
+/** Wrapper for /git/repos response. */
+@Serializable
+internal data class ReposResponse(
+    val repos: List<GitRepo> = emptyList(),
+    val notice: String? = null,
+)
+
+/** Wrapper for /git/branches response. */
+@Serializable
+internal data class BranchesResponse(
+    val branches: List<GitBranch> = emptyList(),
+)
+
+/** A mutation response: fresh HEAD oid + working-tree status (+ branches). */
+@Serializable
+data class GitMutationResult(
+    val head: String = "",
+    val status: GitStatus = GitStatus(),
+    val branches: List<GitBranch> = emptyList(),
+)
+
+/** A /git/commit_message suggestion: generated message + optional notice. */
+@Serializable
+data class GitCommitMessage(
+    val message: String = "",
+    val notice: String = "",
+)
+
+/** A /git/stash_checkout result: standard mutation shape + stash flag/message. */
+@Serializable
+data class GitStashCheckoutResult(
+    val head: String = "",
+    val status: GitStatus = GitStatus(),
+    val branches: List<GitBranch> = emptyList(),
+    val stashed: Boolean = false,
+    @SerialName("stash_message") val stashMessage: String = "",
+)
@@ -38,6 +38,8 @@ data class ProactiveInboxEntry(
    val connectionId: String? = null,
    /** Relay proved this row came from its bounded offline queue. */
    val arrivedWhileAway: Boolean = false,
+    /** Exact Android notification slot, when recorded by the receiving build. */
+    val notificationId: Int? = null,
 )

 private val Context.proactiveInboxStore: DataStore<Preferences> by
@@ -58,15 +60,19 @@ private const val MAX_ENTRIES = 100
 * bounded store also backs the provisional Thread until the user's first reply
 * promotes it to a real `source=phone` session.
 */
-class ProactiveInboxRepository(private val context: Context) {
+class ProactiveInboxRepository internal constructor(
+    private val store: DataStore<Preferences>,
+) {
+
+    constructor(context: Context) : this(context.proactiveInboxStore)

    private val json = Json { ignoreUnknownKeys = true }

    val entries: Flow<List<ProactiveInboxEntry>> =
-        context.proactiveInboxStore.data.map { prefs -> decode(prefs[INBOX_JSON]) }
+        store.data.map { prefs -> decode(prefs[INBOX_JSON]) }

    suspend fun add(entry: ProactiveInboxEntry) {
-        context.proactiveInboxStore.edit { prefs ->
+        store.edit { prefs ->
            val current = decode(prefs[INBOX_JSON]).toMutableList()
            current.removeAll { it.id == entry.id }
            current.add(0, entry)
@@ -76,7 +82,40 @@ class ProactiveInboxRepository(private val context: Context) {
    }

    suspend fun clear() {
-        context.proactiveInboxStore.edit { it.remove(INBOX_JSON) }
+        store.edit { it.remove(INBOX_JSON) }
+    }
+
+    /**
+     * Remove one provisional Thread owned by one saved connection.
+     *
+     * This only edits the bounded local inbox. A promoted Thread is server
+     * history and is deliberately outside this repository, so this operation
+     * can never delete it. Legacy entries without a connection owner are
+     * removed with the active row because they are rendered in that row; rows
+     * explicitly owned by another connection remain isolated.
+     */
+    suspend fun removeThread(
+        chatId: String,
+        connectionId: String,
+    ): List<ProactiveInboxEntry> {
+        val normalizedChatId = chatId.ifBlank { "phone" }
+        var removed = emptyList<ProactiveInboxEntry>()
+        store.edit { prefs ->
+            val current = decode(prefs[INBOX_JSON])
+            removed = current.filter {
+                (it.connectionId == null || it.connectionId == connectionId) &&
+                    (it.chatId ?: "phone") == normalizedChatId
+            }
+            if (removed.isNotEmpty()) {
+                val retained = current.filterNot { it in removed }
+                if (retained.isEmpty()) {
+                    prefs.remove(INBOX_JSON)
+                } else {
+                    prefs[INBOX_JSON] = json.encodeToString(retained)
+                }
+            }
+        }
+        return removed
    }

    private fun decode(raw: String?): List<ProactiveInboxEntry> {
@@ -0,0 +1,63 @@
+package com.hermesandroid.relay.data
+
+import android.content.Context
+import androidx.datastore.core.DataStore
+import androidx.datastore.preferences.core.Preferences
+import androidx.datastore.preferences.core.edit
+import androidx.datastore.preferences.core.stringPreferencesKey
+import androidx.datastore.preferences.core.stringSetPreferencesKey
+import kotlinx.coroutines.flow.Flow
+import kotlinx.coroutines.flow.distinctUntilChanged
+import kotlinx.coroutines.flow.map
+
+enum class ProviderUsageLandingMode(val storedValue: String) {
+    Summary("summary"),
+    Expanded("expanded"),
+    Hidden("hidden"),
+    ;
+
+    companion object {
+        fun fromStoredValue(value: String?): ProviderUsageLandingMode =
+            entries.firstOrNull { it.storedValue == value } ?: Summary
+    }
+}
+
+data class ProviderUsagePreferences(
+    val landingMode: ProviderUsageLandingMode = ProviderUsageLandingMode.Summary,
+    val visibleProviders: Set<String> = DEFAULT_VISIBLE_PROVIDERS,
+) {
+    companion object {
+        val DEFAULT_VISIBLE_PROVIDERS = setOf("openai-codex", "nous", "opencode-go")
+    }
+}
+
+class ProviderUsagePreferencesRepository(private val dataStore: DataStore<Preferences>) {
+    constructor(context: Context) : this(context.relayDataStore)
+
+    companion object {
+        internal val KEY_LANDING_MODE = stringPreferencesKey("provider_usage_landing_mode")
+        internal val KEY_VISIBLE_PROVIDERS = stringSetPreferencesKey("provider_usage_visible_providers")
+    }
+
+    val preferences: Flow<ProviderUsagePreferences> = dataStore.data
+        .map { prefs ->
+            ProviderUsagePreferences(
+                landingMode = ProviderUsageLandingMode.fromStoredValue(prefs[KEY_LANDING_MODE]),
+                visibleProviders = prefs[KEY_VISIBLE_PROVIDERS]
+                    ?: ProviderUsagePreferences.DEFAULT_VISIBLE_PROVIDERS,
+            )
+        }
+        .distinctUntilChanged()
+
+    suspend fun setLandingMode(mode: ProviderUsageLandingMode) {
+        dataStore.edit { it[KEY_LANDING_MODE] = mode.storedValue }
+    }
+
+    suspend fun setProviderVisible(providerId: String, visible: Boolean) {
+        dataStore.edit { prefs ->
+            val current = prefs[KEY_VISIBLE_PROVIDERS]
+                ?: ProviderUsagePreferences.DEFAULT_VISIBLE_PROVIDERS
+            prefs[KEY_VISIBLE_PROVIDERS] = if (visible) current + providerId else current - providerId
+        }
+    }
+}
@@ -11,6 +11,29 @@ data class RelayEndpoints(
    val healthUrl: String,
 )

+/** Dashboard plugin namespace used when Relay rides the Dashboard origin. */
+const val DASHBOARD_RELAY_INGRESS_PATH: String =
+    "/api/plugins/hermes-relay/transport"
+
+/**
+ * True when [raw] points at the Dashboard-mounted Relay transport rather than
+ * a directly exposed Relay listener. The distinction is authentication
+ * relevant: the outer Dashboard request keeps its cookie/bearer credential,
+ * while Relay's independently scoped session travels in
+ * `X-Hermes-Relay-Session`.
+ */
+fun isDashboardRelayIngressUrl(raw: String?): Boolean {
+    val endpoints = RelayEndpointContract.parseOrNull(raw) ?: return false
+    val path = runCatching { URI(endpoints.httpBaseUrl).rawPath.orEmpty() }
+        .getOrDefault("")
+        .trimEnd('/')
+    val marker = path.indexOf(DASHBOARD_RELAY_INGRESS_PATH)
+    if (marker < 0) return false
+    val markerEndsAt = marker + DASHBOARD_RELAY_INGRESS_PATH.length
+    val suffixBoundary = markerEndsAt == path.length || path[markerEndsAt] == '/'
+    return suffixBoundary
+}
+
 /**
 * Parses the accepted Relay URL forms and derives every route from one base.
 *
@@ -0,0 +1,552 @@
+package com.hermesandroid.relay.data
+
+import java.util.Locale
+
+/** Stable ownership boundary for live activity. Runtime ids are aliases, never owners. */
+@ConsistentCopyVisibility
+data class SessionActivityOwner private constructor(
+    val connectionId: String,
+    val profile: String,
+    val storedSessionId: String,
+) {
+    companion object {
+        fun of(connectionId: String, profile: String, storedSessionId: String) =
+            SessionActivityOwner(
+                connectionId = connectionId.trim(),
+                profile = profile.trim().lowercase(Locale.ROOT),
+                storedSessionId = storedSessionId.trim(),
+            ).also {
+                require(it.connectionId.isNotEmpty()) { "connectionId must not be blank" }
+                require(it.profile.isNotEmpty()) { "profile must not be blank" }
+                require(it.storedSessionId.isNotEmpty()) { "storedSessionId must not be blank" }
+            }
+    }
+}
+
+@ConsistentCopyVisibility
+data class SessionActivityScope private constructor(
+    val connectionId: String,
+    val profile: String,
+) {
+    companion object {
+        fun of(connectionId: String, profile: String) = SessionActivityScope(
+            connectionId = connectionId.trim(),
+            profile = profile.trim().lowercase(Locale.ROOT),
+        ).also {
+            require(it.connectionId.isNotEmpty()) { "connectionId must not be blank" }
+            require(it.profile.isNotEmpty()) { "profile must not be blank" }
+        }
+    }
+}
+
+enum class SessionActivityPhase {
+    Starting,
+    Working,
+    NeedsInput,
+    BackgroundWork,
+    Idle,
+}
+
+enum class SessionActivityFreshness {
+    Confirmed,
+    Revalidating,
+    Unavailable,
+}
+
+enum class SessionActivityEvidenceSource {
+    Directory,
+    LocalSend,
+    ActiveList,
+    SessionEvent,
+    PendingInput,
+    Terminal,
+    Checkpoint,
+    Process,
+}
+
+data class SessionActivityEvidence(
+    val source: SessionActivityEvidenceSource,
+    val generation: Long,
+    val observedAtMillis: Long,
+)
+
+data class SessionActivityRecord(
+    val owner: SessionActivityOwner,
+    /** Authoritative turn state before exact pending-input and background-process overlays. */
+    val turnPhase: SessionActivityPhase,
+    val freshness: SessionActivityFreshness,
+    val evidence: SessionActivityEvidence,
+    val runtimeId: String? = null,
+    val pendingInputs: Map<String, Long?> = emptyMap(),
+    val backgroundProcessIds: Set<String> = emptySet(),
+) {
+    fun phase(nowMillis: Long = Long.MIN_VALUE): SessionActivityPhase {
+        val hasPendingInput = pendingInputs.any { (_, expiresAt) -> expiresAt == null || expiresAt > nowMillis }
+        return when {
+            hasPendingInput -> SessionActivityPhase.NeedsInput
+            turnPhase != SessionActivityPhase.Idle -> turnPhase
+            backgroundProcessIds.isNotEmpty() -> SessionActivityPhase.BackgroundWork
+            else -> SessionActivityPhase.Idle
+        }
+    }
+
+    /** Presentation projection that never labels missing optional runtime data as session state. */
+    fun presentationState(nowMillis: Long = Long.MIN_VALUE): SessionActivityState? = when (freshness) {
+        SessionActivityFreshness.Revalidating -> null
+        SessionActivityFreshness.Unavailable -> null
+        SessionActivityFreshness.Confirmed -> when (phase(nowMillis)) {
+            SessionActivityPhase.Starting -> SessionActivityState.Starting
+            SessionActivityPhase.Working -> SessionActivityState.Working
+            SessionActivityPhase.NeedsInput -> SessionActivityState.NeedsInput
+            SessionActivityPhase.BackgroundWork -> SessionActivityState.BackgroundWork
+            SessionActivityPhase.Idle -> null
+        }
+    }
+}
+
+enum class SessionLiveStatus {
+    Starting,
+    Working,
+    Waiting,
+    Idle,
+}
+
+data class SessionLiveRuntime(
+    /** Null when transport data cannot be resolved uniquely to a stored session owner. */
+    val owner: SessionActivityOwner?,
+    val runtimeId: String,
+    val status: SessionLiveStatus,
+)
+
+sealed interface SessionActivityUpdate {
+    val generation: Long
+    val observedAtMillis: Long
+
+    data class BeginGeneration(
+        val scope: SessionActivityScope,
+        override val generation: Long,
+        override val observedAtMillis: Long,
+    ) : SessionActivityUpdate
+
+    data class ObserveOwner(
+        val owner: SessionActivityOwner,
+        override val generation: Long,
+        override val observedAtMillis: Long,
+    ) : SessionActivityUpdate
+
+    data class LocalSend(
+        val owner: SessionActivityOwner,
+        override val generation: Long,
+        override val observedAtMillis: Long,
+    ) : SessionActivityUpdate
+
+    data class LiveState(
+        val owner: SessionActivityOwner,
+        val runtimeId: String?,
+        val status: SessionLiveStatus,
+        val source: SessionActivityEvidenceSource = SessionActivityEvidenceSource.SessionEvent,
+        override val generation: Long,
+        override val observedAtMillis: Long,
+    ) : SessionActivityUpdate
+
+    data class RuntimeState(
+        val scope: SessionActivityScope,
+        val runtimeId: String,
+        val status: SessionLiveStatus,
+        override val generation: Long,
+        override val observedAtMillis: Long,
+    ) : SessionActivityUpdate
+
+    data class ActiveList(
+        val scope: SessionActivityScope,
+        val runtimes: List<SessionLiveRuntime>,
+        /** True only when every upstream row was safely attributable for this scope. */
+        val isCompleteForScope: Boolean,
+        override val generation: Long,
+        override val observedAtMillis: Long,
+    ) : SessionActivityUpdate
+
+    data class StatusUnavailable(
+        val scope: SessionActivityScope,
+        override val generation: Long,
+        override val observedAtMillis: Long,
+    ) : SessionActivityUpdate
+
+    data class Terminal(
+        val owner: SessionActivityOwner,
+        val runtimeId: String? = null,
+        override val generation: Long,
+        override val observedAtMillis: Long,
+    ) : SessionActivityUpdate
+
+    data class RestoreCheckpoint(
+        val owner: SessionActivityOwner,
+        val runtimeId: String?,
+        val phase: SessionActivityPhase,
+        override val generation: Long,
+        override val observedAtMillis: Long,
+    ) : SessionActivityUpdate
+
+    data class PendingInputOpened(
+        val owner: SessionActivityOwner,
+        val requestId: String,
+        val expiresAtMillis: Long? = null,
+        val confirmed: Boolean = true,
+        override val generation: Long,
+        override val observedAtMillis: Long,
+    ) : SessionActivityUpdate
+
+    data class PendingInputClosed(
+        val owner: SessionActivityOwner,
+        val requestId: String,
+        val confirmed: Boolean = true,
+        override val generation: Long,
+        override val observedAtMillis: Long,
+    ) : SessionActivityUpdate
+
+    data class ProcessState(
+        val owner: SessionActivityOwner,
+        val processId: String,
+        val running: Boolean,
+        override val generation: Long,
+        override val observedAtMillis: Long,
+    ) : SessionActivityUpdate
+
+    data class Tick(
+        val nowMillis: Long,
+        override val generation: Long = Long.MAX_VALUE,
+        override val observedAtMillis: Long = nowMillis,
+    ) : SessionActivityUpdate
+}
+
+/**
+ * Pure reducer for session activity. Every update is generation-gated per connection/profile.
+ * An unsuccessful/unsupported refresh never manufactures an idle result.
+ */
+data class SessionActivityRegistry(
+    val records: Map<SessionActivityOwner, SessionActivityRecord> = emptyMap(),
+    private val runtimeAliases: Map<RuntimeAlias, SessionActivityOwner> = emptyMap(),
+    private val generations: Map<SessionActivityScope, Long> = emptyMap(),
+) {
+    fun record(owner: SessionActivityOwner): SessionActivityRecord? = records[owner]
+
+    fun ownerForRuntime(scope: SessionActivityScope, runtimeId: String): SessionActivityOwner? =
+        runtimeAliases[RuntimeAlias(scope, runtimeId.trim(), generations[scope] ?: return null)]
+
+    fun presentationStates(nowMillis: Long = Long.MIN_VALUE): Map<SessionActivityOwner, SessionActivityState> =
+        records.mapNotNull { (owner, record) -> record.presentationState(nowMillis)?.let { owner to it } }.toMap()
+
+    fun reduce(update: SessionActivityUpdate): SessionActivityRegistry {
+        if (update is SessionActivityUpdate.Tick) return expirePendingInputs(update.nowMillis)
+        val scope = update.scope()
+        val currentGeneration = generations[scope]
+        if (currentGeneration != null && update.generation < currentGeneration) return this
+
+        var state = this
+        if (currentGeneration == null || update.generation > currentGeneration) {
+            state = state.beginGeneration(scope, update.generation)
+        }
+
+        return when (update) {
+            is SessionActivityUpdate.BeginGeneration -> state
+            is SessionActivityUpdate.ObserveOwner -> state.observeOwner(update)
+            is SessionActivityUpdate.LocalSend -> state.putTurn(
+                update.owner, null, SessionActivityPhase.Starting, SessionActivityFreshness.Confirmed,
+                SessionActivityEvidenceSource.LocalSend, update.generation, update.observedAtMillis,
+            )
+            is SessionActivityUpdate.LiveState -> state.putLiveState(update)
+            is SessionActivityUpdate.RuntimeState -> {
+                val owner = state.ownerForRuntime(update.scope, update.runtimeId) ?: return state
+                state.putTurn(
+                    owner, update.runtimeId, update.status.phase(), SessionActivityFreshness.Confirmed,
+                    SessionActivityEvidenceSource.SessionEvent, update.generation, update.observedAtMillis,
+                )
+            }
+            is SessionActivityUpdate.ActiveList -> state.applyActiveList(update)
+            is SessionActivityUpdate.StatusUnavailable -> state.markUnavailable(update.scope)
+            is SessionActivityUpdate.Terminal -> state.settleTerminal(update)
+            is SessionActivityUpdate.RestoreCheckpoint -> state.restoreCheckpoint(update)
+            is SessionActivityUpdate.PendingInputOpened -> state.updatePendingInput(
+                update.owner, update.requestId, update.expiresAtMillis, true,
+                update.confirmed, update.generation, update.observedAtMillis,
+            )
+            is SessionActivityUpdate.PendingInputClosed -> state.updatePendingInput(
+                update.owner, update.requestId, null, false,
+                update.confirmed, update.generation, update.observedAtMillis,
+            )
+            is SessionActivityUpdate.ProcessState -> state.updateProcess(update)
+            is SessionActivityUpdate.Tick -> state
+        }
+    }
+
+    private fun beginGeneration(scope: SessionActivityScope, generation: Long): SessionActivityRegistry {
+        val refreshedRecords = records.mapValues { (owner, record) ->
+            if (owner.scope() == scope) {
+                record.copy(freshness = SessionActivityFreshness.Revalidating)
+            } else record
+        }
+        return copy(
+            records = refreshedRecords,
+            runtimeAliases = runtimeAliases.filterKeys { it.scope != scope },
+            generations = generations + (scope to generation),
+        )
+    }
+
+    private fun observeOwner(update: SessionActivityUpdate.ObserveOwner): SessionActivityRegistry {
+        val existing = records[update.owner]
+        // Directory rows establish ownership only. They are not live evidence and must not
+        // turn an unsupported/failed active-list probe back into a permanent Checking row.
+        if (existing != null) return this
+        val observed = SessionActivityRecord(
+            owner = update.owner,
+            turnPhase = SessionActivityPhase.Idle,
+            freshness = SessionActivityFreshness.Revalidating,
+            evidence = SessionActivityEvidence(
+                SessionActivityEvidenceSource.Directory,
+                update.generation,
+                update.observedAtMillis,
+            ),
+        )
+        return copy(records = records + (update.owner to observed))
+    }
+
+    private fun putLiveState(update: SessionActivityUpdate.LiveState): SessionActivityRegistry = putTurn(
+        owner = update.owner,
+        runtimeId = update.runtimeId,
+        phase = update.status.phase(),
+        freshness = SessionActivityFreshness.Confirmed,
+        source = update.source,
+        generation = update.generation,
+        observedAtMillis = update.observedAtMillis,
+    )
+
+    private fun putTurn(
+        owner: SessionActivityOwner,
+        runtimeId: String?,
+        phase: SessionActivityPhase,
+        freshness: SessionActivityFreshness,
+        source: SessionActivityEvidenceSource,
+        generation: Long,
+        observedAtMillis: Long,
+    ): SessionActivityRegistry {
+        val previous = records[owner]
+        val record = SessionActivityRecord(
+            owner = owner,
+            turnPhase = phase,
+            freshness = freshness,
+            evidence = SessionActivityEvidence(source, generation, observedAtMillis),
+            runtimeId = runtimeId ?: previous?.runtimeId,
+            pendingInputs = previous?.pendingInputs.orEmpty(),
+            backgroundProcessIds = previous?.backgroundProcessIds.orEmpty(),
+        )
+        val alias = runtimeId?.trim()?.takeIf { it.isNotEmpty() }
+        return copy(
+            records = records + (owner to record),
+            runtimeAliases = if (alias == null) runtimeAliases else {
+                runtimeAliases + (RuntimeAlias(owner.scope(), alias, generation) to owner)
+            },
+        )
+    }
+
+    private fun applyActiveList(update: SessionActivityUpdate.ActiveList): SessionActivityRegistry {
+        require(update.runtimes.all { it.owner == null || it.owner.scope() == update.scope }) {
+            "Active-list rows must belong to the snapshot scope"
+        }
+        var state = copy(runtimeAliases = runtimeAliases.filterKeys { it.scope != update.scope })
+        val resolvedRuntimes = update.runtimes.filter { it.owner != null }
+        val observedOwners = resolvedRuntimes.mapTo(mutableSetOf()) { requireNotNull(it.owner) }
+        resolvedRuntimes.forEach { runtime ->
+            val resolvedOwner = requireNotNull(runtime.owner)
+            state = state.putTurn(
+                resolvedOwner, runtime.runtimeId, runtime.status.phase(), SessionActivityFreshness.Confirmed,
+                SessionActivityEvidenceSource.ActiveList, update.generation, update.observedAtMillis,
+            )
+            if (runtime.status == SessionLiveStatus.Idle) {
+                val idleRecord = requireNotNull(state.records[resolvedOwner]).copy(pendingInputs = emptyMap())
+                state = state.copy(records = state.records + (resolvedOwner to idleRecord))
+            }
+        }
+        val snapshotCanSettle = update.isCompleteForScope && resolvedRuntimes.size == update.runtimes.size
+        if (!snapshotCanSettle) return state
+        val settled = state.records.mapValues { (owner, record) ->
+            if (
+                owner.scope() == update.scope && owner !in observedOwners &&
+                record.shouldSettleWhenAbsent()
+            ) {
+                record.copy(
+                    turnPhase = SessionActivityPhase.Idle,
+                    freshness = SessionActivityFreshness.Confirmed,
+                    runtimeId = null,
+                    pendingInputs = emptyMap(),
+                    evidence = SessionActivityEvidence(
+                        SessionActivityEvidenceSource.ActiveList,
+                        update.generation,
+                        update.observedAtMillis,
+                    ),
+                )
+            } else record
+        }
+        return state.copy(records = settled)
+    }
+
+    private fun markUnavailable(scope: SessionActivityScope): SessionActivityRegistry = copy(
+        records = records.mapValues { (owner, record) ->
+            if (
+                owner.scope() == scope && record.evidence.source in setOf(
+                    SessionActivityEvidenceSource.ActiveList,
+                    SessionActivityEvidenceSource.Directory,
+                    SessionActivityEvidenceSource.Checkpoint,
+                )
+            ) {
+                record.copy(freshness = SessionActivityFreshness.Unavailable)
+            } else record
+        },
+    )
+
+    private fun settleTerminal(update: SessionActivityUpdate.Terminal): SessionActivityRegistry {
+        val settled = putTurn(
+            update.owner,
+            runtimeId = null,
+            phase = SessionActivityPhase.Idle,
+            freshness = SessionActivityFreshness.Confirmed,
+            source = SessionActivityEvidenceSource.Terminal,
+            generation = update.generation,
+            observedAtMillis = update.observedAtMillis,
+        )
+        val record = requireNotNull(settled.records[update.owner]).copy(
+            runtimeId = null,
+            pendingInputs = emptyMap(),
+        )
+        return settled.copy(
+            records = settled.records + (update.owner to record),
+            runtimeAliases = settled.runtimeAliases.filterNot { (alias, owner) ->
+                alias.scope == update.owner.scope() && owner == update.owner &&
+                    (update.runtimeId == null || alias.runtimeId == update.runtimeId)
+            },
+        )
+    }
+
+    private fun restoreCheckpoint(update: SessionActivityUpdate.RestoreCheckpoint): SessionActivityRegistry {
+        val existing = records[update.owner]
+        if (existing?.freshness == SessionActivityFreshness.Confirmed) return this
+        return putTurn(
+            update.owner, update.runtimeId, update.phase, SessionActivityFreshness.Revalidating,
+            SessionActivityEvidenceSource.Checkpoint, update.generation, update.observedAtMillis,
+        )
+    }
+
+    private fun updatePendingInput(
+        owner: SessionActivityOwner,
+        requestId: String,
+        expiresAtMillis: Long?,
+        opened: Boolean,
+        confirmed: Boolean,
+        generation: Long,
+        observedAtMillis: Long,
+    ): SessionActivityRegistry {
+        val previous = records[owner] ?: SessionActivityRecord(
+            owner = owner,
+            turnPhase = SessionActivityPhase.Idle,
+            freshness = if (confirmed) {
+                SessionActivityFreshness.Confirmed
+            } else {
+                SessionActivityFreshness.Revalidating
+            },
+            evidence = SessionActivityEvidence(
+                if (confirmed) {
+                    SessionActivityEvidenceSource.PendingInput
+                } else {
+                    SessionActivityEvidenceSource.Checkpoint
+                },
+                generation,
+                observedAtMillis,
+            ),
+        )
+        val pending = if (opened) {
+            previous.pendingInputs + (requestId to expiresAtMillis)
+        } else {
+            previous.pendingInputs - requestId
+        }
+        return copy(records = records + (owner to previous.copy(
+            pendingInputs = pending,
+            freshness = if (confirmed) SessionActivityFreshness.Confirmed else previous.freshness,
+            evidence = if (confirmed) {
+                SessionActivityEvidence(
+                    SessionActivityEvidenceSource.PendingInput,
+                    generation,
+                    observedAtMillis,
+                )
+            } else previous.evidence,
+        )))
+    }
+
+    private fun updateProcess(update: SessionActivityUpdate.ProcessState): SessionActivityRegistry {
+        val previous = records[update.owner] ?: SessionActivityRecord(
+            owner = update.owner,
+            turnPhase = SessionActivityPhase.Idle,
+            freshness = SessionActivityFreshness.Confirmed,
+            evidence = SessionActivityEvidence(
+                SessionActivityEvidenceSource.Process,
+                update.generation,
+                update.observedAtMillis,
+            ),
+        )
+        val processes = if (update.running) {
+            previous.backgroundProcessIds + update.processId
+        } else {
+            previous.backgroundProcessIds - update.processId
+        }
+        return copy(records = records + (update.owner to previous.copy(
+            backgroundProcessIds = processes,
+            evidence = SessionActivityEvidence(
+                SessionActivityEvidenceSource.Process,
+                update.generation,
+                update.observedAtMillis,
+            ),
+        )))
+    }
+
+    private fun expirePendingInputs(nowMillis: Long): SessionActivityRegistry = copy(
+        records = records.mapValues { (_, record) ->
+            record.copy(pendingInputs = record.pendingInputs.filterValues { it == null || it > nowMillis })
+        },
+    )
+
+    private fun SessionActivityRecord.shouldSettleWhenAbsent(): Boolean =
+        runtimeId != null || evidence.source in setOf(
+            SessionActivityEvidenceSource.ActiveList,
+            SessionActivityEvidenceSource.Checkpoint,
+            SessionActivityEvidenceSource.Directory,
+        )
+
+    private fun SessionActivityUpdate.scope(): SessionActivityScope = when (this) {
+        is SessionActivityUpdate.BeginGeneration -> scope
+        is SessionActivityUpdate.ObserveOwner -> owner.scope()
+        is SessionActivityUpdate.RuntimeState -> scope
+        is SessionActivityUpdate.ActiveList -> scope
+        is SessionActivityUpdate.StatusUnavailable -> scope
+        is SessionActivityUpdate.Terminal -> owner.scope()
+        is SessionActivityUpdate.LocalSend -> owner.scope()
+        is SessionActivityUpdate.LiveState -> owner.scope()
+        is SessionActivityUpdate.RestoreCheckpoint -> owner.scope()
+        is SessionActivityUpdate.PendingInputOpened -> owner.scope()
+        is SessionActivityUpdate.PendingInputClosed -> owner.scope()
+        is SessionActivityUpdate.ProcessState -> owner.scope()
+        is SessionActivityUpdate.Tick -> error("Tick has no scope")
+    }
+
+    private fun SessionActivityOwner.scope() = SessionActivityScope.of(connectionId, profile)
+
+    private fun SessionLiveStatus.phase(): SessionActivityPhase = when (this) {
+        SessionLiveStatus.Starting -> SessionActivityPhase.Starting
+        SessionLiveStatus.Working -> SessionActivityPhase.Working
+        SessionLiveStatus.Waiting -> SessionActivityPhase.NeedsInput
+        SessionLiveStatus.Idle -> SessionActivityPhase.Idle
+    }
+
+    data class RuntimeAlias(
+        val scope: SessionActivityScope,
+        val runtimeId: String,
+        val generation: Long,
+    )
+}
@@ -2,6 +2,10 @@ package com.hermesandroid.relay.data

 /** Live activity surfaced beside a session without conflating it with selection. */
 enum class SessionActivityState {
+    Starting,
    Working,
    NeedsInput,
+    BackgroundWork,
+    Checking,
+    Unavailable,
 }
@@ -0,0 +1,234 @@
+package com.hermesandroid.relay.data
+
+import kotlinx.serialization.SerialName
+import kotlinx.serialization.Serializable
+import com.hermesandroid.relay.ui.theme.AppThemes
+
+/**
+ * Parent-configured restrictions for the official Android client.
+ *
+ * This policy deliberately describes a client presentation mode, not a server
+ * authorization boundary. The pinned profile is expected to have already been
+ * configured with the appropriate server-side tool and content restrictions.
+ */
+@Serializable
+data class SupervisedModePolicy(
+    val enabled: Boolean = false,
+    val pinnedProfileName: String? = null,
+    val capabilities: SupervisedCapabilities = SupervisedCapabilities(),
+    val appearance: SupervisedAppearance = SupervisedAppearance(),
+    val visibility: SupervisedVisibility = SupervisedVisibility(),
+    val parentAccess: SupervisedParentAccess = SupervisedParentAccess(),
+) {
+    /** A saved policy is usable only when it names a concrete Hermes profile. */
+    val isConfigured: Boolean
+        get() = !pinnedProfileName.isNullOrBlank()
+
+    /** Consumers should use this instead of treating [enabled] alone as sufficient. */
+    val isActive: Boolean
+        get() = enabled && isConfigured
+
+    internal fun normalized(): SupervisedModePolicy = copy(
+        pinnedProfileName = pinnedProfileName?.trim()?.takeIf { it.isNotEmpty() },
+        capabilities = capabilities.normalized(),
+        appearance = appearance.normalized(),
+        parentAccess = parentAccess.normalized(),
+    )
+}
+
+/** Actions and content types the supervised chat surface may expose. */
+@Serializable
+data class SupervisedCapabilities(
+    val attachments: Boolean = false,
+    val voice: Boolean = false,
+    val generatedImages: Boolean = true,
+    val conversationHistory: Boolean = false,
+    val newChat: Boolean = true,
+    val cancelResponse: Boolean = true,
+    val steerResponse: Boolean = true,
+    val retryResponse: Boolean = true,
+    val copyResponses: Boolean = true,
+    val quoteReplies: Boolean = true,
+    val editAndResend: Boolean = false,
+    val shareGeneratedImages: Boolean = false,
+    val sessionActions: SupervisedSessionActions = SupervisedSessionActions(),
+    val attachmentMaxCount: Int = DEFAULT_ATTACHMENT_MAX_COUNT,
+    val attachmentMaxFileMb: Int = DEFAULT_ATTACHMENT_MAX_FILE_MB,
+    val attachmentCategories: Set<SupervisedAttachmentCategory> = setOf(
+        SupervisedAttachmentCategory.Images,
+    ),
+) {
+    internal fun normalized(): SupervisedCapabilities = copy(
+        attachmentMaxCount = attachmentMaxCount.coerceIn(1, MAX_ATTACHMENT_COUNT),
+        attachmentMaxFileMb = attachmentMaxFileMb.coerceIn(1, MAX_ATTACHMENT_FILE_MB),
+        attachmentCategories = attachmentCategories.ifEmpty {
+            setOf(SupervisedAttachmentCategory.Images)
+        },
+    )
+
+    companion object {
+        const val DEFAULT_ATTACHMENT_MAX_COUNT = 4
+        const val DEFAULT_ATTACHMENT_MAX_FILE_MB = 10
+        const val MAX_ATTACHMENT_COUNT = 10
+        const val MAX_ATTACHMENT_FILE_MB = 100
+    }
+}
+
+/** Appearance applied only while the supervised root is locked. */
+@Serializable
+data class SupervisedAppearance(
+    val appThemeId: String = AppThemes.DEFAULT_ID,
+    val themePreference: String = "auto",
+    val showPet: Boolean = false,
+    val allowProfileIconChanges: Boolean = false,
+    val allowBackgroundChanges: Boolean = false,
+) {
+    internal fun normalized(): SupervisedAppearance = copy(
+        appThemeId = AppThemes.byId(appThemeId).id,
+        themePreference = themePreference.takeIf { it in VALID_THEME_PREFERENCES } ?: "auto",
+    )
+
+    private companion object {
+        val VALID_THEME_PREFERENCES = setOf("auto", "light", "dark")
+    }
+}
+
+/** Mutable operations available from a supervised conversation-history row. */
+@Serializable
+data class SupervisedSessionActions(
+    val pin: Boolean = false,
+    val rename: Boolean = false,
+    val archive: Boolean = false,
+    val delete: Boolean = false,
+    val shareTranscript: Boolean = false,
+) {
+    val enabledCount: Int
+        get() = listOf(pin, rename, archive, delete, shareTranscript).count { it }
+
+    val allEnabled: Boolean
+        get() = enabledCount == TOTAL
+
+    val noneEnabled: Boolean
+        get() = enabledCount == 0
+
+    fun withAll(enabled: Boolean): SupervisedSessionActions = SupervisedSessionActions(
+        pin = enabled,
+        rename = enabled,
+        archive = enabled,
+        delete = enabled,
+        shareTranscript = enabled,
+    )
+
+    companion object {
+        const val TOTAL = 5
+    }
+}
+
+enum class SupervisedSessionAction {
+    Pin,
+    Rename,
+    Archive,
+    Delete,
+    ShareTranscript,
+}
+
+fun SupervisedModePolicy.allowsSessionAction(action: SupervisedSessionAction): Boolean {
+    if (!enabled) return true
+    if (!capabilities.conversationHistory) return false
+    return when (action) {
+        SupervisedSessionAction.Pin -> capabilities.sessionActions.pin
+        SupervisedSessionAction.Rename -> capabilities.sessionActions.rename
+        SupervisedSessionAction.Archive -> capabilities.sessionActions.archive
+        SupervisedSessionAction.Delete -> capabilities.sessionActions.delete
+        SupervisedSessionAction.ShareTranscript -> capabilities.sessionActions.shareTranscript
+    }
+}
+
+@Serializable
+enum class SupervisedAttachmentCategory {
+    @SerialName("images")
+    Images,
+
+    @SerialName("documents")
+    Documents,
+
+    @SerialName("audio")
+    Audio,
+
+    @SerialName("video")
+    Video,
+}
+
+/**
+ * Controls which metadata and conversation affordances are rendered.
+ *
+ * [Simple] is the quiet default. [Transparent] is a useful preset for older or
+ * technical users, while [Custom] tells the UI to honor every stored toggle.
+ */
+@Serializable
+data class SupervisedVisibility(
+    val preset: SupervisedVisibilityPreset = SupervisedVisibilityPreset.Simple,
+    val showAgentIdentity: Boolean = true,
+    val showModelName: Boolean = false,
+    val showProfileName: Boolean = false,
+    val showConnectionStatus: Boolean = true,
+    val showTechnicalRoute: Boolean = false,
+    val showTimestamps: Boolean = true,
+    val showToolNames: Boolean = false,
+    val showToolDetails: Boolean = false,
+    val showWorkingStatus: Boolean = true,
+    val showReasoning: Boolean = false,
+    val showUsage: Boolean = false,
+) {
+    /** Resolve presets to the concrete flags consumed by chat presentation. */
+    fun resolved(): SupervisedVisibility = when (preset) {
+        SupervisedVisibilityPreset.Simple -> SIMPLE
+        SupervisedVisibilityPreset.Transparent -> TRANSPARENT
+        SupervisedVisibilityPreset.Custom -> this
+    }
+
+    companion object {
+        val SIMPLE = SupervisedVisibility(preset = SupervisedVisibilityPreset.Simple)
+
+        val TRANSPARENT = SupervisedVisibility(
+            preset = SupervisedVisibilityPreset.Transparent,
+            showModelName = true,
+            showProfileName = true,
+            showTechnicalRoute = true,
+            showToolNames = true,
+            showUsage = true,
+        )
+    }
+}
+
+@Serializable
+enum class SupervisedVisibilityPreset {
+    @SerialName("simple")
+    Simple,
+
+    @SerialName("transparent")
+    Transparent,
+
+    @SerialName("custom")
+    Custom,
+}
+
+/** Device-authentication and automatic relock behavior for parent access. */
+@Serializable
+data class SupervisedParentAccess(
+    /** Reserved for forward-compatible persistence; normalization never permits an auth bypass. */
+    val requireDeviceAuthentication: Boolean = true,
+    val relockOnBackground: Boolean = true,
+    val timeoutMinutes: Int = DEFAULT_TIMEOUT_MINUTES,
+) {
+    internal fun normalized(): SupervisedParentAccess = copy(
+        requireDeviceAuthentication = true,
+        timeoutMinutes = timeoutMinutes.coerceIn(MIN_TIMEOUT_MINUTES, MAX_TIMEOUT_MINUTES),
+    )
+
+    companion object {
+        const val DEFAULT_TIMEOUT_MINUTES = 5
+        const val MIN_TIMEOUT_MINUTES = 1
+        const val MAX_TIMEOUT_MINUTES = 60
+    }
+}
@@ -0,0 +1,106 @@
+package com.hermesandroid.relay.data
+
+import android.content.Context
+import android.util.Log
+import androidx.datastore.core.DataStore
+import androidx.datastore.preferences.core.Preferences
+import androidx.datastore.preferences.core.edit
+import androidx.datastore.preferences.core.stringPreferencesKey
+import kotlinx.coroutines.flow.Flow
+import kotlinx.coroutines.flow.map
+import kotlinx.serialization.builtins.MapSerializer
+import kotlinx.serialization.builtins.serializer
+import kotlinx.serialization.json.Json
+
+/** Persists one independent [SupervisedModePolicy] per Hermes connection. */
+class SupervisedModeStore private constructor(
+    private val dataStore: DataStore<Preferences>,
+) {
+    constructor(context: Context) : this(context.relayDataStore)
+
+    private val json = Json {
+        encodeDefaults = true
+        ignoreUnknownKeys = true
+    }
+    private val serializer = MapSerializer(String.serializer(), SupervisedModePolicy.serializer())
+
+    fun policyFlow(connectionId: String): Flow<SupervisedModePolicy> =
+        dataStore.data.map { preferences ->
+            val decoded = decode(preferences[KEY_POLICIES])
+            if (decoded.corrupt) {
+                // A malformed persisted policy must never silently reopen the
+                // unrestricted app. Enabled + unconfigured renders the
+                // supervised recovery surface until an authenticated user
+                // repairs or clears the policy.
+                SupervisedModePolicy(enabled = true)
+            } else {
+                decoded.policies[connectionId]?.normalized() ?: SupervisedModePolicy()
+            }
+        }
+
+    suspend fun setPolicy(connectionId: String, policy: SupervisedModePolicy) {
+        require(connectionId.isNotBlank()) { "connectionId must not be blank" }
+        dataStore.edit { preferences ->
+            val policies = decode(preferences[KEY_POLICIES]).policies.toMutableMap()
+            policies[connectionId] = policy.normalized()
+            preferences[KEY_POLICIES] = json.encodeToString(serializer, policies)
+        }
+    }
+
+    suspend fun updatePolicy(
+        connectionId: String,
+        transform: (SupervisedModePolicy) -> SupervisedModePolicy,
+    ) {
+        require(connectionId.isNotBlank()) { "connectionId must not be blank" }
+        dataStore.edit { preferences ->
+            val policies = decode(preferences[KEY_POLICIES]).policies.toMutableMap()
+            val current = policies[connectionId]?.normalized() ?: SupervisedModePolicy()
+            policies[connectionId] = transform(current).normalized()
+            preferences[KEY_POLICIES] = json.encodeToString(serializer, policies)
+        }
+    }
+
+    suspend fun setEnabled(connectionId: String, enabled: Boolean) {
+        updatePolicy(connectionId) { it.copy(enabled = enabled) }
+    }
+
+    suspend fun clear(connectionId: String) {
+        dataStore.edit { preferences ->
+            val policies = decode(preferences[KEY_POLICIES]).policies.toMutableMap()
+            policies.remove(connectionId)
+            if (policies.isEmpty()) {
+                preferences.remove(KEY_POLICIES)
+            } else {
+                preferences[KEY_POLICIES] = json.encodeToString(serializer, policies)
+            }
+        }
+    }
+
+    /** Clear supervised policies without disturbing unrelated app settings. */
+    suspend fun clearAll() {
+        dataStore.edit { preferences -> preferences.remove(KEY_POLICIES) }
+    }
+
+    private fun decode(raw: String?): DecodeResult {
+        if (raw.isNullOrBlank()) return DecodeResult(emptyMap(), corrupt = false)
+        return try {
+            DecodeResult(json.decodeFromString(serializer, raw), corrupt = false)
+        } catch (error: Exception) {
+            Log.w(TAG, "Unable to decode supervised-mode policies; failing closed", error)
+            DecodeResult(emptyMap(), corrupt = true)
+        }
+    }
+
+    private data class DecodeResult(
+        val policies: Map<String, SupervisedModePolicy>,
+        val corrupt: Boolean,
+    )
+
+    internal companion object {
+        private const val TAG = "SupervisedModeStore"
+        private val KEY_POLICIES = stringPreferencesKey("supervised_mode_policies_v1")
+
+        fun forTesting(dataStore: DataStore<Preferences>): SupervisedModeStore =
+            SupervisedModeStore(dataStore)
+    }
+}
@@ -5,6 +5,7 @@ import kotlinx.coroutines.flow.StateFlow
 import kotlinx.coroutines.flow.asStateFlow
 import com.hermesandroid.relay.reliability.ReliabilityCenter
 import com.hermesandroid.relay.reliability.ReliabilityRedactor
+import java.time.Instant

 enum class DiagnosticCategory(val label: String) {
    Api("API"),
@@ -83,6 +84,8 @@ data class StatusCheck(
 object DiagnosticsLog {
    private const val MAX_ENTRIES = 200
    private const val MAX_TEXT_LENGTH = 180
+    const val SUPPORT_ENTRY_LIMIT = 80
+    private const val MAX_SUPPORT_TEXT_LENGTH = 32_000

    /** Cap for the full stacktrace kept on an error entry — a few KB is plenty. */
    private const val MAX_TRACE_LENGTH = 8000
@@ -204,6 +207,46 @@ object DiagnosticsLog {
        }
    }

+    /**
+     * Exact, bounded diagnostics section used by the review-before-sharing
+     * support export. Entries were already sanitized at record time; the final
+     * redaction pass protects legacy entries and keeps this safe to compose with
+     * persistent reliability reports.
+     */
+    fun supportText(entries: List<DiagnosticLogEntry>): String {
+        val selected = entries.takeLast(SUPPORT_ENTRY_LIMIT)
+        if (selected.isEmpty()) return ""
+        return ReliabilityRedactor.redact(
+            buildString {
+                appendLine("Recent in-app diagnostics")
+                appendLine("Diagnostics: ${selected.size}")
+                selected.forEachIndexed { index, entry ->
+                    appendLine()
+                    appendLine("===== Diagnostic ${index + 1} =====")
+                    appendLine("Time:     ${Instant.ofEpochMilli(entry.timestampMs)}")
+                    appendLine("Category: ${entry.category.label}")
+                    appendLine("Severity: ${entry.severity.name}")
+                    appendLine("Title:    ${entry.title}")
+                    entry.operation?.let { appendLine("Operation: $it") }
+                    entry.endpointRole?.let { appendLine("Route:    $it") }
+                    entry.configuredUrl?.let { appendLine("Configured URL: $it") }
+                    entry.requestUrl?.let { appendLine("Request:  $it") }
+                    if (entry.configuredUrl == null && entry.requestUrl == null) {
+                        entry.url?.let { appendLine("URL:      $it") }
+                    }
+                    entry.elapsedMs?.let { appendLine("Elapsed:  ${it}ms") }
+                    entry.detail?.let { appendLine("Detail:   $it") }
+                    entry.suggestion?.let { appendLine("Next:     $it") }
+                    entry.stacktrace?.let {
+                        appendLine("Technical detail (redacted)")
+                        appendLine(it)
+                    }
+                }
+            },
+            MAX_SUPPORT_TEXT_LENGTH,
+        )
+    }
+
    fun sanitizeUrl(value: String?): String? {
        val trimmed = value?.trim()?.takeIf { it.isNotBlank() } ?: return null
        val noQuery = trimmed.substringBefore('?').substringBefore('#')
@@ -153,7 +153,7 @@ class ChannelMultiplexer {
                )
                send(pong)
            }
-            "auth.ok", "auth.fail" -> {
+            "auth.ok", "auth.fail", "supervised.updated", "error" -> {
                // Delegate to system handler if registered
                handlers["system"]?.onMessage(envelope)
            }
@@ -11,6 +11,7 @@ import com.hermesandroid.relay.R
 import com.hermesandroid.relay.auth.CertPinStore
 import com.hermesandroid.relay.data.EndpointCandidate
 import com.hermesandroid.relay.data.RelayEndpointContract
+import com.hermesandroid.relay.data.isDashboardRelayIngressUrl
 import com.hermesandroid.relay.data.primaryRouteUrl
 import com.hermesandroid.relay.data.PairingPreferences
 import com.hermesandroid.relay.network.shared.pluginProxyRoutesOrNull
@@ -43,6 +44,7 @@ import okhttp3.Response
 import okhttp3.WebSocket
 import okhttp3.WebSocketListener
 import java.util.concurrent.TimeUnit
+import java.util.concurrent.atomic.AtomicLong

 enum class ConnectionState {
    Disconnected,
@@ -138,6 +140,12 @@ class ConnectionManager(
     * back to the legacy per-device PairingPreferences source below.
     */
    private val endpointCandidatesProvider: (suspend () -> List<EndpointCandidate>)? = null,
+    /**
+     * Dynamic ownership fence for Relay-only resolution. Production uses it
+     * to keep Dashboard ingress on the exact origin that owns Dashboard auth,
+     * while direct Relay and proxy routes remain independently eligible.
+     */
+    private val relayCandidateEligibility: (EndpointCandidate) -> Boolean = { true },
    /**
     * Suspending supplier for the active device id. Used to key into
     * [PairingPreferences.getDeviceEndpoints] during resolution. `null`
@@ -151,6 +159,14 @@ class ConnectionManager(
    private val proxyClientProvider: ((String) -> OkHttpClient?)? = null,
    /** Test seam for observing lifecycle teardown without opening a socket. */
    private val okHttpClientFactory: (() -> OkHttpClient)? = null,
+    /**
+     * Builds a Dashboard-authorized WebSocket request for plugin ingress.
+     * Implementations mint a fresh single-use Dashboard WS ticket on every
+     * invocation. Direct Relay listeners never call this provider.
+     */
+    private val dashboardRelayRequestProvider: (suspend (String) -> Request?)? = null,
+    /** Deterministic race seam immediately before an ingress failure may poison route state. */
+    private val beforeIngressFailureCommit: suspend () -> Unit = {},
 ) {
    private val supervisorJob = SupervisorJob()
    private val scope = CoroutineScope(supervisorJob + Dispatchers.IO)
@@ -191,6 +207,9 @@ class ConnectionManager(

    @Volatile
    private var webSocket: WebSocket? = null
+    private val socketGeneration = AtomicLong(0L)
+    @Volatile
+    private var activeSocketGeneration: Long = 0L

    @Volatile
    private var serverUrl: String? = null
@@ -273,6 +292,11 @@ class ConnectionManager(
    @Volatile
    private var networkResolveJob: kotlinx.coroutines.Job? = null

+    /** Optional API discovery is never part of Dashboard/Gateway readiness. */
+    @Volatile
+    private var apiResolveJob: Job? = null
+    private var apiResolveRevision: Long = 0L
+
    /** Deferred reaction to a network loss — cancelled if a network returns within the grace. */
    private var networkLossJob: kotlinx.coroutines.Job? = null

@@ -363,13 +387,12 @@ class ConnectionManager(
        // the synthesized list just collapses to the same URL anyway.
        scope.launch {
            val resolved = resolveBestEndpointSafe(EndpointSurface.Dashboard)
-                ?: resolveBestEndpointSafe(EndpointSurface.Standard)
-            val apiResolved = resolveBestEndpointSafe(EndpointSurface.Api)
-            val relayResolved = resolveBestEndpointSafe(EndpointSurface.Relay)
+                ?: resolveLegacyStandardFallbackSafe()
+            scheduleApiResolution()
+            val relayResolved = resolveBestRelayEndpointSafe()
            val resolvedRelayUrl = relayResolved?.relayWebSocketUrl()?.takeIf { it.isNotBlank() }
            val targetUrl = resolvedRelayUrl ?: url.takeIf { it.isNotBlank() }
            _activeRelayEndpoint.value = relayResolved
-            _activeApiEndpoint.value = apiResolved
            if (resolved != null) {
                _activeEndpoint.value = resolved
                Log.i(TAG, "connect: standard resolver picked role=${resolved.role} " +
@@ -407,6 +430,18 @@ class ConnectionManager(
        }
    }

+    /**
+     * Open the exact QR-advertised socket for a fresh pair. Relay health probes
+     * require an established Relay session, so running the normal resolver
+     * before `auth.ok` is circular and can consume the entire pairing window.
+     * Post-pair reconnects continue to use [connect] and full route resolution.
+     */
+    fun connectPairing(url: String) {
+        ensureNetworkCallbackRegistered()
+        _activeRelayEndpoint.value = null
+        connectToUrlOnMainPath(url, replaceReason = "Fresh Relay pairing")
+    }
+
    /**
     * Replace an ordinary scheduled reconnect with an immediate attempt.
     *
@@ -442,6 +477,35 @@ class ConnectionManager(
        return true
    }

+    /**
+     * Reopen the current authenticated Relay socket without discarding pair
+     * state. Used only as a compatibility fallback when an older Relay does
+     * not acknowledge a post-auth metadata update; the replacement socket's
+     * normal `system/auth` frame carries the latest metadata.
+     */
+    fun reconnectForAuthenticatedMetadataUpdate(): Boolean {
+        val targetUrl = serverUrl?.takeIf { it.isNotBlank() } ?: return false
+        if (isRelayRateLimitBackoffActive(
+                rateLimitBackoffUntilMs,
+                SystemClock.elapsedRealtime(),
+            )
+        ) {
+            Log.i(TAG, "metadata reconnect: preserving active rate-limit backoff")
+            return false
+        }
+        val previousSocket = webSocket
+        if (previousSocket == null) {
+            connect(targetUrl)
+        } else {
+            doConnect(
+                targetUrl,
+                previousSocketToClose = previousSocket,
+                replaceReason = "Relay metadata compatibility refresh",
+            )
+        }
+        return true
+    }
+
    /**
     * Same as [connect] but bypasses the resolver — used by the network-
     * change callback when we've already picked a winner and just want to
@@ -548,10 +612,17 @@ class ConnectionManager(
     */
    suspend fun resolveBestEndpoint(): EndpointCandidate? =
        resolveBestEndpointSafe(EndpointSurface.Dashboard)
-            ?: resolveBestEndpointSafe(EndpointSurface.Standard)
+            ?: resolveLegacyStandardFallbackSafe()
+
+    private suspend fun resolveLegacyStandardFallbackSafe(): EndpointCandidate? =
+        resolveBestEndpointSafe(EndpointSurface.Standard) { candidate ->
+            candidate.dashboard?.url.isNullOrBlank() &&
+                candidate.pluginProxyRoutesOrNull()?.dashboardBaseUrl == null
+        }

    private suspend fun resolveBestEndpointSafe(
        surface: EndpointSurface,
+        candidateFilter: (EndpointCandidate) -> Boolean = { true },
    ): EndpointCandidate? {
        val resolver = endpointResolver ?: return null
        val ctx = context ?: return null
@@ -580,13 +651,14 @@ class ConnectionManager(
            } ?: emptyList()
        }

-        if (endpoints.isEmpty()) return null
+        val eligibleEndpoints = endpoints.filter(candidateFilter)
+        if (eligibleEndpoints.isEmpty()) return null

        // Manual override: if the user pinned a role in the Endpoints card,
        // try that one first; fall through to the strict-priority algorithm
        // if it isn't reachable.
        _manualRoleOverride.value?.let { preferredRole ->
-            val preferred = endpoints.firstOrNull {
+            val preferred = eligibleEndpoints.firstOrNull {
                it.role.equals(preferredRole, ignoreCase = true)
            }
            if (preferred != null) {
@@ -598,7 +670,54 @@ class ConnectionManager(
            }
        }

-        return resolver.resolve(endpoints, surface)
+        return resolver.resolve(eligibleEndpoints, surface)
+    }
+
+    /** Every Relay selection path must apply the same live ownership fence. */
+    private suspend fun resolveBestRelayEndpointSafe(): EndpointCandidate? =
+        resolveBestEndpointSafe(
+            surface = EndpointSurface.Relay,
+            candidateFilter = relayCandidateEligibility,
+        )
+
+    /**
+     * Discover the optional API fallback without holding up the standard
+     * Dashboard/Gateway route. A single manager-level job coalesces lifecycle
+     * callers; [EndpointResolver] additionally shares an in-flight request per
+     * route/surface. The negative cache keeps ordinary profile changes cheap,
+     * while network callbacks and explicit probes still invalidate it.
+     */
+    private fun scheduleApiResolution() {
+        synchronized(this) {
+            apiResolveRevision += 1L
+            if (apiResolveJob?.isActive != true) {
+                startApiResolutionLocked(apiResolveRevision)
+            }
+        }
+    }
+
+    /** Caller must hold this manager's monitor. */
+    private fun startApiResolutionLocked(revision: Long) {
+        apiResolveJob = scope.launch {
+            try {
+                val resolved = resolveBestEndpointSafe(EndpointSurface.Api)
+                synchronized(this@ConnectionManager) {
+                    // A route/connection refresh may have arrived while this
+                    // optional probe was waiting. Never publish its stale
+                    // winner over the newer connection's API ownership.
+                    if (revision == apiResolveRevision) {
+                        _activeApiEndpoint.value = resolved
+                    }
+                }
+            } finally {
+                synchronized(this@ConnectionManager) {
+                    apiResolveJob = null
+                    if (revision != apiResolveRevision && supervisorJob.isActive) {
+                        startApiResolutionLocked(apiResolveRevision)
+                    }
+                }
+            }
+        }
    }

    /**
@@ -627,9 +746,9 @@ class ConnectionManager(
        endpointResolver?.clearCache()
        val current = serverUrl
        val resolved = resolveBestEndpointSafe(EndpointSurface.Dashboard)
-            ?: resolveBestEndpointSafe(EndpointSurface.Standard)
-        val apiResolved = resolveBestEndpointSafe(EndpointSurface.Api)
-        val relayResolved = resolveBestEndpointSafe(EndpointSurface.Relay)
+            ?: resolveLegacyStandardFallbackSafe()
+        scheduleApiResolution()
+        val relayResolved = resolveBestRelayEndpointSafe()
        if (resolved == null && _connectionState.value == ConnectionState.Connected) {
            // Transient probe miss while the relay socket is demonstrably up
            // — keep the live route published rather than downgrading every
@@ -637,7 +756,6 @@ class ConnectionManager(
            return _activeEndpoint.value
        }
        _activeEndpoint.value = resolved
-        _activeApiEndpoint.value = apiResolved
        if (relayResolved != null) _activeRelayEndpoint.value = relayResolved
        val targetUrl = relayResolved?.relayWebSocketUrl() ?: current ?: return resolved
        val normalizedTarget = normalizeRelayUrl(targetUrl)
@@ -677,8 +795,8 @@ class ConnectionManager(
    suspend fun refreshActiveEndpoint(clearProbeCache: Boolean = false): EndpointCandidate? {
        if (clearProbeCache) endpointResolver?.clearCache()
        val resolved = resolveBestEndpointSafe(EndpointSurface.Dashboard)
-            ?: resolveBestEndpointSafe(EndpointSurface.Standard)
-        val apiResolved = resolveBestEndpointSafe(EndpointSurface.Api)
+            ?: resolveLegacyStandardFallbackSafe()
+        scheduleApiResolution()
        if (resolved == null && _connectionState.value == ConnectionState.Connected) {
            // Transient probe miss while the relay socket is demonstrably up
            // (slow resume, mid-handoff blip) — keep publishing the live
@@ -687,7 +805,6 @@ class ConnectionManager(
            return _activeEndpoint.value
        }
        _activeEndpoint.value = resolved
-        _activeApiEndpoint.value = apiResolved
        return resolved
    }

@@ -709,6 +826,46 @@ class ConnectionManager(
        Log.i(TAG, "marked endpoint role=${active.role} unreachable ($reason)")
    }

+    /** Admission is stronger evidence than `/transport/health`: reject this ingress and retain direct fallback. */
+    private suspend fun fallbackFromBrokenDashboardIngress(
+        url: String,
+        reason: String,
+        failingSocket: WebSocket? = null,
+        failingGeneration: Long? = null,
+    ): Boolean {
+        if (!isDashboardRelayIngressUrl(url)) return false
+        if (failingGeneration != null) {
+            beforeIngressFailureCommit()
+            if (activeSocketGeneration != failingGeneration || webSocket !== failingSocket) {
+                Log.i(TAG, "Ignoring stale Dashboard ingress failure ($reason)")
+                return false
+            }
+        }
+        val failed = _activeRelayEndpoint.value ?: return false
+        val failedUrl = failed.relayWebSocketUrl()?.let(::normalizeRelayUrl)
+        if (failedUrl != normalizeRelayUrl(url)) return false
+        endpointResolver?.markUnreachable(failed, EndpointSurface.Relay) ?: return false
+        val replacement = resolveBestRelayEndpointSafe() ?: return false
+        val replacementUrl = replacement.relayWebSocketUrl()?.takeIf(String::isNotBlank) ?: return false
+        if (normalizeRelayUrl(replacementUrl) == normalizeRelayUrl(url)) return false
+        _activeRelayEndpoint.value = replacement
+        Log.i(TAG, "Dashboard Relay ingress rejected; switching to ${replacement.role} ($reason)")
+        DiagnosticsLog.record(
+            category = DiagnosticCategory.Relay,
+            severity = DiagnosticSeverity.Warning,
+            title = "Relay ingress unavailable",
+            detail = "Dashboard admission failed; using retained direct Relay route.",
+            operation = "Select Relay transport after admission failure",
+            endpointRole = failed.role,
+            requestUrl = url,
+        )
+        connectToUrlOnMainPath(
+            replacementUrl,
+            replaceReason = "Dashboard Relay ingress admission failed",
+        )
+        return true
+    }
+
    /**
     * Debounced network-change re-resolution, shared by both NetworkCallback
     * events. Re-runs the resolver and publishes the winner to
@@ -731,8 +888,8 @@ class ConnectionManager(
            if (wipeCache) endpointResolver.clearCache()
            val current = serverUrl
            val resolved = resolveBestEndpointSafe(EndpointSurface.Dashboard)
-                ?: resolveBestEndpointSafe(EndpointSurface.Standard)
-            val apiResolved = resolveBestEndpointSafe(EndpointSurface.Api)
+                ?: resolveLegacyStandardFallbackSafe()
+            scheduleApiResolution()
            if (resolved == null) {
                // Hysteresis for the AUTOMATIC (network-callback) path. A
                // transient cold-route probe miss must NOT null the published
@@ -769,7 +926,6 @@ class ConnectionManager(
            }
            sustainedLossDeclared = false
            _activeEndpoint.value = resolved
-            _activeApiEndpoint.value = apiResolved
            if (current == null) return@launch
            // After an explicit disconnect() the route still publishes above
            // (HTTP surfaces keep roaming), but no socket action: without
@@ -778,7 +934,7 @@ class ConnectionManager(
            // (connectToUrlOnMainPath force-sets shouldReconnect = true, so
            // the swap path never re-checked it.)
            if (!shouldReconnect) return@launch
-            val relayResolved = resolveBestEndpointSafe(EndpointSurface.Relay)
+            val relayResolved = resolveBestRelayEndpointSafe()
            if (relayResolved != null) _activeRelayEndpoint.value = relayResolved
            val relayUrl = relayResolved?.relayWebSocketUrl()?.takeIf { it.isNotBlank() }
                ?: return@launch
@@ -945,7 +1101,8 @@ class ConnectionManager(
        webSocket?.send(text)
    }

-    private fun isActiveSocket(socket: WebSocket): Boolean = webSocket === socket
+    private fun isActiveSocket(socket: WebSocket, generation: Long): Boolean =
+        webSocket === socket && activeSocketGeneration == generation

    private fun doConnect(
        url: String,
@@ -981,7 +1138,7 @@ class ConnectionManager(
        scope.launch { doConnectInternal(url, previousSocketToClose, replaceReason) }
    }

-    private fun doConnectInternal(
+    private suspend fun doConnectInternal(
        url: String,
        previousSocketToClose: WebSocket? = null,
        replaceReason: String = "Relay socket replaced",
@@ -1006,22 +1163,49 @@ class ConnectionManager(
            buildClient(url)
        }

-        val request = buildRelayRequestOrNull(url)
+        val request = if (isDashboardRelayIngressUrl(url)) {
+            dashboardRelayRequestProvider?.invoke(url)
+        } else {
+            buildRelayRequestOrNull(url)
+        }
        if (request == null) {
            // A malformed relay URL (an invalid/empty host from a corrupt or
            // hand-edited pairing payload) can't be built into a request. This
            // runs on a background coroutine, so letting OkHttp's url() throw
            // would crash the app — the #131 "Invalid URL host" class, relay-
            // socket half. Route it through the same path onFailure uses.
-            Log.e(TAG, "doConnect: malformed relay URL '$url' — not connecting")
+            Log.e(
+                TAG,
+                if (isDashboardRelayIngressUrl(url)) {
+                    "doConnect: Dashboard Relay ticket/request unavailable for '$url'"
+                } else {
+                    "doConnect: malformed relay URL '$url' — not connecting"
+                },
+            )
            DiagnosticsLog.record(
                category = DiagnosticCategory.Relay,
                severity = DiagnosticSeverity.Error,
-                title = "Invalid relay URL",
-                detail = "The relay address could not be parsed; re-pair to refresh it.",
-                operation = "Build Relay WebSocket request",
+                title = if (isDashboardRelayIngressUrl(url)) {
+                    "Dashboard Relay authorization unavailable"
+                } else {
+                    "Invalid relay URL"
+                },
+                detail = if (isDashboardRelayIngressUrl(url)) {
+                    "Dashboard authorization could not prepare the Relay WebSocket request."
+                } else {
+                    "The relay address could not be parsed; re-pair to refresh it."
+                },
+                operation = if (isDashboardRelayIngressUrl(url)) {
+                    "Mint Dashboard Relay WebSocket ticket"
+                } else {
+                    "Build Relay WebSocket request"
+                },
                configuredUrl = url,
-                suggestion = "Edit or re-pair the Relay route to replace the invalid address.",
+                suggestion = if (isDashboardRelayIngressUrl(url)) {
+                    "Sign in to the matching Dashboard route, then recheck Relay routes."
+                } else {
+                    "Edit or re-pair the Relay route to replace the invalid address."
+                },
            )
            authenticated = false
            _connectionState.value = ConnectionState.Disconnected
@@ -1029,14 +1213,18 @@ class ConnectionManager(
                runCatching { stale.close(1000, replaceReason) }
                stale.cancel()
            }
-            scheduleReconnect()
+            if (!fallbackFromBrokenDashboardIngress(url, "request provider or ticket unavailable")) {
+                scheduleReconnect()
+            }
            return
        }

        Log.i(TAG, "doConnect: opening WSS to $url")
+        val generation = socketGeneration.incrementAndGet()
+        activeSocketGeneration = generation
        val newSocket = client.newWebSocket(request, object : WebSocketListener() {
            override fun onOpen(webSocket: WebSocket, response: Response) {
-                if (!isActiveSocket(webSocket)) {
+                if (!isActiveSocket(webSocket, generation)) {
                    Log.i(TAG, "onOpen: stale WSS handshake ignored ($url)")
                    runCatching { webSocket.close(1000, "Stale relay socket") }
                    webSocket.cancel()
@@ -1079,7 +1267,7 @@ class ConnectionManager(
            }

            override fun onMessage(webSocket: WebSocket, text: String) {
-                if (!isActiveSocket(webSocket)) {
+                if (!isActiveSocket(webSocket, generation)) {
                    Log.i(TAG, "onMessage: stale WSS envelope ignored ($url)")
                    return
                }
@@ -1106,7 +1294,7 @@ class ConnectionManager(
            }

            override fun onClosed(webSocket: WebSocket, code: Int, reason: String) {
-                if (!isActiveSocket(webSocket)) {
+                if (!isActiveSocket(webSocket, generation)) {
                    Log.i(TAG, "onClosed: stale WSS close ignored ($url code=$code reason=$reason)")
                    return
                }
@@ -1120,13 +1308,28 @@ class ConnectionManager(
                    requestUrl = url,
                    suggestion = if (code == 1000) null else "Check the Relay server logs for the matching close code and reason.",
                )
+                val admitted = authenticated
                authenticated = false
                _connectionState.value = ConnectionState.Disconnected
-                scheduleReconnect()
+                if (isDashboardRelayIngressUrl(url) && !admitted && code != 1000) {
+                    scope.launch {
+                        if (!fallbackFromBrokenDashboardIngress(
+                                url,
+                                "pre-auth close $code",
+                                webSocket,
+                                generation,
+                            ) && activeSocketGeneration == generation
+                        ) {
+                            scheduleReconnect()
+                        }
+                    }
+                } else {
+                    scheduleReconnect()
+                }
            }

            override fun onFailure(webSocket: WebSocket, t: Throwable, response: Response?) {
-                if (!isActiveSocket(webSocket)) {
+                if (!isActiveSocket(webSocket, generation)) {
                    Log.i(TAG, "onFailure: stale WSS failure ignored ($url ${t.javaClass.simpleName}: ${t.message})")
                    return
                }
@@ -1148,6 +1351,22 @@ class ConnectionManager(
                    } ?: NetworkDiagnosticGuidance.forThrowable(t, "Relay"),
                )
                lastUpgradeResponseCode = code
+                if (isDashboardRelayIngressUrl(url) && response != null) {
+                    authenticated = false
+                    _connectionState.value = ConnectionState.Disconnected
+                    scope.launch {
+                        if (!fallbackFromBrokenDashboardIngress(
+                                url,
+                                "HTTP admission ${response.code}",
+                                webSocket,
+                                generation,
+                            ) && activeSocketGeneration == generation
+                        ) {
+                            scheduleReconnect()
+                        }
+                    }
+                    return
+                }
                if (response == null) {
                    // Transport-level failure (no HTTP upgrade response): on a
                    // remote (Tailscale) link the first handshake can fail cold.
@@ -1261,7 +1480,7 @@ class ConnectionManager(
            // expires, auth state may have changed (e.g., user hit Revoke
            // during the retry window).
            if (shouldReconnect && reconnectGate()) {
-                val resolved = resolveBestEndpointSafe(EndpointSurface.Relay)
+                val resolved = resolveBestRelayEndpointSafe()
                val targetUrl = resolved?.relayWebSocketUrl()
                if (resolved != null) {
                    // Mirror scheduleNetworkReResolve: clear the sustained-loss
@@ -102,22 +102,18 @@ class ProactiveMessageHandler(
    /** Route a parsed message: into the open Thread if it belongs there, else
     *  the durable inbox log + the surface its hint selects. */
    private fun dispatch(msg: ProactiveMessage) {
-        // Persist first even when the currently open Thread consumes the live
-        // message. Agent-initiated outbound sends do not create a gateway
-        // session until the phone replies, so this cache is the provisional
-        // Thread transcript during that gap.
-        toInbox?.invoke(msg)
        // The surfacing hint selects the additional surface. Thread injection
        // is best-effort presentation of the persisted row, not itself a reason
        // to suppress an explicitly requested notification.
-        when (msg.surfacing?.lowercase()) {
+        val notificationId = when (msg.surfacing?.lowercase()) {
            "inbox" -> {
                injectIntoThread?.invoke(msg)
+                null
            }
            "session" -> {
                val delivered = injectIntoThread?.invoke(msg) == true ||
                    toSession?.invoke(msg) == true
-                if (!delivered) notify(msg)
+                if (delivered) null else notify(msg)
            }
            // null / "default" / "notification" / anything unrecognized.
            else -> {
@@ -125,9 +121,13 @@ class ProactiveMessageHandler(
                notify(msg)
            }
        }
+        // Every message remains in the bounded local cache. Persist the exact
+        // posted notification slot as part of that row so a later local Thread
+        // removal can cancel only its own notification.
+        toInbox?.invoke(msg.copy(notificationId = notificationId))
    }

-    private fun notify(msg: ProactiveMessage) {
+    private fun notify(msg: ProactiveMessage): Int? =
        ProactiveMessageNotifier.notify(
            context = context,
            title = msg.title,
@@ -135,7 +135,6 @@ class ProactiveMessageHandler(
            messageId = msg.messageId,
            chatId = msg.chatId,
        )
-    }

    private fun parse(payload: JsonObject): ProactiveMessage? {
        val text = payload["text"]?.jsonPrimitive?.contentOrNull
@@ -172,4 +171,6 @@ data class ProactiveMessage(
    val replyTo: String? = null,
    /** True only when Relay explicitly marked this as a reconnect queue flush. */
    val arrivedWhileAway: Boolean = false,
+    /** Exact Android notification slot when this delivery posted one. */
+    val notificationId: Int? = null,
 )
@@ -5,10 +5,12 @@ import android.util.Log
 import com.hermesandroid.relay.R
 import com.hermesandroid.relay.auth.PairedDeviceInfo
 import com.hermesandroid.relay.data.RelayEndpointContract
+import com.hermesandroid.relay.data.isDashboardRelayIngressUrl
 import com.hermesandroid.relay.diagnostics.DiagnosticCategory
 import com.hermesandroid.relay.diagnostics.DiagnosticSeverity
 import com.hermesandroid.relay.diagnostics.DiagnosticsLog
 import com.hermesandroid.relay.diagnostics.NetworkDiagnosticGuidance
+import com.hermesandroid.relay.network.usage.ProviderUsageResponse
 import kotlinx.coroutines.Dispatchers
 import kotlinx.coroutines.withContext
 import kotlinx.serialization.SerialName
@@ -27,6 +29,18 @@ import okhttp3.Request
 import okhttp3.RequestBody.Companion.toRequestBody
 import java.io.IOException

+internal const val RELAY_SESSION_HEADER: String = "X-Hermes-Relay-Session"
+
+/** Keep Dashboard outer auth and Relay capability auth in separate headers. */
+internal fun Request.Builder.relaySessionCredential(
+    token: String,
+    dashboardIngress: Boolean,
+): Request.Builder = if (dashboardIngress) {
+    header(RELAY_SESSION_HEADER, token)
+} else {
+    header("Authorization", "Bearer $token")
+}
+
 /**
 * HTTP client for the Hermes relay media endpoint.
 *
@@ -58,11 +72,20 @@ class RelayHttpClient(
    /** Application context for localized string resources. Nullable for
     *  backwards-compat with call sites that don't need localization. */
    private val context: Context? = null,
+    /** Dashboard-authenticated client for same-origin plugin ingress calls. */
+    private val dashboardHttpClientProvider: ((String) -> OkHttpClient?)? = null,
 ) {

    private fun relayHttpBaseOrNull(url: String): String? =
        RelayEndpointContract.parseOrNull(url)?.httpBaseUrl

+    private fun callClient(relayUrl: String): OkHttpClient =
+        if (isDashboardRelayIngressUrl(relayUrl)) {
+            dashboardHttpClientProvider?.invoke(relayUrl) ?: okHttpClient
+        } else {
+            okHttpClient
+        }
+
    companion object {
        private const val TAG = "RelayHttpClient"
        const val MAX_MODEL_CAPABILITY_ROWS = 64
@@ -198,10 +221,10 @@ class RelayHttpClient(
        val request = Request.Builder()
            .url(url)
            .get()
-            .header("Authorization", "Bearer $sessionToken")
+            .relaySessionCredential(sessionToken, isDashboardRelayIngressUrl(relayUrl))
            .header("Accept", "application/json")
            .build()
-        val activityClient = okHttpClient.newBuilder()
+        val activityClient = callClient(relayUrl).newBuilder()
            .callTimeout(3, java.util.concurrent.TimeUnit.SECONDS)
            .build()

@@ -260,12 +283,12 @@ class RelayHttpClient(
        val request = Request.Builder()
            .url(url)
            .get()
-            .header("Authorization", "Bearer $sessionToken")
+            .relaySessionCredential(sessionToken, isDashboardRelayIngressUrl(relayUrl))
            .header("Accept", "*/*")
            .build()

        try {
-            okHttpClient.newCall(request).execute().use { response ->
+            callClient(relayUrl).newCall(request).execute().use { response ->
                if (!response.isSuccessful) {
                    val reason = when (response.code) {
                        401, 403 -> "Unauthorized — re-pair with the relay"
@@ -368,12 +391,12 @@ class RelayHttpClient(
        val request = Request.Builder()
            .url(url)
            .get()
-            .header("Authorization", "Bearer $sessionToken")
+            .relaySessionCredential(sessionToken, isDashboardRelayIngressUrl(relayUrl))
            .header("Accept", "*/*")
            .build()

        try {
-            okHttpClient.newCall(request).execute().use { response ->
+            callClient(relayUrl).newCall(request).execute().use { response ->
                if (!response.isSuccessful) {
                    val reason = when (response.code) {
                        401 -> "Unauthorized — re-pair with the relay"
@@ -455,12 +478,12 @@ class RelayHttpClient(
            val request = Request.Builder()
                .url(url)
                .get()
-                .header("Authorization", "Bearer $sessionToken")
+                .relaySessionCredential(sessionToken, isDashboardRelayIngressUrl(relayUrl))
                .header("Accept", "image/*")
                .build()

            try {
-                okHttpClient.newCall(request).execute().use { response ->
+                callClient(relayUrl).newCall(request).execute().use { response ->
                    if (!response.isSuccessful) {
                        val errorCode = runCatching {
                            sessionsJson.parseToJsonElement(response.body.string())
@@ -553,11 +576,11 @@ class RelayHttpClient(
        val request = Request.Builder()
            .url(url)
            .get()
-            .header("Authorization", "Bearer $sessionToken")
+            .relaySessionCredential(sessionToken, isDashboardRelayIngressUrl(relayUrl))
            .header("Accept", "application/json")
            .build()

-        val auditClient = okHttpClient.newBuilder()
+        val auditClient = callClient(relayUrl).newBuilder()
            .callTimeout(3, java.util.concurrent.TimeUnit.SECONDS)
            .build()

@@ -639,10 +662,10 @@ class RelayHttpClient(
        val request = Request.Builder()
            .url(url)
            .get()
-            .header("Authorization", "Bearer $sessionToken")
+            .relaySessionCredential(sessionToken, isDashboardRelayIngressUrl(relayUrl))
            .header("Accept", "application/json")
            .build()
-        val client = okHttpClient.newBuilder()
+        val client = callClient(relayUrl).newBuilder()
            .callTimeout(3, java.util.concurrent.TimeUnit.SECONDS)
            .build()
        try {
@@ -752,10 +775,10 @@ class RelayHttpClient(
            return@withContext Result.failure(IOException("Invalid relay URL: ${e.message}"))
        }
        val request = Request.Builder().url(url).get()
-            .header("Authorization", "Bearer $token")
+            .relaySessionCredential(token, isDashboardRelayIngressUrl(relayUrl))
            .header("Accept", "application/json").build()
        try {
-            okHttpClient.newBuilder().callTimeout(4, java.util.concurrent.TimeUnit.SECONDS).build()
+            callClient(relayUrl).newBuilder().callTimeout(4, java.util.concurrent.TimeUnit.SECONDS).build()
                .newCall(request).execute().use { response ->
                    if (response.code == 404) return@withContext Result.success(null)
                    if (!response.isSuccessful) return@withContext Result.failure(IOException("HTTP ${response.code}"))
@@ -806,11 +829,11 @@ class RelayHttpClient(
        val request = Request.Builder()
            .url(url)
            .post(sessionsJson.encodeToString(payload).toRequestBody("application/json".toMediaType()))
-            .header("Authorization", "Bearer $token")
+            .relaySessionCredential(token, isDashboardRelayIngressUrl(relayUrl))
            .header("Accept", "application/json")
            .build()
        try {
-            okHttpClient.newBuilder().callTimeout(4, java.util.concurrent.TimeUnit.SECONDS).build()
+            callClient(relayUrl).newBuilder().callTimeout(4, java.util.concurrent.TimeUnit.SECONDS).build()
                .newCall(request).execute().use { response ->
                    if (response.code == 404) return@withContext Result.success(null)
                    if (!response.isSuccessful) return@withContext Result.failure(IOException("HTTP ${response.code}"))
@@ -856,12 +879,12 @@ class RelayHttpClient(
        val request = Request.Builder()
            .url(url)
            .get()
-            .header("Authorization", "Bearer $sessionToken")
+            .relaySessionCredential(sessionToken, isDashboardRelayIngressUrl(relayUrl))
            .header("Accept", "application/json")
            .build()
        // Slightly longer than the other reads — a cache-miss on the relay does a
        // GitHub round-trip in an executor before responding.
-        val client = okHttpClient.newBuilder()
+        val client = callClient(relayUrl).newBuilder()
            .callTimeout(8, java.util.concurrent.TimeUnit.SECONDS)
            .build()
        try {
@@ -940,12 +963,12 @@ class RelayHttpClient(
        val request = Request.Builder()
            .url(url)
            .get()
-            .header("Authorization", "Bearer $sessionToken")
+            .relaySessionCredential(sessionToken, isDashboardRelayIngressUrl(relayUrl))
            .header("Accept", "application/json")
            .build()

        try {
-            okHttpClient.newCall(request).execute().use { response ->
+            callClient(relayUrl).newCall(request).execute().use { response ->
                if (response.code == 404) {
                    // Server hasn't shipped the endpoint yet — degrade to
                    // empty list so the UI can render "No paired devices"
@@ -1027,12 +1050,12 @@ class RelayHttpClient(
        val request = Request.Builder()
            .url(url)
            .delete()
-            .header("Authorization", "Bearer $sessionToken")
+            .relaySessionCredential(sessionToken, isDashboardRelayIngressUrl(relayUrl))
            .header("Accept", "application/json")
            .build()

        try {
-            okHttpClient.newCall(request).execute().use { response ->
+            callClient(relayUrl).newCall(request).execute().use { response ->
                if (response.code == 404) {
                    // Already gone — treat as success so the UI can just
                    // drop the row on the next refresh.
@@ -1144,12 +1167,12 @@ class RelayHttpClient(
        val request = Request.Builder()
            .url(url)
            .patch(bodyJson.toRequestBody("application/json".toMediaType()))
-            .header("Authorization", "Bearer $sessionToken")
+            .relaySessionCredential(sessionToken, isDashboardRelayIngressUrl(relayUrl))
            .header("Accept", "application/json")
            .build()

        try {
-            okHttpClient.newCall(request).execute().use { response ->
+            callClient(relayUrl).newCall(request).execute().use { response ->
                if (!response.isSuccessful) {
                    val reason = when (response.code) {
                        400 -> "Invalid extend request (check TTL/grants)"
@@ -1241,7 +1264,7 @@ class RelayHttpClient(

        // Fast-timeout client — we don't want Save & Test to hang the UI
        // for 10 seconds on a dead URL.
-        val fastClient = okHttpClient.newBuilder()
+        val fastClient = callClient(relayUrl).newBuilder()
            .connectTimeout(3, java.util.concurrent.TimeUnit.SECONDS)
            .readTimeout(3, java.util.concurrent.TimeUnit.SECONDS)
            .writeTimeout(3, java.util.concurrent.TimeUnit.SECONDS)
@@ -1444,4 +1467,86 @@ class RelayHttpClient(
        val value = header?.trim()?.lowercase() ?: return false
        return value == "1" || value == "true"
    }
+
+    /** Provider-neutral compatibility fetch for gateways without `account.usage`. */
+    suspend fun fetchProviderUsage(
+        profile: String? = null,
+        sessionId: String? = null,
+    ): Result<ProviderUsageResponse?> =
+        withContext(Dispatchers.IO) {
+            val relayUrl = relayUrlProvider()?.trim().orEmpty()
+            if (relayUrl.isEmpty()) {
+                return@withContext Result.success(null)
+            }
+            val sessionToken = sessionTokenProvider()
+            if (sessionToken.isNullOrBlank()) {
+                return@withContext Result.success(null)
+            }
+
+            val httpBase = relayUrl
+                .replace(Regex("^wss://", RegexOption.IGNORE_CASE), "https://")
+                .replace(Regex("^ws://", RegexOption.IGNORE_CASE), "http://")
+                .trimEnd('/')
+
+            val url = "$httpBase/usage/providers".toHttpUrlOrNull()
+                ?.newBuilder()
+                ?.apply {
+                    profile?.trim()?.takeIf { it.isNotEmpty() }?.let {
+                        addQueryParameter("profile", it)
+                    }
+                    sessionId?.trim()?.takeIf { it.isNotEmpty() }?.let {
+                        addQueryParameter("session_id", it)
+                    }
+                }
+                ?.build()
+                ?: return@withContext Result.failure(
+                    IllegalArgumentException("Invalid relay URL: $httpBase")
+                )
+
+            val request = Request.Builder()
+                .url(url)
+                .get()
+                .relaySessionCredential(sessionToken, isDashboardRelayIngressUrl(relayUrl))
+                .header("Accept", "application/json")
+                .build()
+
+            try {
+                callClient(relayUrl).newCall(request).execute().use { response ->
+                    if (response.code == 404) {
+                        // Older or operator-disabled hosts simply do not expose
+                        // account usage. This is capability absence, not an error.
+                        return@withContext Result.success(null)
+                    }
+                    if (!response.isSuccessful) {
+                        val reason = when (response.code) {
+                            401, 403 -> "Unauthorized — re-pair with the relay"
+                            502 -> "Provider usage upstream error (HTTP ${response.code})"
+                            in 500..599 -> "Relay error (HTTP ${response.code})"
+                            else -> "HTTP ${response.code}: ${response.message.ifBlank { "request failed" }}"
+                        }
+                        return@withContext Result.failure(IOException(reason))
+                    }
+                    val body = response.body?.string().orEmpty()
+                    if (body.isBlank()) {
+                        return@withContext Result.failure(IOException("Empty response body"))
+                    }
+                    val parsed = runCatching {
+                        sessionsJson.decodeFromString(
+                            ProviderUsageResponse.serializer(),
+                            body,
+                        )
+                    }.getOrElse {
+                        Log.w(TAG, "fetchProviderUsage parse error: ${it.message}")
+                        return@withContext Result.failure(IOException("Unrecognized usage payload"))
+                    }
+                    Result.success(parsed)
+                }
+            } catch (e: IOException) {
+                Log.w(TAG, "fetchProviderUsage failed: ${e.message}")
+                Result.failure(IOException("Relay unreachable: ${e.message ?: "IO error"}"))
+            } catch (e: Exception) {
+                Log.w(TAG, "fetchProviderUsage unexpected error: ${e.message}")
+                Result.failure(e)
+            }
+        }
 }
@@ -10,6 +10,7 @@ import com.hermesandroid.relay.data.ProfileMemoryUpdateResponse
 import com.hermesandroid.relay.data.LegacyProfileInspectorClient
 import com.hermesandroid.relay.data.RelaySkillToggleResult
 import com.hermesandroid.relay.data.RelayEndpointContract
+import com.hermesandroid.relay.data.isDashboardRelayIngressUrl
 import kotlinx.coroutines.Dispatchers
 import kotlinx.coroutines.withContext
 import kotlinx.serialization.SerializationException
@@ -51,11 +52,19 @@ class RelayProfileInspectorClient(
    private val okHttpClient: OkHttpClient,
    private val relayUrlProvider: () -> String?,
    private val sessionTokenProvider: suspend () -> String?,
+    private val dashboardHttpClientProvider: ((String) -> OkHttpClient?)? = null,
 ) : LegacyProfileInspectorClient {

    private fun relayHttpBaseOrNull(url: String): String? =
        RelayEndpointContract.parseOrNull(url)?.httpBaseUrl

+    private fun callClient(relayUrl: String): OkHttpClient =
+        if (isDashboardRelayIngressUrl(relayUrl)) {
+            dashboardHttpClientProvider?.invoke(relayUrl) ?: okHttpClient
+        } else {
+            okHttpClient
+        }
+
    companion object {
        private const val TAG = "RelayProfileInspector"

@@ -211,12 +220,12 @@ class RelayProfileInspectorClient(
        val request = Request.Builder()
            .url(url)
            .put(body.toRequestBody(JSON_MEDIA_TYPE))
-            .header("Authorization", "Bearer $sessionToken")
+            .relaySessionCredential(sessionToken, isDashboardRelayIngressUrl(relayUrl))
            .header("Accept", "application/json")
            .build()

        try {
-            okHttpClient.newCall(request).execute().use { response ->
+            callClient(relayUrl).newCall(request).execute().use { response ->
                if (!response.isSuccessful) {
                    val reason = when (response.code) {
                        400 -> {
@@ -314,12 +323,12 @@ class RelayProfileInspectorClient(
        val request = Request.Builder()
            .url(url)
            .put(bodyJson.toRequestBody(JSON_MEDIA_TYPE))
-            .header("Authorization", "Bearer $sessionToken")
+            .relaySessionCredential(sessionToken, isDashboardRelayIngressUrl(relayUrl))
            .header("Accept", "application/json")
            .build()

        try {
-            okHttpClient.newCall(request).execute().use { response ->
+            callClient(relayUrl).newCall(request).execute().use { response ->
                when (response.code) {
                    in 200..299 -> Result.success(RelaySkillToggleResult.Ok)
                    501 -> Result.success(RelaySkillToggleResult.NotImplemented)
@@ -374,11 +383,11 @@ class RelayProfileInspectorClient(
        val request = Request.Builder()
            .url(url)
            .method("OPTIONS", null)
-            .header("Authorization", "Bearer $sessionToken")
+            .relaySessionCredential(sessionToken, isDashboardRelayIngressUrl(relayUrl))
            .build()

        try {
-            okHttpClient.newCall(request).execute().use { response ->
+            callClient(relayUrl).newCall(request).execute().use { response ->
                when (response.code) {
                    501 -> false
                    404, 405 -> false
@@ -464,12 +473,12 @@ class RelayProfileInspectorClient(
        val request = Request.Builder()
            .url(url)
            .get()
-            .header("Authorization", "Bearer $sessionToken")
+            .relaySessionCredential(sessionToken, isDashboardRelayIngressUrl(relayUrl))
            .header("Accept", "application/json")
            .build()

        try {
-            okHttpClient.newCall(request).execute().use { response ->
+            callClient(relayUrl).newCall(request).execute().use { response ->
                if (!response.isSuccessful) {
                    val reason = when (response.code) {
                        401, 403 -> "Unauthorized — re-pair with the relay"
@@ -7,6 +7,7 @@ import com.hermesandroid.relay.data.EnhancedVoiceOverrides
 import com.hermesandroid.relay.data.MessageRole
 import com.hermesandroid.relay.data.RealtimeConversationContextMessage
 import com.hermesandroid.relay.data.RelayEndpointContract
+import com.hermesandroid.relay.data.isDashboardRelayIngressUrl
 import kotlinx.coroutines.CompletableDeferred
 import kotlinx.coroutines.CoroutineScope
 import kotlinx.coroutines.Dispatchers
@@ -89,7 +90,7 @@ import java.util.concurrent.atomic.AtomicReference
 */
 class RelayVoiceClient(
    private val context: Context,
-    private val okHttpClient: OkHttpClient,
+    okHttpClient: OkHttpClient,
    private val relayUrlProvider: () -> String?,
    private val sessionTokenProvider: suspend () -> String?,
    private val profileNameProvider: () -> String? = { null },
@@ -100,8 +101,26 @@ class RelayVoiceClient(
    private val realtimeResumeRetryIntervalMs: Long = REALTIME_RESUME_RETRY_INTERVAL_MS,
    private val realtimeResumeRetryWindowMs: Long = REALTIME_RESUME_RETRY_WINDOW_MS,
    private val voiceOutputFirstAudioTimeoutMs: Long = VOICE_OUTPUT_FIRST_AUDIO_TIMEOUT_MS,
+    /** Dashboard-authenticated transport for same-origin plugin ingress. */
+    private val dashboardHttpClientProvider: ((String) -> OkHttpClient?)? = null,
+    /** Fresh Dashboard ticket request for every ingress voice socket dial. */
+    private val dashboardIngressWebSocketRequestProvider:
+        (suspend (String) -> Request?)? = null,
 ) {

+    private val directOkHttpClient: OkHttpClient = okHttpClient
+
+    /** Resolve lazily so a Dashboard route/client handoff is observed. */
+    private val okHttpClient: OkHttpClient
+        get() {
+            val relayUrl = relayUrlProvider()?.trim().orEmpty()
+            return if (isDashboardRelayIngressUrl(relayUrl)) {
+                dashboardHttpClientProvider?.invoke(relayUrl) ?: directOkHttpClient
+            } else {
+                directOkHttpClient
+            }
+        }
+
    companion object {
        private const val TAG = "RelayVoiceClient"
        private val json = Json { ignoreUnknownKeys = true; isLenient = true }
@@ -144,13 +163,36 @@ class RelayVoiceClient(
        }
    }

+    private fun callClient(url: String): OkHttpClient =
+        if (isDashboardRelayIngressUrl(url)) {
+            dashboardHttpClientProvider?.invoke(url) ?: directOkHttpClient
+        } else {
+            directOkHttpClient
+        }
+
    private fun sessionClient(): OkHttpClient =
        okHttpClient.newBuilder()
            .callTimeout(SESSION_CALL_TIMEOUT_SECONDS, TimeUnit.SECONDS)
            .build()

    private fun openWebSocket(request: Request, listener: WebSocketListener): WebSocket =
-        webSocketFactory?.invoke(request, listener) ?: okHttpClient.newWebSocket(request, listener)
+        webSocketFactory?.invoke(request, listener)
+            ?: callClient(request.url.toString()).newWebSocket(request, listener)
+
+    private suspend fun voiceWebSocketRequest(url: String, relayToken: String): Request {
+        val dashboardIngress = isDashboardRelayIngressUrl(url)
+        val outerRequest = if (dashboardIngress) {
+            val provider = dashboardIngressWebSocketRequestProvider
+                ?: throw IOException("Dashboard Relay voice authorization is unavailable")
+            provider(url)
+                ?: throw IOException("Dashboard Relay voice ticket could not be minted")
+        } else {
+            Request.Builder().url(url).build()
+        }
+        return outerRequest.newBuilder()
+            .relaySessionCredential(relayToken, dashboardIngress)
+            .build()
+    }

    private fun requestRouteProbeOnce(
        surface: String,
@@ -196,7 +238,7 @@ class RelayVoiceClient(
        val request = Request.Builder()
            .url(urlWithProfile("$httpBase/voice/transcribe"))
            .post(body)
-            .header("Authorization", "Bearer $token")
+            .relaySessionCredential(token, isDashboardRelayIngressUrl(httpBase))
            .header("Accept", "application/json")
            .build()

@@ -278,7 +320,7 @@ class RelayVoiceClient(
        val request = Request.Builder()
            .url("$httpBase/voice/synthesize")
            .post(bodyJson.toRequestBody(JSON_MEDIA_TYPE))
-            .header("Authorization", "Bearer $token")
+            .relaySessionCredential(token, isDashboardRelayIngressUrl(httpBase))
            .header("Accept", "audio/mpeg")
            .build()

@@ -333,7 +375,7 @@ class RelayVoiceClient(
        val request = Request.Builder()
            .url(urlWithProfile("$httpBase/voice/config"))
            .get()
-            .header("Authorization", "Bearer $token")
+            .relaySessionCredential(token, isDashboardRelayIngressUrl(httpBase))
            .header("Accept", "application/json")
            .build()

@@ -375,7 +417,7 @@ class RelayVoiceClient(
        val request = Request.Builder()
            .url(urlWithProfile("$httpBase/voice/realtime/config"))
            .get()
-            .header("Authorization", "Bearer $token")
+            .relaySessionCredential(token, isDashboardRelayIngressUrl(httpBase))
            .header("Accept", "application/json")
            .build()

@@ -414,7 +456,7 @@ class RelayVoiceClient(
        val request = Request.Builder()
            .url(urlWithProfile("$httpBase/voice/realtime/providers/${pathSegment(provider)}/options"))
            .get()
-            .header("Authorization", "Bearer $token")
+            .relaySessionCredential(token, isDashboardRelayIngressUrl(httpBase))
            .header("Accept", "application/json")
            .build()

@@ -462,7 +504,7 @@ class RelayVoiceClient(
        val request = Request.Builder()
            .url(urlWithProfile("$httpBase/voice/realtime/providers/${pathSegment(provider)}/validate"))
            .post(payload.toString().toRequestBody(JSON_MEDIA_TYPE))
-            .header("Authorization", "Bearer $token")
+            .relaySessionCredential(token, isDashboardRelayIngressUrl(httpBase))
            .header("Accept", "application/json")
            .build()

@@ -515,7 +557,7 @@ class RelayVoiceClient(
        val request = Request.Builder()
            .url(urlWithProfile("$httpBase/voice/realtime/config"))
            .patch(payload.toString().toRequestBody(JSON_MEDIA_TYPE))
-            .header("Authorization", "Bearer $token")
+            .relaySessionCredential(token, isDashboardRelayIngressUrl(httpBase))
            .header("Accept", "application/json")
            .build()

@@ -618,7 +660,7 @@ class RelayVoiceClient(
        val request = Request.Builder()
            .url(urlWithProfile("$httpBase/voice/realtime-agent/config"))
            .patch(payload.toString().toRequestBody(JSON_MEDIA_TYPE))
-            .header("Authorization", "Bearer $token")
+            .relaySessionCredential(token, isDashboardRelayIngressUrl(httpBase))
            .header("Accept", "application/json")
            .build()
        try {
@@ -650,7 +692,7 @@ class RelayVoiceClient(
        val request = Request.Builder()
            .url(urlWithProfile("$httpBase/voice/output/config"))
            .get()
-            .header("Authorization", "Bearer $token")
+            .relaySessionCredential(token, isDashboardRelayIngressUrl(httpBase))
            .header("Accept", "application/json")
            .build()

@@ -689,7 +731,7 @@ class RelayVoiceClient(
        val request = Request.Builder()
            .url(urlWithProfile("$httpBase/voice/output/providers/${pathSegment(provider)}/options"))
            .get()
-            .header("Authorization", "Bearer $token")
+            .relaySessionCredential(token, isDashboardRelayIngressUrl(httpBase))
            .header("Accept", "application/json")
            .build()

@@ -741,7 +783,7 @@ class RelayVoiceClient(
        val request = Request.Builder()
            .url(urlWithProfile("$httpBase/voice/output/providers/${pathSegment(provider)}/validate"))
            .post(payload.toString().toRequestBody(JSON_MEDIA_TYPE))
-            .header("Authorization", "Bearer $token")
+            .relaySessionCredential(token, isDashboardRelayIngressUrl(httpBase))
            .header("Accept", "application/json")
            .build()

@@ -812,7 +854,7 @@ class RelayVoiceClient(
        val request = Request.Builder()
            .url(urlWithProfile("$httpBase/voice/output/config"))
            .patch(payload.toString().toRequestBody(JSON_MEDIA_TYPE))
-            .header("Authorization", "Bearer $token")
+            .relaySessionCredential(token, isDashboardRelayIngressUrl(httpBase))
            .header("Accept", "application/json")
            .build()

@@ -845,6 +887,7 @@ class RelayVoiceClient(
        onHandoff: (VoiceHandoffEvent) -> Unit = {},
        onEvent: (RealtimeVoiceEvent) -> Unit,
    ): Result<VoiceOutputSummary> = withContext(Dispatchers.IO) {
+        val owningScope = this
        val httpBase = resolveHttpBase()
            ?: return@withContext Result.failure(IllegalStateException("Relay URL not configured"))
        val token = resolveBearerToken()
@@ -869,6 +912,7 @@ class RelayVoiceClient(
        val completed = AtomicBoolean(false)
        val resumeAttempted = AtomicBoolean(false)
        val routeProbeRequested = AtomicBoolean(false)
+        val resumeDialPending = AtomicBoolean(false)
        val currentSocket = AtomicReference<WebSocket?>()
        val firstAudioSeen = AtomicBoolean(false)
        val socketGeneration = AtomicLong(0L)
@@ -907,14 +951,14 @@ class RelayVoiceClient(
            }
        }

-        fun openSocket(resume: Boolean, overrideWsBase: String? = null): WebSocket {
+        suspend fun openSocket(resume: Boolean, overrideWsBase: String? = null): WebSocket {
            val generation = socketGeneration.incrementAndGet()
            val currentWsBase = overrideWsBase ?: resolveWebSocketBase()
                ?: throw IOException("Relay URL not configured")
-            val request = Request.Builder()
-                .url("$currentWsBase${session.websocketPath}")
-                .header("Authorization", "Bearer $token")
-                .build()
+            val request = voiceWebSocketRequest(
+                "$currentWsBase${session.websocketPath}",
+                token,
+            )
            Log.i(
                TAG,
                "Voice output websocket opening resume=$resume url=${request.url}",
@@ -1044,23 +1088,28 @@ class RelayVoiceClient(
                        return
                    }
                    if (session.resumeSupported && !session.resumeToken.isNullOrBlank() && resumeAttempted.compareAndSet(false, true)) {
-                        try {
-                            Log.i(TAG, "Voice output websocket failed; attempting resume: ${t.message}")
-                            requestRouteProbeOnce("Voice output", t.message, routeProbeRequested)
-                            onHandoff(
-                                VoiceHandoffEvent(
-                                    label = context.getString(R.string.voice_diag_connection_changed),
-                                    detail = t.message,
-                                    route = routeLabel(webSocket.request().url.toString()),
-                                    active = true,
-                                )
+                        Log.i(TAG, "Voice output websocket failed; scheduling resume: ${t.message}")
+                        requestRouteProbeOnce("Voice output", t.message, routeProbeRequested)
+                        onHandoff(
+                            VoiceHandoffEvent(
+                                label = context.getString(R.string.voice_diag_connection_changed),
+                                detail = t.message,
+                                route = routeLabel(webSocket.request().url.toString()),
+                                active = true,
                            )
-                            openSocket(resume = true)
-                            return
-                        } catch (e: Exception) {
-                            completeFailure("Voice output resume failed: ${e.message ?: "network error"}", e)
-                            return
+                        )
+                        if (resumeDialPending.compareAndSet(false, true)) {
+                            owningScope.launch {
+                                try {
+                                    openSocket(resume = true)
+                                } catch (e: Exception) {
+                                    completeFailure("Voice output resume failed: ${e.message ?: "network error"}", e)
+                                } finally {
+                                    resumeDialPending.set(false)
+                                }
+                            }
                        }
+                        return
                    }
                    completeFailure("Voice output websocket failed: ${t.message}", t)
                }
@@ -1090,23 +1139,28 @@ class RelayVoiceClient(
                        return
                    }
                    if (session.resumeSupported && !session.resumeToken.isNullOrBlank() && resumeAttempted.compareAndSet(false, true)) {
-                        try {
-                            Log.i(TAG, "Voice output websocket closed code=$code; attempting resume")
-                            requestRouteProbeOnce("Voice output", "Closed $code $reason", routeProbeRequested)
-                            onHandoff(
-                                VoiceHandoffEvent(
-                                    label = context.getString(R.string.voice_diag_connection_changed),
-                                    detail = "Closed $code $reason",
-                                    route = routeLabel(webSocket.request().url.toString()),
-                                    active = true,
-                                )
+                        Log.i(TAG, "Voice output websocket closed code=$code; scheduling resume")
+                        requestRouteProbeOnce("Voice output", "Closed $code $reason", routeProbeRequested)
+                        onHandoff(
+                            VoiceHandoffEvent(
+                                label = context.getString(R.string.voice_diag_connection_changed),
+                                detail = "Closed $code $reason",
+                                route = routeLabel(webSocket.request().url.toString()),
+                                active = true,
                            )
-                            openSocket(resume = true)
-                            return
-                        } catch (e: Exception) {
-                            completeFailure("Voice output resume failed: ${e.message ?: "network error"}", e)
-                            return
+                        )
+                        if (resumeDialPending.compareAndSet(false, true)) {
+                            owningScope.launch {
+                                try {
+                                    openSocket(resume = true)
+                                } catch (e: Exception) {
+                                    completeFailure("Voice output resume failed: ${e.message ?: "network error"}", e)
+                                } finally {
+                                    resumeDialPending.set(false)
+                                }
+                            }
                        }
+                        return
                    }
                    completeFailure("Voice output websocket closed before completion: $code $reason")
                }
@@ -1178,10 +1232,7 @@ class RelayVoiceClient(
        var audioChunks = 0
        var audioBytes = 0

-        val request = Request.Builder()
-            .url("$wsBase${session.websocketPath}")
-            .header("Authorization", "Bearer $token")
-            .build()
+        val request = voiceWebSocketRequest("$wsBase${session.websocketPath}", token)

        val listener = object : WebSocketListener() {
            override fun onOpen(webSocket: WebSocket, response: Response) {
@@ -1306,6 +1357,7 @@ class RelayVoiceClient(
        prewarm: Boolean = false,
        onEvent: (RealtimeVoiceEvent, RealtimeAgentSessionControl) -> Unit,
    ): Result<RealtimeVoiceSummary> = withContext(Dispatchers.IO) {
+        val owningScope = this
        val persistent = turnInputs != null
        val httpBase = resolveHttpBase()
            ?: return@withContext Result.failure(IllegalStateException("Relay URL not configured"))
@@ -1649,7 +1701,7 @@ class RelayVoiceClient(
            }
        }

-        fun openSocket(
+        suspend fun openSocket(
            resume: Boolean,
            overrideWsBase: String? = null,
            expectedResumeEpisode: Long? = null,
@@ -1673,10 +1725,10 @@ class RelayVoiceClient(
            val (currentWsBase, request) = try {
                val base = overrideWsBase ?: resolveWebSocketBase()
                    ?: throw IOException("Relay URL not configured")
-                val socketRequest = Request.Builder()
-                    .url("$base${session.websocketPath}")
-                    .header("Authorization", "Bearer $token")
-                    .build()
+                val socketRequest = voiceWebSocketRequest(
+                    "$base${session.websocketPath}",
+                    token,
+                )
                Log.i(
                    TAG,
                    "Realtime agent websocket opening resume=$resume url=${socketRequest.url}",
@@ -1765,12 +1817,20 @@ class RelayVoiceClient(
                                // A synchronous failure callback can replace this
                                // socket while setup sends are still unwinding. A
                                // stale attempt must not terminate the newer route.
-                                if (currentSocket.get() !== webSocket || completed.get()) return
+                                if (
+                                    terminalCallbackSeen.get() ||
+                                    currentSocket.get() !== webSocket ||
+                                    completed.get()
+                                ) return
                                completeFailure("Realtime agent websocket rejected session setup")
                                webSocket.close(1011, "session setup failed")
                                return
                            }
-                            if (currentSocket.get() !== webSocket || completed.get()) return
+                            if (
+                                terminalCallbackSeen.get() ||
+                                currentSocket.get() !== webSocket ||
+                                completed.get()
+                            ) return
                            if (resume) {
                                Log.i(TAG, "Realtime agent resume sent; awaiting relay confirmation")
                            } else {
@@ -1984,16 +2044,17 @@ class RelayVoiceClient(
                            )
                        )
                        if (!claim.openImmediately) return
-                        try {
-                            openSocket(
-                                resume = true,
-                                expectedResumeEpisode = claim.waiting.episode,
-                            )
-                            return
-                        } catch (e: Exception) {
-                            completeFailure("Realtime agent resume failed: ${e.message ?: "network error"}", e)
-                            return
+                        owningScope.launch {
+                            try {
+                                openSocket(
+                                    resume = true,
+                                    expectedResumeEpisode = claim.waiting.episode,
+                                )
+                            } catch (e: Exception) {
+                                completeFailure("Realtime agent resume failed: ${e.message ?: "network error"}", e)
+                            }
                        }
+                        return
                    }
                    val transitionRevision = claimTerminalSocket(
                        webSocket,
@@ -2097,16 +2158,17 @@ class RelayVoiceClient(
                            )
                        )
                        if (!claim.openImmediately) return
-                        try {
-                            openSocket(
-                                resume = true,
-                                expectedResumeEpisode = claim.waiting.episode,
-                            )
-                            return
-                        } catch (e: Exception) {
-                            completeFailure("Realtime agent resume failed: ${e.message ?: "network error"}", e)
-                            return
+                        owningScope.launch {
+                            try {
+                                openSocket(
+                                    resume = true,
+                                    expectedResumeEpisode = claim.waiting.episode,
+                                )
+                            } catch (e: Exception) {
+                                completeFailure("Realtime agent resume failed: ${e.message ?: "network error"}", e)
+                            }
                        }
+                        return
                    }
                    val transitionRevision = claimTerminalSocket(
                        webSocket,
@@ -2294,9 +2356,7 @@ class RelayVoiceClient(
            null
        }

-        val socket = openSocket(resume = false)
-            ?: currentSocket.get()
-            ?: throw IOException("Realtime agent websocket handshake was already pending")
+        val initialSocket = openSocket(resume = false) ?: currentSocket.get()
        val routeWatcherResumeEpisode = AtomicLong(0L)
        val routeWatcher = startRouteResumeWatcher(
            surface = "Realtime agent",
@@ -2378,7 +2438,7 @@ class RelayVoiceClient(
            awaitRealtimeAgentCompletion()
        } catch (e: Exception) {
            currentSocket.get()?.close(1001, "timeout")
-            socket.close(1001, "timeout")
+            initialSocket?.close(1001, "timeout")
            Result.failure(IOException(e.message ?: "Realtime agent timed out", e))
        } finally {
            routeWatcher?.cancel()
@@ -2394,7 +2454,7 @@ class RelayVoiceClient(
        resumeSupported: Boolean,
        resumeToken: String?,
        currentSocket: AtomicReference<WebSocket?>,
-        openResumeSocket: (String?) -> WebSocket?,
+        openResumeSocket: suspend (String?) -> WebSocket?,
        onHandoff: (VoiceHandoffEvent) -> Unit,
        completeFailure: (String, Throwable?) -> Unit,
    ): Job? {
@@ -2454,7 +2514,7 @@ class RelayVoiceClient(
        val request = Request.Builder()
            .url(urlWithProfile("$httpBase$path"))
            .get()
-            .header("Authorization", "Bearer $token")
+            .relaySessionCredential(token, isDashboardRelayIngressUrl(httpBase))
            .header("Accept", "application/json")
            .build()
        try {
@@ -2493,7 +2553,7 @@ class RelayVoiceClient(
        val request = Request.Builder()
            .url(urlWithProfile("$httpBase$pathPrefix/${pathSegment(provider)}/options"))
            .get()
-            .header("Authorization", "Bearer $token")
+            .relaySessionCredential(token, isDashboardRelayIngressUrl(httpBase))
            .header("Accept", "application/json")
            .build()
        try {
@@ -2541,7 +2601,7 @@ class RelayVoiceClient(
        val request = Request.Builder()
            .url(urlWithProfile("$httpBase$pathPrefix/${pathSegment(provider)}/validate"))
            .post(payload.toString().toRequestBody(JSON_MEDIA_TYPE))
-            .header("Authorization", "Bearer $token")
+            .relaySessionCredential(token, isDashboardRelayIngressUrl(httpBase))
            .header("Accept", "application/json")
            .build()
        try {
@@ -2593,7 +2653,7 @@ class RelayVoiceClient(
        val request = Request.Builder()
            .url(urlWithProfile("$httpBase$path"))
            .patch(payload.toString().toRequestBody(JSON_MEDIA_TYPE))
-            .header("Authorization", "Bearer $token")
+            .relaySessionCredential(token, isDashboardRelayIngressUrl(httpBase))
            .header("Accept", "application/json")
            .build()
        try {
@@ -2678,7 +2738,7 @@ class RelayVoiceClient(
        val request = Request.Builder()
            .url("$httpBase/voice/realtime/session")
            .post(body.toRequestBody(JSON_MEDIA_TYPE))
-            .header("Authorization", "Bearer $token")
+            .relaySessionCredential(token, isDashboardRelayIngressUrl(httpBase))
            .header("Accept", "application/json")
            .build()
        return try {
@@ -2763,7 +2823,7 @@ class RelayVoiceClient(
        val request = Request.Builder()
            .url("$httpBase/voice/realtime-agent/session")
            .post(body.toRequestBody(JSON_MEDIA_TYPE))
-            .header("Authorization", "Bearer $token")
+            .relaySessionCredential(token, isDashboardRelayIngressUrl(httpBase))
            .header("Accept", "application/json")
            .build()
        return try {
@@ -2804,7 +2864,7 @@ class RelayVoiceClient(
        val request = Request.Builder()
            .url("$httpBase/voice/output/session")
            .post(body.toRequestBody(JSON_MEDIA_TYPE))
-            .header("Authorization", "Bearer $token")
+            .relaySessionCredential(token, isDashboardRelayIngressUrl(httpBase))
            .header("Accept", "application/json")
            .build()
        return try {
@@ -5,6 +5,7 @@ import android.util.Log
 import com.hermesandroid.relay.R
 import com.hermesandroid.relay.data.EndpointCandidate
 import com.hermesandroid.relay.data.RelayEndpointContract
+import com.hermesandroid.relay.data.isDashboardRelayIngressUrl
 import com.hermesandroid.relay.data.primaryRouteUrl
 import com.hermesandroid.relay.data.routeAuthority
 import com.hermesandroid.relay.diagnostics.DiagnosticCategory
@@ -12,16 +13,24 @@ import com.hermesandroid.relay.diagnostics.DiagnosticSeverity
 import com.hermesandroid.relay.diagnostics.DiagnosticsLog
 import com.hermesandroid.relay.diagnostics.NetworkDiagnosticGuidance
 import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.CoroutineScope
+import kotlinx.coroutines.CoroutineStart
+import kotlinx.coroutines.CancellationException
+import kotlinx.coroutines.Deferred
+import kotlinx.coroutines.SupervisorJob
 import kotlinx.coroutines.TimeoutCancellationException
 import kotlinx.coroutines.async
-import kotlinx.coroutines.awaitAll
 import kotlinx.coroutines.coroutineScope
+import kotlinx.coroutines.channels.Channel
 import kotlinx.coroutines.flow.MutableStateFlow
 import kotlinx.coroutines.flow.StateFlow
 import kotlinx.coroutines.flow.asStateFlow
 import kotlinx.coroutines.flow.update
+import kotlinx.coroutines.currentCoroutineContext
+import kotlinx.coroutines.ensureActive
 import kotlinx.coroutines.withContext
 import kotlinx.coroutines.withTimeoutOrNull
+import kotlinx.coroutines.launch
 import okhttp3.HttpUrl.Companion.toHttpUrlOrNull
 import okhttp3.OkHttpClient
 import okhttp3.Request
@@ -43,7 +52,7 @@ import javax.net.ssl.SSLException
 */
 data class RouteProbeOutcome(
    val reachable: Boolean,
-    /** Short human-readable failure reason; null when [reachable]. */
+    /** Short result detail; protected ingress may be reachable but require authorization. */
    val detail: String? = null,
    /** Resolver-clock timestamp of when the probe finished. */
    val atMillis: Long,
@@ -68,12 +77,15 @@ enum class EndpointSurface {
 *
 * ### Semantics (locked by ADR 24)
 *
- *  * **Strict priority.** `priority = 0` is highest. If a priority-0
- *    candidate is reachable we use it; reachability never promotes a lower
- *    priority over a higher one. Reachability is **only** the tiebreaker
- *    among candidates that share the same priority.
- *  * **Reachability probe.** Dashboard-first routes use `GET
- *    ${dashboard.url}/api/status`; legacy API routes use `GET
+ *  * **Strict selection priority with speculative probes.** `priority = 0`
+ *    is highest. All supported priority groups start probing together so one
+ *    dead route cannot add its full timeout before the fallback even starts,
+ *    but a lower-priority result is considered only after every higher group
+ *    has failed. Reachability is **only** the tiebreaker among candidates that
+ *    share the same priority.
+ *  * **Reachability probe.** Dashboard-first routes use lightweight `GET
+ *    ${dashboard.url}/api/health` and fall back to `/api/status` only for a
+ *    confirmed legacy host without the health route. Legacy API routes use `GET
 *    ${api.url}/health`. Relay-only routes use `GET ${relay.httpUrl}/health`.
 *    Each request has a 4-second
 *    per-candidate timeout. Positive results are cached longer than negative
@@ -126,9 +138,21 @@ class EndpointResolver(
        val baseUrl: String,
        val requestUrl: String,
        val path: String,
+        val legacyFallbackRequestUrl: String? = null,
+        val legacyFallbackPath: String? = null,
+    )
+
+    private data class ProbeHttpResult(
+        val code: Int,
+        val successful: Boolean,
+        val bodyPreview: String,
    )

    private val probeCache = ConcurrentHashMap<String, CacheEntry>()
+    private val inFlightProbes = ConcurrentHashMap<String, Deferred<Boolean>>()
+    private val probeScope = CoroutineScope(SupervisorJob() + Dispatchers.IO)
+    private val probeStateLock = Any()
+    private var probeGeneration = 0L

    private val _probeOutcomes = MutableStateFlow<Map<String, RouteProbeOutcome>>(emptyMap())

@@ -140,6 +164,12 @@ class EndpointResolver(
     */
    val probeOutcomes: StateFlow<Map<String, RouteProbeOutcome>> = _probeOutcomes.asStateFlow()

+    /** Last independently observed verdict for one configured route surface. */
+    fun outcomeFor(
+        candidate: EndpointCandidate,
+        surface: EndpointSurface,
+    ): RouteProbeOutcome? = probeOutcomes.value[outcomeKey(candidate, surface)]
+
    private fun recordOutcome(
        candidate: EndpointCandidate,
        surface: EndpointSurface,
@@ -177,41 +207,48 @@ class EndpointResolver(
        const val CACHE_TTL_MS = 60_000L

        /**
-         * Failed probe-result cache TTL. Keep this intentionally short:
+         * Failed probe-result cache TTL. Keep this bounded but long enough
+         * that ordinary screen/profile lifecycle work cannot repeatedly pay
+         * the full probe timeout:
         * Android may report a new cellular/VPN network before Tailscale has
         * finished routing, so a single early ConnectException must not keep a
-         * viable fallback route suppressed through the voice resume window.
+         * viable fallback route suppressed for long. Network-change and
+         * explicit-probe paths invalidate the cache immediately.
         */
-        const val NEGATIVE_CACHE_TTL_MS = 2_000L
+        const val NEGATIVE_CACHE_TTL_MS = 15_000L

        /** Shared timeout wording so HEAD-timeout and socket-timeout read the same. */
        private const val PROBE_TIMEOUT_DETAIL = "No answer (timed out)"

        /**
-         * Stable cache key for one candidate surface:
-         * `"<surface>|<role>|<surface host>:<port>"`.
+         * Stable outcome/cache key for one candidate surface:
+         * `"<surface>|<role>|<normalized service base>"`.
         * Roles are preserved case-verbatim (HMAC canonicalization contract)
         * but hostnames are lowercased — two roles pointing at the same
         * host:port share reachability state.
         */
-        internal fun cacheKey(
+        fun outcomeKey(
            candidate: EndpointCandidate,
            surface: EndpointSurface = EndpointSurface.Standard,
        ): String {
-            val authority = when (surface) {
+            val serviceIdentity = when (surface) {
                EndpointSurface.Standard ->
                    candidate.routeAuthority() ?: candidate.primaryRouteUrl().orEmpty().lowercase()
                EndpointSurface.Dashboard ->
-                    routeAuthority(candidate.pluginProxyRoutesOrNull()?.dashboardBaseUrl ?: candidate.dashboard?.url).orEmpty()
+                    routeIdentity(candidate.pluginProxyRoutesOrNull()?.dashboardBaseUrl ?: candidate.dashboard?.url)
                EndpointSurface.Api ->
-                    routeAuthority(candidate.pluginProxyRoutesOrNull()?.apiBaseUrl ?: candidate.api?.url).orEmpty()
+                    routeIdentity(candidate.pluginProxyRoutesOrNull()?.apiBaseUrl ?: candidate.api?.url)
                EndpointSurface.Relay ->
-                    candidate.pluginProxyRoutesOrNull()?.authority
-                        ?: routeAuthority(candidate.relay?.url).orEmpty()
+                    routeIdentity(candidate.pluginProxyRoutesOrNull()?.relayHttpUrl ?: candidate.relay?.url)
            }
-            return "${surface.name.lowercase()}|${candidate.role}|$authority"
+            return "${surface.name.lowercase()}|${candidate.role}|$serviceIdentity"
        }

+        internal fun cacheKey(
+            candidate: EndpointCandidate,
+            surface: EndpointSurface = EndpointSurface.Standard,
+        ): String = outcomeKey(candidate, surface)
+
        private fun routeAuthority(rawUrl: String?): String? {
            val candidate = rawUrl?.trim()?.takeIf { it.isNotBlank() } ?: return null
            val httpUrl = when {
@@ -223,17 +260,31 @@ class EndpointResolver(
            }
            return httpUrl.toHttpUrlOrNull()?.let { url -> "${url.host}:${url.port}" }
        }
+
+        private fun routeIdentity(rawUrl: String?): String {
+            val candidate = rawUrl?.trim()?.takeIf { it.isNotBlank() } ?: return ""
+            val httpCandidate = when {
+                candidate.startsWith("ws://", ignoreCase = true) ->
+                    "http://${candidate.substringAfter("://")}"
+                candidate.startsWith("wss://", ignoreCase = true) ->
+                    "https://${candidate.substringAfter("://")}"
+                else -> candidate
+            }
+            return httpCandidate.toHttpUrlOrNull()?.let { url ->
+                val path = url.encodedPath.trimEnd('/').takeIf { it.isNotEmpty() }.orEmpty()
+                "${url.scheme}://${url.host}:${url.port}$path"
+            } ?: candidate.lowercase().trimEnd('/')
+        }
    }

    /**
     * Run the resolver against [candidates].
     *
-     *  1. Group by `priority` ascending.
-     *  2. For each priority group, race the selected surface's health probe
-     *     against every candidate in the group. First 2xx wins; ties
-     *     broken by whichever response lands first.
-     *  3. If the entire group is unreachable, fall through to the next
-     *     priority group.
+     *  1. Group by `priority` ascending and by supported/experimental tier.
+     *  2. Start every supported priority group speculatively, while awaiting
+     *     their results in strict priority order. Within a group, first 2xx
+     *     wins. If higher groups fail, a completed fallback is ready at once.
+     *  3. Probe the experimental tier only when every supported group fails.
     *  4. If no candidate is reachable, return `null` — the caller falls back
     *     to its legacy single-URL path.
     *
@@ -254,14 +305,15 @@ class EndpointResolver(
        // last-resort fallback without displacing Tailscale or direct TLS.
        val supported = eligible.filterNot { it.experimental || it.role.equals("outbound_broker", ignoreCase = true) }
        val experimental = eligible.filter { it.experimental || it.role.equals("outbound_broker", ignoreCase = true) }
-        val groups = (supported.groupBy { it.priority }.toSortedMap().values +
-            experimental.groupBy { it.priority }.toSortedMap().values)
+        val tiers = listOf(
+            supported.groupBy { it.priority }.toSortedMap().values.toList(),
+            experimental.groupBy { it.priority }.toSortedMap().values.toList(),
+        )

-        for (group in groups) {
-            val priority = group.first().priority
-            Log.d(TAG, "probing priority=$priority group (size=${group.size})")
-            val winner = raceGroup(group, surface)
+        for (groups in tiers) {
+            val winner = racePriorityGroups(groups, surface)
            if (winner != null) {
+                val priority = winner.priority
                val winnerUrl = probeTarget(winner, surface)?.baseUrl
                Log.i(TAG, "resolve winner: role=${winner.role} " +
                    "surface=$surface route=$winnerUrl priority=$priority")
@@ -287,6 +339,76 @@ class EndpointResolver(
        return null
    }

+    /**
+     * Start all groups in one stability tier together, but consume them in
+     * strict priority order. Cancelling losing waiters never cancels the shared
+     * physical probes, so their cache/outcome records still warm later calls.
+     */
+    private suspend fun racePriorityGroups(
+        groups: List<List<EndpointCandidate>>,
+        surface: EndpointSurface,
+    ): EndpointCandidate? = coroutineScope {
+        if (groups.isEmpty()) return@coroutineScope null
+        val races = groups.map { group ->
+            val priority = group.first().priority
+            Log.d(TAG, "probing priority=$priority group (size=${group.size})")
+            group to async(Dispatchers.IO) { raceGroup(group, surface) }
+        }
+        for ((_, race) in races) {
+            val winner = race.await()
+            if (winner != null) {
+                races.forEach { (_, other) -> if (other !== race) other.cancel() }
+                return@coroutineScope winner
+            }
+        }
+        null
+    }
+
+    /**
+     * Probe every independently configured route surface in parallel.
+     *
+     * Dashboard/Gateway, optional API fallback, and Relay do not vouch for one
+     * another even when they share a hostname. Unconfigured surfaces are
+     * omitted. Invalidated probes publish no result, preserving the prior
+     * outcome until a fresh physical probe completes.
+     */
+    suspend fun probeSurfaces(
+        candidate: EndpointCandidate,
+    ): Map<EndpointSurface, RouteProbeOutcome> = coroutineScope {
+        val configuredSurfaces = listOf(
+            EndpointSurface.Dashboard,
+            EndpointSurface.Api,
+            EndpointSurface.Relay,
+        ).filter { probeTarget(candidate, it) != null }
+
+        configuredSurfaces
+            .map { surface ->
+                async {
+                    isReachable(candidate, surface)
+                    surface to currentCachedOutcomeFor(candidate, surface)
+                }
+            }
+            .mapNotNull { deferred ->
+                val (surface, outcome) = deferred.await()
+                outcome?.let { surface to it }
+            }
+            .toMap()
+    }
+
+    /** Return only an outcome still backed by this generation's probe cache. */
+    private fun currentCachedOutcomeFor(
+        candidate: EndpointCandidate,
+        surface: EndpointSurface,
+    ): RouteProbeOutcome? = synchronized(probeStateLock) {
+        val key = cacheKey(candidate, surface)
+        val cached = probeCache[key]
+        if (cached != null && cached.expiresAt > clock()) {
+            probeOutcomes.value[key]
+        } else {
+            null
+        }
+    }
+
    /**
     * Race all candidates in [group] (same priority tier) in parallel. First
     * candidate that reports reachable — whether from cache or a fresh probe
@@ -316,20 +438,23 @@ class EndpointResolver(
        }

        return coroutineScope {
-            val deferred = group.map { candidate ->
-                async(Dispatchers.IO) {
-                    if (isReachable(candidate, surface)) candidate else null
+            val completions = Channel<EndpointCandidate?>(group.size)
+            val waiters = group.map { candidate ->
+                launch(Dispatchers.IO) {
+                    completions.send(if (isReachable(candidate, surface)) candidate else null)
                }
            }
-            // Collect results in arrival order: iterate through awaitAll +
-            // pick the first non-null. awaitAll preserves input order, which
-            // means a slow-but-reachable priority-0 candidate would block a
-            // fast-and-reachable sibling. But HEAD /health against a healthy
-            // API route replies in <100ms and the timeout caps stragglers at 2s,
-            // so this is acceptable in practice. A true "first to arrive"
-            // would need kotlinx.coroutines Channel plumbing that's not
-            // worth the weight here.
-            deferred.awaitAll().firstOrNull { it != null }
+            repeat(group.size) {
+                val completed = completions.receive()
+                if (completed != null) {
+                    // Cancelling these waiters does not cancel the shared
+                    // physical probes below; their outcomes still populate
+                    // the cache for the next resolution.
+                    waiters.forEach { it.cancel() }
+                    return@coroutineScope completed
+                }
+            }
+            null
        }
    }

@@ -350,10 +475,33 @@ class EndpointResolver(
            return cached.reachable
        }

-        val reachable = probe(candidate, surface)
-        val ttl = if (reachable) CACHE_TTL_MS else NEGATIVE_CACHE_TTL_MS
-        probeCache[key] = CacheEntry(expiresAt = now + ttl, reachable = reachable)
-        return reachable
+        // Resolution is triggered from several independent lifecycle paths
+        // (connection hydration, profile restoration, network callbacks, and
+        // explicit probes). Share one physical request per route/surface so a
+        // slow optional endpoint cannot accumulate duplicate 4-second probes.
+        val shared = synchronized(probeStateLock) {
+            inFlightProbes[key] ?: run {
+                val generation = probeGeneration
+                probeScope.async(start = CoroutineStart.LAZY) {
+                    probe(candidate, surface, generation)
+                }.also { deferred ->
+                    inFlightProbes[key] = deferred
+                    deferred.invokeOnCompletion { inFlightProbes.remove(key, deferred) }
+                    deferred.start()
+                }
+            }
+        }
+        return try {
+            shared.await()
+        } catch (_: CancellationException) {
+            // clearCache() owns cancellation of the shared physical probe. A
+            // still-active waiter treats that invalidated result as unknown so
+            // same-priority races can publish their non-winning completion.
+            // Genuine caller cancellation still propagates from ensureActive.
+            currentCoroutineContext().ensureActive()
+            Log.d(TAG, "probe invalidated for $key")
+            false
+        }
    }

    /**
@@ -367,6 +515,7 @@ class EndpointResolver(
    private suspend fun probe(
        candidate: EndpointCandidate,
        surface: EndpointSurface,
+        generation: Long,
    ): Boolean {
        val startedAtMs = clock()
        val operation = when (surface) {
@@ -378,19 +527,25 @@ class EndpointResolver(
        val target = probeTarget(candidate, surface)
        val url = target?.requestUrl?.toHttpUrlOrNull()
            ?: run {
-                Log.w(TAG, "probe: invalid url for role=${candidate.role}")
-                DiagnosticsLog.record(
-                    category = DiagnosticCategory.Endpoint,
-                    severity = DiagnosticSeverity.Error,
-                    title = context?.getString(R.string.endpoint_diag_probe_invalid) ?: "Endpoint probe invalid",
-                    detail = "No valid Dashboard, API, or Relay URL",
-                    operation = operation,
-                    endpointRole = candidate.role,
-                    configuredUrl = candidate.primaryRouteUrl(),
-                    suggestion = "Edit or re-pair this route so it contains a valid service URL.",
-                )
-                recordOutcome(candidate, surface, reachable = false, detail = "Invalid route URL")
-                return false
+                return completeProbe(
+                    candidate = candidate,
+                    surface = surface,
+                    generation = generation,
+                    reachable = false,
+                    detail = "Invalid route URL",
+                ) {
+                    Log.w(TAG, "probe: invalid url for role=${candidate.role}")
+                    DiagnosticsLog.record(
+                        category = DiagnosticCategory.Endpoint,
+                        severity = DiagnosticSeverity.Error,
+                        title = context?.getString(R.string.endpoint_diag_probe_invalid) ?: "Endpoint probe invalid",
+                        detail = "No valid Dashboard, API, or Relay URL",
+                        operation = operation,
+                        endpointRole = candidate.role,
+                        configuredUrl = candidate.primaryRouteUrl(),
+                        suggestion = "Edit or re-pair this route so it contains a valid service URL.",
+                    )
+                }
            }
        val fastClient = (clientForCandidate?.invoke(candidate) ?: httpClient).newBuilder()
            .connectTimeout(PROBE_TIMEOUT_MS, TimeUnit.MILLISECONDS)
@@ -398,49 +553,96 @@ class EndpointResolver(
            .writeTimeout(PROBE_TIMEOUT_MS, TimeUnit.MILLISECONDS)
            .callTimeout(PROBE_TIMEOUT_MS, TimeUnit.MILLISECONDS)
            .build()
-        val requestBuilder = Request.Builder()
-            .url(url)
-            .header("Accept", "*/*")
-        // Hermes API's aiohttp health route accepts GET but returns 405 to
-        // HEAD. That response proves connectivity while the old probe marked
-        // the route unreachable. Health payloads are tiny, so follow the
-        // endpoint's actual public contract on every surface.
-        val request = requestBuilder.get().build()
        return withContext(Dispatchers.IO) {
            try {
                withTimeoutOrNull(PROBE_TIMEOUT_MS + 200L) {
-                    fastClient.newCall(request).execute().use { resp ->
-                        val ok = resp.isSuccessful
-                        val probeTitle = if (ok) {
+                    val primary = executeProbeHttp(fastClient, url)
+                    val fallbackUrl = target.legacyFallbackRequestUrl
+                        ?.takeIf { dashboardHealthNeedsLegacyFallback(primary) }
+                        ?.toHttpUrlOrNull()
+                    val result = fallbackUrl?.let { executeProbeHttp(fastClient, it) } ?: primary
+                    val resultPath = if (fallbackUrl != null) {
+                        target.legacyFallbackPath ?: target.path
+                    } else {
+                        target.path
+                    }
+                    val resultUrl = fallbackUrl?.toString() ?: target.requestUrl
+                    result.let { response ->
+                        val authRequired = surface == EndpointSurface.Relay &&
+                            isDashboardRelayIngressUrl(candidate.relay?.url) &&
+                            response.code in setOf(401, 403)
+                        val reachable = response.successful || authRequired
+                        val probeTitle = if (reachable) {
                            context?.getString(R.string.endpoint_diag_probe_ok) ?: "Endpoint probe ok"
                        } else {
                            context?.getString(R.string.endpoint_diag_probe_failed) ?: "Endpoint probe failed"
                        }
+                        completeProbe(
+                            candidate = candidate,
+                            surface = surface,
+                            generation = generation,
+                            reachable = reachable,
+                            detail = when {
+                                authRequired -> "HTTP ${response.code} · Dashboard authorization required"
+                                reachable -> null
+                                else -> "HTTP ${response.code} from $resultPath"
+                            },
+                        ) {
+                            DiagnosticsLog.record(
+                                category = DiagnosticCategory.Endpoint,
+                                severity = if (reachable) DiagnosticSeverity.Info else DiagnosticSeverity.Warning,
+                                title = probeTitle,
+                                detail = when {
+                                    authRequired -> "HTTP ${response.code} · Dashboard authorization required"
+                                    reachable -> null
+                                    else -> "HTTP ${response.code}"
+                                },
+                                operation = operation,
+                                endpointRole = candidate.role,
+                                configuredUrl = target.baseUrl,
+                                requestUrl = resultUrl,
+                                elapsedMs = clock() - startedAtMs,
+                                suggestion = if (reachable) {
+                                    null
+                                } else {
+                                    NetworkDiagnosticGuidance.forHttpStatus(
+                                        response.code,
+                                        surface.diagnosticTarget(),
+                                    )
+                                },
+                            )
+                        }
+                    }
+                } ?: run {
+                    completeProbe(
+                        candidate = candidate,
+                        surface = surface,
+                        generation = generation,
+                        reachable = false,
+                        detail = PROBE_TIMEOUT_DETAIL,
+                    ) {
                        DiagnosticsLog.record(
                            category = DiagnosticCategory.Endpoint,
-                            severity = if (ok) DiagnosticSeverity.Info else DiagnosticSeverity.Warning,
-                            title = probeTitle,
-                            detail = if (ok) null else "HTTP ${resp.code}",
+                            severity = DiagnosticSeverity.Warning,
+                            title = context?.getString(R.string.endpoint_diag_probe_timeout) ?: "Endpoint probe timeout",
+                            detail = "No ${target.path} response in ${PROBE_TIMEOUT_MS}ms",
                            operation = operation,
                            endpointRole = candidate.role,
                            configuredUrl = target.baseUrl,
                            requestUrl = target.requestUrl,
                            elapsedMs = clock() - startedAtMs,
-                            suggestion = if (ok) {
-                                null
-                            } else {
-                                NetworkDiagnosticGuidance.forHttpStatus(resp.code, surface.diagnosticTarget())
-                            },
+                            suggestion = "Check network routing or firewall rules between this device and ${surface.diagnosticTarget()}.",
                        )
-                        recordOutcome(
-                            candidate,
-                            surface,
-                            reachable = ok,
-                            detail = if (ok) null else "HTTP ${resp.code} from ${target.path}",
-                        )
-                        ok
                    }
-                } ?: run {
+                }
+            } catch (_: TimeoutCancellationException) {
+                completeProbe(
+                    candidate = candidate,
+                    surface = surface,
+                    generation = generation,
+                    reachable = false,
+                    detail = PROBE_TIMEOUT_DETAIL,
+                ) {
                    DiagnosticsLog.record(
                        category = DiagnosticCategory.Endpoint,
                        severity = DiagnosticSeverity.Warning,
@@ -453,45 +655,81 @@ class EndpointResolver(
                        elapsedMs = clock() - startedAtMs,
                        suggestion = "Check network routing or firewall rules between this device and ${surface.diagnosticTarget()}.",
                    )
-                    recordOutcome(candidate, surface, reachable = false, detail = PROBE_TIMEOUT_DETAIL)
-                    false
                }
-            } catch (_: TimeoutCancellationException) {
-                DiagnosticsLog.record(
-                    category = DiagnosticCategory.Endpoint,
-                    severity = DiagnosticSeverity.Warning,
-                    title = context?.getString(R.string.endpoint_diag_probe_timeout) ?: "Endpoint probe timeout",
-                    detail = "No ${target.path} response in ${PROBE_TIMEOUT_MS}ms",
-                    operation = operation,
-                    endpointRole = candidate.role,
-                    configuredUrl = target.baseUrl,
-                    requestUrl = target.requestUrl,
-                    elapsedMs = clock() - startedAtMs,
-                    suggestion = "Check network routing or firewall rules between this device and ${surface.diagnosticTarget()}.",
-                )
-                recordOutcome(candidate, surface, reachable = false, detail = PROBE_TIMEOUT_DETAIL)
-                false
+            } catch (e: CancellationException) {
+                throw e
            } catch (e: Exception) {
-                Log.d(TAG, "probe failed role=${candidate.role} " +
-                    "route=${target.baseUrl}: ${e.javaClass.simpleName}")
-                DiagnosticsLog.record(
-                    category = DiagnosticCategory.Endpoint,
-                    severity = DiagnosticSeverity.Warning,
-                    title = context?.getString(R.string.endpoint_diag_probe_failed) ?: "Endpoint probe failed",
+                completeProbe(
+                    candidate = candidate,
+                    surface = surface,
+                    generation = generation,
+                    reachable = false,
                    detail = humanProbeFailure(e),
-                    operation = operation,
-                    endpointRole = candidate.role,
-                    configuredUrl = target.baseUrl,
-                    requestUrl = target.requestUrl,
-                    elapsedMs = clock() - startedAtMs,
-                    suggestion = NetworkDiagnosticGuidance.forThrowable(e, surface.diagnosticTarget()),
-                )
-                recordOutcome(candidate, surface, reachable = false, detail = humanProbeFailure(e))
-                false
+                ) {
+                    Log.d(TAG, "probe failed role=${candidate.role} " +
+                        "route=${target.baseUrl}: ${e.javaClass.simpleName}")
+                    DiagnosticsLog.record(
+                        category = DiagnosticCategory.Endpoint,
+                        severity = DiagnosticSeverity.Warning,
+                        title = context?.getString(R.string.endpoint_diag_probe_failed) ?: "Endpoint probe failed",
+                        detail = humanProbeFailure(e),
+                        operation = operation,
+                        endpointRole = candidate.role,
+                        configuredUrl = target.baseUrl,
+                        requestUrl = target.requestUrl,
+                        elapsedMs = clock() - startedAtMs,
+                        suggestion = NetworkDiagnosticGuidance.forThrowable(e, surface.diagnosticTarget()),
+                    )
+                }
            }
        }
    }

+    private fun executeProbeHttp(client: OkHttpClient, url: okhttp3.HttpUrl): ProbeHttpResult {
+        val request = Request.Builder()
+            .url(url)
+            .header("Accept", "application/json")
+            .get()
+            .build()
+        return client.newCall(request).execute().use { response ->
+            ProbeHttpResult(
+                code = response.code,
+                successful = response.isSuccessful,
+                bodyPreview = response.peekBody(4_096L).string(),
+            )
+        }
+    }
+
+    /** Official Desktop compatibility for Hermes versions predating `/api/health`. */
+    private fun dashboardHealthNeedsLegacyFallback(result: ProbeHttpResult): Boolean =
+        result.code == 404 ||
+            (result.code == 401 && result.bodyPreview.contains("no_cookie", ignoreCase = true))
+
+    /** Commit one physical probe only if it still belongs to the active cache generation. */
+    private suspend fun completeProbe(
+        candidate: EndpointCandidate,
+        surface: EndpointSurface,
+        generation: Long,
+        reachable: Boolean,
+        detail: String?,
+        recordDiagnostic: () -> Unit,
+    ): Boolean {
+        currentCoroutineContext().ensureActive()
+        synchronized(probeStateLock) {
+            if (generation != probeGeneration) {
+                throw CancellationException("Endpoint probe invalidated")
+            }
+            recordDiagnostic()
+            recordOutcome(candidate, surface, reachable, detail)
+            val ttl = if (reachable) CACHE_TTL_MS else NEGATIVE_CACHE_TTL_MS
+            probeCache[cacheKey(candidate, surface)] = CacheEntry(
+                expiresAt = clock() + ttl,
+                reachable = reachable,
+            )
+        }
+        return reachable
+    }
+
    /** Choose the standard Dashboard/Gateway surface first when advertised. */
    private fun probeTarget(
        candidate: EndpointCandidate,
@@ -499,10 +737,22 @@ class EndpointResolver(
    ): ProbeTarget? {
        if (surface == EndpointSurface.Dashboard) {
            candidate.pluginProxyRoutesOrNull()?.dashboardBaseUrl?.let { base ->
-                return ProbeTarget(base, "$base/api/status", "/dashboard/api/status")
+                return ProbeTarget(
+                    baseUrl = base,
+                    requestUrl = "$base/api/health",
+                    path = "/dashboard/api/health",
+                    legacyFallbackRequestUrl = "$base/api/status",
+                    legacyFallbackPath = "/dashboard/api/status",
+                )
            }
            candidate.dashboard?.url?.trim()?.trimEnd('/')?.takeIf { it.isNotBlank() }?.let { base ->
-                return ProbeTarget(base, "$base/api/status", "/api/status")
+                return ProbeTarget(
+                    baseUrl = base,
+                    requestUrl = "$base/api/health",
+                    path = "/api/health",
+                    legacyFallbackRequestUrl = "$base/api/status",
+                    legacyFallbackPath = "/api/status",
+                )
            }
            return null
        }
@@ -530,8 +780,10 @@ class EndpointResolver(
            ?.let { base ->
                return ProbeTarget(
                    baseUrl = base,
-                    requestUrl = "$base/api/status",
-                    path = "/api/status",
+                    requestUrl = "$base/api/health",
+                    path = "/api/health",
+                    legacyFallbackRequestUrl = "$base/api/status",
+                    legacyFallbackPath = "/api/status",
                )
            }

@@ -602,17 +854,19 @@ class EndpointResolver(
        candidate: EndpointCandidate,
        surface: EndpointSurface = EndpointSurface.Standard,
    ) {
-        val key = cacheKey(candidate, surface)
-        probeCache[key] = CacheEntry(
-            expiresAt = clock() + NEGATIVE_CACHE_TTL_MS,
-            reachable = false,
-        )
-        recordOutcome(
-            candidate,
-            surface,
-            reachable = false,
-            detail = "Network changed — assumed offline",
-        )
+        synchronized(probeStateLock) {
+            val key = cacheKey(candidate, surface)
+            probeCache[key] = CacheEntry(
+                expiresAt = clock() + NEGATIVE_CACHE_TTL_MS,
+                reachable = false,
+            )
+            recordOutcome(
+                candidate,
+                surface,
+                reachable = false,
+                detail = "Network changed — assumed offline",
+            )
+        }
    }

    /**
@@ -623,7 +877,17 @@ class EndpointResolver(
     * just-died route must not outlive the handoff.
     */
    internal fun clearCache() {
-        probeCache.clear()
+        val staleProbes = synchronized(probeStateLock) {
+            probeGeneration += 1L
+            probeCache.clear()
+            inFlightProbes.values.toList().also { inFlightProbes.clear() }
+        }
+        // An explicit re-probe must not join a request that began before the
+        // invalidation signal. Cancellation is resolver-owned (not waiter-
+        // owned), so ordinary lifecycle cancellation still leaves shared
+        // probes alive for other callers. The generation check prevents a
+        // late InterruptedIOException/response from publishing stale state.
+        staleProbes.forEach { it.cancel() }
    }

    /** Test-only: snapshot the current cache for assertion purposes. */
@@ -43,15 +43,16 @@ object HermesLanDiscovery {
    private const val TAG = "HermesLanDiscovery"
    private const val MAX_HOSTS = 254
    private const val MAX_CONCURRENT_PROBES = 32
-    private const val PROBE_TIMEOUT_MS = 650L
+    private const val PROBE_TIMEOUT_MS = 750L
    private const val IPV4_MASK = 0xFFFF_FFFFL

    suspend fun scan(
        context: Context,
        apiPort: Int = 8642,
        dashboardPort: Int = 9119,
+        dashboardOnly: Boolean = false,
    ): List<HermesLanDiscoveryResult> = withContext(Dispatchers.IO) {
-        val hosts = localLanHosts(context.applicationContext)
+        val hosts = prioritizeHostSweep(localLanHosts(context.applicationContext))
        if (hosts.isEmpty()) return@withContext emptyList()

        val client = OkHttpClient.Builder()
@@ -66,7 +67,13 @@ object HermesLanDiscovery {
            hosts.map { host ->
                async {
                    semaphore.withPermit {
-                        probeHost(client, host, apiPort, dashboardPort)?.let { result ->
+                        probeHost(
+                            client,
+                            host,
+                            apiPort,
+                            dashboardPort,
+                            dashboardOnly,
+                        )?.let { result ->
                            result.copy(hostname = resolveHostname(host))
                        }
                    }
@@ -88,6 +95,7 @@ object HermesLanDiscovery {
        host: String,
        apiPort: Int,
        dashboardPort: Int,
+        dashboardOnly: Boolean,
    ): HermesLanDiscoveryResult? {
        val apiUrl = "http://$host:$apiPort"
        val dashboardUrl = "http://$host:$dashboardPort"
@@ -95,12 +103,18 @@ object HermesLanDiscovery {
            client = client,
            url = "$dashboardUrl/api/status",
            expectedBody = ::looksLikeDashboardStatus,
+            attempts = 2,
        )
-        val apiReachable = probe(
-            client = client,
-            url = "$apiUrl/health",
-            expectedBody = ::looksLikeApiHealth,
-        )
+        if (dashboardOnly && !dashboardReachable) return null
+        val apiReachable = if (dashboardOnly) {
+            false
+        } else {
+            probe(
+                client = client,
+                url = "$apiUrl/health",
+                expectedBody = ::looksLikeApiHealth,
+            )
+        }
        if (!dashboardReachable && !apiReachable) return null
        return HermesLanDiscoveryResult(
            host = host,
@@ -115,6 +129,7 @@ object HermesLanDiscovery {
        client: OkHttpClient,
        url: String,
        expectedBody: (String, String) -> Boolean,
+        attempts: Int = 1,
    ): Boolean {
        val httpUrl = url.toHttpUrlOrNull() ?: return false
        val request = Request.Builder()
@@ -123,21 +138,25 @@ object HermesLanDiscovery {
            .header("Accept", "application/json, text/plain, */*")
            .build()

-        return try {
-            client.newCall(request).execute().use { response ->
-                if (response.code == 401 || response.code == 403) {
-                    return true
+        repeat(attempts.coerceAtLeast(1)) { attempt ->
+            try {
+                client.newCall(request).execute().use { response ->
+                    if (response.code == 401 || response.code == 403) {
+                        return true
+                    }
+                    if (!response.isSuccessful) {
+                        if (response.code >= 500 && attempt + 1 < attempts) return@use
+                        return false
+                    }
+                    val contentType = response.header("Content-Type").orEmpty()
+                    val body = response.body.string().take(2_048)
+                    if (expectedBody(body, contentType)) return true
                }
-                if (!response.isSuccessful) {
-                    return false
-                }
-                val contentType = response.header("Content-Type").orEmpty()
-                val body = response.body.string().take(2_048)
-                expectedBody(body, contentType)
+            } catch (_: Exception) {
+                if (attempt + 1 >= attempts) return false
            }
-        } catch (_: Exception) {
-            false
        }
+        return false
    }

    private suspend fun resolveHostname(address: String): String? =
@@ -158,6 +177,23 @@ object HermesLanDiscovery {
        return normalized
    }

+    /** Interleave low/high host suffixes so `.1` and `.250` are both early. */
+    internal fun prioritizeHostSweep(hosts: List<String>): List<String> {
+        val sorted = hosts.distinct().sortedBy { address ->
+            address.split('.').fold(0L) { acc, part ->
+                (acc shl 8) + (part.toLongOrNull() ?: 0L)
+            }
+        }
+        val prioritized = ArrayList<String>(sorted.size)
+        var low = 0
+        var high = sorted.lastIndex
+        while (low <= high) {
+            prioritized += sorted[low++]
+            if (low <= high) prioritized += sorted[high--]
+        }
+        return prioritized
+    }
+
    private fun looksLikeDashboardStatus(body: String, contentType: String): Boolean {
        val lower = body.lowercase()
        return contentType.contains("json", ignoreCase = true) && (
@@ -48,6 +48,9 @@ interface VoiceAudioClient {
    val effectiveRoute: VoiceAudioRoute
        get() = route

+    /** Temporary client-policy override; the shared router honors it before user prefs. */
+    fun setRouteOverride(route: VoiceAudioRoute?) = Unit
+
    suspend fun transcribe(audioFile: File): Result<String>
    suspend fun synthesize(text: String): Result<File>

@@ -82,8 +85,15 @@ class AutoVoiceAudioClient(
    private val standardReadyProvider: () -> Boolean,
    private val relayReadyProvider: () -> Boolean,
 ) : VoiceAudioClient {
+    @Volatile
+    private var routeOverride: VoiceAudioRoute? = null
+
+    override fun setRouteOverride(route: VoiceAudioRoute?) {
+        routeOverride = route
+    }
+
    override val route: VoiceAudioRoute
-        get() = routeProvider()
+        get() = routeOverride ?: routeProvider()

    /**
     * Resolve the configured preference to the backend a call would land on:
@@ -92,7 +102,7 @@ class AutoVoiceAudioClient(
     * decide whether standard-only limitations (global TTS) currently apply.
     */
    override val effectiveRoute: VoiceAudioRoute
-        get() = when (routeProvider()) {
+        get() = when (route) {
            VoiceAudioRoute.Standard -> VoiceAudioRoute.Standard
            VoiceAudioRoute.Relay -> VoiceAudioRoute.Relay
            VoiceAudioRoute.Auto ->
@@ -114,7 +124,7 @@ class AutoVoiceAudioClient(
    private suspend fun <T> runWithSelectedRoute(
        block: suspend (VoiceAudioClient) -> Result<T>,
    ): Result<T> {
-        return when (routeProvider()) {
+        return when (route) {
            VoiceAudioRoute.Standard -> {
                if (!standardReadyProvider()) {
                    Result.failure(
@@ -1006,6 +1006,56 @@ class ChatHandler {
        }
    }

+    /**
+     * Bound the ephemeral, read-only child-watch projection. This is stricter
+     * than the main transcript: system rows and tool results are not part of
+     * the preview contract, and one live child must not retain unbounded text.
+     */
+    internal fun boundReadOnlyPreview(
+        maxMessages: Int = 100,
+        maxTotalChars: Int = 32_000,
+        maxFieldChars: Int = 8_000,
+        maxToolChars: Int = 1_000,
+    ): Boolean {
+        var truncated = false
+        _messages.update { current ->
+            val visible = current.filterNot { it.role == MessageRole.SYSTEM }
+            if (visible.size != current.size || visible.size > maxMessages) truncated = true
+            var remaining = maxTotalChars
+            val kept = mutableListOf<ChatMessage>()
+            visible.takeLast(maxMessages).asReversed().forEach { message ->
+                if (remaining <= 0) {
+                    truncated = true
+                    return@forEach
+                }
+                fun bounded(value: String, limit: Int): String {
+                    val allowed = minOf(limit, remaining)
+                    val next = value.takeLast(allowed)
+                    if (next.length != value.length) truncated = true
+                    remaining -= next.length
+                    return next
+                }
+                val content = bounded(message.content, maxFieldChars)
+                val thinking = bounded(message.thinkingContent, maxFieldChars)
+                val tools = message.toolCalls.takeLast(50).map { tool ->
+                    if (message.toolCalls.size > 50) truncated = true
+                    tool.copy(
+                        args = tool.args?.let { bounded(it, maxToolChars) },
+                        result = null,
+                        error = tool.error?.let { bounded(it, maxToolChars) },
+                    )
+                }
+                kept += message.copy(
+                    content = content,
+                    thinkingContent = thinking,
+                    toolCalls = tools,
+                )
+            }
+            kept.asReversed()
+        }
+        return truncated
+    }
+
    /**
     * Rehydrate the last client-owned state of an unfinished turn.
     *
@@ -2036,7 +2086,7 @@ class ChatHandler {
    /**
     * Update sessions list from API response.
     */
-    fun updateSessions(items: List<SessionItem>) {
+    fun updateSessions(items: List<SessionItem>, append: Boolean = false) {
        // Index the current rows so a server row that arrives without a title
        // can inherit a title we already know locally. Auto-titling is a
        // fire-and-forget background job on the server (upstream
@@ -2075,7 +2125,7 @@ class ChatHandler {
                outputTokens = item.outputTokens ?: 0,
                actualCostUsd = item.actualCostUsd,
                estimatedCostUsd = item.estimatedCostUsd,
-                isActive = item.isActive,
+                recentlyActive = item.isActive,
                updatedAt = activityAtMs,
                startedAt = startedAtMs,
                lastActivityAt = lastActivityAtMs,
@@ -2109,9 +2159,22 @@ class ChatHandler {
        } else {
            null
        }
-        _sessions.value = if (pending != null) listOf(pending) + mapped else mapped
+        val resolved = if (append) {
+            (_sessions.value + mapped)
+                .distinctBy { it.sessionId }
+                .sortedByDescending { it.activityTimestamp }
+        } else {
+            mapped
+        }
+        _sessions.value = if (pending != null && resolved.none { it.sessionId == pending.sessionId }) {
+            listOf(pending) + resolved
+        } else {
+            resolved
+        }
    }

+    fun appendSessions(items: List<SessionItem>) = updateSessions(items, append = true)
+
    fun clearSessions() {
        _sessions.value = emptyList()
    }
@@ -3030,7 +3093,9 @@ class ChatHandler {
    fun onSubagentEvent(messageId: String, event: GatewaySubagentEvent) {
        val label = event.goal.trim().take(60).ifBlank { null }
        when (event.phase) {
-            GatewaySubagentEvent.Phase.START -> {
+            GatewaySubagentEvent.Phase.SPAWN_REQUESTED,
+            GatewaySubagentEvent.Phase.START,
+            -> {
                if (label != null) subagentLabels[event.taskIndex] = label
                event.subagentId?.takeIf(String::isNotBlank)?.let {
                    subagentIds[event.taskIndex] = it
@@ -3,6 +3,7 @@ package com.hermesandroid.relay.network.upstream
 import android.content.Context
 import com.hermesandroid.relay.data.Profile
 import com.hermesandroid.relay.network.shutdownOffMainThread
+import com.hermesandroid.relay.network.usage.ProviderUsageResponse
 import com.hermesandroid.relay.network.upstream.models.MessageItem
 import com.hermesandroid.relay.network.upstream.models.MessageListResponse
 import com.hermesandroid.relay.network.upstream.models.SessionItem
@@ -17,6 +18,8 @@ import com.hermesandroid.relay.auth.SecureStoreCache
 import com.hermesandroid.relay.auth.SessionTokenStore
 import com.hermesandroid.relay.auth.buildRawTokenStore
 import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.suspendCancellableCoroutine
+import kotlinx.coroutines.withTimeoutOrNull
 import kotlinx.coroutines.withContext
 import kotlinx.serialization.Serializable
 import kotlinx.serialization.SerialName
@@ -33,6 +36,8 @@ import kotlinx.serialization.json.contentOrNull
 import kotlinx.serialization.json.jsonObject
 import kotlinx.serialization.json.jsonPrimitive
 import kotlinx.serialization.json.put
+import okhttp3.Call
+import okhttp3.Callback
 import okhttp3.Cookie
 import okhttp3.CookieJar
 import okhttp3.HttpUrl
@@ -49,6 +54,7 @@ import java.io.InputStream
 import java.io.OutputStream
 import java.net.URLEncoder
 import java.util.concurrent.TimeUnit
+import kotlin.coroutines.resume
 import okio.BufferedSink

 // Status/session/provider snapshots are @Serializable so the Manage tab's
@@ -56,6 +62,7 @@ import okio.BufferedSink
@Serializable
 data class DashboardStatus(
    val authRequired: Boolean,
+    @SerialName("install_id") val installId: String? = null,
    val authProviders: List<String> = emptyList(),
    val authProviderDetails: List<DashboardAuthProvider> = emptyList(),
    @SerialName("auth_flows") val authFlows: List<String> = emptyList(),
@@ -314,12 +321,16 @@ data class ElevenLabsVoices(
 class DashboardApiClient(
    baseUrl: String,
    private val okHttpClient: OkHttpClient = defaultClient(),
+    private val ownsHttpClient: Boolean = true,
    private val json: Json = Json {
        ignoreUnknownKeys = true
        isLenient = true
        coerceInputValues = true
    },
    private val nowMillis: () -> Long = System::currentTimeMillis,
+    private val sessionReadTimeoutMillis: Long = SESSION_READ_TIMEOUT_MILLIS,
+    private val controlReadTimeoutMillis: Long = CONTROL_READ_TIMEOUT_MILLIS,
+    private val sessionEnrichmentBudgetMillis: Long = SESSION_ENRICHMENT_BUDGET_MILLIS,
 ) {
    private val baseUrl: String = baseUrl.trim().trimEnd('/')
    private val sessionPrScanLock = Any()
@@ -447,6 +458,25 @@ class DashboardApiClient(
     */
    suspend fun getConfig(): Result<JsonObject> = getJsonObject("/api/config")

+    suspend fun getProviderUsage(
+        profile: String? = null,
+        sessionId: String? = null,
+    ): Result<ProviderUsageResponse?> {
+        val query = buildList {
+            profile?.trim()?.takeIf { it.isNotEmpty() }?.let {
+                add("profile=${queryValue(it)}")
+            }
+            sessionId?.trim()?.takeIf { it.isNotEmpty() }?.let {
+                add("session_id=${queryValue(it)}")
+            }
+        }
+        val suffix = query.joinToString(prefix = if (query.isEmpty()) "" else "?", separator = "&")
+        return getJsonObject("/api/plugins/hermes-relay/provider-usage$suffix")
+            .mapCatching { root ->
+                json.decodeFromJsonElement(ProviderUsageResponse.serializer(), root)
+            }
+    }
+
    /**
     * The config SCHEMA: `{fields: {<dot.path>: {type, description, category,
     * options?}}, category_order: [...]}`. Describes how to render each field;
@@ -1006,16 +1036,20 @@ class DashboardApiClient(
    suspend fun listSessions(
        profile: String? = null,
        limit: Int = SESSION_LIST_WINDOW_LIMIT,
+        offset: Int = 0,
        archived: String? = null,
+        excludeSources: Collection<String> = emptyList(),
    ): Result<List<SessionItem>> =
        withContext(Dispatchers.IO) {
+            val readDeadlineNanos = System.nanoTime() +
+                TimeUnit.MILLISECONDS.toNanos(sessionReadTimeoutMillis.coerceAtLeast(1L))
            val sessions = linkedMapOf<String, SessionItem>()
            for (page in sessionListPages(limit)) {
                val query = buildList {
                    // Upstream dashboard GET /api/sessions rejects pages over 100.
                    // Keep Android's 200-row drawer window via two bounded pages.
                    add("limit=${page.limit}")
-                    add("offset=${page.offset}")
+                    add("offset=${offset.coerceAtLeast(0) + page.offset}")
                    add("order=recent")
                    add("min_messages=1")
                    val name = profile?.trim().orEmpty()
@@ -1024,8 +1058,33 @@ class DashboardApiClient(
                    // Omitted unless requested so older hosts see an unchanged request.
                    val archivedMode = archived?.trim().orEmpty()
                    if (archivedMode.isNotBlank()) add("archived=${pathSegment(archivedMode)}")
+                    val excluded = excludeSources
+                        .asSequence()
+                        .map(String::trim)
+                        .filter(String::isNotBlank)
+                        .map(String::lowercase)
+                        .distinct()
+                        .sorted()
+                        .toList()
+                    if (excluded.isNotEmpty()) {
+                        add("exclude_sources=${queryValue(excluded.joinToString(","))}")
+                    }
                }.joinToString(prefix = "?", separator = "&")
-                val pageResult = getJson("/api/sessions$query").mapCatching { root ->
+                val remainingReadMillis = TimeUnit.NANOSECONDS.toMillis(
+                    readDeadlineNanos - System.nanoTime(),
+                )
+                if (remainingReadMillis <= 0L) {
+                    return@withContext Result.failure(
+                        IOException("Dashboard session list exceeded its bounded read window"),
+                    )
+                }
+                val pageResult = getJson(
+                    "/api/sessions$query",
+                    // One budget covers the complete 200-row operation. A slow
+                    // first page cannot silently turn the nominal 8s bound into
+                    // 16s when the second page is needed.
+                    callTimeoutMillis = remainingReadMillis,
+                ).mapCatching { root ->
                    val parsed = json.decodeFromJsonElement(SessionListResponse.serializer(), root)
                    parsed.sessions ?: parsed.items ?: parsed.data ?: emptyList()
                }
@@ -1034,13 +1093,20 @@ class DashboardApiClient(
                pageSessions.forEach { sessions.putIfAbsent(it.id, it) }
                if (pageSessions.size < page.limit) break
            }
-            Result.success(
+            val listed = sessions.values.take(limit.coerceIn(1, SESSION_LIST_WINDOW_LIMIT))
+            // Repository/PR decoration is useful drawer metadata, but it is not
+            // authoritative session data. Keep it off the critical path when an
+            // older host or an unavailable GitHub helper stalls: return the exact
+            // profile-scoped rows within a small budget and retry decoration on a
+            // later refresh. Cancellation also cancels the active OkHttp call.
+            val enriched = withTimeoutOrNull(sessionEnrichmentBudgetMillis) {
                enrichSessionWorkState(
-                    sessions.values.take(limit.coerceIn(1, SESSION_LIST_WINDOW_LIMIT)),
+                    listed,
                    fixedProfile = profile?.trim()?.takeIf { it.isNotBlank() }
                        ?: DEFAULT_SESSION_PROFILE_SCOPE,
-                ),
-            )
+                )
+            } ?: listed
+            Result.success(enriched)
        }

    /**
@@ -1206,7 +1272,10 @@ class DashboardApiClient(
                add("order=${page.order}")
                if (name.isNotBlank()) add("profile=${pathSegment(name)}")
            }.joinToString(prefix = "?", separator = "&")
-            getJson("/api/sessions/${pathSegment(sessionId)}/messages$query").mapCatching { root ->
+            getJson(
+                "/api/sessions/${pathSegment(sessionId)}/messages$query",
+                callTimeoutMillis = sessionReadTimeoutMillis,
+            ).mapCatching { root ->
                val parsed = json.decodeFromJsonElement(MessageListResponse.serializer(), root)
                SessionMessagePage(
                    messages = parsed.messages ?: parsed.data ?: parsed.items ?: emptyList(),
@@ -1450,10 +1519,14 @@ class DashboardApiClient(
            .post(ByteArray(0).toRequestBody(null))
            .build()

-        executeJson(request, "Dashboard websocket ticket").mapCatching { root ->
+        executeJson(
+            request,
+            "Dashboard websocket ticket",
+            callTimeoutMillis = controlReadTimeoutMillis,
+        ).mapCatching { root ->
            val ticket = root.stringField("ticket")
                ?: root.stringField("ws_ticket")
-                ?: throw IOException("Dashboard websocket ticket response missing ticket")
+                ?: throw IllegalStateException("Dashboard websocket ticket response missing ticket")
            DashboardWsTicket(
                ticket = ticket,
                ttlSeconds = root.intField("ttl_seconds") ?: root.intField("ttl"),
@@ -1464,47 +1537,88 @@ class DashboardApiClient(
    fun authLoginUrl(provider: String, next: String = "/"): String =
        authLoginUrl(baseUrl = baseUrl, provider = provider, next = next)

-    fun gatewayWebSocketUrl(ticket: String, path: String = "/api/ws"): String? =
-        gatewayWebSocketUrl(baseUrl = baseUrl, ticket = ticket, path = path)
+    fun gatewayWebSocketUrl(
+        ticket: String,
+        path: String = "/api/ws",
+        profile: String? = null,
+    ): String? = gatewayWebSocketUrl(
+        baseUrl = baseUrl,
+        ticket = ticket,
+        path = path,
+        profile = profile,
+    )

-    fun shutdown() = shutdownOffMainThread("DashboardApiClient-shutdown") {
-        okHttpClient.dispatcher.executorService.shutdown()
-        okHttpClient.connectionPool.evictAll()
+    fun shutdown() {
+        if (!ownsHttpClient) return
+        shutdownOffMainThread("DashboardApiClient-shutdown") {
+            okHttpClient.dispatcher.executorService.shutdown()
+            okHttpClient.connectionPool.evictAll()
+        }
    }

-    private suspend fun getJson(path: String): Result<JsonObject> = withContext(Dispatchers.IO) {
+    private suspend fun getJson(
+        path: String,
+        callTimeoutMillis: Long? = null,
+    ): Result<JsonObject> = withContext(Dispatchers.IO) {
        val httpUrl = resolveUrl(path) ?: return@withContext Result.failure(invalidUrlException())
        val request = Request.Builder()
            .url(httpUrl)
            .get()
            .build()
-        executeJson(request, path)
+        executeJson(request, path, callTimeoutMillis)
    }

-    private fun executeJson(request: Request, operation: String): Result<JsonObject> {
-        return try {
-            okHttpClient.newCall(request).execute().use { response ->
-                if (!response.isSuccessful) {
-                    return Result.failure(apiFailure(response, operation))
-                }
-                Result.success(response.readJsonObject(json))
-            }
-        } catch (e: Exception) {
-            Result.failure(e)
-        }
+    private suspend fun executeJson(
+        request: Request,
+        operation: String,
+        callTimeoutMillis: Long? = null,
+    ): Result<JsonObject> = executeCancellable(request, operation, callTimeoutMillis) { response ->
+        response.readJsonObject(json)
    }

-    private fun executeJsonElement(request: Request, operation: String): Result<JsonElement> {
-        return try {
-            okHttpClient.newCall(request).execute().use { response ->
-                if (!response.isSuccessful) {
-                    return Result.failure(apiFailure(response, operation))
-                }
-                Result.success(response.readJsonElement(json))
-            }
-        } catch (e: Exception) {
-            Result.failure(e)
+    private suspend fun executeJsonElement(
+        request: Request,
+        operation: String,
+    ): Result<JsonElement> = executeCancellable(request, operation) { response ->
+        response.readJsonElement(json)
+    }
+
+    /** Bridge OkHttp cancellation to the owning coroutine so superseded profile reads do not linger. */
+    private suspend fun <T> executeCancellable(
+        request: Request,
+        operation: String,
+        callTimeoutMillis: Long? = null,
+        decode: (Response) -> T,
+    ): Result<T> = suspendCancellableCoroutine { continuation ->
+        val call = okHttpClient.newCall(request)
+        callTimeoutMillis?.takeIf { it > 0L }?.let {
+            call.timeout().timeout(it, TimeUnit.MILLISECONDS)
        }
+        continuation.invokeOnCancellation { call.cancel() }
+        call.enqueue(object : Callback {
+            override fun onFailure(call: Call, e: IOException) {
+                runCatching {
+                    if (continuation.isActive) continuation.resume(Result.failure(e))
+                }
+            }
+
+            override fun onResponse(call: Call, response: Response) {
+                val result = response.use {
+                    try {
+                        if (!it.isSuccessful) {
+                            Result.failure(apiFailure(it, operation))
+                        } else {
+                            Result.success(decode(it))
+                        }
+                    } catch (error: Exception) {
+                        Result.failure(error)
+                    }
+                }
+                runCatching {
+                    if (continuation.isActive) continuation.resume(result)
+                }
+            }
+        })
    }

    private suspend fun download(
@@ -1541,6 +1655,13 @@ class DashboardApiClient(
    companion object {
        private val JSON_MEDIA = "application/json; charset=utf-8".toMediaType()
        private const val DEFAULT_SESSION_PROFILE_SCOPE = "__dashboard_default__"
+        // Desktop allows 60s for its 40-row recents request. Android uses a
+        // similarly small initial window and a bounded 20s mobile budget;
+        // the old 8s deadline repeatedly cancelled valid first-load reads on
+        // large profile databases before any row could be shown.
+        private const val SESSION_READ_TIMEOUT_MILLIS = 20_000L
+        private const val CONTROL_READ_TIMEOUT_MILLIS = 8_000L
+        private const val SESSION_ENRICHMENT_BUDGET_MILLIS = 1_500L
        internal const val ACTIVE_SESSION_PR_MISS_TTL_MILLIS = 60_000L
        // Mirrors current upstream `_MANAGED_FILE_MAX_BYTES`; enforcing it
        // client-side avoids uploading a body the Dashboard will reject.
@@ -1683,8 +1804,9 @@ class DashboardApiClient(
            cookieStore: DashboardCookieStore = InMemoryDashboardCookieStore(),
            bearerAuth: DashboardBearerAuth? = null,
        ): OkHttpClient {
+            val cookieJar = DashboardCookieJar(cookieStore)
            val builder = OkHttpClient.Builder()
-                .cookieJar(DashboardCookieJar(cookieStore))
+                .cookieJar(cookieJar)
                .connectTimeout(10, TimeUnit.SECONDS)
                // Skills-hub search fans out server-side with a 30s overall
                // timeout; keep the read window above it so a slow-but-successful
@@ -1692,6 +1814,7 @@ class DashboardApiClient(
                .readTimeout(45, TimeUnit.SECONDS)
                .writeTimeout(30, TimeUnit.SECONDS)
            bearerAuth?.let {
+                it.preferCookiesWhen(cookieJar::hasCookiesFor)
                builder.addInterceptor(it)
                builder.authenticator(it)
            }
@@ -1722,6 +1845,7 @@ class DashboardApiClient(
                authRequired = root.booleanField("auth_required")
                    ?: authObject.booleanField("required")
                    ?: false,
+                installId = root.stringField("install_id")?.trim()?.takeIf(String::isNotEmpty)?.take(256),
                authProviders = providers.map { it.name },
                authProviderDetails = providers,
                authFlows = (root["auth_flows"] as? JsonArray).orEmpty().mapNotNull {
@@ -2050,14 +2174,20 @@ class DashboardCookieJar(
    private val store: DashboardCookieStore,
    private val clockMillis: () -> Long = { System.currentTimeMillis() },
 ) : CookieJar {
+    fun hasCookiesFor(url: HttpUrl): Boolean = loadForRequest(url).isNotEmpty()
+
    override fun saveFromResponse(url: HttpUrl, cookies: List<Cookie>) {
        val now = clockMillis()
        val incoming = cookies.map { StoredDashboardCookie.fromCookie(it) }
            .filterNot { it.isExpired(now) }
+        val incomingSessionFamilies = incoming.mapNotNullTo(mutableSetOf()) {
+            it.sessionFamilyKey()
+        }
        val retained = store.load()
            .filterNot { it.isExpired(now) }
            .filterNot { old -> incoming.any { it.key == old.key } }
-        store.save(retained + incoming)
+            .filterNot { old -> old.sessionFamilyKey() in incomingSessionFamilies }
+        store.save(collapseDashboardSessionCookieVariants(retained + incoming))
    }

    override fun loadForRequest(url: HttpUrl): List<Cookie> {
@@ -2065,7 +2195,9 @@ class DashboardCookieJar(
        // Load once (each load() is a decrypt + JSON decode); prune expired
        // entries back to disk only when something actually expired.
        val all = store.load()
-        val stored = all.filterNot { it.isExpired(now) }
+        val stored = collapseDashboardSessionCookieVariants(
+            all.filterNot { it.isExpired(now) },
+        )
        if (stored.size != all.size) {
            store.save(stored)
        }
@@ -2074,61 +2206,6 @@ class DashboardCookieJar(
    }
 }

-/**
- * Copy only Hermes' authenticated dashboard session cookies to another host
- * that belongs to the same saved Connection. Dashboard cookies are host-only
- * by design, while a Connection may reach one server through LAN and
- * Tailscale hostnames/IPs. The encrypted store remains the source of truth and
- * explicit sign-out clears every mirrored host together.
- *
- * PKCE, SSO-attempt, and unrelated application cookies are intentionally not
- * copied. Secure cookies also remain Secure; this helper never downgrades them
- * for an HTTP route.
- */
-fun mirrorDashboardSessionCookies(
-    store: DashboardCookieStore,
-    targetUrl: String,
-    trustedHosts: Set<String>,
-    clockMillis: () -> Long = { System.currentTimeMillis() },
-): Int {
-    val targetHost = targetUrl.toHttpUrlOrNull()?.host?.lowercase() ?: return 0
-    val allowedHosts = trustedHosts.mapTo(mutableSetOf()) { it.lowercase() }
-    if (targetHost !in allowedHosts) return 0
-
-    val now = clockMillis()
-    val all = store.load()
-    val live = all.filterNot { it.isExpired(now) }
-    val existingTargetKeys = live.asSequence()
-        .filter { it.domain.equals(targetHost, ignoreCase = true) }
-        .map { "${it.name.lowercase()}|$targetHost|${it.path}" }
-        .toSet()
-    val mirrored = live.asSequence()
-        .filter { it.isDashboardSessionCookie() }
-        .filter { it.domain.lowercase() in allowedHosts }
-        .filterNot { it.domain.equals(targetHost, ignoreCase = true) }
-        .groupBy { "${it.name.lowercase()}|${it.path}" }
-        .values
-        .mapNotNull { candidates -> candidates.maxByOrNull { it.expiresAt } }
-        .map { it.copy(domain = targetHost, hostOnly = true) }
-        .filterNot { it.key in existingTargetKeys }
-        .toList()
-
-    if (mirrored.isNotEmpty() || live.size != all.size) {
-        store.save(live + mirrored)
-    }
-    return mirrored.size
-}
-
-private fun StoredDashboardCookie.isDashboardSessionCookie(): Boolean {
-    val bareName = name
-        .removePrefix("__Host-")
-        .removePrefix("__Secure-")
-    return bareName == "hermes_session" ||
-        bareName == "hermes_session_at" ||
-        bareName == "hermes_session_rt" ||
-        bareName == "hermes_session_provider"
-}
-
 /**
 * Cookie jar that resolves the backing per-connection store at request time.
 *
@@ -2190,13 +2267,78 @@ fun importDashboardCookieHeader(
        .filterNot { it.isExpired(now) }
    if (imported.isEmpty()) return 0

+    val importedSessionFamilies = imported.mapNotNullTo(mutableSetOf()) {
+        it.sessionFamilyKey()
+    }
    val retained = store.load()
        .filterNot { it.isExpired(now) }
        .filterNot { old -> imported.any { it.key == old.key } }
-    store.save(retained + imported)
+        .filterNot { old -> old.sessionFamilyKey() in importedSessionFamilies }
+    store.save(collapseDashboardSessionCookieVariants(retained + imported))
    return imported.size
 }

+private val DASHBOARD_SESSION_COOKIE_FAMILIES = setOf(
+    "hermes_session",
+    "hermes_session_at",
+    "hermes_session_rt",
+    "hermes_session_provider",
+)
+
+internal val DASHBOARD_SESSION_COOKIE_VARIANT_NAMES: List<String> =
+    DASHBOARD_SESSION_COOKIE_FAMILIES.flatMap { name ->
+        listOf(name, "__Host-$name", "__Secure-$name")
+    }
+
+private fun isDashboardSessionCookieName(name: String): Boolean =
+    name.lowercase()
+        .removePrefix("__host-")
+        .removePrefix("__secure-") in DASHBOARD_SESSION_COOKIE_FAMILIES
+
+/**
+ * Clear only Hermes session cookies that would be attached to [requestUrl].
+ * Called solely after an explicit provider selection; background 503 probes
+ * never mutate auth state.
+ */
+internal fun clearDashboardSessionCookiesForRequest(
+    store: DashboardCookieStore,
+    requestUrl: String,
+): Int {
+    val url = requestUrl.toHttpUrlOrNull() ?: return 0
+    val current = store.load()
+    val retained = current.filterNot { stored ->
+        isDashboardSessionCookieName(stored.name) && stored.toCookie()?.matches(url) == true
+    }
+    if (retained.size != current.size) store.save(retained)
+    return current.size - retained.size
+}
+
+private fun StoredDashboardCookie.sessionFamilyKey(): String? {
+    val normalized = name.lowercase()
+        .removePrefix("__host-")
+        .removePrefix("__secure-")
+    if (normalized !in DASHBOARD_SESSION_COOKIE_FAMILIES) return null
+    return "$normalized|${domain.lowercase()}|$path"
+}
+
+/**
+ * HTTPS/proxy changes can leave bare, `__Host-`, and `__Secure-` variants in
+ * Android's imported WebView store. Hermes treats those names as one logical
+ * session family and prefers the strict prefix, so coexistence can revive an
+ * older provider session. Preserve list order and keep only the newest variant.
+ */
+private fun collapseDashboardSessionCookieVariants(
+    cookies: List<StoredDashboardCookie>,
+): List<StoredDashboardCookie> {
+    val lastIndexByFamily = mutableMapOf<String, Int>()
+    cookies.forEachIndexed { index, cookie ->
+        cookie.sessionFamilyKey()?.let { lastIndexByFamily[it] = index }
+    }
+    return cookies.filterIndexed { index, cookie ->
+        cookie.sessionFamilyKey()?.let { lastIndexByFamily[it] == index } ?: true
+    }
+}
+
@Serializable
 data class StoredDashboardCookie(
    val name: String,
@@ -2263,10 +2405,59 @@ private fun Response.readJsonElement(json: Json): JsonElement {
    return json.parseToJsonElement(raw)
 }

+internal class DashboardHttpException(
+    val statusCode: Int,
+    message: String,
+) : IOException(message)
+
+internal fun Throwable.isDashboardAuthProviderUnavailable(): Boolean {
+    var current: Throwable? = this
+    val seen = java.util.Collections.newSetFromMap(
+        java.util.IdentityHashMap<Throwable, Boolean>(),
+    )
+    while (current != null && seen.add(current)) {
+        if (
+            current is DashboardHttpException &&
+            current.statusCode == 503 &&
+            current.message.orEmpty().contains("Auth provider", ignoreCase = true) &&
+            current.message.orEmpty().contains("unreachable", ignoreCase = true)
+        ) {
+            return true
+        }
+        current = current.cause
+    }
+    return false
+}
+
+internal fun Throwable.isDashboardSignInRequiredFailure(): Boolean {
+    if (isDashboardAuthProviderUnavailable()) return true
+    var current: Throwable? = this
+    val seen = java.util.Collections.newSetFromMap(
+        java.util.IdentityHashMap<Throwable, Boolean>(),
+    )
+    while (current != null && seen.add(current)) {
+        if (
+            current is DashboardHttpException &&
+            current.statusCode == 401 &&
+            (
+                current.message.orEmpty().contains("no_cookie", ignoreCase = true) ||
+                    current.message.orEmpty().contains("unauthenticated", ignoreCase = true)
+                )
+        ) {
+            return true
+        }
+        current = current.cause
+    }
+    return false
+}
+
 private fun apiFailure(response: Response, operation: String): IOException {
    val bodyDetail = runCatching { response.body.string() }.getOrDefault("")
    val detail = bodyDetail.take(240).ifBlank { response.message }
-    return IOException("$operation failed - HTTP ${response.code}: $detail")
+    return DashboardHttpException(
+        statusCode = response.code,
+        message = "$operation failed - HTTP ${response.code}: $detail",
+    )
 }

 private fun JsonObject?.stringField(name: String): String? =
@@ -281,11 +281,12 @@ class GatewayEventMapper(
                callbacks.onError(payload.string("message") ?: "Gateway error")
            }

-            "subagent.start", "subagent.thinking", "subagent.tool",
+            "subagent.spawn_requested", "subagent.start", "subagent.thinking", "subagent.tool",
            "subagent.progress", "subagent.complete",
            -> {
                clearActivityStatuses()
                val phase = when (type) {
+                    "subagent.spawn_requested" -> GatewaySubagentEvent.Phase.SPAWN_REQUESTED
                    "subagent.start" -> GatewaySubagentEvent.Phase.START
                    "subagent.thinking" -> GatewaySubagentEvent.Phase.THINKING
                    "subagent.tool" -> GatewaySubagentEvent.Phase.TOOL
@@ -306,6 +307,10 @@ class GatewayEventMapper(
                        preview = payload.string("tool_preview") ?: payload.string("text"),
                        durationSeconds = payload.double("duration_seconds"),
                        subagentId = payload.string("subagent_id"),
+                        childSessionId = payload.string("child_session_id"),
+                        parentId = payload.string("parent_id"),
+                        depth = payload.int("depth"),
+                        model = payload.string("model"),
                    ),
                )
            }
@@ -1,5 +1,6 @@
 package com.hermesandroid.relay.network.upstream

+import com.hermesandroid.relay.network.upstream.models.MessageItem
 import com.hermesandroid.relay.network.upstream.models.UsageInfo
 import kotlinx.serialization.json.JsonArray
 import kotlinx.serialization.json.JsonObject
@@ -28,7 +29,7 @@ enum class GatewayAvailability {
    /** No probe has completed yet (startup, connection switch). */
    Unknown,

-    /** Dashboard reachable and authenticated (or auth not required). */
+    /** The `/api/ws` socket completed `gateway.ready` for the active route. */
    Ready,

    /** Dashboard reachable and gated, but no signed-in session — Manage sign-in unlocks it. */
@@ -55,6 +56,13 @@ enum class GatewayConnectionState {
    Ready,
 }

+/** Whether an idle Gateway may be retried automatically by a visible Chat surface. */
+enum class GatewayReconnectDisposition {
+    None,
+    Retryable,
+    Terminal,
+}
+
 /** Profile-persisted approval policy introduced by upstream gateway contract v3. */
 enum class GatewayApprovalMode(val wireValue: String) {
    Manual("manual"),
@@ -257,7 +265,8 @@ data class GatewayToolOutputRisk(

 /**
 * One `subagent.*` lifecycle event, emitted on the PARENT session. Lifecycle
- * per task: START → (THINKING | TOOL | PROGRESS)* → COMPLETE. Field
+ * per task: SPAWN_REQUESTED → START → (THINKING | TOOL | PROGRESS)* →
+ * COMPLETE. Field
 * availability varies by phase — [toolName]/[preview] ride TOOL,
 * [status]/[summary]/[durationSeconds] ride COMPLETE — and older emitters
 * omit everything beyond the three defaults-bearing fields.
@@ -273,10 +282,36 @@ data class GatewaySubagentEvent(
    val preview: String? = null,
    val durationSeconds: Double? = null,
    val subagentId: String? = null,
+    /** Durable child session id accepted by `session.resume {lazy:true}`. */
+    val childSessionId: String? = null,
+    /** Owning subagent id for nested delegation; null for first-level children. */
+    val parentId: String? = null,
+    /** Zero-based depth used by the upstream spawn-tree renderer. */
+    val depth: Int? = null,
+    /** Effective child model, when the emitter exposes it. */
+    val model: String? = null,
 ) {
-    enum class Phase { START, THINKING, TOOL, PROGRESS, COMPLETE }
+    enum class Phase { SPAWN_REQUESTED, START, THINKING, TOOL, PROGRESS, COMPLETE }
 }

+/**
+ * One profile-pinned, read-only child-session watch opened through the vanilla
+ * upstream Gateway. [storedSessionId] is the durable child id from
+ * `subagent.*`; [liveSessionId] is the short runtime id that tags subsequent
+ * mirror events on this socket. The bounded [messages] snapshot is child-only.
+ */
+data class GatewayChildWatch(
+    val storedSessionId: String,
+    val liveSessionId: String,
+    val profile: String?,
+    val generation: Long,
+    val messages: List<MessageItem>,
+    /** True when Android retained only a bounded recent tail of the response. */
+    val historyTruncated: Boolean,
+    val running: Boolean,
+    val status: String?,
+)
+
 /**
 * One session-owned background process returned by the upstream gateway's
 * `process.list` RPC. The registry calls its process id `session_id`; Android
@@ -320,6 +355,69 @@ enum class GatewayProcessCapability {
    Unsupported,
 }

+/** Authoritative execution state reported by upstream `session.active_list`. */
+enum class GatewayActiveSessionStatus(val wireValue: String) {
+    Idle("idle"),
+    Starting("starting"),
+    Working("working"),
+    Waiting("waiting");
+
+    companion object {
+        fun fromWire(value: String?): GatewayActiveSessionStatus? = when (value?.trim()?.lowercase()) {
+            "idle" -> Idle
+            "starting" -> Starting
+            "working" -> Working
+            "waiting" -> Waiting
+            else -> null
+        }
+    }
+}
+
+/**
+ * One in-memory runtime returned by upstream `session.active_list`.
+ *
+ * The RPC is process-wide in current upstream Hermes. Its rows do not normally
+ * identify their profile, so [profile] stays null unless a future gateway
+ * explicitly sends one. Callers must resolve [storedSessionId] against their
+ * own profile-scoped session registry and fail closed when ownership is
+ * ambiguous; the transport never synthesizes profile attribution.
+ */
+data class GatewayActiveSession(
+    /** Per-process runtime id used by live Gateway events and session RPCs. */
+    val runtimeSessionId: String,
+    /** Durable history id (`session_key`) used by the REST/session database. */
+    val storedSessionId: String,
+    val status: GatewayActiveSessionStatus,
+    /** Unix epoch seconds from upstream's in-memory runtime record. */
+    val lastActiveEpochSeconds: Double,
+    /** Future-compatible only; null for the current upstream contract. */
+    val profile: String? = null,
+)
+
+/** Exact owner already known by this client for a foreground or detached runtime. */
+data class GatewayKnownSessionOwner(
+    val storedSessionId: String,
+    val profile: String?,
+)
+
+/** Whether the current Gateway socket exposes `session.active_list`. */
+enum class GatewayActiveSessionCapability {
+    Unknown,
+    Supported,
+    Unsupported,
+}
+
+/**
+ * Result of one process-wide live-session snapshot request. Unsupported is
+ * intentionally distinct from transport/protocol failure so callers can use
+ * another source only for older gateways, while failures remain Unknown.
+ */
+sealed interface GatewayActiveSessionsResult {
+    data class Success(val sessions: List<GatewayActiveSession>) : GatewayActiveSessionsResult
+    data object Unsupported : GatewayActiveSessionsResult
+    data class TransientFailure(val error: Throwable) : GatewayActiveSessionsResult
+}
+
 /**
 * Connection-level background-process events. These are deliberately separate
 * from [GatewayTurnCallbacks]: output and completion notifications can arrive
@@ -1,5 +1,7 @@
 package com.hermesandroid.relay.network.upstream

+import com.hermesandroid.relay.data.normalizeCredentialFreeAuthenticatedDashboardOrigin
+
 import android.content.Context
 import com.hermesandroid.relay.auth.SessionTokenStore
 import com.hermesandroid.relay.auth.SecureStoreCache
@@ -101,6 +103,7 @@ class NativeDashboardAuthorization internal constructor(
    internal val verifier: String,
    internal val state: String,
    internal val generation: Long,
+    internal val usesAlternateOrigin: Boolean,
 )

 class NativeDashboardAuthClient(
@@ -144,14 +147,9 @@ class NativeDashboardAuthClient(
            .addQueryParameter("code_challenge_method", "S256")
            .addQueryParameter("redirect_uri", redirectUri)
            .addQueryParameter("state", state)
-            // Match the official Desktop client for Nous-hosted gateways: the
-            // gateway selects its single native-eligible provider. The provider
-            // name advertised to UI clients is presentation/configuration data,
-            // not a stable native-broker identifier. Other providers retain the
-            // explicit selector for direct client use and tests.
            .apply {
                provider
-                    ?.takeIf { it.isNotBlank() && !it.equals("nous", ignoreCase = true) }
+                    ?.takeIf { it.isNotBlank() }
                    ?.let { addQueryParameter("provider", it) }
            }
            .build()
@@ -159,29 +157,29 @@ class NativeDashboardAuthClient(
        val generation = NativeTokenRefreshCoordinator.beginAuthorization(
            tokenStore.coordinationKey,
        )
-        return NativeDashboardAuthorization(url, verifier, state, generation)
+        return NativeDashboardAuthorization(
+            authorizationUrl = url,
+            verifier = verifier,
+            state = state,
+            generation = generation,
+            usesAlternateOrigin = !sameDashboardBase(authorizationBaseUrl, baseUrl),
+        )
    }

    /**
-     * A private-route dashboard may be configured with a canonical HTTPS
-     * callback origin for its provider. Starting the browser on the private
-     * origin would scope Hermes' temporary PKCE cookie to the wrong host, so
-     * discover the provider's declared callback and start native auth there.
-     * Token exchange still uses [baseUrl], keeping the resulting bearer bound
-     * to the active connection route.
+     * Discover the callback-owning Dashboard origin for every interactive
+     * redirect provider. Provider names do not imply topology; upstream may
+     * advertise a canonical origin that differs from a LAN/Tailscale entry.
+     * Token exchange still uses [baseUrl], keeping the bearer scoped to this
+     * connection while the shared gateway process consumes its one-time code.
     */
    private fun resolveAuthorizationBaseUrl(provider: String?): String {
        val configured = baseUrl.toHttpUrlOrNull() ?: return baseUrl
-        if (
-            !provider.equals("nous", ignoreCase = true) ||
-            configured.scheme != "http" ||
-            !isPrivateNetworkLiteral(configured.host)
-        ) {
-            return baseUrl
-        }
+        val selectedProvider = provider?.takeIf { it.isNotBlank() } ?: return baseUrl
+        if (isLoopbackDashboardHost(configured.host)) return baseUrl
        val loginUrl = configured.newBuilder()
            .addPathSegments("auth/login")
-            .addQueryParameter("provider", provider)
+            .addQueryParameter("provider", selectedProvider)
            .addQueryParameter("next", "/")
            .build()
        val discoveryClient = client.newBuilder()
@@ -193,14 +191,14 @@ class NativeDashboardAuthClient(
        ).execute().use { response ->
            if (response.code !in 300..399) null else response.header("Location")
        }
-        return canonicalDashboardBaseFromNousRedirect(location)
-            ?: throw IOException("Dashboard did not advertise a secure Nous callback origin")
+        return canonicalDashboardBaseFromProviderRedirect(baseUrl, location)
    }

    fun exchangeCallback(
        authorization: NativeDashboardAuthorization,
        callbackTarget: String,
        commitAllowed: () -> Boolean = { true },
+        onValidated: () -> Unit = {},
    ): NativeDashboardTokens {
        val callback = callbackTarget.toHttpUrlOrNull()
            ?: "http://127.0.0.1$callbackTarget".toHttpUrlOrNull()
@@ -224,6 +222,7 @@ class NativeDashboardAuthClient(
            ?: throw NativeDashboardCallbackException(
                "Native sign-in callback did not include an authorization code",
            )
+        runCatching(onValidated)
        val payload = NativeTokenExchange(code = code, codeVerifier = authorization.verifier)
        return postTokens(
            path = "/auth/native/token",
@@ -322,6 +321,10 @@ class NativeDashboardAuthClient(
                throw NativeDashboardInactiveAuthorizationException()
            }
            tokenStore.save(tokens)
+            NativeTokenRefreshCoordinator.markBootstrapApproved(
+                tokenStore.coordinationKey,
+                tokens.accessToken,
+            )
        }
        return tokens
    }
@@ -412,6 +415,63 @@ private fun isPrivateNetworkLiteral(host: String): Boolean {
        (first == 100 && second in 64..127)
 }

+private fun isLoopbackDashboardHost(host: String): Boolean =
+    host.equals("localhost", ignoreCase = true) ||
+        host == "127.0.0.1" ||
+        host == "::1"
+
+/**
+ * Extract a callback-owning Dashboard base from an auth-provider redirect.
+ * Different HTTPS origins are accepted after an HTTPS provider hop. HTTP is
+ * retained for upstream-supported local/overlay callbacks only when both the
+ * selected and callback hosts are private literals/loopback and no HTTPS-to-
+ * HTTP downgrade occurs. Arbitrary public cleartext origins are rejected.
+ */
+internal fun canonicalDashboardBaseFromProviderRedirect(
+    configuredBase: String,
+    location: String?,
+): String {
+    val configured = configuredBase.trim().trimEnd('/').toHttpUrlOrNull()
+        ?: return configuredBase
+    val fallback = configured.toString().trimEnd('/')
+    val providerUrl = location?.toHttpUrlOrNull() ?: return fallback
+    val callback = providerUrl.queryParameter("redirect_uri")
+        ?.toHttpUrlOrNull()
+        ?: return fallback
+    if (
+        providerUrl.username.isNotEmpty() || providerUrl.password.isNotEmpty() ||
+        callback.username.isNotEmpty() || callback.password.isNotEmpty() ||
+        callback.query != null || callback.fragment != null
+    ) {
+        return fallback
+    }
+    val callbackSuffix = "/auth/callback"
+    if (!callback.encodedPath.endsWith(callbackSuffix)) return fallback
+    val callbackBase = callback.newBuilder()
+        .encodedPath(callback.encodedPath.removeSuffix(callbackSuffix).ifBlank { "/" })
+        .query(null)
+        .fragment(null)
+        .build()
+    if (
+        configured.scheme == callbackBase.scheme &&
+        configured.host.equals(callbackBase.host, ignoreCase = true) &&
+        configured.port == callbackBase.port &&
+        configured.encodedPath.trimEnd('/') == callbackBase.encodedPath.trimEnd('/')
+    ) {
+        return fallback
+    }
+    if (providerUrl.scheme != "https") return fallback
+    val trustedDifferentOrigin = callbackBase.scheme == "https" || (
+        configured.scheme == "http" &&
+            callbackBase.scheme == "http" &&
+            normalizeCredentialFreeAuthenticatedDashboardOrigin(fallback) != null &&
+            normalizeCredentialFreeAuthenticatedDashboardOrigin(
+                callbackBase.toString().trimEnd('/'),
+            ) != null
+        )
+    return if (trustedDifferentOrigin) callbackBase.toString().trimEnd('/') else fallback
+}
+
 internal fun canonicalDashboardBaseFromNousRedirect(location: String?): String? {
    val providerUrl = location?.toHttpUrlOrNull() ?: return null
    if (
@@ -420,28 +480,20 @@ internal fun canonicalDashboardBaseFromNousRedirect(location: String?): String?
    ) {
        return null
    }
-    val callback = providerUrl.queryParameter("redirect_uri")
-        ?.toHttpUrlOrNull()
-        ?: return null
-    if (callback.scheme != "https") return null
-    val callbackSuffix = "/auth/callback"
-    if (!callback.encodedPath.endsWith(callbackSuffix)) return null
-    val basePath = callback.encodedPath
-        .removeSuffix(callbackSuffix)
-        .ifBlank { "/" }
-    return callback.newBuilder()
-        .encodedPath(basePath)
-        .query(null)
-        .fragment(null)
-        .build()
-        .toString()
-        .trimEnd('/')
+    val resolved = canonicalDashboardBaseFromProviderRedirect(
+        configuredBase = "http://192.168.0.1:9119",
+        location = location,
+    )
+    return resolved.takeUnless { it == "http://192.168.0.1:9119" }
 }

 /**
 * Adds the native bearer to dashboard REST calls and rotates it before expiry
- * or after one 401. Refresh requests use a separate bare client, so neither a
- * stale bearer nor the authenticator can recurse into token rotation.
+ * or after one 401. Ticket mint also gets one bounded refresh on 503 because a
+ * multi-provider Dashboard can report an expired token as provider-unreachable
+ * before the owning provider gets to reject it. Refresh requests use a separate
+ * bare client, so neither a stale bearer nor the authenticator can recurse into
+ * token rotation.
 */
 class DashboardBearerAuth(
    baseUrl: String,
@@ -449,20 +501,90 @@ class DashboardBearerAuth(
    private val clockSeconds: () -> Long = { System.currentTimeMillis() / 1000L },
 ) : Interceptor, Authenticator {
    private val authClient = NativeDashboardAuthClient(baseUrl, tokenStore)
+    @Volatile
+    private var cookieAuthAvailable: ((okhttp3.HttpUrl) -> Boolean)? = null
+    @Volatile
+    private var preferNativeBearerAfterCookieProviderFailure = false
+
+    internal fun preferCookiesWhen(predicate: (okhttp3.HttpUrl) -> Boolean) {
+        cookieAuthAvailable = predicate
+    }
+
+    private fun shouldPreferCookie(url: okhttp3.HttpUrl): Boolean =
+        !preferNativeBearerAfterCookieProviderFailure &&
+            runCatching { cookieAuthAvailable?.invoke(url) == true }.getOrDefault(false)

    override fun intercept(chain: Interceptor.Chain): Response {
+        if (shouldPreferCookie(chain.request().url)) {
+            val cookieResponse = chain.proceed(chain.request())
+            if (!cookieResponse.isAuthProviderUnavailable()) return cookieResponse
+            val tokens = usableTokens(forceRefresh = false, failedAccessToken = null)
+                ?: return cookieResponse
+            val accessToken = normalizeCredentialForHeader(
+                tokens.accessToken,
+                "Dashboard credential",
+            )
+            cookieResponse.close()
+            val bearerResponse = chain.proceed(
+                chain.request().newBuilder()
+                    .bearerAuthorization(accessToken, "Dashboard credential")
+                    .build(),
+            )
+            if (bearerResponse.isSuccessful) {
+                // Preserve the cookie on disk: upstream's 503 intentionally
+                // avoids logging browsers out during an IdP outage. This exact
+                // Dashboard client merely stops presenting the stranded cookie
+                // first after its connection-scoped bearer proves valid.
+                preferNativeBearerAfterCookieProviderFailure = true
+            }
+            return bearerResponse
+        }
        val tokens = usableTokens(forceRefresh = false, failedAccessToken = null)
        val request = tokens?.let {
            chain.request().newBuilder()
                .bearerAuthorization(it.accessToken, "Dashboard credential")
                .build()
        } ?: chain.request()
-        return chain.proceed(request)
+        val response = chain.proceed(request)
+        if (
+            response.code != 503 ||
+            !request.url.encodedPath.endsWith("/api/auth/ws-ticket")
+        ) {
+            return response
+        }
+        val previous = request.header("Authorization") ?: return response
+        val failedAccessToken = previous.removePrefix("Bearer ").takeIf { it != previous }
+            ?: return response
+        val refreshed = usableTokens(
+            forceRefresh = true,
+            failedAccessToken = failedAccessToken,
+        ) ?: return response
+        val accessToken = normalizeCredentialForHeader(
+            refreshed.accessToken,
+            "Dashboard credential",
+        )
+        if (accessToken == failedAccessToken) return response
+        response.close()
+        return chain.proceed(
+            request.newBuilder()
+                .bearerAuthorization(accessToken, "Dashboard credential")
+                .build(),
+        )
    }

    override fun authenticate(route: Route?, response: Response): Request? {
        if (responseCount(response) >= 2) return null
-        val previous = response.request.header("Authorization") ?: return null
+        val previous = response.request.header("Authorization")
+        if (previous == null) {
+            if (!shouldPreferCookie(response.request.url)) return null
+            val tokens = usableTokens(
+                forceRefresh = false,
+                failedAccessToken = null,
+            ) ?: return null
+            return response.request.newBuilder()
+                .bearerAuthorization(tokens.accessToken, "Dashboard credential")
+                .build()
+        }
        val failedAccessToken = previous.removePrefix("Bearer ").takeIf { it != previous }
        val tokens = usableTokens(
            forceRefresh = true,
@@ -487,11 +609,39 @@ class DashboardBearerAuth(
            if (failedAccessToken != null && current.accessToken != failedAccessToken) {
                return@synchronized current
            }
+            val needsNousBootstrap = current.provider.equals("nous", ignoreCase = true) &&
+                current.refreshToken.isNotBlank() &&
+                !NativeTokenRefreshCoordinator.isBootstrapApproved(
+                    tokenStore.coordinationKey,
+                    current.accessToken,
+                )
+            if (needsNousBootstrap &&
+                NativeTokenRefreshCoordinator.isBootstrapRejected(
+                    tokenStore.coordinationKey,
+                    current.accessToken,
+                )
+            ) {
+                return@synchronized null
+            }
            val nearExpiry = current.expiresAt <= 0L || clockSeconds() >= current.expiresAt - 60L
-            if (!forceRefresh && !nearExpiry) return@synchronized current
-            runCatching { authClient.refresh(current) }.getOrNull()
+            if (!forceRefresh && !nearExpiry && !needsNousBootstrap) return@synchronized current
+            val refreshed = runCatching { authClient.refresh(current) }.getOrNull()
+            if (refreshed == null && needsNousBootstrap) {
+                NativeTokenRefreshCoordinator.markBootstrapRejected(
+                    tokenStore.coordinationKey,
+                    current.accessToken,
+                )
+            }
+            refreshed
        }

+    private fun Response.isAuthProviderUnavailable(): Boolean {
+        if (code != 503) return false
+        val detail = runCatching { peekBody(1_024L).string() }.getOrDefault("")
+        return detail.contains("Auth provider", ignoreCase = true) &&
+            detail.contains("unreachable", ignoreCase = true)
+    }
+
    private fun responseCount(response: Response): Int {
        var count = 1
        var prior = response.priorResponse
@@ -564,6 +714,8 @@ private inline fun <reified T : Throwable> Throwable.firstCauseOfType(): T? {
 private object NativeTokenRefreshCoordinator {
    private val locks = ConcurrentHashMap<String, Any>()
    private val generations = ConcurrentHashMap<String, Long>()
+    private val bootstrapApproved = ConcurrentHashMap<String, String>()
+    private val bootstrapRejected = ConcurrentHashMap<String, String>()

    fun lockFor(key: String): Any = locks.computeIfAbsent(key) { Any() }

@@ -583,10 +735,28 @@ private object NativeTokenRefreshCoordinator {
        }
    }

+    fun isBootstrapApproved(key: String, accessToken: String): Boolean =
+        bootstrapApproved[key] == accessToken
+
+    fun isBootstrapRejected(key: String, accessToken: String): Boolean =
+        bootstrapRejected[key] == accessToken
+
+    fun markBootstrapApproved(key: String, accessToken: String) {
+        bootstrapApproved[key] = accessToken
+        bootstrapRejected.remove(key)
+    }
+
+    fun markBootstrapRejected(key: String, accessToken: String) {
+        bootstrapRejected[key] = accessToken
+        bootstrapApproved.remove(key)
+    }
+
    fun clear(store: NativeDashboardTokenStore) {
        synchronized(lockFor(store.coordinationKey)) {
            generations[store.coordinationKey] =
                (generations[store.coordinationKey] ?: 0L) + 1L
+            bootstrapApproved.remove(store.coordinationKey)
+            bootstrapRejected.remove(store.coordinationKey)
            store.clear()
        }
    }
@@ -3,6 +3,7 @@ package com.hermesandroid.relay.network.upstream
 import com.hermesandroid.relay.BuildConfig
 import java.io.IOException
 import java.io.InputStream
+import java.io.InterruptedIOException
 import java.net.InetAddress
 import java.net.InetSocketAddress
 import java.net.ServerSocket
@@ -25,6 +26,9 @@ private const val ACCEPT_POLL_MILLIS = 500
 internal const val DEFAULT_NATIVE_SIGN_IN_TIMEOUT_MILLIS = 5 * 60 * 1000L
 internal val NATIVE_SIGN_IN_RETURN_URI = "${BuildConfig.APPLICATION_ID}://return"

+internal class NativeDashboardSignInTimeoutException :
+    InterruptedIOException("Dashboard sign-in timed out")
+
 private enum class CallbackPage(
    val modifier: String,
    val eyebrow: String,
@@ -109,23 +113,24 @@ internal fun dashboardRedirectAuthMode(authFlows: List<String>): DashboardRedire
        DashboardRedirectAuthMode.WebView
    }

-/**
- * Nous Portal uses Cloudflare Turnstile and does not support embedded Android
- * WebViews. Keep self-hosted OIDC on the dashboard cookie flow, but use the
- * gateway's brokered system-browser flow for Nous when it is advertised.
- */
+/** Match upstream Desktop's capability-driven redirect policy. */
 internal fun androidDashboardRedirectAuthMode(
-    providerName: String,
+    @Suppress("UNUSED_PARAMETER") providerName: String,
    authFlows: List<String>,
-): DashboardRedirectAuthMode =
-    if (
-        providerName.equals("nous", ignoreCase = true) &&
-        dashboardRedirectAuthMode(authFlows) == DashboardRedirectAuthMode.NativePkce
-    ) {
-        DashboardRedirectAuthMode.NativePkce
-    } else {
-        DashboardRedirectAuthMode.WebView
-    }
+    @Suppress("UNUSED_PARAMETER") competingRedirectProviders: Int = 1,
+): DashboardRedirectAuthMode = dashboardRedirectAuthMode(authFlows)
+
+/**
+ * Hosted gateways commonly expose Nous as their single native provider and
+ * require the selector to be omitted. Multi-provider self-hosted gateways need
+ * the explicit selector so upstream can disambiguate the requested provider.
+ */
+internal fun nativeDashboardAuthorizationProvider(
+    providerName: String,
+    competingRedirectProviders: Int,
+): String? = providerName.takeUnless {
+    it.equals("nous", ignoreCase = true) && competingRedirectProviders <= 1
+}

 /**
 * Owns one native dashboard sign-in attempt.
@@ -141,6 +146,8 @@ class NativeDashboardSignInCoordinator(
 ) {
    suspend fun signIn(
        provider: String?,
+        onAuthorizationPrepared: (usesAlternateOrigin: Boolean) -> Unit = {},
+        onCallbackValidated: () -> Unit = {},
        launchAuthorization: suspend (String) -> Unit,
    ): NativeDashboardTokens =
        try {
@@ -165,11 +172,15 @@ class NativeDashboardSignInCoordinator(
                        val attemptContext = currentCoroutineContext()
                        var completed = false
                        try {
+                            runCatching {
+                                onAuthorizationPrepared(authorization.usesAlternateOrigin)
+                            }
                            launchAuthorization(authorization.authorizationUrl)
                            awaitValidCallback(
                                server = server,
                                authorization = authorization,
                                commitAllowed = { attemptContext.isActive },
+                                onCallbackValidated = onCallbackValidated,
                            ).also { completed = true }
                        } finally {
                            if (!completed) {
@@ -180,13 +191,14 @@ class NativeDashboardSignInCoordinator(
                }
            }
        } catch (_: TimeoutCancellationException) {
-            throw IOException("Dashboard sign-in timed out")
+            throw NativeDashboardSignInTimeoutException()
        }

    private suspend fun awaitValidCallback(
        server: ServerSocket,
        authorization: NativeDashboardAuthorization,
        commitAllowed: () -> Boolean,
+        onCallbackValidated: () -> Unit,
    ): NativeDashboardTokens {
        while (true) {
            val callback = acceptCallback(server)
@@ -217,6 +229,7 @@ class NativeDashboardSignInCoordinator(
                        authorization,
                        target,
                        commitAllowed = commitAllowed,
+                        onValidated = onCallbackValidated,
                    ).also {
                        writeResponse(
                            socket,
@@ -250,6 +250,7 @@ data class SessionItem(
    @SerialName("output_tokens") val outputTokens: Int? = null,
    @SerialName("actual_cost_usd") val actualCostUsd: Double? = null,
    @SerialName("estimated_cost_usd") val estimatedCostUsd: Double? = null,
+    /** REST recency heuristic from upstream; not live Gateway execution state. */
    @SerialName("is_active") val isActive: Boolean = false,
    @SerialName("has_model_config")
    @Serializable(with = FlexibleBooleanSerializer::class)
@@ -0,0 +1,89 @@
+package com.hermesandroid.relay.network.usage
+
+import kotlinx.serialization.SerialName
+import kotlinx.serialization.Serializable
+
+@Serializable
+data class ProviderUsageResponse(
+    @SerialName("schema_version") val schemaVersion: Int = 1,
+    @SerialName("fetched_at") val fetchedAt: String? = null,
+    val capabilities: Set<String> = emptySet(),
+    val providers: List<ProviderUsageProvider> = emptyList(),
+) {
+    val relayEnhanced: Boolean
+        get() = capabilities.containsAll(RELAY_ENHANCED_CAPABILITIES)
+
+    companion object {
+        val RELAY_ENHANCED_CAPABILITIES = setOf(
+            "credential_pools",
+            "structured_balances",
+            "opencode_go",
+        )
+    }
+}
+
+@Serializable
+data class ProviderUsageProvider(
+    val id: String,
+    @SerialName("display_name") val displayName: String,
+    val status: String,
+    val source: String? = null,
+    @SerialName("fetched_at") val fetchedAt: String? = null,
+    val plan: String? = null,
+    val windows: List<ProviderUsageWindow> = emptyList(),
+    val details: List<String> = emptyList(),
+    val balances: List<ProviderUsageBalance> = emptyList(),
+    @SerialName("renews_at") val renewsAt: String? = null,
+    @SerialName("action_url") val actionUrl: String? = null,
+    val credentials: List<ProviderUsageCredential> = emptyList(),
+    @SerialName("active_credential_id") val activeCredentialId: String? = null,
+    @SerialName("active_credential_state") val activeCredentialState: String = "unknown",
+    @SerialName("active_observed_at") val activeObservedAt: String? = null,
+    val message: String? = null,
+) {
+    val available: Boolean get() = status == STATUS_AVAILABLE
+
+    companion object {
+        const val STATUS_AVAILABLE = "available"
+        const val STATUS_NOT_CONFIGURED = "not_configured"
+        const val STATUS_UNAVAILABLE = "unavailable"
+    }
+}
+
+@Serializable
+data class ProviderUsageBalance(
+    val id: String,
+    val label: String,
+    val amount: Double,
+    val currency: String = "USD",
+)
+
+@Serializable
+data class ProviderUsageCredential(
+    val id: String,
+    val label: String,
+    val active: Boolean = false,
+    val status: String,
+    @SerialName("pool_status") val poolStatus: String? = null,
+    @SerialName("last_status_at") val lastStatusAt: String? = null,
+    @SerialName("reset_at") val resetAt: String? = null,
+    val plan: String? = null,
+    val windows: List<ProviderUsageWindow> = emptyList(),
+    val details: List<String> = emptyList(),
+    val message: String? = null,
+) {
+    companion object {
+        const val STATUS_AVAILABLE = "available"
+        const val STATUS_AT_LIMIT = "at_limit"
+        const val STATUS_UNAVAILABLE = "unavailable"
+    }
+}
+
+@Serializable
+data class ProviderUsageWindow(
+    val id: String,
+    val label: String,
+    @SerialName("used_percent") val usedPercent: Double? = null,
+    @SerialName("reset_at") val resetAt: String? = null,
+    val detail: String? = null,
+)
@@ -0,0 +1,46 @@
+package com.hermesandroid.relay.network.usage
+
+import com.hermesandroid.relay.network.relay.RelayHttpClient
+import com.hermesandroid.relay.network.upstream.GatewayChatClient
+import com.hermesandroid.relay.network.upstream.DashboardApiClient
+import kotlinx.serialization.json.Json
+import kotlinx.serialization.json.decodeFromJsonElement
+
+/** Relay-enhanced usage with an upstream fallback for hosts without Relay support. */
+class ProviderUsageRepository(
+    private val gatewayClientProvider: () -> GatewayChatClient?,
+    private val dashboardClientProvider: () -> DashboardApiClient? = { null },
+    private val relayHttpClient: RelayHttpClient,
+    private val profileProvider: () -> String? = { null },
+    private val sessionProvider: () -> String? = { null },
+) {
+    private val json = Json {
+        ignoreUnknownKeys = true
+        coerceInputValues = true
+        explicitNulls = false
+    }
+
+    suspend fun fetch(): Result<ProviderUsageResponse?> {
+        val profile = profileProvider()
+        val session = sessionProvider()
+        val dashboard = dashboardClientProvider()
+        if (dashboard != null) {
+            val enhanced = dashboard.getProviderUsage(profile, session)
+            if (enhanced.isSuccess && enhanced.getOrNull() != null) return enhanced
+        }
+
+        val relay = relayHttpClient.fetchProviderUsage(
+            profile = profile,
+            sessionId = session,
+        )
+        if (relay.isSuccess && relay.getOrNull() != null) return relay
+
+        val gateway = gatewayClientProvider()
+        if (gateway != null) {
+            val upstream = gateway.providerUsage()
+                .mapCatching { json.decodeFromJsonElement<ProviderUsageResponse>(it) }
+            if (upstream.isSuccess) return upstream
+        }
+        return relay
+    }
+}
@@ -74,13 +74,13 @@ object ProactiveMessageNotifier {
        text: String,
        messageId: String?,
        chatId: String?,
-    ) {
+    ): Int? {
        ensureChannel(context)
        if (!hasPostNotificationsPermission(context)) {
            Log.i(TAG, "POST_NOTIFICATIONS not granted — skipping proactive notification")
-            return
+            return null
        }
-        if (text.isBlank()) return
+        if (text.isBlank()) return null

        val tapIntent = Intent(context, MainActivity::class.java).apply {
            flags = Intent.FLAG_ACTIVITY_NEW_TASK or Intent.FLAG_ACTIVITY_CLEAR_TOP
@@ -89,7 +89,7 @@ object ProactiveMessageNotifier {
        val pendingFlags = PendingIntent.FLAG_UPDATE_CURRENT or PendingIntent.FLAG_IMMUTABLE
        // Distinct requestCode per slot so each notification gets its own
        // PendingIntent rather than all sharing slot 0's intent.
-        val notificationId = slotFor(messageId)
+        val notificationId = slotFor(messageId, chatId)
        val tapPending =
            PendingIntent.getActivity(context, notificationId, tapIntent, pendingFlags)

@@ -108,9 +108,15 @@ object ProactiveMessageNotifier {
            .setCategory(NotificationCompat.CATEGORY_MESSAGE)
            .setPriority(NotificationCompat.PRIORITY_HIGH)

-        runCatching {
+        return runCatching {
            NotificationManagerCompat.from(context).notify(notificationId, builder.build())
-        }.onFailure { Log.w(TAG, "notify failed", it) }
+            notificationId
+        }.onFailure { Log.w(TAG, "notify failed", it) }.getOrNull()
+    }
+
+    /** Cancel one exact slot previously returned by [notificationIdFor]. */
+    fun cancel(context: Context, notificationId: Int) {
+        NotificationManagerCompat.from(context).cancel(notificationId)
    }

    /**
@@ -206,8 +212,12 @@ object ProactiveMessageNotifier {
    }

    /** Derive a stable notification slot from the message id. */
-    private fun slotFor(messageId: String?): Int {
-        val key = messageId?.takeIf { it.isNotBlank() } ?: return ID_BASE
+    internal fun notificationIdFor(messageId: String?, chatId: String?): Int =
+        slotFor(messageId, chatId)
+
+    private fun slotFor(messageId: String?, chatId: String?): Int {
+        val key = messageId?.takeIf { it.isNotBlank() }
+            ?: "chat:${chatId?.takeIf { it.isNotBlank() } ?: "phone"}"
        // Keep within a small positive window above the base so re-delivery of
        // the same id collapses to one slot and distinct ids spread out.
        return ID_BASE + (key.hashCode() and 0xFFFF)
@@ -240,6 +240,25 @@ class HermesProcessRuntime internal constructor(
        }
    }

+    fun republishAssistantSnapshot(activationId: String) {
+        val snapshot = synchronized(activationLock) {
+            if (currentActivationId != activationId ||
+                _initializationState.value != HermesRuntimeInitializationState.Ready
+            ) {
+                null
+            } else {
+                binder.assistantSnapshot.value
+            }
+        } ?: return
+        if (snapshot.phase != com.hermesandroid.relay.assistant.AssistantSessionPhase.Closed) {
+            com.hermesandroid.relay.assistant.AssistantSessionProtocol.publish(
+                application,
+                activationId,
+                snapshot,
+            )
+        }
+    }
+
    fun recordAssistantHeartbeat(
        activationId: String,
        nowElapsedMs: Long = SystemClock.elapsedRealtime(),
@@ -25,7 +25,9 @@ import com.hermesandroid.relay.data.VoiceSettings
 import com.hermesandroid.relay.network.relay.RelayVoiceAudioClientAdapter
 import com.hermesandroid.relay.network.relay.RelayVoiceClient
 import com.hermesandroid.relay.network.shared.AutoVoiceAudioClient
+import com.hermesandroid.relay.network.shared.pluginProxyRoutesOrNull
 import com.hermesandroid.relay.network.upstream.StandardHermesVoiceClient
+import com.hermesandroid.relay.viewmodel.SESSION_DIRECTORY_PAGE_SIZE
 import com.hermesandroid.relay.viewmodel.StandardVoiceAvailability
 import com.hermesandroid.relay.viewmodel.VoiceState
 import java.util.concurrent.TimeUnit
@@ -89,7 +91,10 @@ internal class HermesRuntimeBinder(
                .build(),
            relayUrlProvider = { connection.effectiveRelayUrl.value },
            relayRouteChangesProvider = {
-                connection.activeEndpoint.mapNotNull { it?.relay?.url }
+                connection.activeRelayEndpoint.mapNotNull { endpoint ->
+                    endpoint?.pluginProxyRoutesOrNull()?.relayWebSocketUrl
+                        ?: endpoint?.relay?.url
+                }
            },
            routeProbeRequester = connection::probeNow,
            profileNameProvider = {
@@ -99,6 +104,8 @@ internal class HermesRuntimeBinder(
                (connection.authState.value as? AuthState.Paired)?.token
            },
            apiBearerTokenProvider = connection::getApiKey,
+            dashboardHttpClientProvider = connection::dashboardHttpClientForRelayIngress,
+            dashboardIngressWebSocketRequestProvider = connection::dashboardRelayRequestForIngress,
        )
        val standardVoiceClient = StandardHermesVoiceClient(
            context = application,
@@ -185,7 +192,19 @@ internal class HermesRuntimeBinder(
            }
        }
        chat.setProfileSessionLister { profileName ->
-            connection.listProfileScopedSessions(profileName)
+            connection.listProfileScopedSessions(
+                profileName = profileName,
+                limit = SESSION_DIRECTORY_PAGE_SIZE,
+                excludeSources = connection.hiddenSources.value,
+            )
+        }
+        chat.setProfileSessionPageLister { profileName, offset, limit ->
+            connection.listProfileScopedSessions(
+                profileName = profileName,
+                limit = limit,
+                offset = offset,
+                excludeSources = connection.hiddenSources.value,
+            )
        }
        chat.setProfileMessageLoaderWithMode { profileName, sessionId, mode ->
            connection.loadProfileScopedMessages(profileName, sessionId, mode)
@@ -196,6 +215,7 @@ internal class HermesRuntimeBinder(
        chat.profileSessionPinner = connection::setSessionPinned
        chat.profileSessionArchiver = connection::setSessionArchived
        chat.onSessionChanged = connection::saveLastSessionId
+        chat.onFreshDraftSelected = connection::saveFreshDraft
        chat.setDemoModeWiring(
            isDemo = { connection.isDemoMode.value },
            handler = { connection.chatHandler },
@@ -291,23 +311,41 @@ internal class HermesRuntimeBinder(
                connection.activeConnectionId,
                connection.effectiveSessionProfileName,
                connection.lastSessionId,
-            ) { ready, connectionId, profileName, sessionId ->
-                ProfileContextInputs(ready, connectionId, profileName, sessionId)
+                connection.activeEndpoint,
+            ) { ready, connectionId, profileName, sessionId, activeEndpoint ->
+                ProfileContextInputs(
+                    ready,
+                    connectionId,
+                    profileName,
+                    sessionId,
+                    dashboardRouteResolved = activeEndpoint != null,
+                )
            }
            combine(
                contextInputs,
                connection.profileSelectionSettled,
                connection.lockedProfileName,
-            ) { inputs, settled, lockedProfileName ->
+                connection.hiddenSources,
+            ) { inputs, settled, lockedProfileName, hiddenSources ->
                inputs.copy(
                    profileSelectionSettled = settled,
                    profileLocked = lockedProfileName != null,
+                    hiddenSources = hiddenSources,
                )
            }.collectLatest { inputs ->
                profileContextReady.value = false
-                if (!inputs.chatReady) return@collectLatest
-                if (!inputs.profileSelectionSettled) delay(PROFILE_SETTLE_BACKSTOP_MS)
-                else delay(PROFILE_CONTEXT_COALESCE_MS)
+                if (!shouldRefreshSessionDirectory(inputs.chatReady, inputs.dashboardRouteResolved)) {
+                    return@collectLatest
+                }
+                if (!inputs.profileSelectionSettled) {
+                    delay(PROFILE_SETTLE_BACKSTOP_MS)
+                    // The backstop is diagnostic patience, not permission to
+                    // issue an unscoped read. Server-default ownership remains
+                    // unknown until the lightweight active-profile scope lands.
+                    if (!connection.profileSelectionSettled.value) return@collectLatest
+                } else {
+                    delay(PROFILE_CONTEXT_COALESCE_MS)
+                }
                val contextKey = AgentDisplay.profileContextKey(
                    connectionId = inputs.connectionId,
                    profileName = inputs.profileName,
@@ -321,6 +359,28 @@ internal class HermesRuntimeBinder(
                profileContextReady.value = true
            }
        }
+        jobs += runtime.coroutineScope.launch {
+            var metadataHydratedRoute: Pair<String, String>? = null
+            chat.sessionDirectoryReadyEvents.collect { event ->
+                if (!chat.ownsSessionDirectoryReadyEvent(event)) return@collect
+                val connectionId = connection.activeConnectionId.value ?: return@collect
+                val expectedContextKey = AgentDisplay.profileContextKey(
+                    connectionId = connectionId,
+                    profileName = connection.effectiveSessionProfileName.value,
+                )
+                if (event.contextKey != expectedContextKey) return@collect
+                val dashboardUrl = connection.effectiveDashboardUrl.value
+                    .takeIf(String::isNotBlank)
+                    ?: return@collect
+                val routeKey = connectionId to dashboardUrl.trim().trimEnd('/').lowercase()
+                if (metadataHydratedRoute == routeKey) return@collect
+                metadataHydratedRoute = routeKey
+                // `/api/profiles`, Gateway avatars, pets, skills, and model
+                // metadata are not session-directory prerequisites. Hydrate
+                // them only after exact-owner rows have already published.
+                connection.refreshDeferredProfileMetadata()
+            }
+        }
        jobs += runtime.coroutineScope.launch {
            connection.parseToolAnnotations.collect { enabled ->
                connection.chatHandler.parseToolAnnotations = enabled
@@ -376,7 +436,9 @@ internal class HermesRuntimeBinder(
                if (!AssistantAppSessionState.active.value) return@collect
                if (state.voiceMode) AssistantAppSessionState.markVoiceStarted()
                if (state.voiceMode || AssistantAppSessionState.hasVoiceStarted()) {
-                    AssistantSessionProtocol.publish(application, snapshot)
+                    state.assistantActivationId?.let { activationId ->
+                        AssistantSessionProtocol.publish(application, activationId, snapshot)
+                    }
                }
            }
        }
@@ -489,8 +551,10 @@ internal class HermesRuntimeBinder(
        val connectionId: String?,
        val profileName: String?,
        val sessionId: String?,
+        val dashboardRouteResolved: Boolean,
        val profileSelectionSettled: Boolean = false,
        val profileLocked: Boolean = false,
+        val hiddenSources: Set<String> = emptySet(),
    )

    private companion object {
@@ -500,6 +564,16 @@ internal class HermesRuntimeBinder(
    }
 }

+/**
+ * Session browsing is Dashboard HTTP state, not Gateway-socket state. API-only
+ * connections still use chat readiness; Dashboard connections can refresh once
+ * the resolver has selected a live route, after the profile-settle fence.
+ */
+internal fun shouldRefreshSessionDirectory(
+    chatReady: Boolean,
+    dashboardRouteResolved: Boolean,
+): Boolean = chatReady || dashboardRouteResolved
+
 internal fun assistantCanTransmitScreenContext(engineMode: VoiceEngineMode): Boolean =
    engineMode == VoiceEngineMode.HermesVoiceOutput

@@ -0,0 +1,55 @@
+package com.hermesandroid.relay.ui
+
+import com.hermesandroid.relay.data.GitRepo
+import com.hermesandroid.relay.ui.components.ChatGitWorkspaceSummary
+import com.hermesandroid.relay.viewmodel.GitRepoDetailState
+
+internal fun selectGitRepoForWorkspace(
+    repos: List<GitRepo>,
+    selectedRepoId: String?,
+    sessionRepoRoot: String?,
+    sessionWorkingDirectory: String?,
+): GitRepo? {
+    if (repos.isEmpty()) return null
+
+    fun normalized(path: String): String =
+        path.trim().replace('\\', '/').trimEnd('/')
+
+    val exactRoot = sessionRepoRoot?.let(::normalized).orEmpty()
+    val workingDirectory = sessionWorkingDirectory?.let(::normalized).orEmpty()
+    val matched = exactRoot.takeIf { it.isNotBlank() }?.let { root ->
+        repos.firstOrNull { normalized(it.root).equals(root, ignoreCase = true) }
+    } ?: workingDirectory.takeIf { it.isNotBlank() }?.let { cwd ->
+        repos.filter { repo ->
+            val root = normalized(repo.root)
+            cwd.equals(root, ignoreCase = true) ||
+                cwd.startsWith("$root/", ignoreCase = true)
+        }.maxByOrNull { normalized(it.root).length }
+    }
+    if (matched != null) return matched
+    if (repos.any { it.id == selectedRepoId }) return null
+    return repos.singleOrNull()
+}
+
+internal fun buildChatGitWorkspaceSummary(
+    repo: GitRepo?,
+    detail: GitRepoDetailState,
+): ChatGitWorkspaceSummary? {
+    val ready = detail as? GitRepoDetailState.Ready ?: return null
+    repo ?: return null
+    val status = ready.status
+    val changedPaths = buildSet {
+        status.staged.forEach { add(it.path) }
+        status.modified.forEach { add(it.path) }
+        status.untracked.forEach { add(it.path) }
+    }
+    val branch = ready.branches.firstOrNull { it.isCurrent }?.name
+        ?: repo.currentBranch.orEmpty()
+    if (branch.isBlank()) return null
+    return ChatGitWorkspaceSummary(
+        branch = branch,
+        changeCount = status.counts.changes.takeIf { it >= 0 } ?: changedPaths.size,
+        additions = status.counts.additions,
+        deletions = status.counts.deletions,
+    )
+}
@@ -0,0 +1,34 @@
+package com.hermesandroid.relay.ui
+
+import com.hermesandroid.relay.data.SupervisedModePolicy
+
+internal data class ResolvedSupervisedTheme(
+    val appThemeId: String,
+    val themePreference: String,
+    val useGlobalCustomTheme: Boolean,
+)
+
+/** Keep the supervised palette isolated from the parent's ordinary app theme. */
+internal fun resolveSupervisedTheme(
+    policy: SupervisedModePolicy,
+    parentAccessUnlocked: Boolean,
+    globalAppThemeId: String,
+    globalThemePreference: String,
+): ResolvedSupervisedTheme = if (policy.enabled && !parentAccessUnlocked) {
+    ResolvedSupervisedTheme(
+        appThemeId = policy.appearance.appThemeId,
+        themePreference = policy.appearance.themePreference,
+        useGlobalCustomTheme = false,
+    )
+} else {
+    ResolvedSupervisedTheme(
+        appThemeId = globalAppThemeId,
+        themePreference = globalThemePreference,
+        useGlobalCustomTheme = true,
+    )
+}
+
+internal fun shouldShowPetInSupervisedMode(
+    policy: SupervisedModePolicy,
+    parentAccessUnlocked: Boolean,
+): Boolean = !policy.enabled || parentAccessUnlocked || policy.appearance.showPet
@@ -0,0 +1,143 @@
+package com.hermesandroid.relay.ui
+
+import com.hermesandroid.relay.data.ConnectionStore
+import com.hermesandroid.relay.data.SupervisedModePolicy
+
+/** Allowlist applied to external, deep-link, and programmatic navigation. */
+internal fun isSupervisedRouteAllowed(route: String?, parentAccessUnlocked: Boolean): Boolean {
+    if (parentAccessUnlocked) return true
+    val normalized = route?.substringBefore('?') ?: return false
+    return normalized == "chat" ||
+        normalized == Screen.Settings.route ||
+        normalized == Screen.SupervisedAppearanceSettings.route
+}
+
+internal fun mayStartAddConnection(
+    supervisedEnabled: Boolean,
+    parentAccessUnlocked: Boolean,
+): Boolean = !supervisedEnabled || parentAccessUnlocked
+
+internal inline fun runAddConnectionAction(
+    supervisedEnabled: Boolean,
+    parentAccessUnlocked: Boolean,
+    navigateToPair: () -> Unit,
+    prepareConnection: () -> Unit,
+): Boolean {
+    if (!mayStartAddConnection(supervisedEnabled, parentAccessUnlocked)) return false
+    navigateToPair()
+    prepareConnection()
+    return true
+}
+
+/** Do not inspect or mutate a NavController until its first destination exists. */
+internal fun shouldRedirectSupervisedRoute(
+    supervisedEnabled: Boolean,
+    parentAccessUnlocked: Boolean,
+    currentRoute: String?,
+): Boolean = currentRoute != null &&
+    supervisedEnabled &&
+    !isSupervisedRouteAllowed(currentRoute, parentAccessUnlocked)
+
+/** A null route is Navigation's pre-graph bootstrap state, not a forbidden destination. */
+internal fun isSupervisedRouteContentAllowed(
+    supervisedEnabled: Boolean,
+    parentAccessUnlocked: Boolean,
+    currentRoute: String?,
+): Boolean = currentRoute == null ||
+    !supervisedEnabled ||
+    isSupervisedRouteAllowed(currentRoute, parentAccessUnlocked)
+
+/**
+ * Cold-start gate for the app navigation graph.
+ *
+ * A null active connection is also the seed value used while [ConnectionStore]
+ * is reading DataStore. Callers must therefore wait for the store's explicit
+ * hydration signal before treating null as "no connection" and composing the
+ * unrestricted onboarding/settings graph.
+ */
+internal fun isRelayNavigationHydrated(
+    connectionStoreHydrated: Boolean,
+    activeConnectionId: String?,
+    supervisedPolicyHydrated: Boolean,
+): Boolean = connectionStoreHydrated &&
+    (activeConnectionId == null || supervisedPolicyHydrated)
+
+/**
+ * Keep the NavHost mounted while a new connection's supervised policy loads.
+ * Setup and Dashboard sign-in expose no protected conversation/settings data,
+ * so they may remain visible; every other route stays covered fail-closed.
+ */
+internal fun shouldCoverRelayNavigation(
+    navigationHydrated: Boolean,
+    routeContentAllowed: Boolean,
+    currentRoute: String?,
+): Boolean {
+    if (!routeContentAllowed) return true
+    if (navigationHydrated) return false
+    return currentRoute?.substringBefore('?') !in setOf(
+        Screen.Onboarding.route,
+        Screen.Pair.route.substringBefore('?'),
+        Screen.DashboardSignIn.route.substringBefore('?'),
+    )
+}
+
+/** A parent unlock never follows the user back into the supervised chat root. */
+internal fun shouldRelockParentAccess(
+    supervisedEnabled: Boolean,
+    parentAccessUnlocked: Boolean,
+    route: String?,
+): Boolean = supervisedEnabled &&
+    parentAccessUnlocked &&
+    route?.substringBefore('?') == "chat"
+
+/**
+ * External chat route arguments are untrusted. A session may be restored only
+ * after an owner-aware source has proved that it belongs to the pinned profile.
+ */
+internal fun mayRestoreSupervisedSessionRoute(
+    policy: SupervisedModePolicy,
+    requestedSessionId: String?,
+    requestedProfile: String?,
+    pinnedProfileOwnershipProven: Boolean,
+): Boolean = policy.isActive &&
+    policy.capabilities.conversationHistory &&
+    pinnedProfileOwnershipProven &&
+    !requestedSessionId.isNullOrBlank() &&
+    !requestedProfile.isNullOrBlank() &&
+    requestedProfile.equals(policy.pinnedProfileName, ignoreCase = true)
+
+internal data class SupervisedChatRouteArgs(
+    val sessionId: String? = null,
+    val profile: String? = null,
+    val proactiveChatId: String? = null,
+)
+
+/** Strip external chat targeting before any destination effect can dispatch it. */
+internal fun sanitizeSupervisedChatRouteArgs(
+    policy: SupervisedModePolicy,
+    args: SupervisedChatRouteArgs,
+    pinnedProfileOwnershipProven: Boolean,
+): SupervisedChatRouteArgs {
+    if (!policy.enabled) return args
+    val allowSession = mayRestoreSupervisedSessionRoute(
+        policy = policy,
+        requestedSessionId = args.sessionId,
+        requestedProfile = args.profile,
+        pinnedProfileOwnershipProven = pinnedProfileOwnershipProven,
+    )
+    return if (allowSession) {
+        args.copy(proactiveChatId = null)
+    } else {
+        SupervisedChatRouteArgs()
+    }
+}
+
+/** A disabled policy may become active only after an enrolled credential succeeds. */
+internal fun mayEnableSupervisedMode(
+    policy: SupervisedModePolicy,
+    deviceSecure: Boolean,
+    deviceCredentialConfirmed: Boolean,
+): Boolean = !policy.enabled &&
+    policy.isConfigured &&
+    deviceSecure &&
+    deviceCredentialConfirmed
@@ -0,0 +1,53 @@
+package com.hermesandroid.relay.ui.components
+
+import android.content.Context
+import android.provider.Settings
+import android.view.accessibility.AccessibilityManager
+import androidx.compose.runtime.Composable
+import androidx.compose.runtime.DisposableEffect
+import androidx.compose.runtime.getValue
+import androidx.compose.runtime.mutableStateOf
+import androidx.compose.runtime.remember
+import androidx.compose.runtime.setValue
+import androidx.compose.ui.platform.LocalContext
+
+/** Shared OS motion/accessibility posture for animated UI affordances. */
+internal data class AccessibleMotionState(
+    /** OS animator scale is non-zero (i.e. system animations are on). */
+    val osAnimations: Boolean,
+    /** TalkBack-style touch exploration is active. */
+    val touchExploration: Boolean,
+)
+
+@Composable
+internal fun rememberAccessibleMotionState(): AccessibleMotionState {
+    val context = LocalContext.current
+    val osAnimations = remember {
+        runCatching {
+            Settings.Global.getFloat(
+                context.contentResolver,
+                Settings.Global.ANIMATOR_DURATION_SCALE,
+                1f,
+            ) != 0f
+        }.getOrDefault(true)
+    }
+    val accessibilityManager = remember {
+        context.getSystemService(Context.ACCESSIBILITY_SERVICE) as? AccessibilityManager
+    }
+    var touchExploration by remember {
+        mutableStateOf(accessibilityManager?.isTouchExplorationEnabled == true)
+    }
+    DisposableEffect(accessibilityManager) {
+        val listener = AccessibilityManager.TouchExplorationStateChangeListener { enabled ->
+            touchExploration = enabled
+        }
+        accessibilityManager?.addTouchExplorationStateChangeListener(listener)
+        onDispose {
+            accessibilityManager?.removeTouchExplorationStateChangeListener(listener)
+        }
+    }
+    return AccessibleMotionState(
+        osAnimations = osAnimations,
+        touchExploration = touchExploration,
+    )
+}
@@ -1,665 +0,0 @@
-package com.hermesandroid.relay.ui.components
-
-import android.content.Context
-import android.provider.Settings
-import android.view.accessibility.AccessibilityManager
-import androidx.activity.compose.BackHandler
-import androidx.compose.animation.AnimatedVisibility
-import androidx.compose.animation.core.MutableTransitionState
-import androidx.compose.animation.core.tween
-import androidx.compose.animation.fadeIn
-import androidx.compose.animation.fadeOut
-import androidx.compose.animation.slideInVertically
-import androidx.compose.foundation.background
-import androidx.compose.foundation.rememberScrollState
-import androidx.compose.foundation.verticalScroll
-import androidx.compose.foundation.layout.Arrangement
-import androidx.compose.foundation.layout.Box
-import androidx.compose.foundation.layout.Column
-import androidx.compose.foundation.layout.Row
-import androidx.compose.foundation.layout.Spacer
-import androidx.compose.foundation.layout.fillMaxSize
-import androidx.compose.foundation.layout.fillMaxWidth
-import androidx.compose.foundation.layout.height
-import androidx.compose.foundation.layout.heightIn
-import androidx.compose.foundation.layout.imePadding
-import androidx.compose.foundation.layout.navigationBarsPadding
-import androidx.compose.foundation.layout.padding
-import androidx.compose.foundation.layout.size
-import androidx.compose.foundation.layout.statusBarsPadding
-import androidx.compose.foundation.layout.widthIn
-import androidx.compose.foundation.shape.RoundedCornerShape
-import androidx.compose.foundation.text.BasicTextField
-import androidx.compose.foundation.text.KeyboardActions
-import androidx.compose.foundation.text.KeyboardOptions
-import androidx.compose.material.icons.Icons
-import androidx.compose.material.icons.automirrored.filled.Send
-import androidx.compose.material.icons.filled.Close
-import androidx.compose.material3.Icon
-import androidx.compose.material3.IconButton
-import androidx.compose.material3.MaterialTheme
-import androidx.compose.material3.Surface
-import androidx.compose.material3.Text
-import androidx.compose.runtime.Composable
-import androidx.compose.runtime.DisposableEffect
-import androidx.compose.runtime.LaunchedEffect
-import androidx.compose.runtime.getValue
-import androidx.compose.runtime.mutableStateListOf
-import androidx.compose.runtime.mutableStateOf
-import androidx.compose.runtime.remember
-import androidx.compose.runtime.rememberUpdatedState
-import androidx.compose.runtime.setValue
-import androidx.compose.ui.Alignment
-import androidx.compose.ui.Modifier
-import androidx.compose.ui.draw.alpha
-import androidx.compose.ui.draw.drawWithContent
-import androidx.compose.ui.graphics.BlendMode
-import androidx.compose.ui.graphics.Brush
-import androidx.compose.ui.graphics.Color
-import androidx.compose.ui.graphics.CompositingStrategy
-import androidx.compose.ui.graphics.SolidColor
-import androidx.compose.ui.graphics.graphicsLayer
-import androidx.compose.ui.input.pointer.pointerInput
-import androidx.compose.ui.platform.LocalConfiguration
-import androidx.compose.ui.platform.LocalContext
-import androidx.compose.ui.semantics.LiveRegionMode
-import androidx.compose.ui.semantics.clearAndSetSemantics
-import androidx.compose.ui.semantics.contentDescription
-import androidx.compose.ui.semantics.liveRegion
-import androidx.compose.ui.semantics.semantics
-import androidx.compose.ui.text.font.FontFamily
-import androidx.compose.ui.text.input.ImeAction
-import androidx.compose.ui.text.style.TextOverflow
-import androidx.compose.ui.unit.Dp
-import androidx.compose.ui.unit.dp
-import androidx.compose.ui.unit.sp
-import androidx.compose.ui.res.stringResource
-import com.hermesandroid.relay.data.ChatMessage
-import com.hermesandroid.relay.data.MessageRole
-import com.hermesandroid.relay.ui.components.avatar.AvatarRenderState
-import com.hermesandroid.relay.ui.components.avatar.LocalAgentAvatar
-import com.hermesandroid.relay.ui.components.avatar.LocalBackgroundVisualizationEnabled
-import kotlinx.coroutines.delay
-import com.hermesandroid.relay.R
-import com.hermesandroid.relay.ui.theme.RelayRefresh
-
-// --- Text-flow tuning constants -------------------------------------------
-//
-// All time-based numbers stay inside the ranges WP-C1 prescribes so the
-// "clean text flowing in and fading out" reads calm rather than frantic.
-
-/** Soft word-wrap width for a flow line — keeps each buffer entry to ~one
- *  visual line so the bounded buffer maps cleanly to "≤6 lines". */
-private const val FLOW_MAX_CHARS = 42
-
-/** Soft-wrap target only — the visible buffer is now bounded by the
- *  scrollable viewport height + scroll, not a hard line count. */
-private const val FLOW_MAX_LINES = 6
-
-/** Memory ceiling for the persistent line buffer. Lines past this (already
- *  scrolled well above the faded top edge) are dropped silently so a very long
- *  turn can't grow the list without bound. */
-private const val FLOW_BUFFER_MAX = 80
-
-/** How long a settled line lingers after it stops growing, before it begins
- *  fading. Inside the 2.5–4s band from the spec. */
-private const val FLOW_DWELL_MS = 3_000L
-
-private const val FLOW_FADE_IN_MS = 180
-private const val FLOW_FADE_OUT_MS = 600
-
-/** Buffer maintenance cadence. Cheap list bookkeeping only — it mutates
- *  observed state (and so triggers recomposition) only when something
- *  actually changes, so an idle clean mode does not churn the UI. */
-private const val FLOW_TICK_MS = 80L
-
-/**
- * One ephemeral line in the text flow.
- *
- * [text] and [visibility] are snapshot-observed so a growing tail or a
- * fade-out re-renders just that line. [settledAt]/[hiddenAt] are plain
- * bookkeeping read only by the maintenance loop, so they intentionally do
- * NOT trigger recomposition.
- *
- * [visibility] starts `currentState = false, targetState = true`; handing
- * that to `AnimatedVisibility(visibleState = …)` plays the enter transition
- * the first time the line is composed — the idiomatic "animate on appear".
- */
-private class FlowLine(val key: Int, initialText: String) {
-    var text by mutableStateOf(initialText)
-    val visibility = MutableTransitionState(false).apply { targetState = true }
-
-    /** Wall-clock millis at which the line stopped growing (null while it is
-     *  still the active streaming tail). Starts the dwell countdown. */
-    var settledAt: Long? = null
-
-    /** Wall-clock millis at which the fade-out was requested. */
-    var hiddenAt: Long? = null
-}
-
-/**
- * Split [text] into short, append-only flow segments.
- *
- * Explicit newlines hard-break; long paragraphs greedily soft-wrap at word
- * boundaries to [maxChars]. Because the source content only ever grows
- * (streaming appends), every segment except the last is final the moment the
- * next word/line exists — which is exactly what lets the caller treat the
- * last segment as the "growing tail" and everything before it as settled,
- * and key each line by its stable index.
- */
-private fun segmentFlowLines(text: String, maxChars: Int): List<String> {
-    if (text.isBlank()) return emptyList()
-    val out = ArrayList<String>()
-    for (rawLine in text.split('\n')) {
-        val line = rawLine.trim()
-        if (line.isEmpty()) continue
-        val current = StringBuilder()
-        for (word in line.split(' ')) {
-            if (word.isEmpty()) continue
-            val candidate = if (current.isEmpty()) word.length else current.length + 1 + word.length
-            if (candidate > maxChars && current.isNotEmpty()) {
-                out.add(current.toString())
-                current.setLength(0)
-                current.append(word)
-            } else {
-                if (current.isNotEmpty()) current.append(' ')
-                current.append(word)
-            }
-        }
-        if (current.isNotEmpty()) out.add(current.toString())
-    }
-    return out
-}
-
-/**
- * Soft fade on the TOP edge so lines that scroll up dissolve cleanly into the
- * background instead of hard-clipping — the "slides up and clears" look — while
- * the avatar above stays unobstructed. Renders the content into an offscreen
- * layer and masks the top [fade] dp with a transparent->opaque gradient.
- */
-private fun Modifier.topFadeEdge(fade: Dp = 28.dp): Modifier = this
-    .graphicsLayer { compositingStrategy = CompositingStrategy.Offscreen }
-    .drawWithContent {
-        drawContent()
-        val fadePx = fade.toPx().coerceAtMost(size.height)
-        if (fadePx <= 0f) return@drawWithContent
-        drawRect(
-            brush = Brush.verticalGradient(
-                0f to Color.Transparent,
-                (fadePx / size.height) to Color.Black,
-            ),
-            blendMode = BlendMode.DstIn,
-        )
-    }
-
-/** Shared OS motion/accessibility posture for animated chat affordances. */
-internal data class AccessibleMotionState(
-    /** OS animator scale is non-zero (i.e. system animations are ON). */
-    val osAnimations: Boolean,
-    /** TalkBack-style touch exploration is active — faded text is unreadable
-     *  to it, so the text path must fall back to a static, announced mirror. */
-    val touchExploration: Boolean,
-)
-
-@Composable
-internal fun rememberAccessibleMotionState(): AccessibleMotionState {
-    val context = LocalContext.current
-    // ANIMATOR_DURATION_SCALE == 0 is the platform "remove animations" / many
-    // OEM "reduce motion" toggles. Read once on entry; a mid-mode toggle is
-    // rare and recovered by leaving + re-entering the mode.
-    val osAnimations = remember {
-        runCatching {
-            Settings.Global.getFloat(
-                context.contentResolver,
-                Settings.Global.ANIMATOR_DURATION_SCALE,
-                1f,
-            ) != 0f
-        }.getOrDefault(true)
-    }
-    val a11y = remember {
-        context.getSystemService(Context.ACCESSIBILITY_SERVICE) as? AccessibilityManager
-    }
-    var touchExploration by remember {
-        mutableStateOf(a11y?.isTouchExplorationEnabled == true)
-    }
-    DisposableEffect(a11y) {
-        val listener = AccessibilityManager.TouchExplorationStateChangeListener { enabled ->
-            touchExploration = enabled
-        }
-        a11y?.addTouchExplorationStateChangeListener(listener)
-        onDispose { a11y?.removeTouchExplorationStateChangeListener(listener) }
-    }
-    return AccessibleMotionState(
-        osAnimations = osAnimations,
-        touchExploration = touchExploration,
-    )
-}
-
-/**
- * Ephemeral, themed text flow bound to the agent's streaming reply.
- *
- * New segments materialize with `fadeIn + slideInVertically`; a settled line
- * dwells ~[FLOW_DWELL_MS], then `fadeOut`s and is **removed from the buffer**
- * (it leaves the composition tree, so it stops composing — not merely
- * alpha-0). The still-growing tail never fades; its dwell starts only once
- * [streaming] flips false. The buffer is hard-capped at [FLOW_MAX_LINES].
- *
- * Accessibility: when [motionEnabled] is false (animations disabled, OS
- * reduce-motion, or TalkBack touch exploration) the flow renders the recent
- * lines **statically** inside a polite live region — never gating the
- * conversation on animation. Even on the animated path a visually-hidden
- * polite mirror carries the readable words, since faded glyphs are
- * unreadable to assistive tech.
- *
- * @param content the last assistant message's (streaming) content.
- * @param streaming whether that message is still growing this turn.
- * @param messageId stable id of the bound message; a new id resets the buffer.
- */
-@Composable
-fun AgentTextFlow(
-    content: String,
-    streaming: Boolean,
-    messageId: String?,
-    motionEnabled: Boolean,
-    modifier: Modifier = Modifier,
-) {
-    val flowStyle = MaterialTheme.typography.bodyMedium.copy(
-        fontFamily = FontFamily.Monospace,
-        fontSize = 15.sp,
-        lineHeight = 21.sp,
-    )
-    val flowColor = MaterialTheme.colorScheme.onSurface
-
-    // Readable, non-faded mirror of the visible tail — used as the live-region
-    // text on both paths so assistive tech hears the words.
-    val mirrorText = remember(content) {
-        segmentFlowLines(content, FLOW_MAX_CHARS).takeLast(FLOW_MAX_LINES).joinToString(" ")
-    }
-
-    // --- Static / reduced-motion path -------------------------------------
-    if (!motionEnabled) {
-        val staticLines = remember(content) {
-            segmentFlowLines(content, FLOW_MAX_CHARS).takeLast(FLOW_BUFFER_MAX)
-        }
-        val staticScroll = rememberScrollState()
-        // Pin the latest line to the bottom of the bounded viewport.
-        LaunchedEffect(staticLines.size) { staticScroll.scrollTo(staticScroll.maxValue) }
-        // No contentDescription — the merged child Text content IS the readable
-        // content; liveRegion announces it on change. Lines persist + scroll
-        // (bounded + top-faded like the animated path) — they never vanish.
-        Column(
-            modifier = modifier
-                .semantics { liveRegion = LiveRegionMode.Polite }
-                // Fade the top edge ONLY when there's content scrolled above it —
-                // a message that fits shows its first line crisply (no cut-off look).
-                .topFadeEdge(fade = if (staticScroll.canScrollBackward) 28.dp else 0.dp)
-                .verticalScroll(staticScroll),
-            verticalArrangement = Arrangement.Bottom,
-        ) {
-            staticLines.forEach { line ->
-                Text(
-                    text = line,
-                    style = flowStyle,
-                    color = flowColor,
-                    maxLines = 2,
-                    overflow = TextOverflow.Ellipsis,
-                    modifier = Modifier.fillMaxWidth(),
-                )
-            }
-        }
-        return
-    }
-
-    // --- Animated path ----------------------------------------------------
-    val flowLines = remember(messageId) { mutableStateListOf<FlowLine>() }
-    val currentContent by rememberUpdatedState(content)
-
-    LaunchedEffect(messageId) {
-        flowLines.clear()
-        // Largest segment index ever materialized — guards against re-adding a
-        // line that was dropped from the front by the memory cap.
-        var maxKeyAdded = -1
-        var lastText: String? = null
-        while (true) {
-            val text = currentContent
-            // Re-diff only when the transcript changed, so an idle clean mode
-            // (no streaming, no new turn) doesn't churn. We never permanently
-            // exit: a new turn appended to the transcript must still slide in.
-            if (text != lastText) {
-                lastText = text
-                val segs = segmentFlowLines(text, FLOW_MAX_CHARS)
-                // Add new lines (they slide in); update a changed tail in place.
-                // Lines PERSIST — older ones simply scroll up within the bounded,
-                // scrollable viewport and dissolve at the top fade edge.
-                segs.forEachIndexed { i, s ->
-                    val existing = flowLines.firstOrNull { it.key == i }
-                    if (existing == null) {
-                        if (i > maxKeyAdded) {
-                            flowLines.add(FlowLine(key = i, initialText = s))
-                            maxKeyAdded = i
-                        }
-                    } else if (existing.text != s) {
-                        existing.text = s
-                    }
-                }
-                // Memory guard: drop the oldest lines once well past the viewport.
-                while (flowLines.size > FLOW_BUFFER_MAX) flowLines.removeAt(0)
-            }
-            delay(FLOW_TICK_MS)
-        }
-    }
-
-    val scrollState = rememberScrollState()
-    // Pin the latest line to the bottom as content streams in / lines slide up.
-    LaunchedEffect(flowLines.size, flowLines.lastOrNull()?.text) {
-        scrollState.scrollTo(scrollState.maxValue)
-    }
-
-    Box(modifier = modifier) {
-        // Visually-hidden, readable, politely-announced mirror. Present even
-        // with motion on, so non-touch assistive tech still receives the words
-        // the faded glyphs can't convey. The Text's own content is its
-        // semantics text, so liveRegion alone announces it on change.
-        Text(
-            text = mirrorText,
-            maxLines = 1,
-            modifier = Modifier
-                .fillMaxWidth()
-                .heightIn(max = 1.dp)
-                .alpha(0f)
-                .semantics { liveRegion = LiveRegionMode.Polite },
-            style = flowStyle,
-        )
-
-        Column(
-            modifier = Modifier
-                .align(Alignment.BottomStart)
-                .fillMaxWidth()
-                // Fade the top edge ONLY when content is scrolled above it, so a
-                // reply that fits the viewport shows its first line crisply.
-                .topFadeEdge(fade = if (scrollState.canScrollBackward) 28.dp else 0.dp)
-                .verticalScroll(scrollState),
-            verticalArrangement = Arrangement.Bottom,
-        ) {
-            flowLines.forEach { line ->
-                androidx.compose.runtime.key(line.key) {
-                    AnimatedVisibility(
-                        visibleState = line.visibility,
-                        enter = fadeIn(tween(FLOW_FADE_IN_MS)) +
-                            slideInVertically(tween(FLOW_FADE_IN_MS)) { it / 6 },
-                        exit = fadeOut(tween(FLOW_FADE_OUT_MS)),
-                    ) {
-                        Text(
-                            text = line.text,
-                            style = flowStyle,
-                            color = flowColor,
-                            maxLines = 2,
-                            overflow = TextOverflow.Ellipsis,
-                            // The visible glyphs fade; the mirror above owns
-                            // accessibility, so keep AT off these duplicates.
-                            modifier = Modifier
-                                .fillMaxWidth()
-                                .clearAndSetSemantics {},
-                        )
-                    }
-                }
-            }
-        }
-    }
-}
-
-/**
- * Thin single-line composer for clean mode.
- *
- * Deliberately stripped: no model/effort pills, no attachments, no slash
- * palette — just a pill field plus a send affordance, calling [onSend] with
- * the same [com.hermesandroid.relay.viewmodel.ChatViewModel.sendMessage]
- * contract the full composer uses. Internal text state is UI-local.
- */
-@Composable
-private fun CleanModeComposer(
-    enabled: Boolean,
-    onSend: (String) -> Unit,
-    modifier: Modifier = Modifier,
-) {
-    var text by remember { mutableStateOf("") }
-    val canSend = enabled && text.isNotBlank()
-    val submit = {
-        val trimmed = text.trim()
-        if (enabled && trimmed.isNotEmpty()) {
-            onSend(trimmed)
-            text = ""
-        }
-    }
-
-    Surface(
-        shape = RoundedCornerShape(28.dp),
-        color = MaterialTheme.colorScheme.surfaceContainerHigh,
-        modifier = modifier.fillMaxWidth(),
-    ) {
-        Row(
-            modifier = Modifier.padding(start = 18.dp, end = 6.dp, top = 4.dp, bottom = 4.dp),
-            verticalAlignment = Alignment.CenterVertically,
-            horizontalArrangement = Arrangement.spacedBy(6.dp),
-        ) {
-            BasicTextField(
-                value = text,
-                onValueChange = { text = it },
-                modifier = Modifier
-                    .weight(1f)
-                    .heightIn(min = 40.dp)
-                    .padding(vertical = 8.dp),
-                enabled = enabled,
-                singleLine = true,
-                textStyle = MaterialTheme.typography.bodyLarge.copy(
-                    color = MaterialTheme.colorScheme.onSurface,
-                ),
-                cursorBrush = SolidColor(MaterialTheme.colorScheme.primary),
-                keyboardOptions = KeyboardOptions(imeAction = ImeAction.Send),
-                keyboardActions = KeyboardActions(onSend = { submit() }),
-                decorationBox = { inner ->
-                    Box(contentAlignment = Alignment.CenterStart) {
-                        if (text.isEmpty()) {
-                            Text(
-                                text = stringResource(R.string.agent_text_placeholder),
-                                style = MaterialTheme.typography.bodyLarge,
-                                color = RelayRefresh.Dim,
-                            )
-                        }
-                        inner()
-                    }
-                },
-            )
-            IconButton(
-                onClick = submit,
-                enabled = canSend,
-                modifier = Modifier.size(44.dp),
-            ) {
-                Icon(
-                    imageVector = Icons.AutoMirrored.Filled.Send,
-                    contentDescription = stringResource(R.string.agent_text_send_cd),
-                    tint = if (canSend) {
-                        MaterialTheme.colorScheme.primary
-                    } else {
-                        MaterialTheme.colorScheme.onSurfaceVariant.copy(alpha = 0.5f)
-                    },
-                )
-            }
-        }
-    }
-}
-
-/**
- * Clean text-flow chat mode — a full-screen, minimalist third presentation of
- * the agent surface (alongside normal chat and the voice overlay).
- *
- * Centered morphing sphere, a calm themed text flow ([AgentTextFlow]) instead
- * of a persistent transcript, and a thin composer. Mirrors the voice overlay's
- * centered-sphere + bottom-content skeleton (`VoiceModeOverlay.kt:262-280`).
- *
- * Exit is an **explicit control** (top-corner dismiss + system back) — never
- * any-tap, because the in-mode composer needs taps. All mode state lives in
- * the caller as plain UI-local state; this is a presentation over the same
- * conversation, not new ViewModel state.
- *
- * Honors the ambient-visualization preference independently from motion.
- * When visible, [animationEnabled] and OS reduce-motion pause the sphere on a
- * static frame; TalkBack keeps the text readable and announced.
- */
-@Composable
-fun CleanChatMode(
-    messages: List<ChatMessage>,
-    isStreaming: Boolean,
-    sphereState: SphereState,
-    streamingIntensity: Float,
-    toolCallBurst: Float,
-    animationEnabled: Boolean,
-    enabled: Boolean,
-    onSend: (String) -> Unit,
-    onExit: () -> Unit,
-    modifier: Modifier = Modifier,
-) {
-    val motion = rememberAccessibleMotionState()
-    val backgroundVisualizationEnabled = LocalBackgroundVisualizationEnabled.current
-    val sphereAnimated = animationEnabled && motion.osAnimations
-    // Faded text is unreadable to touch exploration, so the text path goes
-    // static (readable + announced) whenever TalkBack is exploring.
-    val textMotionEnabled = sphereAnimated && !motion.touchExploration
-
-    val lastAssistant = remember(messages) {
-        messages.lastOrNull { it.role == MessageRole.ASSISTANT }
-    }
-    // Clean mode shows the recent CONVERSATION (not just the last reply) as one
-    // faded, scrollable flow, so scrolling up brings history into view. The flow
-    // is append-only across turns; user turns get a subtle "›" so the
-    // back-and-forth stays legible. How far back it retains is bounded by the
-    // flow's line buffer (FLOW_BUFFER_MAX).
-    val flowContent = remember(messages) {
-        messages
-            .filter { it.role == MessageRole.USER || it.role == MessageRole.ASSISTANT }
-            .joinToString("\n\n") { msg ->
-                val body = msg.content.trim()
-                if (msg.role == MessageRole.USER) "› $body" else body
-            }
-    }
-    // Stable per-conversation key so the flow buffer accumulates across turns and
-    // resets only on a new conversation (the oldest message's id changes).
-    val conversationKey = messages.firstOrNull()?.id
-    val flowStreaming = lastAssistant?.isStreaming == true && isStreaming
-    // The sphere + text are a vertically-centered group (equal spacers above and
-    // below). The sphere is a fixed size so the group grows via the TEXT: a short
-    // reply sits centered, and as the reply lengthens the centered group gets
-    // taller — sliding the sphere up toward the top third while the text fills
-    // down toward the composer.
-    val sphereHeight = (LocalConfiguration.current.screenHeightDp * 0.34f).dp
-    val maxFlowHeight = (LocalConfiguration.current.screenHeightDp * 0.5f).dp
-
-    BackHandler(enabled = true) { onExit() }
-
-    val sphereDescLabel = stringResource(R.string.agent_text_sphere_desc)
-    val sphereDescription = remember(sphereState) {
-        "$sphereDescLabel ${sphereState.name.lowercase()}"
-    }
-
-    Box(
-        modifier = modifier
-            .fillMaxSize()
-            // Opaque so the chat underneath is fully hidden — this is a mode,
-            // not a translucent overlay.
-            .background(RelayRefresh.Background)
-            // Consume any pointer event the children (composer, exit button, text
-            // scroll) didn't handle, so stray taps/swipes in the empty areas don't
-            // fall through to the chat + session drawer behind this mode. Children
-            // run leaf-first on the same Main pass, so this only catches the gaps
-            // (mirrors the voice overlay's focus-mode scrim).
-            .pointerInput(Unit) {
-                awaitPointerEventScope {
-                    while (true) {
-                        awaitPointerEvent().changes.forEach { it.consume() }
-                    }
-                }
-            },
-    ) {
-        Column(
-            modifier = Modifier
-                .fillMaxSize()
-                .statusBarsPadding()
-                .navigationBarsPadding()
-                .imePadding()
-                .padding(horizontal = 20.dp),
-        ) {
-            // Explicit dismiss — the only way out besides system back.
-            Row(
-                modifier = Modifier.fillMaxWidth(),
-                horizontalArrangement = Arrangement.End,
-            ) {
-                IconButton(onClick = onExit) {
-                    Icon(
-                        imageVector = Icons.Filled.Close,
-                        contentDescription = stringResource(R.string.agent_text_exit_clean),
-                        tint = MaterialTheme.colorScheme.onSurfaceVariant,
-                    )
-                }
-            }
-
-            // Flexible top spacer — with the bottom one it vertically centers the
-            // sphere + text group; as the text grows the spacers yield and the
-            // sphere rises toward the top third.
-            Spacer(modifier = Modifier.weight(1f))
-
-            // The ambient sphere is optional. Hiding it collapses the visual's
-            // slot so the conversation remains centered instead of leaving a
-            // large blank region above the text.
-            if (backgroundVisualizationEnabled) {
-                Box(
-                    modifier = Modifier
-                        .fillMaxWidth()
-                        .height(sphereHeight),
-                    contentAlignment = Alignment.Center,
-                ) {
-                    Box(
-                        modifier = Modifier
-                            .fillMaxSize()
-                            .semantics { contentDescription = sphereDescription },
-                    ) {
-                        LocalAgentAvatar.current.Render(
-                            state = AvatarRenderState(
-                                state = sphereState,
-                                intensity = streamingIntensity,
-                                toolCallBurst = toolCallBurst,
-                                // Pin to a still frame when motion is suppressed.
-                                paused = !sphereAnimated,
-                            ),
-                            modifier = Modifier.fillMaxSize(),
-                        )
-                    }
-                }
-            }
-
-            AgentTextFlow(
-                content = flowContent,
-                streaming = flowStreaming,
-                messageId = conversationKey,
-                motionEnabled = textMotionEnabled,
-                // Content-sized reading area (capped ~half the screen) directly
-                // below the sphere — no gap between them. Grows + scrolls with the
-                // reply, which is what lifts the centered group (and the sphere).
-                modifier = Modifier
-                    .fillMaxWidth()
-                    .widthIn(max = 560.dp)
-                    .heightIn(min = 96.dp, max = maxFlowHeight)
-                    .padding(bottom = 12.dp),
-            )
-
-            // Flexible bottom spacer — balances the top one to keep the
-            // sphere + text group vertically centered.
-            Spacer(modifier = Modifier.weight(1f))
-
-            CleanModeComposer(
-                enabled = enabled,
-                onSend = onSend,
-                modifier = Modifier.padding(bottom = 12.dp),
-            )
-        }
-    }
-}
@@ -125,6 +125,7 @@ fun AttachmentGallery(
    if (attachments.size < 2) return

    val context = LocalContext.current
+    val exportAllowed = LocalImageExportAllowed.current
    val scope = rememberCoroutineScope()
    val blurMode = LocalMediaBlurMode.current
    val revealed = remember { mutableStateMapOf<String, Boolean>() }
@@ -189,7 +190,7 @@ fun AttachmentGallery(
                            )
                        }

-                        if (!blurred) {
+                        if (!blurred && exportAllowed) {
                            SaveOverlayButton(
                                onClick = {
                                    scope.launch { saveAttachment(context, attachment) }
@@ -201,7 +202,7 @@ fun AttachmentGallery(
                        }

                        AttachmentActionsMenu(
-                            expanded = menuExpanded,
+                            expanded = menuExpanded && exportAllowed,
                            onDismiss = { menuExpanded = false },
                            context = context,
                            scope = scope,
@@ -312,6 +312,8 @@ fun AttachmentViewer(
        properties = DialogProperties(usePlatformDefaultWidth = false),
    ) {
        val context = LocalContext.current
+        val exportAllowed = LocalImageExportAllowed.current ||
+            attachment.renderMode != AttachmentRenderMode.IMAGE
        AllowDeviceRotation()
        val scope = rememberCoroutineScope()
        var busy by remember { mutableStateOf(false) }
@@ -405,6 +407,7 @@ fun AttachmentViewer(
                title = title,
                busy = busy,
                actionsEnabled = !blurred,
+                exportAllowed = exportAllowed,
                onShare = onShare,
                onSave = onSave,
                onOpenExternal = onOpenExternal,
@@ -448,6 +451,7 @@ internal fun AttachmentGalleryViewer(
        properties = DialogProperties(usePlatformDefaultWidth = false),
    ) {
        val context = LocalContext.current
+        val exportAllowed = LocalImageExportAllowed.current
        AllowDeviceRotation()
        val scope = rememberCoroutineScope()
        var busy by remember { mutableStateOf(false) }
@@ -584,6 +588,7 @@ internal fun AttachmentGalleryViewer(
                title = toolbarTitle,
                busy = busy,
                actionsEnabled = !currentBlurred,
+                exportAllowed = exportAllowed,
                onShare = onShare,
                onSave = onSave,
                onOpenExternal = onOpenExternal,
@@ -613,6 +618,7 @@ private fun MediaViewerToolbar(
    title: String,
    busy: Boolean,
    actionsEnabled: Boolean = true,
+    exportAllowed: Boolean = true,
    onShare: () -> Unit,
    onSave: () -> Unit,
    onOpenExternal: () -> Unit,
@@ -653,11 +659,13 @@ private fun MediaViewerToolbar(
        ) {
            Icon(Icons.Filled.OpenInNew, contentDescription = stringResource(R.string.attachment_open_externally_a11y))
        }
-        IconButton(onClick = onShare, enabled = actionsEnabled && !busy, colors = tint) {
-            Icon(Icons.Filled.Share, contentDescription = stringResource(R.string.attachment_share_a11y))
-        }
-        IconButton(onClick = onSave, enabled = actionsEnabled && !busy, colors = tint) {
-            Icon(Icons.Filled.Download, contentDescription = stringResource(R.string.attachment_save_a11y))
+        if (exportAllowed) {
+            IconButton(onClick = onShare, enabled = actionsEnabled && !busy, colors = tint) {
+                Icon(Icons.Filled.Share, contentDescription = stringResource(R.string.attachment_share_a11y))
+            }
+            IconButton(onClick = onSave, enabled = actionsEnabled && !busy, colors = tint) {
+                Icon(Icons.Filled.Download, contentDescription = stringResource(R.string.attachment_save_a11y))
+            }
        }
    }
 }
@@ -47,7 +47,7 @@ import com.hermesandroid.relay.viewmodel.BridgeStatus
 * Phase 3 Wave 1 — bridge-ui (`bridge-screen-ui`). Visual style mirrors the status
 * cards in `PairedDevicesScreen`: surfaceVariant background, 16dp padding,
 * 10dp row spacing. Uses [ConnectionStatusBadge] for the pulsing status dot
- * so the Bridge tab looks visually consistent with the Settings → Connections
+ * so the Bridge tab looks visually consistent with the Settings → Gateways
 * section.
 *
 * The headline switch is `enabled = allowEnable` so users can't flip it on
@@ -30,7 +30,7 @@ import com.hermesandroid.relay.viewmodel.BridgeStatus
 * Phase 3 Wave 1 — bridge-ui (`bridge-screen-ui`). Kept distinct from
 * [BridgeMasterToggle] so that Agent safety-rails in Wave 2 can relocate the master
 * toggle without losing the status surface (and so we can reuse this card
- * in the Settings → Connections section later if desired).
+ * in Settings → Gateways later if desired).
 */
@Composable
 fun BridgeStatusCard(
@@ -32,6 +32,7 @@ fun ChatFailurePanel(
    onDetails: () -> Unit,
    onRetry: () -> Unit,
    onDismiss: () -> Unit,
+    showDetails: Boolean = true,
    modifier: Modifier = Modifier,
 ) {
    Surface(
@@ -72,8 +73,10 @@ fun ChatFailurePanel(
                horizontalArrangement = Arrangement.End,
                verticalAlignment = Alignment.CenterVertically,
            ) {
-                TextButton(onClick = onDetails) {
-                    Text(stringResource(R.string.chat_failure_details))
+                if (showDetails) {
+                    TextButton(onClick = onDetails) {
+                        Text(stringResource(R.string.chat_failure_details))
+                    }
                }
                if (failure.recoverable) {
                    TextButton(onClick = onRetry) {
@@ -0,0 +1,156 @@
+package com.hermesandroid.relay.ui.components
+
+import androidx.compose.foundation.BorderStroke
+import androidx.compose.foundation.background
+import androidx.compose.foundation.layout.Arrangement
+import androidx.compose.foundation.layout.Box
+import androidx.compose.foundation.layout.Row
+import androidx.compose.foundation.layout.Spacer
+import androidx.compose.foundation.layout.fillMaxWidth
+import androidx.compose.foundation.layout.height
+import androidx.compose.foundation.layout.padding
+import androidx.compose.foundation.layout.size
+import androidx.compose.foundation.layout.width
+import androidx.compose.foundation.layout.widthIn
+import androidx.compose.foundation.shape.CircleShape
+import androidx.compose.material.icons.Icons
+import androidx.compose.material.icons.automirrored.filled.KeyboardArrowRight
+import androidx.compose.material.icons.filled.AccountTree
+import androidx.compose.material3.Icon
+import androidx.compose.material3.Surface
+import androidx.compose.material3.Text
+import androidx.compose.runtime.Composable
+import androidx.compose.ui.Alignment
+import androidx.compose.ui.Modifier
+import androidx.compose.ui.semantics.clearAndSetSemantics
+import androidx.compose.ui.semantics.contentDescription
+import androidx.compose.ui.text.style.TextOverflow
+import androidx.compose.ui.unit.dp
+import androidx.compose.ui.res.pluralStringResource
+import androidx.compose.ui.res.stringResource
+import com.hermesandroid.relay.R
+import com.hermesandroid.relay.ui.theme.RelayRefresh
+import com.hermesandroid.relay.ui.theme.appearanceRoundedCornerShape
+import com.hermesandroid.relay.ui.theme.relayMetadataStyle
+
+/** Small, read-only Git projection supplied by the native workspace owner. */
+data class ChatGitWorkspaceSummary(
+    val branch: String,
+    val changeCount: Int,
+    val additions: Int? = null,
+    val deletions: Int? = null,
+)
+
+@Composable
+fun ChatGitContextButton(
+    onClick: () -> Unit,
+    modifier: Modifier = Modifier,
+) {
+    Box(modifier = modifier) {
+        RelayChromeIconButton(
+            icon = Icons.Filled.AccountTree,
+            contentDescription = stringResource(R.string.chat_git_open_workspace),
+            onClick = onClick,
+        )
+        Surface(
+            modifier = Modifier
+                .size(9.dp)
+                .align(Alignment.TopEnd),
+            shape = CircleShape,
+            color = RelayRefresh.Green,
+            border = BorderStroke(1.5.dp, RelayRefresh.Background),
+            content = {},
+        )
+    }
+}
+
+@Composable
+fun ChatGitWorkspaceRail(
+    summary: ChatGitWorkspaceSummary,
+    onClick: () -> Unit,
+    modifier: Modifier = Modifier,
+) {
+    val branch = summary.branch.trim()
+    val changeCount = summary.changeCount.coerceAtLeast(0)
+    val changeLabel = pluralStringResource(
+        R.plurals.chat_git_change_count,
+        changeCount,
+        changeCount,
+    )
+    val additions = summary.additions?.coerceAtLeast(0)
+    val deletions = summary.deletions?.coerceAtLeast(0)
+    val a11yLabel = buildList {
+        add(stringResource(R.string.chat_git_branch, branch))
+        add(changeLabel)
+        additions?.let { add(stringResource(R.string.chat_git_additions, it)) }
+        deletions?.let { add(stringResource(R.string.chat_git_deletions, it)) }
+        add(stringResource(R.string.chat_git_open_workspace))
+    }.joinToString(". ")
+
+    Surface(
+        onClick = onClick,
+        modifier = modifier
+            .fillMaxWidth()
+            .height(38.dp)
+            .clearAndSetSemantics { contentDescription = a11yLabel },
+        shape = appearanceRoundedCornerShape(12.dp),
+        color = RelayRefresh.Background.copy(alpha = 0.72f),
+        border = BorderStroke(1.dp, RelayRefresh.LineStrong),
+    ) {
+        Row(
+            modifier = Modifier.padding(horizontal = 11.dp),
+            verticalAlignment = Alignment.CenterVertically,
+            horizontalArrangement = Arrangement.spacedBy(8.dp),
+        ) {
+            Icon(
+                imageVector = Icons.Filled.AccountTree,
+                contentDescription = null,
+                tint = RelayRefresh.Cyan,
+                modifier = Modifier.size(17.dp),
+            )
+            Text(
+                text = branch,
+                style = relayMetadataStyle(),
+                color = RelayRefresh.Paper,
+                maxLines = 1,
+                overflow = TextOverflow.Ellipsis,
+                modifier = Modifier.widthIn(max = 92.dp),
+            )
+            Box(
+                modifier = Modifier
+                    .width(1.dp)
+                    .height(16.dp)
+                    .background(RelayRefresh.LineStrong),
+            )
+            Text(
+                text = changeLabel,
+                style = relayMetadataStyle(),
+                color = RelayRefresh.Muted,
+                maxLines = 1,
+            )
+            Spacer(modifier = Modifier.weight(1f))
+            additions?.let {
+                Text(
+                    text = "+$it",
+                    style = relayMetadataStyle(),
+                    color = RelayRefresh.Green,
+                    maxLines = 1,
+                )
+            }
+            deletions?.let {
+                Text(
+                    text = "-$it",
+                    style = relayMetadataStyle(),
+                    color = RelayRefresh.Danger,
+                    maxLines = 1,
+                )
+            }
+            Icon(
+                imageVector = Icons.AutoMirrored.Filled.KeyboardArrowRight,
+                contentDescription = null,
+                tint = RelayRefresh.Muted,
+                modifier = Modifier.size(18.dp),
+            )
+        }
+    }
+}
@@ -27,6 +27,7 @@ import androidx.compose.runtime.mutableStateOf
 import androidx.compose.runtime.remember
 import androidx.compose.runtime.rememberCoroutineScope
 import androidx.compose.runtime.setValue
+import androidx.compose.runtime.staticCompositionLocalOf
 import androidx.compose.ui.Alignment
 import androidx.compose.ui.Modifier
 import androidx.compose.ui.graphics.Color
@@ -42,6 +43,9 @@ import com.hermesandroid.relay.R
 import com.hermesandroid.relay.util.MediaSaver
 import kotlinx.coroutines.launch

+/** Whether the current conversation policy permits copying image bytes out of the app. */
+val LocalImageExportAllowed = staticCompositionLocalOf { true }
+
 /**
 * What the [ChatImageViewer] displays and how it obtains bytes for Save/Share.
 *
@@ -104,6 +108,7 @@ fun ChatImageViewer(
        properties = DialogProperties(usePlatformDefaultWidth = false),
    ) {
        val context = LocalContext.current
+        val exportAllowed = LocalImageExportAllowed.current
        AllowDeviceRotation()
        val scope = rememberCoroutineScope()

@@ -156,60 +161,72 @@ fun ChatImageViewer(
                horizontalArrangement = Arrangement.spacedBy(4.dp),
            ) {
                val tint = IconButtonDefaults.iconButtonColors(contentColor = Color.White)
-                val cdShare = stringResource(R.string.cd_share)
-                val cdSave = stringResource(R.string.cd_save)
                val cdClose = stringResource(R.string.cd_close_viewer)
                val errorMsg = context.getString(R.string.image_viewer_error)
-                IconButton(
-                    onClick = {
-                        scope.launch {
-                            busy = true
-                            val bytes = runCatching { source.bytesProvider() }.getOrNull()
-                            busy = false
-                            if (bytes == null) {
-                                toast(context, errorMsg)
-                                return@launch
-                            }
-                            val uri = MediaSaver.stageForShare(context, bytes, source.displayName, source.mime)
-                            MediaSaver.share(context, uri, source.mime)
-                        }
-                    },
-                    colors = tint,
-                ) {
-                    Icon(Icons.Filled.Share, contentDescription = cdShare)
-                }
-                val savedFmt = context.getString(R.string.image_viewer_saved)
-                val failedFmt = context.getString(R.string.image_viewer_failed)
-                IconButton(
-                    onClick = {
-                        scope.launch {
-                            busy = true
-                            val bytes = runCatching { source.bytesProvider() }.getOrNull()
-                            if (bytes == null) {
+                if (exportAllowed) {
+                    val cdShare = stringResource(R.string.cd_share)
+                    val cdSave = stringResource(R.string.cd_save)
+                    IconButton(
+                        onClick = {
+                            scope.launch {
+                                busy = true
+                                val bytes = runCatching { source.bytesProvider() }.getOrNull()
                                busy = false
-                                toast(context, errorMsg)
-                                return@launch
+                                if (bytes == null) {
+                                    toast(context, errorMsg)
+                                    return@launch
+                                }
+                                val uri = MediaSaver.stageForShare(
+                                    context,
+                                    bytes,
+                                    source.displayName,
+                                    source.mime,
+                                )
+                                MediaSaver.share(context, uri, source.mime)
                            }
-                            when (val result = MediaSaver.saveImage(context, bytes, source.displayName, source.mime)) {
-                                is MediaSaver.SaveResult.Saved -> {
+                        },
+                        colors = tint,
+                    ) {
+                        Icon(Icons.Filled.Share, contentDescription = cdShare)
+                    }
+                    val savedFmt = context.getString(R.string.image_viewer_saved)
+                    val failedFmt = context.getString(R.string.image_viewer_failed)
+                    IconButton(
+                        onClick = {
+                            scope.launch {
+                                busy = true
+                                val bytes = runCatching { source.bytesProvider() }.getOrNull()
+                                if (bytes == null) {
                                    busy = false
-                                    toast(context, savedFmt.format(result.location))
+                                    toast(context, errorMsg)
+                                    return@launch
                                }
-                                MediaSaver.SaveResult.UseShareInstead -> {
-                                    busy = false
-                                    val uri = MediaSaver.stageForShare(context, bytes, source.displayName, source.mime)
-                                    MediaSaver.share(context, uri, source.mime)
-                                }
-                                is MediaSaver.SaveResult.Failed -> {
-                                    busy = false
-                                    toast(context, failedFmt.format(result.message))
+                                when (val result = MediaSaver.saveImage(context, bytes, source.displayName, source.mime)) {
+                                    is MediaSaver.SaveResult.Saved -> {
+                                        busy = false
+                                        toast(context, savedFmt.format(result.location))
+                                    }
+                                    MediaSaver.SaveResult.UseShareInstead -> {
+                                        busy = false
+                                        val uri = MediaSaver.stageForShare(
+                                            context,
+                                            bytes,
+                                            source.displayName,
+                                            source.mime,
+                                        )
+                                        MediaSaver.share(context, uri, source.mime)
+                                    }
+                                    is MediaSaver.SaveResult.Failed -> {
+                                        busy = false
+                                        toast(context, failedFmt.format(result.message))
+                                    }
                                }
                            }
-                        }
-                    },
-                    colors = tint,
-                ) {
-                    Icon(Icons.Filled.Download, contentDescription = cdSave)
+                        },
+                        colors = tint,
+                    ) {
+                        Icon(Icons.Filled.Download, contentDescription = cdSave)
+                    }
                }
                IconButton(onClick = onDismiss, colors = tint) {
                    Icon(Icons.Filled.Close, contentDescription = cdClose)
@@ -14,6 +14,9 @@ import androidx.compose.material3.ModalBottomSheet
 import androidx.compose.material3.Text
 import androidx.compose.material3.TextButton
 import androidx.compose.material3.rememberModalBottomSheetState
+import androidx.compose.material.icons.Icons
+import androidx.compose.material.icons.filled.LinkOff
+import androidx.compose.material.icons.filled.Shield
 import androidx.compose.runtime.Composable
 import androidx.compose.runtime.getValue
 import androidx.compose.runtime.mutableStateOf
@@ -30,6 +33,7 @@ import androidx.compose.ui.res.stringResource
 import com.hermesandroid.relay.data.ConnectionSecurity
 import com.hermesandroid.relay.data.ConnectionSecurityLevel
 import com.hermesandroid.relay.data.SurfaceSecurity
+import com.hermesandroid.relay.data.SurfaceUseState

 private const val LEARN_MORE_URL =
    "https://hermes-relay.dev/docs/architecture/connection-security.html"
@@ -128,7 +132,23 @@ private fun SurfaceSecurityRow(surface: SurfaceSecurity) {
        horizontalArrangement = Arrangement.spacedBy(10.dp),
        verticalAlignment = Alignment.CenterVertically,
    ) {
-        SurfaceSecurityGlyph(kind = surface.kind, modifier = Modifier.size(16.dp))
+        if (surface.useState == SurfaceUseState.Unavailable) {
+            Icon(
+                imageVector = Icons.Filled.LinkOff,
+                contentDescription = null,
+                tint = MaterialTheme.colorScheme.onSurfaceVariant,
+                modifier = Modifier.size(16.dp),
+            )
+        } else if (surface.useState == SurfaceUseState.Available) {
+            Icon(
+                imageVector = Icons.Filled.Shield,
+                contentDescription = null,
+                tint = MaterialTheme.colorScheme.onSurfaceVariant,
+                modifier = Modifier.size(16.dp),
+            )
+        } else {
+            SurfaceSecurityGlyph(kind = surface.kind, modifier = Modifier.size(16.dp))
+        }
        Column(modifier = Modifier.weight(1f)) {
            Text(
                text = surface.label,
@@ -142,7 +162,17 @@ private fun SurfaceSecurityRow(surface: SurfaceSecurity) {
            )
        }
        Text(
-            text = surface.mechanism,
+            text = when (surface.useState) {
+                SurfaceUseState.InUse -> surface.mechanism
+                SurfaceUseState.Available -> stringResource(
+                    R.string.security_sheet_available_mechanism,
+                    surface.mechanism,
+                )
+                SurfaceUseState.Unavailable -> stringResource(
+                    R.string.security_sheet_unavailable_mechanism,
+                    surface.mechanism,
+                )
+            },
            style = MaterialTheme.typography.labelMedium,
            color = MaterialTheme.colorScheme.onSurfaceVariant,
        )
@@ -31,7 +31,7 @@ import com.hermesandroid.relay.data.Connection

 /**
 * Bottom sheet chooser for switching between Hermes connections. Driven by
- * the top-bar [ConnectionChip] tap and the Settings → Connections row.
+ * the top-bar [ConnectionChip] tap and the Settings → Gateways row.
 * Each row is a radio selection — tapping commits immediately and dismisses
 * the sheet so the swap kicks off before the user's finger is off the screen.
 *
@@ -6,6 +6,8 @@ import androidx.compose.foundation.clickable
 import androidx.compose.foundation.layout.Arrangement
 import androidx.compose.foundation.layout.Box
 import androidx.compose.foundation.layout.Column
+import androidx.compose.foundation.layout.ExperimentalLayoutApi
+import androidx.compose.foundation.layout.FlowRow
 import androidx.compose.foundation.layout.Row
 import androidx.compose.foundation.layout.Spacer
 import androidx.compose.foundation.layout.fillMaxWidth
@@ -56,15 +58,16 @@ import com.hermesandroid.relay.ui.theme.appearanceRoundedCornerShape
 import com.hermesandroid.relay.data.Connection
 import com.hermesandroid.relay.data.EndpointCandidate
 import com.hermesandroid.relay.data.SurfaceSecurityKind
+import com.hermesandroid.relay.data.classifySurfaceSecurity
 import com.hermesandroid.relay.data.displayLabel
+import com.hermesandroid.relay.data.gatewayRouteUrl
 import com.hermesandroid.relay.data.hasSecureProxy
 import com.hermesandroid.relay.data.secureLinkCoversAllServices
 import com.hermesandroid.relay.data.secureLinkServices
-import com.hermesandroid.relay.data.isEncryptedOverlayRoute
 import com.hermesandroid.relay.data.isKnownRole
-import com.hermesandroid.relay.data.isTlsUrl
 import com.hermesandroid.relay.data.primaryRouteUrl
 import com.hermesandroid.relay.data.routeAuthority
+import com.hermesandroid.relay.network.shared.EndpointSurface
 import com.hermesandroid.relay.network.shared.RouteProbeOutcome
 import com.hermesandroid.relay.viewmodel.ConnectionViewModel
 import kotlinx.coroutines.launch
@@ -100,7 +103,7 @@ fun EndpointsCard(
    /**
     * Live transient override installed by "Use now" (or by preference
     * restoration — equal to [preferredRole] in that case). Drives the
-     * automatic / preferred / manual annotation on the Current line.
+     * automatic / preferred / manual annotation on the selected-candidate line.
     */
    manualOverrideRole: String?,
    onUseNow: (EndpointCandidate) -> Unit,
@@ -117,6 +120,7 @@ fun EndpointsCard(
     * resolver's cache-key scheme.
     */
    outcomeFor: (EndpointCandidate) -> RouteProbeOutcome? = { null },
+    surfaceOutcomeFor: (EndpointCandidate, EndpointSurface) -> RouteProbeOutcome? = { _, _ -> null },
    /** Auth state applies only to the currently active Dashboard route. */
    dashboardAuthenticated: Boolean? = null,
    dashboardSignInRequired: Boolean = false,
@@ -133,11 +137,11 @@ fun EndpointsCard(
    // Pre-resolve strings
    val noRoutesStoredText = stringResource(R.string.endpoints_no_routes_stored)
    val addRouteText = stringResource(R.string.endpoints_add_route)
-    val resolvingText = stringResource(R.string.endpoints_resolving)
    val manualUntilDisconnectText = stringResource(R.string.endpoints_manual_until_disconnect)
    val preferredText = stringResource(R.string.endpoints_preferred)
    val automaticText = stringResource(R.string.endpoints_automatic)
    val currentRouteText = stringResource(R.string.endpoints_current_route)
+    val noActiveFallbackText = stringResource(R.string.endpoints_no_active_fallback)

    if (endpoints.isEmpty()) {
        Column(verticalArrangement = Arrangement.spacedBy(4.dp)) {
@@ -166,18 +170,41 @@ fun EndpointsCard(
    val stopPreferringText = stringResource(R.string.endpoints_stop_preferring)

    Column(verticalArrangement = Arrangement.spacedBy(8.dp)) {
-        Text(
-            text = currentRouteText.format(
-                activeEndpoint?.displayLabel() ?: resolvingText,
-                when {
-                    manualSwitchActive -> manualUntilDisconnectText
-                    manualOverrideRole != null -> preferredText
-                    else -> automaticText
-                }
-            ),
-            style = MaterialTheme.typography.bodySmall,
-            color = MaterialTheme.colorScheme.onSurfaceVariant,
-        )
+        val activeOutcome = activeEndpoint?.let(outcomeFor)
+        if (activeEndpoint == null) {
+            Text(
+                text = noActiveFallbackText,
+                style = MaterialTheme.typography.bodySmall,
+                color = MaterialTheme.colorScheme.onSurfaceVariant,
+            )
+        } else {
+            Text(
+                text = currentRouteText.format(
+                    activeEndpoint.displayLabel(),
+                    when {
+                        manualSwitchActive -> manualUntilDisconnectText
+                        manualOverrideRole != null -> preferredText
+                        else -> automaticText
+                    }
+                ),
+                style = MaterialTheme.typography.bodySmall,
+                color = MaterialTheme.colorScheme.onSurfaceVariant,
+            )
+            Text(
+                text = stringResource(
+                    R.string.endpoints_selection_reason,
+                    activeEndpoint.priority,
+                    when (routeReachabilityPresentation(isProbing, activeOutcome)) {
+                        RouteReachabilityPresentation.Checking -> stringResource(R.string.endpoints_checking)
+                        RouteReachabilityPresentation.Reachable -> stringResource(R.string.endpoints_reachable_now)
+                        RouteReachabilityPresentation.Unreachable -> stringResource(R.string.endpoints_last_check_failed)
+                        RouteReachabilityPresentation.NotChecked -> stringResource(R.string.endpoints_reachability_not_checked)
+                    },
+                ),
+                style = MaterialTheme.typography.labelSmall,
+                color = MaterialTheme.colorScheme.onSurfaceVariant,
+            )
+        }
        endpoints.forEachIndexed { index, candidate ->
            if (index > 0) HorizontalDivider()
            EndpointRow(
@@ -188,6 +215,7 @@ fun EndpointsCard(
                isPreferred = preferredRole?.equals(candidate.role, ignoreCase = true) == true,
                isProbing = isProbing,
                outcome = outcomeFor(candidate),
+                surfaceOutcomeFor = surfaceOutcomeFor,
                dashboardAuthenticated = dashboardAuthenticated.takeIf { activeEndpoint != null &&
                    activeEndpoint.role.equals(candidate.role, ignoreCase = true) &&
                    activeEndpoint.routeAuthority() == candidate.routeAuthority()
@@ -232,6 +260,7 @@ fun EndpointsCard(
 /**
 * One row: role chip + host:port + transport hint + health chip + 3-dot menu.
 */
+@OptIn(ExperimentalLayoutApi::class)
@Composable
 private fun EndpointRow(
    candidate: EndpointCandidate,
@@ -239,6 +268,7 @@ private fun EndpointRow(
    isPreferred: Boolean,
    isProbing: Boolean = false,
    outcome: RouteProbeOutcome? = null,
+    surfaceOutcomeFor: (EndpointCandidate, EndpointSurface) -> RouteProbeOutcome? = { _, _ -> null },
    dashboardAuthenticated: Boolean? = null,
    dashboardSignInRequired: Boolean = false,
    onUseNow: () -> Unit,
@@ -276,28 +306,38 @@ private fun EndpointRow(
                Row(
                    verticalAlignment = Alignment.CenterVertically,
                    horizontalArrangement = Arrangement.spacedBy(6.dp),
+                    modifier = Modifier.fillMaxWidth(),
                ) {
                    Text(
                        text = candidate.displayLabel(),
                        style = MaterialTheme.typography.bodyMedium,
+                        modifier = Modifier.weight(1f),
+                        maxLines = 1,
+                        overflow = TextOverflow.Ellipsis,
                    )
-                    SurfaceSecurityGlyph(kind = candidate.routeSecurityKind())
-                    if (isActive) {
-                        ActiveChip(stringResource(R.string.endpoints_active))
-                    } else if (isPreferred) {
-                        PreferredChip(stringResource(R.string.endpoints_preferred_chip))
-                    } else {
-                        FallbackChip(stringResource(R.string.endpoints_fallback))
+                    Text(
+                        text = routeTransportLabel(candidate),
+                        style = MaterialTheme.typography.labelSmall,
+                        color = MaterialTheme.colorScheme.onSurfaceVariant,
+                    )
+                }
+                FlowRow(
+                    modifier = Modifier.padding(top = 4.dp),
+                    horizontalArrangement = Arrangement.spacedBy(6.dp),
+                    verticalArrangement = Arrangement.spacedBy(4.dp),
+                ) {
+                    when {
+                        isActive -> ActiveChip(stringResource(R.string.endpoints_active))
+                        isPreferred -> PreferredChip(stringResource(R.string.endpoints_preferred_chip))
+                        else -> FallbackChip(stringResource(R.string.endpoints_fallback))
                    }
-                    if (!candidate.isKnownRole()) {
-                        // Show the raw role for custom-VPN entries so users
-                        // can tell "netbird-eu" from "wireguard-home" at a
-                        // glance without poking into the menu.
+                    if (!candidate.isKnownRole() && candidate.displayName.isNullOrBlank()) {
                        Text(
-                            text = "(${candidate.role})",
+                            text = candidate.role,
                            style = MaterialTheme.typography.labelSmall,
                            color = MaterialTheme.colorScheme.onSurfaceVariant,
                            fontFamily = FontFamily.Monospace,
+                            modifier = Modifier.padding(horizontal = 4.dp, vertical = 2.dp),
                        )
                    }
                }
@@ -307,7 +347,7 @@ private fun EndpointRow(
                        style = MaterialTheme.typography.labelSmall,
                        color = MaterialTheme.colorScheme.onSurfaceVariant,
                    )
-                    outcome == null -> Unit // never probed — say nothing
+                    outcome == null || outcome.isSupersededProbeFailure() -> Unit
                    outcome.reachable -> Text(
                        text = stringResource(R.string.endpoints_reachable),
                        style = MaterialTheme.typography.labelSmall,
@@ -484,6 +524,7 @@ private fun EndpointRow(
                candidate = candidate,
                dashboardAuthenticated = dashboardAuthenticated,
                dashboardSignInRequired = dashboardSignInRequired,
+                outcomeFor = { surface -> surfaceOutcomeFor(candidate, surface) },
                modifier = Modifier.padding(start = 26.dp, end = 4.dp, top = 8.dp),
            )
        }
@@ -536,13 +577,16 @@ private fun RouteSurfaceMap(
    candidate: EndpointCandidate,
    dashboardAuthenticated: Boolean? = null,
    dashboardSignInRequired: Boolean = false,
+    outcomeFor: (EndpointSurface) -> RouteProbeOutcome? = { null },
    modifier: Modifier = Modifier,
 ) {
    val dashboardUrl = candidate.dashboard?.url
        ?: candidate.api?.url?.let(Connection::deriveDefaultDashboardUrl)
    val apiUrl = candidate.api?.url
    val relayUrl = candidate.relay?.url
-
+    val dashboardOutcome = outcomeFor(EndpointSurface.Dashboard)
+    val apiOutcome = outcomeFor(EndpointSurface.Api)
+    val relayOutcome = outcomeFor(EndpointSurface.Relay)
    Surface(
        color = MaterialTheme.colorScheme.surfaceVariant.copy(alpha = 0.42f),
        shape = appearanceRoundedCornerShape(10.dp),
@@ -558,26 +602,28 @@ private fun RouteSurfaceMap(
                status = when {
                    dashboardSignInRequired -> stringResource(R.string.active_section_sign_in_required)
                    dashboardAuthenticated == true -> stringResource(R.string.active_section_signed_in)
-                    dashboardUrl != null -> stringResource(R.string.active_section_configured)
-                    else -> stringResource(R.string.active_section_not_configured)
+                    else -> routeSurfaceRuntimeStatus(dashboardUrl, dashboardOutcome)
                },
-                warning = dashboardSignInRequired,
+                warning = dashboardSignInRequired || dashboardOutcome.isDefinitiveFailure(),
+                security = routeSurfaceSecurityPresentation(
+                    candidate,
+                    EndpointSurface.Dashboard,
+                    dashboardUrl,
+                ),
            )
            RouteSurfaceRow(
                label = stringResource(R.string.active_section_api_server),
                url = apiUrl,
-                status = stringResource(
-                    if (apiUrl != null) R.string.active_section_configured
-                    else R.string.active_section_not_configured,
-                ),
+                status = routeSurfaceRuntimeStatus(apiUrl, apiOutcome),
+                warning = apiOutcome.isDefinitiveFailure(),
+                security = routeSurfaceSecurityPresentation(candidate, EndpointSurface.Api, apiUrl),
            )
            RouteSurfaceRow(
                label = stringResource(R.string.active_section_relay),
                url = relayUrl,
-                status = stringResource(
-                    if (relayUrl != null) R.string.active_section_configured
-                    else R.string.active_section_not_configured,
-                ),
+                status = routeSurfaceRuntimeStatus(relayUrl, relayOutcome),
+                warning = relayOutcome.isDefinitiveFailure(),
+                security = routeSurfaceSecurityPresentation(candidate, EndpointSurface.Relay, relayUrl),
            )
        }
    }
@@ -589,6 +635,7 @@ private fun RouteSurfaceRow(
    url: String?,
    status: String,
    warning: Boolean = false,
+    security: RouteSurfaceSecurityPresentation = RouteSurfaceSecurityPresentation.NotConfigured,
 ) {
    Row(
        modifier = Modifier.fillMaxWidth(),
@@ -609,6 +656,31 @@ private fun RouteSurfaceRow(
                maxLines = 1,
                overflow = TextOverflow.Ellipsis,
            )
+            if (security != RouteSurfaceSecurityPresentation.NotConfigured) {
+                Text(
+                    text = when (security) {
+                        RouteSurfaceSecurityPresentation.ApplicationTls ->
+                            stringResource(R.string.endpoints_security_application_tls)
+                        RouteSurfaceSecurityPresentation.TailscaleOverlay ->
+                            stringResource(R.string.endpoints_security_tailscale_overlay)
+                        RouteSurfaceSecurityPresentation.WireGuardOverlay ->
+                            stringResource(R.string.endpoints_security_wireguard_overlay)
+                        RouteSurfaceSecurityPresentation.SecureLink ->
+                            stringResource(R.string.endpoints_security_secure_link)
+                        RouteSurfaceSecurityPresentation.PrivatePlain ->
+                            stringResource(R.string.endpoints_security_private_plain)
+                        RouteSurfaceSecurityPresentation.PublicPlain ->
+                            stringResource(R.string.endpoints_security_public_plain)
+                        RouteSurfaceSecurityPresentation.NotConfigured -> ""
+                    },
+                    style = MaterialTheme.typography.labelSmall,
+                    color = if (security == RouteSurfaceSecurityPresentation.PublicPlain) {
+                        MaterialTheme.colorScheme.error
+                    } else {
+                        MaterialTheme.colorScheme.onSurfaceVariant
+                    },
+                )
+            }
        }
        Text(
            text = status,
@@ -700,26 +772,241 @@ private fun FallbackChip(label: String) {

 /**
 * Role → Material icon. Known roles get their canonical glyph; anything
- * else falls through to [Icons.Filled.Shield] (generic "Custom VPN").
+ * else falls through to [Icons.Filled.Shield] (generic custom route).
 */
 private fun roleIcon(role: String): ImageVector = when (role.lowercase()) {
    "lan" -> Icons.Filled.Lan
    "tailscale" -> Icons.Filled.VpnKey
    "public" -> Icons.Filled.Public
+    "dashboard", "authenticated_dashboard", "https" -> Icons.Filled.Public
    else -> Icons.Filled.Shield
 }

+@Composable
+private fun routeSurfaceRuntimeStatus(
+    url: String?,
+    outcome: RouteProbeOutcome?,
+): String = when (routeSurfaceProbePresentation(url, outcome)) {
+    RouteSurfaceProbePresentation.NotConfigured ->
+        stringResource(R.string.active_section_not_configured)
+    RouteSurfaceProbePresentation.NotChecked ->
+        stringResource(R.string.active_section_not_checked_separately)
+    RouteSurfaceProbePresentation.Reachable -> stringResource(R.string.endpoints_reachable)
+    RouteSurfaceProbePresentation.Unreachable -> stringResource(
+        R.string.endpoints_unreachable,
+        outcome?.detail ?: stringResource(R.string.endpoints_unreachable_no_detail),
+    )
+}
+
+internal enum class RouteSurfaceProbePresentation {
+    NotConfigured,
+    NotChecked,
+    Reachable,
+    Unreachable,
+}
+
+internal enum class RouteReachabilityPresentation {
+    Checking,
+    Reachable,
+    Unreachable,
+    NotChecked,
+}
+
+/** Honest selection context: a selected route is not proof of a fresh probe. */
+internal fun routeReachabilityPresentation(
+    isProbing: Boolean,
+    outcome: RouteProbeOutcome?,
+): RouteReachabilityPresentation = when {
+    isProbing -> RouteReachabilityPresentation.Checking
+    outcome == null || outcome.isSupersededProbeFailure() -> RouteReachabilityPresentation.NotChecked
+    outcome.reachable -> RouteReachabilityPresentation.Reachable
+    else -> RouteReachabilityPresentation.Unreachable
+}
+
+internal enum class RouteSurfaceSecurityPresentation {
+    ApplicationTls,
+    TailscaleOverlay,
+    WireGuardOverlay,
+    SecureLink,
+    PrivatePlain,
+    PublicPlain,
+    NotConfigured,
+}
+
 /**
- * Per-route security classification for the picker glyph. Keyed on the
- * candidate's own scheme + role (no device-level Tailscale detection needed —
- * a `tailscale`/`plugin_proxy` role is encrypted regardless), so each row can
- * be classified independently before it's the active route.
+ * Separates application TLS from private overlay encryption. An HTTP/WS
+ * Tailscale route is WireGuard-encrypted in transit, but it does not have
+ * application-layer TLS; public plaintext remains an error.
 */
-private fun EndpointCandidate.routeSecurityKind(): SurfaceSecurityKind = when {
-    hasSecureProxy() -> SurfaceSecurityKind.Tls
-    isTlsUrl(primaryRouteUrl().orEmpty()) -> SurfaceSecurityKind.Tls
-    isEncryptedOverlayRoute(isTailscaleDetected = false) -> SurfaceSecurityKind.Overlay
-    else -> SurfaceSecurityKind.Plain
+internal fun routeSurfaceSecurityPresentation(
+    candidate: EndpointCandidate,
+    surface: EndpointSurface,
+    url: String?,
+): RouteSurfaceSecurityPresentation {
+    if (url.isNullOrBlank()) return RouteSurfaceSecurityPresentation.NotConfigured
+    val label = when (surface) {
+        EndpointSurface.Standard,
+        EndpointSurface.Dashboard -> "Dashboard & Gateway"
+        EndpointSurface.Api -> "API fallback"
+        EndpointSurface.Relay -> "Relay tools"
+    }
+    val securityVerdict = classifySurfaceSecurity(
+        label = label,
+        url = url,
+        activeEndpoint = candidate,
+        isTailscaleDetected = false,
+    )
+    val role = candidate.role.trim().lowercase()
+    return when (securityVerdict.kind) {
+        SurfaceSecurityKind.Tls -> when (securityVerdict.mechanism) {
+            "Hermes Secure Link", "Hermes Reach" -> RouteSurfaceSecurityPresentation.SecureLink
+            else -> RouteSurfaceSecurityPresentation.ApplicationTls
+        }
+        SurfaceSecurityKind.Overlay -> when (securityVerdict.mechanism) {
+            "Tailscale" -> RouteSurfaceSecurityPresentation.TailscaleOverlay
+            else -> RouteSurfaceSecurityPresentation.WireGuardOverlay
+        }
+        SurfaceSecurityKind.Plain -> if (role == "public" || role == "https") {
+            RouteSurfaceSecurityPresentation.PublicPlain
+        } else {
+            RouteSurfaceSecurityPresentation.PrivatePlain
+        }
+    }
+}
+
+internal fun routeSurfaceProbePresentation(
+    url: String?,
+    outcome: RouteProbeOutcome?,
+): RouteSurfaceProbePresentation = when {
+    url == null -> RouteSurfaceProbePresentation.NotConfigured
+    outcome == null || outcome.isSupersededProbeFailure() -> RouteSurfaceProbePresentation.NotChecked
+    outcome.reachable -> RouteSurfaceProbePresentation.Reachable
+    else -> RouteSurfaceProbePresentation.Unreachable
+}
+
+private fun RouteProbeOutcome?.isDefinitiveFailure(): Boolean =
+    this != null && !reachable && !isSupersededProbeFailure()
+
+/** A cancelled shared probe is unknown/checking state, never proof of outage. */
+internal fun RouteProbeOutcome.isSupersededProbeFailure(): Boolean {
+    if (reachable) return false
+    val value = detail.orEmpty().lowercase()
+    return value.contains("interruptedioexception") ||
+        value.contains("canceled") ||
+        value.contains("cancelled") ||
+        value.contains("superseded")
+}
+
+/** Explicit HTTP/HTTPS route identity; security warnings stay surface-scoped. */
+internal fun routeTransportLabel(candidate: EndpointCandidate): String {
+    val routeUrl = candidate.dashboard?.url
+        ?: candidate.api?.url?.let(Connection::deriveDefaultDashboardUrl)
+        ?: candidate.primaryRouteUrl()
+    return when (runCatching { URI(routeUrl.orEmpty()).scheme?.lowercase() }.getOrNull()) {
+        "https" -> "HTTPS"
+        "http" -> "HTTP"
+        "wss" -> "WSS"
+        "ws" -> "WS"
+        else -> "—"
+    }
+}
+
+/** Plain transport warnings belong to Relay, not to an allowed HTTP Gateway. */
+internal fun EndpointCandidate.hasPlainRelayTransport(): Boolean {
+    val relayScheme = runCatching { URI(relay?.url.orEmpty()).scheme?.lowercase() }.getOrNull()
+    if (relayScheme !in setOf("ws", "http")) return false
+    val routeHint = security.orEmpty().lowercase()
+    return role.lowercase() != "tailscale" &&
+        !routeHint.contains("tailscale") &&
+        !routeHint.contains("wireguard")
+}
+
+/** First-class editor for the Dashboard/Gateway origin used by Manage, chat, sessions, and OIDC. */
+@Composable
+fun DashboardAddressEditorDialog(
+    initialUrl: String,
+    onSave: (dashboardUrl: String, onResult: (String?) -> Unit) -> Unit,
+    onDismiss: () -> Unit,
+) {
+    var url by remember(initialUrl) { mutableStateOf(initialUrl) }
+    var errorText by remember { mutableStateOf<String?>(null) }
+    var saving by remember { mutableStateOf(false) }
+    val normalized = remember(url) {
+        url.takeIf { it.isNotBlank() }?.let(Connection::normalizeDashboardUrlInput).orEmpty()
+    }
+    val valid = remember(normalized) { isValidDashboardEditorAddress(normalized) }
+
+    AlertDialog(
+        onDismissRequest = { if (!saving) onDismiss() },
+        title = { Text(stringResource(R.string.dashboard_address_editor_title)) },
+        text = {
+            Column(verticalArrangement = Arrangement.spacedBy(12.dp)) {
+                Text(
+                    text = stringResource(R.string.dashboard_address_editor_body),
+                    style = MaterialTheme.typography.bodySmall,
+                    color = MaterialTheme.colorScheme.onSurfaceVariant,
+                )
+                OutlinedTextField(
+                    value = url,
+                    onValueChange = {
+                        url = it
+                        errorText = null
+                    },
+                    label = { Text(stringResource(R.string.dashboard_address_label)) },
+                    placeholder = { Text(stringResource(R.string.dashboard_address_placeholder)) },
+                    singleLine = true,
+                    keyboardOptions = KeyboardOptions(keyboardType = KeyboardType.Uri),
+                    isError = errorText != null,
+                    supportingText = {
+                        Text(
+                            text = errorText ?: if (url.isBlank()) {
+                                stringResource(R.string.dashboard_address_required)
+                            } else {
+                                stringResource(R.string.dashboard_address_preview, normalized)
+                            },
+                        )
+                    },
+                    modifier = Modifier.fillMaxWidth(),
+                )
+                Text(
+                    text = stringResource(R.string.dashboard_address_oidc_hint),
+                    style = MaterialTheme.typography.labelSmall,
+                    color = MaterialTheme.colorScheme.onSurfaceVariant,
+                )
+            }
+        },
+        confirmButton = {
+            TextButton(
+                enabled = valid && !saving && normalized != initialUrl.trim().trimEnd('/'),
+                onClick = {
+                    saving = true
+                    onSave(normalized) { error ->
+                        saving = false
+                        if (error == null) onDismiss() else errorText = error
+                    }
+                },
+            ) {
+                Text(
+                    if (saving) stringResource(R.string.endpoints_saving)
+                    else stringResource(R.string.endpoints_save),
+                )
+            }
+        },
+        dismissButton = {
+            TextButton(onClick = onDismiss, enabled = !saving) {
+                Text(stringResource(R.string.endpoints_cancel))
+            }
+        },
+    )
+}
+
+private fun isValidDashboardEditorAddress(address: String): Boolean {
+    val parsed = runCatching { URI(address) }.getOrNull() ?: return false
+    return parsed.scheme?.lowercase() in setOf("http", "https") &&
+        !parsed.host.isNullOrBlank() &&
+        parsed.userInfo == null &&
+        parsed.query == null &&
+        parsed.fragment == null
 }

 /**
@@ -737,6 +1024,7 @@ private fun EndpointCandidate.routeSecurityKind(): SurfaceSecurityKind = when {
 *   receives a user-facing error string to render inline, or null on
 *   success (the dialog then closes itself).
 */
+@OptIn(ExperimentalLayoutApi::class)
@Composable
 fun RouteEditorDialog(
    original: EndpointCandidate?,
@@ -745,11 +1033,11 @@ fun RouteEditorDialog(
    onDismiss: () -> Unit,
 ) {
    val uriHandler = LocalUriHandler.current
-    val knownRoles = listOf("tailscale", "public")
+    val knownRoles = GATEWAY_ROUTE_EDITOR_ROLES
    var selectedRole by remember {
        mutableStateOf(
            when (original?.role?.lowercase()) {
-                null -> "tailscale"
+                null -> "lan"
                in knownRoles -> original.role.lowercase()
                else -> CUSTOM_ROLE
            },
@@ -760,7 +1048,7 @@ fun RouteEditorDialog(
            original?.role?.takeIf { it.lowercase() !in knownRoles }.orEmpty(),
        )
    }
-    var url by remember(original) { mutableStateOf(original?.primaryRouteUrl().orEmpty()) }
+    var url by remember(original) { mutableStateOf(routeEditorInitialGatewayUrl(original)) }
    var errorText by remember { mutableStateOf<String?>(null) }
    var saving by remember { mutableStateOf(false) }

@@ -784,7 +1072,12 @@ fun RouteEditorDialog(
                    style = MaterialTheme.typography.bodySmall,
                    color = MaterialTheme.colorScheme.onSurfaceVariant,
                )
-                Row(horizontalArrangement = Arrangement.spacedBy(8.dp)) {
+                FlowRow(horizontalArrangement = Arrangement.spacedBy(8.dp)) {
+                    FilterChip(
+                        selected = selectedRole == "lan",
+                        onClick = { selectedRole = "lan" },
+                        label = { Text(stringResource(R.string.cw_role_lan)) },
+                    )
                    FilterChip(
                        selected = selectedRole == "tailscale",
                        onClick = { selectedRole = "tailscale" },
@@ -908,3 +1201,6 @@ private const val REMOTE_ACCESS_DOCS_URL =
    "https://hermes-relay.dev/docs/guide/remote-access"

 private const val CUSTOM_ROLE = "__custom__"
+internal val GATEWAY_ROUTE_EDITOR_ROLES = listOf("lan", "tailscale", "public")
+internal fun routeEditorInitialGatewayUrl(original: EndpointCandidate?): String =
+    original?.gatewayRouteUrl().orEmpty()
--- a/Show More
+++ b/Show More