docs(android): include Sessions sidebar review capture

fix(android): complete wide Sessions sidebar behavior
feat(sessions): optional pinned Sessions sidebar on wide layouts
2026-09-25 17:01:01 -04:00 · 2026-09-23 19:28:15 -04:00 · 2026-09-23 18:34:26 -04:00 · 2026-09-23 18:20:13 -04:00 · 2026-09-23 18:06:31 -04:00 · 2026-09-23 18:06:06 -04:00
752 changed files with 69262 additions and 12651 deletions
@@ -1,38 +0,0 @@
-## Summary
-
-<!-- Brief description of what this PR does -->
-
-## Changes
-
-
-
-## Verification
-
-<!-- List the checks you ran, or explain why a check is not applicable. -->
-
-
-
-## Lineage / contributor credit
-
-<!--
-If this PR salvages or supersedes earlier work, link every source PR and name
-the original contributor(s). Preserve original commit authors where practical;
-otherwise use verified Co-authored-by trailers. Write "N/A" for original work.
-->
-
- Source PR(s): N/A
- Attribution preserved by: N/A
-
-## Checklist
-
- [ ] Target branch is `dev`, unless this is a `dev` → `main` release PR or a focused production-tag hotfix PR to `main`
- [ ] Android changes: lint and focused unit tests ran, or rationale is listed above
- [ ] Translation changes: locale status/review references are accurate, `python scripts/check-android-locales.py` ran, and device/emulator review is documented, or N/A
- [ ] Server changes: focused `python -m unittest ...` checks ran, or rationale is listed above
- [ ] Desktop changes: `npm run build` or a narrower documented check ran, or rationale is listed above
- [ ] Docs/site changes: docs build or link check ran, or rationale is listed above
- [ ] UI changes were tested on emulator/device or desktop surface when applicable
- [ ] Commit messages follow [Conventional Commits](https://www.conventionalcommits.org/)
- [ ] CHANGELOG.md updated (if user-facing)
- [ ] Public writing hygiene checked: no secrets, private infrastructure, personal names, or AI/process narration
- [ ] Salvaged work links the source PR and preserves contributor authorship, or N/A
@@ -5,9 +5,8 @@ not `AGENTS.md`) picks up the project's agent guidance.

 **Read [AGENTS.md](../AGENTS.md) first — it is the single source of truth**
 for agent guidance: the entry point, the non-negotiables, and the public-repo
-writing hygiene. It links on to `CLAUDE.md` for the deep reference
-(architecture, upstream Hermes API, repository layout, per-language code style,
-the dev loop, and the Key Files map). Follow those; don't restate them here.
+writing hygiene. `CLAUDE.md` imports that same canonical file. Follow
+`AGENTS.md` and its linked project records; don't restate them here.

 Quick non-negotiables (the full list and rationale are in `AGENTS.md`):

@@ -17,6 +16,8 @@ Quick non-negotiables (the full list and rationale are in `AGENTS.md`):
 - **Conventional Commits**, `main`/`dev` branching — feature branches off
  `dev`, `--no-ff` merges, tags cut from `main`.
 - **Android:** Jetpack Compose (no XML), kotlinx.serialization (no Gson),
-  OkHttp (no Ktor), `wss://` only; run `./gradlew lint` before pushing Kotlin.
+  OkHttp (no Ktor), `wss://` only. Narrow local checks use the Android lane;
+  pushed exact SHAs prefer `Android On-Demand` for heavy verification; full
+  local pre-push remains an explicit fallback.
 - **Public repo:** no personal names, no private infrastructure, no
  AI/assistant self-narration in committed prose.
@@ -0,0 +1,47 @@
+## Summary
+
+<!-- Describe the user/developer outcome and why this change is needed. Link related issues, e.g. Closes #123. -->
+
+## Changes
+
+<!-- List the focused implementation changes. Avoid repeating the commit log. -->
+
+-
+
+## Verification
+
+<!-- List exact commands and results. Say explicitly when a check was not run or when device/UI proof remains outstanding. -->
+
+-
+
+## Screenshots
+
+<!-- UI change: include screenshots/video plus device, viewport, or emulator details. Otherwise write: No visual change. -->
+
+## Compatibility / risk
+
+<!-- Note Standard Hermes/upstream compatibility, migrations/state changes, security/privacy impact, rollout/rollback, or write N/A. -->
+
+## Lineage / contributor credit
+
+<!-- Preserve prior contributor work when replacing, salvaging, or rebuilding another PR. -->
+
+- Source PR(s): N/A
+- Attribution preserved by: N/A
+
+## Checklist
+
+<!-- Check an item when satisfied or when its N/A rationale is stated above. -->
+
+- [ ] Target branch is `dev`, unless this is a `dev` → `main` release PR or a focused production-tag hotfix PR to `main`
+- [ ] Scope is focused and related issues/PRs are linked
+- [ ] Android changes: lint and focused tests ran, or rationale is listed above
+- [ ] Translation changes: locale validation/review ran, or N/A is listed above
+- [ ] Server/plugin changes: focused tests ran, or N/A/rationale is listed above
+- [ ] Desktop changes: build/tests ran, or N/A/rationale is listed above
+- [ ] Docs/site changes: build or link/route checks ran, or N/A/rationale is listed above
+- [ ] UI changes were tested on a relevant device/emulator/desktop surface, or the missing proof is stated above
+- [ ] Commit messages follow [Conventional Commits](https://www.conventionalcommits.org/)
+- [ ] `CHANGELOG.md` is updated for user-visible changes, or N/A is listed above
+- [ ] Public writing hygiene checked: no secrets, private infrastructure, personal names, or AI/process narration
+- [ ] Salvaged/replacement work links source PRs and preserves contributor authorship, or N/A is listed above
@@ -3,29 +3,46 @@
 function classifyCiPaths(paths) {
  const forceAll = paths.some((path) => [
    '.github/workflows/ci-required.yml',
+    '.github/workflows/release-backmerge.yml',
+    '.github/workflows/approve-release-train.yml',
    '.github/scripts/classify-ci-paths.cjs',
    '.github/scripts/classify-ci-paths.test.cjs',
+    'scripts/plan_release_backmerge.py',
+    'scripts/tests/plan_release_backmerge_test.py',
  ].includes(path));
  const exact = (values) => paths.some((path) => values.includes(path));
  const under = (prefixes) => paths.some((path) => prefixes.some((prefix) => path.startsWith(prefix)));

  return {
-    android: forceAll || under(['app/', 'relay-core/', 'relay-ui/', 'ui-preview/', 'quest/', 'gradle/']) || exact([
+    android: forceAll || under(['app/', 'gradle/']) || exact([
      'build.gradle.kts', 'settings.gradle.kts', 'gradle.properties', 'gradlew', 'gradlew.bat',
      'scripts/check-android-locales.py', 'scripts/android-locale-harness.py',
-      'scripts/check-android-collection-apis.py', '.github/workflows/ci-android.yml',
+      'scripts/check-android-capabilities.py', 'scripts/tests/check_android_capabilities_test.py',
+      'scripts/check-android-collection-apis.py', 'scripts/check-android-native-compat.py',
+      'scripts/check-android-release-notes.py',
+      'scripts/android_release_artifacts.py',
+      'scripts/android-lane.ps1', 'scripts/android-prepush.py', 'scripts/dev.bat', 'scripts/dev.sh',
+      'scripts/tests/android_prepush_test.py',
+      'scripts/tests/check_android_native_compat_test.py',
+      'scripts/tests/check_android_release_notes_test.py',
+      'scripts/tests/android_release_artifacts_test.py',
+      '.github/workflows/android-on-demand.yml', '.github/workflows/ci-android.yml',
      '.github/workflows/play-preflight-android.yml',
      '.github/workflows/approve-release-android.yml',
      '.github/workflows/release-android.yml',
    ]),
    desktop: forceAll || under(['desktop/']) || exact([
      '.github/workflows/ci-desktop.yml',
+      '.github/workflows/approve-release-extensions.yml',
+      '.github/workflows/release-cli.yml',
    ]),
    plugin: forceAll || paths.some((path) => /^plugin\/[^/]+\.py$/.test(path)) ||
      under(['plugin/relay/', 'plugin/tools/', 'plugin/tests/', 'relay_server/', 'hermes_relay_bootstrap/']) || exact([
        'plugin/plugin.yaml', 'pyproject.toml', 'scripts/check-plugin-version-sync.py',
        'scripts/check-server-version-sync.py', 'scripts/bump-plugin-version.sh',
        'scripts/bump-server-version.sh', '.github/workflows/ci-plugin.yml',
+        '.github/workflows/approve-release-extensions.yml',
+        '.github/workflows/release-plugin.yml',
      ]),
    dashboard: forceAll || under(['plugin/dashboard/']) || exact([
      '.github/workflows/ci-dashboard.yml',
@@ -1,6 +1,8 @@
 'use strict';

 const assert = require('node:assert/strict');
+const { readFileSync } = require('node:fs');
+const { join } = require('node:path');
 const { classifyCiPaths } = require('./classify-ci-paths.cjs');

 const none = {
@@ -14,7 +16,25 @@ const none = {

 assert.deepEqual(classifyCiPaths(['README.md']), none);
 assert.deepEqual(classifyCiPaths(['desktop/src/cli.ts']), { ...none, desktop: true });
-assert.deepEqual(classifyCiPaths(['relay-core/src/main/kotlin/Wire.kt']), { ...none, android: true });
+assert.deepEqual(classifyCiPaths(['experiments/quest/src/main/kotlin/Quest.kt']), none);
+assert.deepEqual(classifyCiPaths(['scripts/check-android-release-notes.py']), { ...none, android: true });
+assert.deepEqual(classifyCiPaths(['scripts/check-android-native-compat.py']), { ...none, android: true });
+assert.deepEqual(classifyCiPaths(['scripts/android_release_artifacts.py']), { ...none, android: true });
+assert.deepEqual(classifyCiPaths(['scripts/tests/android_release_artifacts_test.py']), { ...none, android: true });
+assert.deepEqual(classifyCiPaths(['scripts/tests/check_android_native_compat_test.py']), { ...none, android: true });
+assert.deepEqual(classifyCiPaths(['scripts/android-lane.ps1']), { ...none, android: true });
+assert.deepEqual(classifyCiPaths(['scripts/android-prepush.py']), { ...none, android: true });
+assert.deepEqual(classifyCiPaths(['scripts/dev.bat']), { ...none, android: true });
+assert.deepEqual(classifyCiPaths(['scripts/dev.sh']), { ...none, android: true });
+assert.deepEqual(classifyCiPaths(['scripts/tests/android_prepush_test.py']), { ...none, android: true });
+assert.deepEqual(classifyCiPaths(['.github/workflows/android-on-demand.yml']), { ...none, android: true });
+assert.deepEqual(classifyCiPaths(['.github/workflows/approve-release-extensions.yml']), {
+  ...none,
+  desktop: true,
+  plugin: true,
+});
+assert.deepEqual(classifyCiPaths(['.github/workflows/release-cli.yml']), { ...none, desktop: true });
+assert.deepEqual(classifyCiPaths(['.github/workflows/release-plugin.yml']), { ...none, plugin: true });
 assert.deepEqual(classifyCiPaths(['plugin/relay/server.py']), { ...none, plugin: true });
 assert.deepEqual(classifyCiPaths(['plugin/dashboard/src/App.tsx']), { ...none, dashboard: true });
 assert.deepEqual(classifyCiPaths(['user-docs/index.md']), { ...none, docs: true });
@@ -30,5 +50,84 @@ assert.deepEqual(classifyCiPaths(['.github/workflows/ci-required.yml']), {
  contract: true,
  docs: true,
 });
+assert.deepEqual(classifyCiPaths(['.github/workflows/release-backmerge.yml']), {
+  android: true,
+  desktop: true,
+  plugin: true,
+  dashboard: true,
+  contract: true,
+  docs: true,
+});
+assert.deepEqual(classifyCiPaths(['.github/workflows/approve-release-train.yml']), {
+  android: true,
+  desktop: true,
+  plugin: true,
+  dashboard: true,
+  contract: true,
+  docs: true,
+});
+
+const repoRoot = join(__dirname, '..', '..');
+const approvalWorkflow = readFileSync(
+  join(repoRoot, '.github', 'workflows', 'approve-release-extensions.yml'),
+  'utf8',
+);
+const cliReleaseWorkflow = readFileSync(
+  join(repoRoot, '.github', 'workflows', 'release-cli.yml'),
+  'utf8',
+);
+const pluginReleaseWorkflow = readFileSync(
+  join(repoRoot, '.github', 'workflows', 'release-plugin.yml'),
+  'utf8',
+);
+const desktopCiWorkflow = readFileSync(
+  join(repoRoot, '.github', 'workflows', 'ci-desktop.yml'),
+  'utf8',
+);
+const androidPreflightWorkflow = readFileSync(
+  join(repoRoot, '.github', 'workflows', 'play-preflight-android.yml'),
+  'utf8',
+);
+const androidApprovalWorkflow = readFileSync(
+  join(repoRoot, '.github', 'workflows', 'approve-release-android.yml'),
+  'utf8',
+);
+const androidReleaseWorkflow = readFileSync(
+  join(repoRoot, '.github', 'workflows', 'release-android.yml'),
+  'utf8',
+);
+const requiredChecksWorkflow = readFileSync(
+  join(repoRoot, '.github', 'workflows', 'ci-required.yml'),
+  'utf8',
+);
+const releaseTrainWorkflow = readFileSync(
+  join(repoRoot, '.github', 'workflows', 'approve-release-train.yml'),
+  'utf8',
+);
+
+assert.match(approvalWorkflow, /permissions:\r?\n  contents: read/);
+assert.match(
+  approvalWorkflow,
+  /approve:[\s\S]*?permissions:\r?\n      actions: write\r?\n      contents: write/,
+);
+assert.match(
+  approvalWorkflow,
+  /ref: \$\{\{ contains\(inputs\.version, '-'\) && 'dev' \|\| 'main' \}\}/,
+);
+assert.match(cliReleaseWorkflow, /workflow_dispatch:[\s\S]*?Approved CLI\+UI version/);
+assert.match(cliReleaseWorkflow, /name: Restore exact-source tray build cache[\s\S]*?actions\/cache@v6/);
+assert.match(desktopCiWorkflow, /name: Restore exact-source tray build cache[\s\S]*?actions\/cache@v6/);
+assert.match(pluginReleaseWorkflow, /workflow_dispatch:[\s\S]*?Approved Plugin version/);
+assert.match(androidPreflightWorkflow, /Package immutable preflight artifacts/);
+assert.match(androidApprovalWorkflow, /Android public approval accepts stable SemVer only/);
+assert.match(androidReleaseWorkflow, /Download exact stable preflight artifacts/);
+assert.match(androidReleaseWorkflow, /artifact-ids: \$\{\{ needs\.validate\.outputs\.preflight_artifact_id \}\}/);
+assert.match(requiredChecksWorkflow, /name: Reuse exact-tree required checks/);
+assert.match(requiredChecksWorkflow, /name: required-checks-\$\{\{ needs\.changes\.outputs\.tree \}\}/);
+assert.match(releaseTrainWorkflow, /name: Hermes-Relay Coordinated Release Approval/);
+assert.match(releaseTrainWorkflow, /Coordinated Android approval is stable-only/);

 console.log('CI path classification tests passed.');
+
+assert.deepEqual(classifyCiPaths(['scripts/check-android-capabilities.py']), { ...none, android: true });
+assert.deepEqual(classifyCiPaths(['scripts/tests/check_android_capabilities_test.py']), { ...none, android: true });
@@ -0,0 +1,232 @@
+name: Android On-Demand
+
+run-name: Android ${{ inputs.preset }} · ${{ inputs.head_sha }}
+
+on:
+  workflow_call:
+    inputs:
+      head_sha:
+        required: true
+        type: string
+      preset:
+        required: true
+        type: string
+
+permissions:
+  contents: read
+
+concurrency:
+  group: android-on-demand-${{ inputs.head_sha }}-${{ inputs.preset }}
+  cancel-in-progress: false
+
+jobs:
+  validate:
+    name: Validate exact SHA
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - name: Validate input shape
+        shell: bash
+        env:
+          REQUESTED_SHA: ${{ inputs.head_sha }}
+          REQUESTED_PRESET: ${{ inputs.preset }}
+        run: |
+          if [[ ! "$REQUESTED_SHA" =~ ^[0-9a-f]{40}$ ]]; then
+            echo "head_sha must be a full lowercase 40-character commit SHA" >&2
+            exit 2
+          fi
+          case "$REQUESTED_PRESET" in
+            focused|lint|assemble-debug|release-smoke|all-final) ;;
+            *)
+              echo "unsupported Android preset: $REQUESTED_PRESET" >&2
+              exit 2
+              ;;
+          esac
+
+      - name: Checkout exact commit
+        uses: actions/checkout@v7
+        with:
+          ref: ${{ inputs.head_sha }}
+          fetch-depth: 1
+
+      - name: Confirm checkout identity
+        shell: bash
+        env:
+          REQUESTED_SHA: ${{ inputs.head_sha }}
+        run: test "$(git rev-parse HEAD)" = "$REQUESTED_SHA"
+
+  focused:
+    name: Focused Android checks
+    needs: validate
+    if: ${{ inputs.preset == 'focused' || inputs.preset == 'all-final' }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          ref: ${{ inputs.head_sha }}
+
+      - uses: actions/setup-java@v6
+        with:
+          distribution: temurin
+          java-version: 17
+
+      - uses: gradle/actions/setup-gradle@v6.3.0
+        with:
+          cache-read-only: true
+
+      - name: Run repository checks and focused sideload tests
+        run: python3 scripts/android-prepush.py --skip-lint
+
+      - name: Run the same focused tests for Google Play
+        shell: bash
+        run: |
+          mapfile -t focused_tests < <(python3 -c \
+            "import runpy; print(*runpy.run_path('scripts/android-prepush.py')['FOCUSED_TESTS'], sep='\n')")
+          test_args=()
+          for test_name in "${focused_tests[@]}"; do
+            test_args+=(--tests "$test_name")
+          done
+          ./gradlew :app:testGooglePlayDebugUnitTest "${test_args[@]}" --console=plain
+
+      - name: Upload failed test reports
+        uses: actions/upload-artifact@v7
+        if: failure()
+        with:
+          name: focused-test-reports-${{ inputs.head_sha }}
+          path: app/build/reports/tests/
+          if-no-files-found: ignore
+          retention-days: 7
+
+  lint:
+    name: Android lint
+    needs: validate
+    if: ${{ inputs.preset == 'lint' || inputs.preset == 'all-final' }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          ref: ${{ inputs.head_sha }}
+
+      - uses: actions/setup-java@v6
+        with:
+          distribution: temurin
+          java-version: 17
+
+      - uses: gradle/actions/setup-gradle@v6.3.0
+        with:
+          cache-read-only: true
+
+      - name: Validate Android repository inputs
+        run: |
+          python3 scripts/check-android-locales.py
+          python3 scripts/check-user-docs-locales.py
+          python3 scripts/check-android-collection-apis.py
+          python3 scripts/check-android-release-notes.py
+          python3 scripts/check-version-tracks.py
+          if [[ -f scripts/tests/android_prepush_test.py ]]; then
+            python3 -m unittest scripts.tests.android_prepush_test
+          fi
+          python3 -m unittest scripts.tests.check_android_release_notes_test
+          python3 -m unittest scripts.tests.check_android_native_compat_test
+
+      - name: Run Android lint
+        run: ./gradlew lint --console=plain
+
+      - name: Upload lint reports
+        uses: actions/upload-artifact@v7
+        if: always()
+        with:
+          name: lint-reports-${{ inputs.head_sha }}
+          path: app/build/reports/lint-results*
+          if-no-files-found: ignore
+          retention-days: 7
+
+  assemble-debug:
+    name: Assemble both debug flavors
+    needs: validate
+    if: ${{ inputs.preset == 'assemble-debug' || inputs.preset == 'all-final' }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 25
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          ref: ${{ inputs.head_sha }}
+
+      - uses: actions/setup-java@v6
+        with:
+          distribution: temurin
+          java-version: 17
+
+      - uses: gradle/actions/setup-gradle@v6.3.0
+        with:
+          cache-read-only: true
+
+      - name: Build debug APKs
+        run: ./gradlew assembleDebug --console=plain
+
+      - name: Verify Play capability manifest
+        run: python3 scripts/check-android-capabilities.py --variant googlePlayDebug
+
+      - name: Verify packaged native compatibility
+        run: |
+          python3 scripts/check-android-native-compat.py \
+            app/build/outputs/apk/googlePlay/debug/*.apk \
+            app/build/outputs/apk/sideload/debug/*.apk
+
+      - name: Upload debug APKs
+        uses: actions/upload-artifact@v7
+        with:
+          name: debug-apks-${{ inputs.head_sha }}
+          path: app/build/outputs/apk/*/debug/*.apk
+          if-no-files-found: error
+          retention-days: 7
+
+  release-smoke:
+    name: Release build smoke
+    needs: validate
+    if: ${{ inputs.preset == 'release-smoke' || inputs.preset == 'all-final' }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 35
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          ref: ${{ inputs.head_sha }}
+
+      - uses: actions/setup-java@v6
+        with:
+          distribution: temurin
+          java-version: 17
+
+      - uses: gradle/actions/setup-gradle@v6.3.0
+        with:
+          cache-read-only: true
+
+      - name: Build release bundles and APKs
+        run: ./gradlew bundleRelease assembleRelease --console=plain
+
+      - name: Verify Play release capability manifest
+        run: python3 scripts/check-android-capabilities.py --variant googlePlayRelease
+
+      - name: Scan release DEX for unsupported collection APIs
+        run: |
+          python3 scripts/check-android-collection-apis.py \
+            --apk app/build/outputs/apk/googlePlay/release/*.apk \
+            --apk app/build/outputs/apk/sideload/release/*.apk
+
+      - name: Verify packaged native compatibility
+        run: |
+          python3 scripts/check-android-native-compat.py \
+            app/build/outputs/apk/googlePlay/release/*.apk \
+            app/build/outputs/apk/sideload/release/*.apk
+
+      - name: Upload release smoke artifacts
+        uses: actions/upload-artifact@v7
+        with:
+          name: release-smoke-${{ inputs.head_sha }}
+          path: |
+            app/build/outputs/apk/*/release/*.apk
+            app/build/outputs/bundle/**/*.aab
+          if-no-files-found: error
+          retention-days: 7
@@ -40,6 +40,10 @@ jobs:
            echo "::error::Hermes-Relay Android Release Approval must run from main, not $GITHUB_REF"
            exit 1
          fi
+          if [[ ! "$REQUESTED_VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+            echo "::error::Android public approval accepts stable SemVer only: $REQUESTED_VERSION"
+            exit 1
+          fi
          TOML_VERSION=$(grep -oP 'appVersionName\s*=\s*"\K[^"]+' gradle/libs.versions.toml)
          if [ "$REQUESTED_VERSION" != "$TOML_VERSION" ]; then
            echo "::error::Requested version $REQUESTED_VERSION does not match appVersionName $TOML_VERSION"
@@ -56,13 +60,21 @@ jobs:
          RELEASE_TREE: ${{ steps.metadata.outputs.tree }}
        run: |
          ARTIFACT_NAME="play-preflight-${VERSION}-${RELEASE_TREE}"
-          COUNT=$(gh api "/repos/${GITHUB_REPOSITORY}/actions/artifacts?name=${ARTIFACT_NAME}" \
-            --jq '[.artifacts[] | select(.expired == false)] | length')
-          if [ "$COUNT" -lt 1 ]; then
+          ARTIFACT=$(gh api "/repos/${GITHUB_REPOSITORY}/actions/artifacts?name=${ARTIFACT_NAME}" \
+            --jq '[.artifacts[] | select(.expired == false)] | sort_by(.created_at) | last')
+          RUN_ID=$(jq -r '.workflow_run.id // empty' <<<"$ARTIFACT")
+          if [ -z "$RUN_ID" ]; then
            echo "::error::No successful Play preflight found for version $VERSION with tree $RELEASE_TREE"
            exit 1
          fi
-          echo "Verified Play preflight proof: $ARTIFACT_NAME"
+          RUN=$(gh api "/repos/${GITHUB_REPOSITORY}/actions/runs/${RUN_ID}")
+          CONCLUSION=$(jq -r '.conclusion' <<<"$RUN")
+          WORKFLOW_PATH=$(jq -r '.path' <<<"$RUN")
+          if [ "$WORKFLOW_PATH" != ".github/workflows/play-preflight-android.yml" ] || [ "$CONCLUSION" != "success" ]; then
+            echo "::error::Preflight artifact came from ${WORKFLOW_PATH} with conclusion ${CONCLUSION}"
+            exit 1
+          fi
+          echo "Verified immutable Play preflight artifacts: $ARTIFACT_NAME (run $RUN_ID)"

      - name: Ensure release tag does not already exist
        env:
@@ -0,0 +1,158 @@
+name: Hermes-Relay Plugin and CLI+UI Release Approval
+
+on:
+  workflow_dispatch:
+    inputs:
+      surface:
+        description: "Release surface"
+        required: true
+        type: choice
+        options:
+          - plugin
+          - desktop
+      version:
+        description: "Approved version (for example 1.11.2 or 0.4.0-beta.7)"
+        required: true
+        type: string
+
+permissions:
+  contents: read
+
+concurrency:
+  group: approve-${{ inputs.surface }}-release
+  cancel-in-progress: false
+
+jobs:
+  validate:
+    name: Validate release source and metadata
+    runs-on: ubuntu-latest
+    outputs:
+      source_branch: ${{ steps.metadata.outputs.source_branch }}
+      source_sha: ${{ steps.metadata.outputs.source_sha }}
+      tag: ${{ steps.metadata.outputs.tag }}
+      workflow: ${{ steps.metadata.outputs.workflow }}
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+          ref: ${{ contains(inputs.version, '-') && 'dev' || 'main' }}
+
+      - name: Validate approval request
+        id: metadata
+        env:
+          REQUESTED_SURFACE: ${{ inputs.surface }}
+          REQUESTED_VERSION: ${{ inputs.version }}
+        run: |
+          set -euo pipefail
+          if [[ ! "$REQUESTED_VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.-]+)?$ ]]; then
+            echo "::error::Version must be SemVer with an optional prerelease suffix: $REQUESTED_VERSION"
+            exit 1
+          fi
+
+          if [[ "$REQUESTED_VERSION" == *-* ]]; then
+            source_branch="dev"
+          else
+            source_branch="main"
+          fi
+          if [ "$GITHUB_REF" != "refs/heads/main" ]; then
+            echo "::error::Release approval must run from the trusted main workflow definition, not $GITHUB_REF"
+            exit 1
+          fi
+          git fetch origin "$source_branch" --no-tags
+          source_sha="$(git rev-parse HEAD)"
+          expected_sha="$(git rev-parse FETCH_HEAD)"
+          if [ "$source_sha" != "$expected_sha" ]; then
+            echo "::error::Checked out $source_sha, but origin/$source_branch is $expected_sha"
+            exit 1
+          fi
+
+          case "$REQUESTED_SURFACE" in
+            plugin)
+              tag="server-v${REQUESTED_VERSION}"
+              workflow="release-plugin.yml"
+              python3 scripts/check-plugin-version-sync.py --expect "$REQUESTED_VERSION"
+              if ! grep -Eq "^## \[Plugin ${REQUESTED_VERSION}\]" CHANGELOG.md; then
+                echo "::error::CHANGELOG.md has no Plugin release heading for $REQUESTED_VERSION"
+                exit 1
+              fi
+              ;;
+            desktop)
+              tag="desktop-v${REQUESTED_VERSION}"
+              workflow="release-cli.yml"
+              node desktop/scripts/cli-version-sync.mjs --expect "$REQUESTED_VERSION"
+              if ! grep -Fq "## [$REQUESTED_VERSION]" CHANGELOG.md; then
+                echo "::error::CHANGELOG.md has no CLI+UI release heading for $REQUESTED_VERSION"
+                exit 1
+              fi
+              ;;
+            *)
+              echo "::error::Unsupported release surface: $REQUESTED_SURFACE"
+              exit 1
+              ;;
+          esac
+
+          echo "tag=$tag" >> "$GITHUB_OUTPUT"
+          echo "workflow=$workflow" >> "$GITHUB_OUTPUT"
+          echo "source_branch=$source_branch" >> "$GITHUB_OUTPUT"
+          echo "source_sha=$source_sha" >> "$GITHUB_OUTPUT"
+
+  approve:
+    name: Create release tag and start publication
+    needs: validate
+    permissions:
+      actions: write
+      contents: write
+    runs-on: ubuntu-latest
+    steps:
+      - name: Verify release source has not moved
+        env:
+          GH_TOKEN: ${{ github.token }}
+          SOURCE_BRANCH: ${{ needs.validate.outputs.source_branch }}
+          SOURCE_SHA: ${{ needs.validate.outputs.source_sha }}
+        run: |
+          current_sha=$(gh api "/repos/${GITHUB_REPOSITORY}/git/ref/heads/${SOURCE_BRANCH}" --jq .object.sha)
+          if [ "$current_sha" != "$SOURCE_SHA" ]; then
+            echo "::error::$SOURCE_BRANCH moved from $SOURCE_SHA to $current_sha; run approval again"
+            exit 1
+          fi
+
+      - name: Ensure release tag does not already exist
+        env:
+          GH_TOKEN: ${{ github.token }}
+          RELEASE_TAG: ${{ needs.validate.outputs.tag }}
+        run: |
+          if gh api "/repos/${GITHUB_REPOSITORY}/git/ref/tags/${RELEASE_TAG}" >/dev/null 2>&1; then
+            echo "::error::Tag $RELEASE_TAG already exists"
+            exit 1
+          fi
+
+      - name: Create approved release tag
+        env:
+          GH_TOKEN: ${{ github.token }}
+          RELEASE_TAG: ${{ needs.validate.outputs.tag }}
+          RELEASE_SHA: ${{ needs.validate.outputs.source_sha }}
+        run: |
+          gh api --method POST "/repos/${GITHUB_REPOSITORY}/git/refs" \
+            -f ref="refs/tags/${RELEASE_TAG}" \
+            -f sha="$RELEASE_SHA"
+
+      - name: Start the immutable tag release workflow
+        env:
+          GH_TOKEN: ${{ github.token }}
+          RELEASE_WORKFLOW: ${{ needs.validate.outputs.workflow }}
+          RELEASE_VERSION: ${{ inputs.version }}
+        run: |
+          # A tag created by GITHUB_TOKEN does not recursively start workflows.
+          # Dispatch the trusted definition from main; release jobs check out
+          # and validate the immutable tag created above.
+          gh workflow run "$RELEASE_WORKFLOW" \
+            --repo "$GITHUB_REPOSITORY" \
+            --ref main \
+            -f version="$RELEASE_VERSION"
+
+      - name: Approval summary
+        run: |
+          echo "## Release approved" >> "$GITHUB_STEP_SUMMARY"
+          echo "" >> "$GITHUB_STEP_SUMMARY"
+          echo "Created \`${{ needs.validate.outputs.tag }}\` from \`${{ needs.validate.outputs.source_branch }}\` at \`${{ needs.validate.outputs.source_sha }}\`." >> "$GITHUB_STEP_SUMMARY"
+          echo "Dispatched \`${{ needs.validate.outputs.workflow }}\` to validate and publish that immutable tag." >> "$GITHUB_STEP_SUMMARY"
@@ -0,0 +1,120 @@
+name: Hermes-Relay Coordinated Release Approval
+
+on:
+  workflow_dispatch:
+    inputs:
+      android:
+        description: "Approve Hermes-Relay Android"
+        required: true
+        default: false
+        type: boolean
+      android_version:
+        description: "Android version when selected"
+        required: false
+        type: string
+      plugin:
+        description: "Approve Hermes-Relay Plugin"
+        required: true
+        default: false
+        type: boolean
+      plugin_version:
+        description: "Plugin version when selected"
+        required: false
+        type: string
+      desktop:
+        description: "Approve Hermes-Relay CLI+UI"
+        required: true
+        default: false
+        type: boolean
+      desktop_version:
+        description: "CLI+UI version when selected"
+        required: false
+        type: string
+
+permissions:
+  actions: write
+  contents: read
+
+concurrency:
+  group: approve-coordinated-release
+  cancel-in-progress: false
+
+jobs:
+  validate:
+    name: Validate selected release surfaces
+    runs-on: ubuntu-latest
+    steps:
+      - name: Require versions for every selected surface
+        env:
+          ANDROID: ${{ inputs.android }}
+          ANDROID_VERSION: ${{ inputs.android_version }}
+          PLUGIN: ${{ inputs.plugin }}
+          PLUGIN_VERSION: ${{ inputs.plugin_version }}
+          DESKTOP: ${{ inputs.desktop }}
+          DESKTOP_VERSION: ${{ inputs.desktop_version }}
+        run: |
+          set -euo pipefail
+          if [ "$ANDROID" != "true" ] && [ "$PLUGIN" != "true" ] && [ "$DESKTOP" != "true" ]; then
+            echo "::error::Select at least one release surface"
+            exit 1
+          fi
+          for pair in \
+            "$ANDROID:$ANDROID_VERSION:Android" \
+            "$PLUGIN:$PLUGIN_VERSION:Plugin" \
+            "$DESKTOP:$DESKTOP_VERSION:CLI+UI"; do
+            IFS=: read -r selected version label <<<"$pair"
+            if [ "$selected" = "true" ] && [[ ! "$version" =~ ^[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.-]+)?$ ]]; then
+              echo "::error::$label requires a valid SemVer version"
+              exit 1
+            fi
+          done
+          if [ "$ANDROID" = "true" ] && [[ "$ANDROID_VERSION" == *-* ]]; then
+            echo "::error::Coordinated Android approval is stable-only; use a dev candidate tag for prereleases"
+            exit 1
+          fi
+
+  android:
+    name: Approve Hermes-Relay Android
+    needs: validate
+    if: inputs.android
+    runs-on: ubuntu-latest
+    steps:
+      - name: Dispatch Android approval
+        env:
+          GH_TOKEN: ${{ github.token }}
+          VERSION: ${{ inputs.android_version }}
+        run: gh workflow run approve-release-android.yml --repo "$GITHUB_REPOSITORY" --ref main -f version="$VERSION"
+
+  plugin:
+    name: Approve Hermes-Relay Plugin
+    needs: validate
+    if: inputs.plugin
+    runs-on: ubuntu-latest
+    steps:
+      - name: Dispatch Plugin approval
+        env:
+          GH_TOKEN: ${{ github.token }}
+          VERSION: ${{ inputs.plugin_version }}
+        run: |
+          gh workflow run approve-release-extensions.yml \
+            --repo "$GITHUB_REPOSITORY" \
+            --ref main \
+            -f surface=plugin \
+            -f version="$VERSION"
+
+  desktop:
+    name: Approve Hermes-Relay CLI+UI
+    needs: validate
+    if: inputs.desktop
+    runs-on: ubuntu-latest
+    steps:
+      - name: Dispatch CLI+UI approval
+        env:
+          GH_TOKEN: ${{ github.token }}
+          VERSION: ${{ inputs.desktop_version }}
+        run: |
+          gh workflow run approve-release-extensions.yml \
+            --repo "$GITHUB_REPOSITORY" \
+            --ref main \
+            -f surface=desktop \
+            -f version="$VERSION"
@@ -20,20 +20,28 @@ on:
    branches: [main, dev]
    paths:
      - "app/**"
-      - "relay-core/**"
-      - "relay-ui/**"
-      - "ui-preview/**"
-      - "quest/**"
      - "gradle/**"
      - "build.gradle.kts"
      - "settings.gradle.kts"
      - "gradle.properties"
      - "gradlew"
      - "gradlew.bat"
+      - "scripts/android-lane.ps1"
+      - "scripts/android-prepush.py"
+      - "scripts/dev.bat"
+      - "scripts/dev.sh"
+      - "scripts/tests/android_prepush_test.py"
      - "scripts/check-android-locales.py"
      - "scripts/android-locale-harness.py"
      - "scripts/check-android-collection-apis.py"
+      - "scripts/check-android-capabilities.py"
+      - "scripts/tests/check_android_capabilities_test.py"
+      - "scripts/check-android-native-compat.py"
+      - "scripts/check-android-release-notes.py"
+      - "scripts/tests/check_android_native_compat_test.py"
+      - "scripts/tests/check_android_release_notes_test.py"
      - ".github/workflows/ci-android.yml"
+      - ".github/workflows/android-on-demand.yml"
      - ".github/workflows/play-preflight-android.yml"
      - ".github/workflows/approve-release-android.yml"
      - ".github/workflows/release-android.yml"
@@ -57,7 +65,7 @@ jobs:
        uses: actions/checkout@v7

      - name: Set up JDK 17
-        uses: actions/setup-java@v5
+        uses: actions/setup-java@v6
        with:
          distribution: temurin
          java-version: 17
@@ -67,12 +75,26 @@ jobs:
        with:
          cache-read-only: ${{ github.ref != 'refs/heads/main' && github.ref != 'refs/heads/dev' }}

+      - name: Validate Play capability boundary
+        run: |
+          python3 scripts/check-android-capabilities.py
+          python3 -m unittest scripts.tests.check_android_capabilities_test
+
      - name: Validate translation catalogs
        run: python3 scripts/check-android-locales.py

      - name: Reject unsafe Android collection APIs
        run: python3 scripts/check-android-collection-apis.py

+      - name: Validate Android release notes
+        run: |
+          python3 scripts/check-android-release-notes.py
+          python3 -m unittest scripts.tests.android_prepush_test
+          python3 -m unittest scripts.tests.check_android_release_notes_test
+
+      - name: Test Android native compatibility checker
+        run: python3 -m unittest scripts.tests.check_android_native_compat_test
+
      - name: Run Android lint
        run: ./gradlew lint --console=plain

@@ -89,7 +111,7 @@ jobs:
        uses: actions/checkout@v7

      - name: Set up JDK 17
-        uses: actions/setup-java@v5
+        uses: actions/setup-java@v6
        with:
          distribution: temurin
          java-version: 17
@@ -102,6 +124,15 @@ jobs:
      - name: Build debug APK
        run: ./gradlew assembleDebug --console=plain

+      - name: Verify Play capability manifest
+        run: python3 scripts/check-android-capabilities.py --variant googlePlayDebug
+
+      - name: Verify packaged ONNX Runtime compatibility
+        run: |
+          python3 scripts/check-android-native-compat.py \
+            app/build/outputs/apk/googlePlay/debug/*.apk \
+            app/build/outputs/apk/sideload/debug/*.apk
+
      - name: Upload debug APK
        uses: actions/upload-artifact@v7
        if: ${{ github.ref == 'refs/heads/main' }}
@@ -133,7 +164,7 @@ jobs:
        uses: actions/checkout@v7

      - name: Set up JDK 17
-        uses: actions/setup-java@v5
+        uses: actions/setup-java@v6
        with:
          distribution: temurin
          java-version: 17
@@ -152,11 +183,21 @@ jobs:
          ./gradlew :app:testSideloadDebugUnitTest \
            --tests com.hermesandroid.relay.network.ArchitectureBoundaryTest \
            --tests com.hermesandroid.relay.network.relay.RelayUrlDeriverTest \
+            --tests com.hermesandroid.relay.network.shared.PluginProxyTransportTest \
+            --tests '*GatewayChatClientTest*retarget*' \
+            --tests '*RelayVoiceClientRoutingTest.proxyProviderOwnsBothVoiceSessionAndWebSocketRequests' \
+            --tests com.hermesandroid.relay.network.relay.RelayHttpClientDiagnosticsTest \
+            --tests com.hermesandroid.relay.ui.components.GatewayRoutesAccessPresentationTest \
+            --tests com.hermesandroid.relay.ui.components.EndpointsCardCompactLayoutTest \
+            --tests com.hermesandroid.relay.ui.screens.ConnectionDetailPresentationTest \
            --tests com.hermesandroid.relay.viewmodel.ConnectionSwitchTest \
            --tests com.hermesandroid.relay.util.ServerAddressTest \
            --tests com.hermesandroid.relay.util.IssueReportAndDiagnosticsTest \
            --tests com.hermesandroid.relay.data.AppLanguageTest \
            --tests com.hermesandroid.relay.viewmodel.ChatStreamRecoveryTest \
+            --tests com.hermesandroid.relay.viewmodel.ChatViewModelGatewayInboundTurnTest \
+            --tests com.hermesandroid.relay.viewmodel.VoiceInboundCompletionTest \
+            --tests com.hermesandroid.relay.voice.VoiceViewModelBargeInTest \
            --tests com.hermesandroid.relay.viewmodel.ChatViewModelRealtimeTurnTest \
            --tests com.hermesandroid.relay.network.relay.RealtimeVoiceEventParsingTest \
            --tests com.hermesandroid.relay.voice.VoiceCommandInterpreterTest \
@@ -197,7 +238,7 @@ jobs:
        uses: actions/checkout@v7

      - name: Set up JDK 17
-        uses: actions/setup-java@v5
+        uses: actions/setup-java@v6
        with:
          distribution: temurin
          java-version: 17
@@ -218,3 +259,9 @@ jobs:
          python3 scripts/check-android-collection-apis.py \
            --apk app/build/outputs/apk/googlePlay/release/*.apk \
            --apk app/build/outputs/apk/sideload/release/*.apk
+
+      - name: Verify packaged ONNX Runtime compatibility
+        run: |
+          python3 scripts/check-android-native-compat.py \
+            app/build/outputs/apk/googlePlay/release/*.apk \
+            app/build/outputs/apk/sideload/release/*.apk
@@ -11,6 +11,9 @@

 name: CI — Upstream Contract

+permissions:
+  contents: read
+
 on:
  workflow_call:
  push:
@@ -40,45 +43,64 @@ jobs:
    steps:
      - name: Checkout hermes-relay
        uses: actions/checkout@v7
+        with:
+          persist-credentials: false

      - name: Resolve upstream ref
        id: ref
+        env:
+          REQUESTED_REF: ${{ github.event.inputs.upstream_ref }}
        run: |
+          set -euo pipefail
          # PR/push runs use a known-good NousResearch/hermes-agent commit so
          # normal CI is stable. The weekly schedule below intentionally tracks
          # main as the upstream-drift siren.
          DEFAULT_REF="ef4b897a1843cd32c4f141f55db60f0f0602cc98"
          if [ "${{ github.event_name }}" = "schedule" ]; then
            REF="main"                                   # weekly drift siren
-          elif [ -n "${{ github.event.inputs.upstream_ref }}" ]; then
-            REF="${{ github.event.inputs.upstream_ref }}" # manual override
+          elif [ -n "$REQUESTED_REF" ]; then
+            REF="$REQUESTED_REF"                          # manual override
          else
            REF="$DEFAULT_REF"
          fi
+
+          # The ref is passed to git below, so reject option-like or malformed
+          # values before it reaches that boundary. Full commit IDs and normal
+          # branch/tag names remain supported for manual contract checks.
+          if [[ "$REF" == -* ]] ||
+             ! git check-ref-format --allow-onelevel "$REF" >/dev/null; then
+            echo "FAIL: invalid upstream branch or tag name." >&2
+            exit 1
+          fi
+
          echo "ref=$REF" >> "$GITHUB_OUTPUT"
          echo "Checking standard-path route contract against upstream ref: $REF"

-      - name: Checkout vanilla upstream (no plugin, no bootstrap)
-        uses: actions/checkout@v7
-        with:
-          repository: NousResearch/hermes-agent
-          ref: ${{ steps.ref.outputs.ref }}
-          path: _upstream
-          fetch-depth: 1
+      - name: Extract trusted upstream contract sources
+        env:
+          UPSTREAM_REF: ${{ steps.ref.outputs.ref }}
+        run: |
+          set -euo pipefail
+          UPSTREAM_GIT="$RUNNER_TEMP/hermes-agent-contract.git"
+          git init --bare "$UPSTREAM_GIT"
+          git -C "$UPSTREAM_GIT" remote add origin \
+            "https://github.com/NousResearch/hermes-agent.git"
+          git -C "$UPSTREAM_GIT" fetch --no-tags --depth=1 origin -- "$UPSTREAM_REF"
+          UPSTREAM_COMMIT="$(git -C "$UPSTREAM_GIT" rev-parse 'FETCH_HEAD^{commit}')"
+
+          mkdir -p _upstream/gateway/platforms _upstream/hermes_cli
+          git -C "$UPSTREAM_GIT" show \
+            "$UPSTREAM_COMMIT:gateway/platforms/api_server.py" \
+            > _upstream/gateway/platforms/api_server.py
+          git -C "$UPSTREAM_GIT" show \
+            "$UPSTREAM_COMMIT:hermes_cli/web_server.py" \
+            > _upstream/hermes_cli/web_server.py
+          echo "Extracted contract sources from upstream commit: $UPSTREAM_COMMIT"

      - name: Set up Python 3.11
        uses: actions/setup-python@v7
        with:
          python-version: "3.11"

-      - name: Assert upstream checkout is vanilla (no relay bootstrap/plugin)
-        run: |
-          if [ -e "_upstream/hermes_relay_bootstrap" ] || \
-             [ -e "_upstream/plugin/hermes_relay_bootstrap" ] || \
-             find _upstream -name "hermes_relay_bootstrap.pth" 2>/dev/null | grep -q .; then
-            echo "FAIL: upstream checkout contains a relay bootstrap — not vanilla."; exit 1
-          fi
-          echo "OK: upstream checkout carries no relay plugin/bootstrap."
-
      - name: Run route-surface contract
        run: python scripts/check-upstream-route-contract.py "_upstream"
@@ -107,6 +107,18 @@ jobs:
      - name: Setup Rust
        uses: dtolnay/rust-toolchain@stable

+      - name: Restore exact-source tray build cache
+        uses: actions/cache@v6
+        with:
+          path: |
+            ~/.cargo/registry/index
+            ~/.cargo/registry/cache
+            ~/.cargo/git/db
+            desktop/tray/target
+          key: ${{ runner.os }}-tray-rust-${{ hashFiles('desktop/tray/Cargo.lock') }}-${{ hashFiles('desktop/tray/Cargo.toml', 'desktop/tray/build.rs', 'desktop/tray/src/**/*.rs') }}
+          restore-keys: |
+            ${{ runner.os }}-tray-rust-${{ hashFiles('desktop/tray/Cargo.lock') }}-
+
      - name: Install deps
        run: npm ci && npm --prefix tray ci

@@ -101,7 +101,12 @@ jobs:
      - name: Run focused Plugin tests
        run: |
          python -m pytest \
+            plugin/tests/test_manifest_compatibility.py \
            plugin/tests/test_relay_security.py \
+            plugin/tests/test_secure_proxy.py \
+            plugin/tests/test_secure_proxy_contract.py \
+            plugin/tests/test_secure_link_setup.py \
+            plugin/tests/test_secure_proxy_security.py \
            plugin/tests/test_voice_routes.py \
            plugin/tests/test_session_grants.py \
            plugin/tests/test_native_layout_imports.py \
@@ -110,4 +115,8 @@ jobs:
            plugin/tests/test_git_state.py \
            plugin/tests/test_git_state_write.py \
            plugin/tests/test_git_state_extras.py \
-            plugin/tests/test_mobile_plugin_store.py
+            plugin/tests/test_mobile_plugin_store.py \
+            plugin/tests/test_android_tool.py \
+            plugin/tests/test_android_navigate.py \
+            plugin/tests/test_phone_platform.py \
+            plugin/tests/test_desktop_tool_availability.py
@@ -10,13 +10,36 @@ on:
  pull_request:
    branches: [main, dev]
    types: [opened, synchronize, reopened, ready_for_review]
+  workflow_dispatch:
+    inputs:
+      base_sha:
+        description: "Exact base commit for a trusted release-backmerge candidate"
+        required: true
+        type: string
+      head_sha:
+        description: "Exact candidate commit to check"
+        required: true
+        type: string
+      android_preset:
+        description: "Optional Android-only compute lane"
+        required: false
+        default: auto
+        type: choice
+        options:
+          - auto
+          - focused
+          - lint
+          - assemble-debug
+          - release-smoke
+          - all-final

 permissions:
+  actions: read
  contents: read
  pull-requests: read

 concurrency:
-  group: ci-required-${{ github.ref }}
+  group: ci-required-${{ github.event_name == 'workflow_dispatch' && format('{0}-{1}', inputs.head_sha, inputs.android_preset) || github.ref }}
  cancel-in-progress: true

 jobs:
@@ -30,23 +53,86 @@ jobs:
      dashboard: ${{ steps.filter.outputs.dashboard }}
      contract: ${{ steps.filter.outputs.contract }}
      docs: ${{ steps.filter.outputs.docs }}
+      release_pr: ${{ steps.release.outputs.release_pr }}
+      tree: ${{ steps.tree.outputs.tree }}
    steps:
-      - name: Checkout repository
+      - name: Checkout pull request merge
+        if: github.event_name == 'pull_request'
        uses: actions/checkout@v7
        with:
          fetch-depth: 2

+      - name: Checkout exact dispatched candidate
+        if: github.event_name == 'workflow_dispatch'
+        uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+          ref: ${{ inputs.head_sha }}
+
      - name: Test path classifier
        run: node .github/scripts/classify-ci-paths.test.cjs

+      - name: Record checked tree
+        id: tree
+        run: echo "tree=$(git rev-parse 'HEAD^{tree}')" >> "$GITHUB_OUTPUT"
+
+      - name: Detect canonical release promotion
+        id: release
+        env:
+          BASE_REF: ${{ github.base_ref }}
+          HEAD_REF: ${{ github.head_ref }}
+          HEAD_REPOSITORY: ${{ github.event.pull_request.head.repo.full_name }}
+        run: |
+          if [ "$GITHUB_EVENT_NAME" = "pull_request" ] && \
+             [ "$BASE_REF" = "main" ] && \
+             [ "$HEAD_REF" = "dev" ] && \
+             [ "$HEAD_REPOSITORY" = "$GITHUB_REPOSITORY" ]; then
+            echo "release_pr=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "release_pr=false" >> "$GITHUB_OUTPUT"
+          fi
+
      - name: Classify changed files
        id: filter
        uses: actions/github-script@v8
+        env:
+          DISPATCH_BASE_SHA: ${{ inputs.base_sha }}
+          DISPATCH_HEAD_SHA: ${{ inputs.head_sha }}
        with:
          script: |
+            let diffArgs;
+            if (context.eventName === 'workflow_dispatch') {
+              const base = process.env.DISPATCH_BASE_SHA || '';
+              const head = process.env.DISPATCH_HEAD_SHA || '';
+              const shaPattern = /^[0-9a-f]{40}$/;
+              if (!shaPattern.test(base) || !shaPattern.test(head)) {
+                core.setFailed('Exact-tree dispatch requires full 40-character base/head SHAs.');
+                return;
+              }
+              const { stdout: checkedOut } = await exec.getExecOutput(
+                'git',
+                ['rev-parse', 'HEAD'],
+              );
+              if (checkedOut.trim() !== head) {
+                core.setFailed(`Checked out ${checkedOut.trim()}, expected ${head}.`);
+                return;
+              }
+              const ancestry = await exec.exec(
+                'git',
+                ['merge-base', '--is-ancestor', base, head],
+                { ignoreReturnCode: true },
+              );
+              if (ancestry !== 0) {
+                core.setFailed(`Candidate ${head} does not descend from base ${base}.`);
+                return;
+              }
+              diffArgs = ['diff', '--name-only', base, head];
+            } else {
+              diffArgs = ['diff', '--name-only', 'HEAD^1', 'HEAD^2'];
+            }
            const { stdout } = await exec.getExecOutput(
              'git',
-              ['diff', '--name-only', 'HEAD^1', 'HEAD^2'],
+              diffArgs,
            );
            const paths = stdout.split(/\r?\n/).filter(Boolean);
            const { classifyCiPaths } = require(
@@ -60,35 +146,117 @@ jobs:
            core.notice(`Changed paths: ${paths.join(', ')}`);
            core.notice(`Selected checks: ${Object.entries(outputs).filter(([, value]) => value).map(([key]) => key).join(', ') || 'none'}`);

-  android:
+  release-proof:
+    name: Reuse exact-tree required checks
    needs: changes
-    if: needs.changes.outputs.android == 'true'
+    if: needs.changes.outputs.release_pr == 'true'
+    runs-on: ubuntu-latest
+    outputs:
+      reuse: ${{ steps.proof.outputs.reuse }}
+      artifact_id: ${{ steps.proof.outputs.artifact_id }}
+      run_id: ${{ steps.proof.outputs.run_id }}
+      tree: ${{ steps.proof.outputs.tree }}
+    steps:
+      - name: Checkout simulated release merge
+        uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+
+      - name: Locate exact-tree proof
+        id: proof
+        env:
+          GH_TOKEN: ${{ github.token }}
+          DEV_SHA: ${{ github.event.pull_request.head.sha }}
+        run: |
+          set -euo pipefail
+          merge_tree=$(git rev-parse 'HEAD^{tree}')
+          dev_tree=$(git rev-parse "${DEV_SHA}^{tree}")
+          echo "reuse=false" >> "$GITHUB_OUTPUT"
+          echo "tree=$dev_tree" >> "$GITHUB_OUTPUT"
+          if [ "$merge_tree" != "$dev_tree" ]; then
+            echo "Release merge changes the dev tree ($dev_tree -> $merge_tree); running full CI."
+            exit 0
+          fi
+
+          artifact_name="required-checks-${dev_tree}"
+          artifact=$(gh api "/repos/${GITHUB_REPOSITORY}/actions/artifacts?name=${artifact_name}" \
+            --jq '[.artifacts[] | select(.expired == false)] | sort_by(.created_at) | last')
+          artifact_id=$(jq -r '.id // empty' <<<"$artifact")
+          run_id=$(jq -r '.workflow_run.id // empty' <<<"$artifact")
+          if [ -z "$artifact_id" ] || [ -z "$run_id" ]; then
+            echo "No reusable proof exists for tree $dev_tree; running full CI."
+            exit 0
+          fi
+
+          run=$(gh api "/repos/${GITHUB_REPOSITORY}/actions/runs/${run_id}")
+          conclusion=$(jq -r '.conclusion' <<<"$run")
+          workflow_path=$(jq -r '.path' <<<"$run")
+          if [ "$workflow_path" != ".github/workflows/ci-required.yml" ] || [ "$conclusion" != "success" ]; then
+            echo "::error::Required-check proof came from ${workflow_path} with conclusion ${conclusion}"
+            exit 1
+          fi
+          echo "artifact_id=$artifact_id" >> "$GITHUB_OUTPUT"
+          echo "run_id=$run_id" >> "$GITHUB_OUTPUT"
+          echo "reuse=true" >> "$GITHUB_OUTPUT"
+
+      - name: Download exact-tree proof
+        if: steps.proof.outputs.reuse == 'true'
+        uses: actions/download-artifact@v8
+        with:
+          artifact-ids: ${{ steps.proof.outputs.artifact_id }}
+          github-token: ${{ github.token }}
+          repository: ${{ github.repository }}
+          run-id: ${{ steps.proof.outputs.run_id }}
+          path: required-check-proof
+
+      - name: Verify exact-tree proof
+        if: steps.proof.outputs.reuse == 'true'
+        env:
+          EXPECTED_TREE: ${{ steps.proof.outputs.tree }}
+        run: |
+          jq -e \
+            --arg repository "$GITHUB_REPOSITORY" \
+            --arg tree "$EXPECTED_TREE" \
+            '.schemaVersion == 1 and .repository == $repository and .tree == $tree' \
+            required-check-proof/required-checks.json
+
+  android:
+    needs: [changes, release-proof]
+    if: ${{ always() && needs.changes.result == 'success' && needs.changes.outputs.android == 'true' && needs.release-proof.outputs.reuse != 'true' && (github.event_name != 'workflow_dispatch' || inputs.android_preset == 'auto') }}
    uses: ./.github/workflows/ci-android.yml

+  android_on_demand:
+    needs: [changes, release-proof]
+    if: ${{ always() && needs.changes.result == 'success' && needs.release-proof.outputs.reuse != 'true' && github.event_name == 'workflow_dispatch' && inputs.android_preset != 'auto' }}
+    uses: ./.github/workflows/android-on-demand.yml
+    with:
+      head_sha: ${{ inputs.head_sha }}
+      preset: ${{ inputs.android_preset }}
+
  desktop:
-    needs: changes
-    if: needs.changes.outputs.desktop == 'true'
+    needs: [changes, release-proof]
+    if: ${{ always() && needs.changes.result == 'success' && needs.changes.outputs.desktop == 'true' && needs.release-proof.outputs.reuse != 'true' && (github.event_name != 'workflow_dispatch' || inputs.android_preset == 'auto') }}
    uses: ./.github/workflows/ci-desktop.yml

  plugin:
-    needs: changes
-    if: needs.changes.outputs.plugin == 'true'
+    needs: [changes, release-proof]
+    if: ${{ always() && needs.changes.result == 'success' && needs.changes.outputs.plugin == 'true' && needs.release-proof.outputs.reuse != 'true' && (github.event_name != 'workflow_dispatch' || inputs.android_preset == 'auto') }}
    uses: ./.github/workflows/ci-plugin.yml

  dashboard:
-    needs: changes
-    if: needs.changes.outputs.dashboard == 'true'
+    needs: [changes, release-proof]
+    if: ${{ always() && needs.changes.result == 'success' && needs.changes.outputs.dashboard == 'true' && needs.release-proof.outputs.reuse != 'true' && (github.event_name != 'workflow_dispatch' || inputs.android_preset == 'auto') }}
    uses: ./.github/workflows/ci-dashboard.yml

  contract:
-    needs: changes
-    if: needs.changes.outputs.contract == 'true'
+    needs: [changes, release-proof]
+    if: ${{ always() && needs.changes.result == 'success' && needs.changes.outputs.contract == 'true' && needs.release-proof.outputs.reuse != 'true' && (github.event_name != 'workflow_dispatch' || inputs.android_preset == 'auto') }}
    uses: ./.github/workflows/ci-contract.yml

  docs:
    name: Build public docs
-    needs: changes
-    if: needs.changes.outputs.docs == 'true'
+    needs: [changes, release-proof]
+    if: ${{ always() && needs.changes.result == 'success' && needs.changes.outputs.docs == 'true' && needs.release-proof.outputs.reuse != 'true' && (github.event_name != 'workflow_dispatch' || inputs.android_preset == 'auto') }}
    runs-on: ubuntu-latest
    defaults:
      run:
@@ -110,11 +278,14 @@ jobs:
  guard:
    name: Required checks
    if: always()
-    needs: [changes, android, desktop, plugin, dashboard, contract, docs]
+    needs: [changes, release-proof, android, android_on_demand, desktop, plugin, dashboard, contract, docs]
    runs-on: ubuntu-latest
    env:
      CHANGES_RESULT: ${{ needs.changes.result }}
+      RELEASE_PROOF_RESULT: ${{ needs.release-proof.result }}
+      REUSED_REQUIRED_CHECKS: ${{ needs.release-proof.outputs.reuse }}
      ANDROID_RESULT: ${{ needs.android.result }}
+      ANDROID_ON_DEMAND_RESULT: ${{ needs.android_on_demand.result }}
      DESKTOP_RESULT: ${{ needs.desktop.result }}
      PLUGIN_RESULT: ${{ needs.plugin.result }}
      DASHBOARD_RESULT: ${{ needs.dashboard.result }}
@@ -125,7 +296,7 @@ jobs:
        shell: bash
        run: |
          failed=0
-          for check in CHANGES ANDROID DESKTOP PLUGIN DASHBOARD CONTRACT DOCS; do
+          for check in CHANGES RELEASE_PROOF ANDROID ANDROID_ON_DEMAND DESKTOP PLUGIN DASHBOARD CONTRACT DOCS; do
            result_var="${check}_RESULT"
            result="${!result_var}"
            echo "$check: $result"
@@ -135,3 +306,26 @@ jobs:
            esac
          done
          exit "$failed"
+
+      - name: Write exact-tree proof
+        if: ${{ needs.release-proof.outputs.reuse != 'true' }}
+        env:
+          CHECKED_TREE: ${{ needs.changes.outputs.tree }}
+        run: |
+          mkdir -p required-check-proof
+          jq -n \
+            --arg repository "$GITHUB_REPOSITORY" \
+            --arg tree "$CHECKED_TREE" \
+            --arg commit "$GITHUB_SHA" \
+            --arg run_id "$GITHUB_RUN_ID" \
+            '{schemaVersion: 1, repository: $repository, tree: $tree, commit: $commit, runId: $run_id}' \
+            > required-check-proof/required-checks.json
+
+      - name: Upload exact-tree proof
+        if: ${{ needs.release-proof.outputs.reuse != 'true' }}
+        uses: actions/upload-artifact@v7
+        with:
+          name: required-checks-${{ needs.changes.outputs.tree }}
+          path: required-check-proof/required-checks.json
+          if-no-files-found: error
+          retention-days: 30
@@ -8,6 +8,15 @@ on:
      - "assets/screenshots/03_voice.png"
      - "assets/screenshots/06_manage.png"
      - "docs/media/screenshots.json"
+      - "docs/media/desktop-ui-screenshots.json"
+      - "assets/screenshots/desktop-ui/**"
+      - "desktop/tray/ui/**"
+      - "desktop/tray/scripts/*.mjs"
+      - "desktop/tray/package-lock.json"
+      - "desktop/tray/index.html"
+      - "desktop/tray/icons/icon-256.png"
+      - "desktop/src/endpoint.ts"
+      - "desktop/src/transportSecurity.ts"
      - ".github/workflows/ci-website.yml"
  push:
    branches: [main, dev]
@@ -17,6 +26,15 @@ on:
      - "assets/screenshots/03_voice.png"
      - "assets/screenshots/06_manage.png"
      - "docs/media/screenshots.json"
+      - "docs/media/desktop-ui-screenshots.json"
+      - "assets/screenshots/desktop-ui/**"
+      - "desktop/tray/ui/**"
+      - "desktop/tray/scripts/*.mjs"
+      - "desktop/tray/package-lock.json"
+      - "desktop/tray/index.html"
+      - "desktop/tray/icons/icon-256.png"
+      - "desktop/src/endpoint.ts"
+      - "desktop/src/transportSecurity.ts"
      - ".github/workflows/ci-website.yml"

 permissions:
@@ -70,7 +70,7 @@ jobs:
      - uses: actions/checkout@v7

      - name: Set up JDK 17
-        uses: actions/setup-java@v5
+        uses: actions/setup-java@v6
        with:
          distribution: temurin
          java-version: 17
@@ -2,10 +2,11 @@
 #
 # Run manually from the final dev or untagged main tree before creating
 # android-v*. The job
-# builds the same signed release artifacts, scans final DEX, and uploads the
-# Google Play bundle as a production DRAFT. A successful upload is the automated
-# Play gate while no public GitHub Release or sideload APK exists. Console-only
-# pre-review and pre-launch reports are informational and do not block release.
+# builds the signed release artifacts once, scans the final packages, and uploads
+# the Google Play bundle as a production DRAFT. The exact signed APK/AAB,
+# mappings, manifest, and checksums remain private Actions artifacts until
+# approval publishes those same bytes. Console-only pre-review and pre-launch
+# reports are informational and do not block release.

 name: Hermes-Relay Android Play Preflight

@@ -68,7 +69,7 @@ jobs:
          fi

      - name: Set up JDK 17
-        uses: actions/setup-java@v5
+        uses: actions/setup-java@v6
        with:
          distribution: temurin
          java-version: 17
@@ -81,10 +82,10 @@ jobs:
      - name: Validate release metadata and source compatibility
        run: |
          python3 scripts/check-version-tracks.py
+          python3 scripts/check-android-release-notes.py
          python3 scripts/check-privacy-policy.py --live
          python3 scripts/check-android-locales.py
          python3 scripts/check-android-collection-apis.py
-          python3 -m json.tool app/src/main/assets/changelog.json >/dev/null

      - name: Decode release keystore
        env:
@@ -98,7 +99,15 @@ jobs:
          HERMES_KEYSTORE_PASSWORD: ${{ secrets.HERMES_KEYSTORE_PASSWORD }}
          HERMES_KEY_ALIAS: ${{ secrets.HERMES_KEY_ALIAS }}
          HERMES_KEY_PASSWORD: ${{ secrets.HERMES_KEY_PASSWORD }}
-        run: ./gradlew bundleRelease assembleRelease --console=plain
+        run: |
+          ./gradlew \
+            :app:bundleGooglePlayRelease \
+            :app:assembleGooglePlayRelease \
+            :app:assembleSideloadRelease \
+            --console=plain
+
+      - name: Verify Play capability manifest
+        run: python3 scripts/check-android-capabilities.py --variant googlePlayRelease

      - name: Scan final release DEX
        run: |
@@ -106,6 +115,12 @@ jobs:
            --apk app/build/outputs/apk/googlePlay/release/*.apk \
            --apk app/build/outputs/apk/sideload/release/*.apk

+      - name: Verify packaged native compatibility
+        run: |
+          python3 scripts/check-android-native-compat.py \
+            app/build/outputs/apk/googlePlay/release/*.apk \
+            app/build/outputs/apk/sideload/release/*.apk
+
      - name: Upload private production draft to Play
        env:
          PLAY_SERVICE_ACCOUNT_JSON: ${{ secrets.PLAY_SERVICE_ACCOUNT_JSON }}
@@ -121,27 +136,27 @@ jobs:
            --resolution-strategy=ignore \
            --release-name="Hermes-Relay Android v${{ steps.metadata.outputs.version }}"

-      - name: Record successful preflight for the exact commit
+      - name: Package immutable preflight artifacts
        run: |
-          mkdir -p app/build/reports
-          cat > app/build/reports/play-preflight.json <<EOF
-          {
-            "version": "${{ steps.metadata.outputs.version }}",
-            "versionCode": "${{ steps.metadata.outputs.version_code }}",
-            "commit": "$GITHUB_SHA",
-            "tree": "${{ steps.metadata.outputs.tree }}",
-            "track": "production",
-            "status": "draft"
-          }
-          EOF
+          python3 scripts/android_release_artifacts.py package \
+            --version "${{ steps.metadata.outputs.version }}" \
+            --version-code "${{ steps.metadata.outputs.version_code }}" \
+            --commit "$GITHUB_SHA" \
+            --tree "${{ steps.metadata.outputs.tree }}" \
+            --sideload-apk app/build/outputs/apk/sideload/release/*.apk \
+            --google-play-aab app/build/outputs/bundle/googlePlayRelease/*.aab \
+            --sideload-mapping app/build/outputs/mapping/sideloadRelease/mapping.txt \
+            --google-play-mapping app/build/outputs/mapping/googlePlayRelease/mapping.txt \
+            --output app/build/preflight-artifacts

-      - name: Upload preflight proof
+      - name: Upload immutable preflight artifacts
        uses: actions/upload-artifact@v7
        with:
          name: play-preflight-${{ steps.metadata.outputs.version }}-${{ steps.metadata.outputs.tree }}
-          path: app/build/reports/play-preflight.json
+          path: app/build/preflight-artifacts/*
          if-no-files-found: error
          retention-days: 30
+          compression-level: 0

      - name: Preflight summary
        run: |
@@ -152,4 +167,4 @@ jobs:
          echo "- Release tree: \`${{ steps.metadata.outputs.tree }}\`" >> "$GITHUB_STEP_SUMMARY"
          echo "- Play track/status: **Production draft**" >> "$GITHUB_STEP_SUMMARY"
          echo "" >> "$GITHUB_STEP_SUMMARY"
-          echo "The signed build, DEX scan, and Play draft upload passed. Ensure this exact release tree is on main, then run **Hermes-Relay Android Release Approval** from main. Console-only reports are informational and non-blocking." >> "$GITHUB_STEP_SUMMARY"
+          echo "The signed build, package scans, and Play draft upload passed. Approval will publish these exact private artifacts if the unchanged tree reaches main. Console-only reports are informational and non-blocking." >> "$GITHUB_STEP_SUMMARY"
@@ -36,6 +36,9 @@ jobs:
      version: ${{ steps.version.outputs.version }}
      version_code: ${{ steps.version.outputs.version_code }}
      prerelease: ${{ steps.version.outputs.prerelease }}
+      release_tree: ${{ steps.version.outputs.release_tree }}
+      preflight_artifact_id: ${{ steps.preflight.outputs.artifact_id }}
+      preflight_run_id: ${{ steps.preflight.outputs.run_id }}
    steps:
      - uses: actions/checkout@v7
        with:
@@ -66,6 +69,7 @@ jobs:
          echo "version=$REF_VERSION" >> "$GITHUB_OUTPUT"
          echo "version_code=$VERSION_CODE" >> "$GITHUB_OUTPUT"
          echo "prerelease=$PRERELEASE" >> "$GITHUB_OUTPUT"
+          echo "release_tree=$(git rev-parse 'HEAD^{tree}')" >> "$GITHUB_OUTPUT"

      - name: Verify version sync
        run: |
@@ -110,25 +114,38 @@ jobs:
          fi

      - name: Require successful Play preflight for this exact release tree
+        id: preflight
        if: ${{ !contains(steps.version.outputs.version, '-') }}
        env:
          GH_TOKEN: ${{ github.token }}
          VERSION: ${{ steps.version.outputs.version }}
        run: |
-          RELEASE_TREE=$(git rev-parse 'HEAD^{tree}')
+          RELEASE_TREE="${{ steps.version.outputs.release_tree }}"
          ARTIFACT_NAME="play-preflight-${VERSION}-${RELEASE_TREE}"
-          COUNT=$(gh api "/repos/${GITHUB_REPOSITORY}/actions/artifacts?name=${ARTIFACT_NAME}" \
-            --jq '[.artifacts[] | select(.expired == false)] | length')
-          if [ "$COUNT" -lt 1 ]; then
+          ARTIFACT=$(gh api "/repos/${GITHUB_REPOSITORY}/actions/artifacts?name=${ARTIFACT_NAME}" \
+            --jq '[.artifacts[] | select(.expired == false)] | sort_by(.created_at) | last')
+          ARTIFACT_ID=$(jq -r '.id // empty' <<<"$ARTIFACT")
+          RUN_ID=$(jq -r '.workflow_run.id // empty' <<<"$ARTIFACT")
+          if [ -z "$ARTIFACT_ID" ] || [ -z "$RUN_ID" ]; then
            echo "::error::No successful Play preflight found for version $VERSION with tree $RELEASE_TREE"
            echo "Run Hermes-Relay Android Play Preflight from the final dev tree, merge that unchanged tree to main, then approve the release."
            exit 1
          fi
-          echo "Play preflight proof found: $ARTIFACT_NAME"
+          RUN=$(gh api "/repos/${GITHUB_REPOSITORY}/actions/runs/${RUN_ID}")
+          CONCLUSION=$(jq -r '.conclusion' <<<"$RUN")
+          WORKFLOW_PATH=$(jq -r '.path' <<<"$RUN")
+          if [ "$WORKFLOW_PATH" != ".github/workflows/play-preflight-android.yml" ] || [ "$CONCLUSION" != "success" ]; then
+            echo "::error::Preflight artifact came from ${WORKFLOW_PATH} with conclusion ${CONCLUSION}"
+            exit 1
+          fi
+          echo "artifact_id=$ARTIFACT_ID" >> "$GITHUB_OUTPUT"
+          echo "run_id=$RUN_ID" >> "$GITHUB_OUTPUT"
+          echo "Play preflight artifacts verified: $ARTIFACT_NAME (run $RUN_ID, artifact $ARTIFACT_ID)"

  ci:
-    name: CI Checks
+    name: CI Checks (prerelease only)
    needs: validate
+    if: ${{ needs.validate.outputs.prerelease == 'true' }}
    runs-on: ubuntu-latest
    timeout-minutes: 30
    steps:
@@ -137,7 +154,7 @@ jobs:
          ref: ${{ github.event_name == 'workflow_dispatch' && format('android-v{0}', inputs.version) || github.ref }}

      - name: Set up JDK 17
-        uses: actions/setup-java@v5
+        uses: actions/setup-java@v6
        with:
          distribution: temurin
          java-version: 17
@@ -150,6 +167,7 @@ jobs:
      - name: Validate release metadata and Android API compatibility
        run: |
          python3 scripts/check-version-tracks.py
+          python3 scripts/check-android-release-notes.py
          python3 scripts/check-privacy-policy.py
          python3 scripts/check-android-locales.py
          python3 scripts/check-android-collection-apis.py
@@ -167,6 +185,7 @@ jobs:
  release:
    name: Build & Publish Release
    needs: [validate, ci]
+    if: ${{ always() && needs.validate.result == 'success' && (needs.ci.result == 'success' || needs.ci.result == 'skipped') }}
    runs-on: ubuntu-latest
    timeout-minutes: 30
    steps:
@@ -175,7 +194,7 @@ jobs:
          ref: ${{ github.event_name == 'workflow_dispatch' && format('android-v{0}', inputs.version) || github.ref }}

      - name: Set up JDK 17
-        uses: actions/setup-java@v5
+        uses: actions/setup-java@v6
        with:
          distribution: temurin
          java-version: 17
@@ -185,31 +204,33 @@ jobs:
        with:
          cache-read-only: false

-      - name: Decode release keystore
+      - name: Download exact stable preflight artifacts
+        if: ${{ needs.validate.outputs.prerelease != 'true' }}
+        uses: actions/download-artifact@v8
+        with:
+          artifact-ids: ${{ needs.validate.outputs.preflight_artifact_id }}
+          github-token: ${{ github.token }}
+          repository: ${{ github.repository }}
+          run-id: ${{ needs.validate.outputs.preflight_run_id }}
+          path: app/build/preflight-artifacts
+
+      - name: Verify exact stable preflight artifacts
+        if: ${{ needs.validate.outputs.prerelease != 'true' }}
+        run: |
+          python3 scripts/android_release_artifacts.py verify \
+            --version "${{ needs.validate.outputs.version }}" \
+            --version-code "${{ needs.validate.outputs.version_code }}" \
+            --tree "${{ needs.validate.outputs.release_tree }}" \
+            --directory app/build/preflight-artifacts
+
+      - name: Decode release keystore for candidate build
        env:
          HERMES_KEYSTORE_BASE64: ${{ secrets.HERMES_KEYSTORE_BASE64 }}
-        if: env.HERMES_KEYSTORE_BASE64 != ''
+        if: ${{ needs.validate.outputs.prerelease == 'true' && env.HERMES_KEYSTORE_BASE64 != '' }}
        run: |
          echo "$HERMES_KEYSTORE_BASE64" | base64 -d > "$RUNNER_TEMP/release.keystore"
          echo "HERMES_KEYSTORE_PATH=$RUNNER_TEMP/release.keystore" >> "$GITHUB_ENV"

-      - name: Build stable release artifacts (APK + AAB)
-        if: ${{ needs.validate.outputs.prerelease != 'true' }}
-        env:
-          HERMES_KEYSTORE_PASSWORD: ${{ secrets.HERMES_KEYSTORE_PASSWORD }}
-          HERMES_KEY_ALIAS: ${{ secrets.HERMES_KEY_ALIAS }}
-          HERMES_KEY_PASSWORD: ${{ secrets.HERMES_KEY_PASSWORD }}
-        # `assembleRelease` and `bundleRelease` are flavor-wide task aliases
-        # (added by `flavorDimensions += "track"` in app/build.gradle.kts), so
-        # this one line builds ALL four artifacts at once. Filenames come from
-        # `archivesName` (set in app/build.gradle.kts) which injects the app
-        # version, so `<version>` below is `libs.versions.appVersionName`:
-        #   app/build/outputs/apk/googlePlay/release/hermes-relay-<version>-googlePlay-release.apk
-        #   app/build/outputs/apk/sideload/release/hermes-relay-<version>-sideload-release.apk
-        #   app/build/outputs/bundle/googlePlayRelease/hermes-relay-<version>-googlePlay-release.aab
-        #   app/build/outputs/bundle/sideloadRelease/hermes-relay-<version>-sideload-release.aab
-        run: ./gradlew bundleRelease assembleRelease
-
      - name: Build side-by-side release candidate APK
        if: ${{ needs.validate.outputs.prerelease == 'true' }}
        env:
@@ -233,10 +254,10 @@ jobs:
        if: ${{ needs.validate.outputs.prerelease != 'true' }}
        uses: actions/upload-artifact@v7
        with:
-          name: android-r8-mappings-${{ needs.validate.outputs.version }}-${{ github.sha }}
+          name: android-r8-mappings-${{ needs.validate.outputs.version }}-${{ needs.validate.outputs.release_tree }}
          path: |
-            app/build/outputs/mapping/googlePlayRelease/mapping.txt
-            app/build/outputs/mapping/sideloadRelease/mapping.txt
+            app/build/preflight-artifacts/mapping-googlePlayRelease.txt
+            app/build/preflight-artifacts/mapping-sideloadRelease.txt
          if-no-files-found: error
          retention-days: 90

@@ -253,8 +274,7 @@ jobs:
        if: ${{ needs.validate.outputs.prerelease != 'true' }}
        run: |
          python3 scripts/check-android-collection-apis.py \
-            --apk app/build/outputs/apk/googlePlay/release/*.apk \
-            --apk app/build/outputs/apk/sideload/release/*.apk
+            --apk app/build/preflight-artifacts/*-sideload-release.apk

      - name: Scan candidate DEX for unsupported collection APIs
        if: ${{ needs.validate.outputs.prerelease == 'true' }}
@@ -262,25 +282,24 @@ jobs:
          python3 scripts/check-android-collection-apis.py \
            --apk app/build/outputs/apk/sideload/candidate/*.apk

+      - name: Verify stable packaged ONNX Runtime compatibility
+        if: ${{ needs.validate.outputs.prerelease != 'true' }}
+        run: |
+          python3 scripts/check-android-native-compat.py \
+            app/build/preflight-artifacts/*-sideload-release.apk
+
+      - name: Verify candidate packaged ONNX Runtime compatibility
+        if: ${{ needs.validate.outputs.prerelease == 'true' }}
+        run: |
+          python3 scripts/check-android-native-compat.py \
+            app/build/outputs/apk/sideload/candidate/*.apk
+
      - name: List produced artifacts (debug aid)
        run: |
-          echo "=== APK outputs ==="
+          echo "=== Reused stable artifacts ==="
+          find app/build/preflight-artifacts -maxdepth 1 -type f -print 2>/dev/null || true
+          echo "=== Candidate APK outputs ==="
          find app/build/outputs/apk -name '*.apk' -print 2>/dev/null || true
-          echo "=== AAB outputs ==="
-          find app/build/outputs/bundle -name '*.aab' -print 2>/dev/null || true
-
-      - name: Generate stable checksums
-        if: ${{ needs.validate.outputs.prerelease != 'true' }}
-        # Flavor dimension adds an extra path segment to the AGP output layout.
-        # APKs live under `apk/<flavor>/release/`, AABs under `bundle/<flavor>Release/`
-        # (note the concatenated camelCase — AGP path quirk, documented but
-        # different between APK and AAB). Checksums cover EXACTLY the files
-        # attached to the GitHub Release (see the 2-asset policy on the
-        # release step below) so SHA256SUMS.txt matches the assets 1:1.
-        run: |
-          cd app/build/outputs
-          sha256sum apk/sideload/release/*.apk bundle/googlePlayRelease/*.aab > SHA256SUMS.txt
-          cat SHA256SUMS.txt

      - name: Generate candidate checksums
        if: ${{ needs.validate.outputs.prerelease == 'true' }}
@@ -326,9 +345,9 @@ jobs:
          # Deliberate 2-asset policy (#144): attach ONLY the installable
          # sideload APK and Play AAB, plus checksums covering those files.
          files: |
-            app/build/outputs/apk/sideload/release/*.apk
-            app/build/outputs/bundle/googlePlayRelease/*.aab
-            app/build/outputs/SHA256SUMS.txt
+            app/build/preflight-artifacts/*-sideload-release.apk
+            app/build/preflight-artifacts/*-googlePlay-release.aab
+            app/build/preflight-artifacts/SHA256SUMS.txt

      - name: Create candidate GitHub prerelease
        if: ${{ needs.validate.outputs.prerelease == 'true' }}
@@ -350,18 +369,36 @@ jobs:
        run: |
          echo "## Hermes-Relay Android v${{ needs.validate.outputs.version }}" >> "$GITHUB_STEP_SUMMARY"
          echo "" >> "$GITHUB_STEP_SUMMARY"
-          if [ "$PRERELEASE" = "true" ] && [ -n "$HERMES_KEYSTORE_BASE64" ]; then
-            echo "✅ **Release-signed HR Candidate app** — separate package ID; never uploaded to Play" >> "$GITHUB_STEP_SUMMARY"
-          elif [ "$PRERELEASE" = "true" ]; then
-            echo "⚠️ **Debug-signed HR Candidate app** — separate package ID; never uploaded to Play" >> "$GITHUB_STEP_SUMMARY"
+          if [ "$PRERELEASE" != "true" ]; then
+            echo "✅ **Published the exact signed Play-preflight artifacts**" >> "$GITHUB_STEP_SUMMARY"
          elif [ -n "$HERMES_KEYSTORE_BASE64" ]; then
-            echo "✅ **Signed with release keystore** — suitable for Play Store upload" >> "$GITHUB_STEP_SUMMARY"
+            echo "✅ **Release-signed HR Candidate app** — separate package ID; never uploaded to Play" >> "$GITHUB_STEP_SUMMARY"
          else
-            echo "⚠️ **Debug-signed** (no \`HERMES_KEYSTORE_BASE64\` secret) — NOT suitable for Play Store. Add the secret in repo settings to enable release signing." >> "$GITHUB_STEP_SUMMARY"
+            echo "⚠️ **Debug-signed HR Candidate app** — separate package ID; never uploaded to Play" >> "$GITHUB_STEP_SUMMARY"
          fi
          echo "" >> "$GITHUB_STEP_SUMMARY"
          echo "### Artifacts" >> "$GITHUB_STEP_SUMMARY"
          echo '```' >> "$GITHUB_STEP_SUMMARY"
+          find app/build/preflight-artifacts -maxdepth 1 -type f -exec ls -la {} + >> "$GITHUB_STEP_SUMMARY" 2>/dev/null || true
          find app/build/outputs/apk -name '*.apk' -exec ls -la {} + >> "$GITHUB_STEP_SUMMARY" 2>/dev/null || true
          find app/build/outputs/bundle -name '*.aab' -exec ls -la {} + >> "$GITHUB_STEP_SUMMARY" 2>/dev/null || true
          echo '```' >> "$GITHUB_STEP_SUMMARY"
+
+  request-backmerge:
+    name: Request stable release backmerge
+    needs: [validate, release]
+    if: needs.validate.outputs.prerelease != 'true'
+    permissions:
+      actions: write
+      contents: read
+    runs-on: ubuntu-latest
+    steps:
+      - name: Dispatch fail-closed release reconciliation
+        env:
+          GH_TOKEN: ${{ github.token }}
+          RELEASE_TAG: android-v${{ needs.validate.outputs.version }}
+        run: |
+          gh workflow run release-backmerge.yml \
+            --repo "$GITHUB_REPOSITORY" \
+            --ref main \
+            -f release_tag="$RELEASE_TAG"
@@ -0,0 +1,267 @@
+# Reconcile a completed stable hotfix into dev without adding a ceremonial PR
+# merge commit. Normal dev -> main releases are detected and intentionally no-op.
+# A conflicted merge, failed exact-tree CI, stale dev ref, or denied branch update
+# stops without mutating dev and falls back to the normal reconciliation PR path.
+
+name: Release Backmerge
+
+on:
+  workflow_dispatch:
+    inputs:
+      release_tag:
+        description: "Published stable tag to reconcile (android-v*, server-v*, or desktop-v*)"
+        required: true
+        type: string
+
+permissions:
+  contents: read
+
+concurrency:
+  group: release-backmerge-dev
+  cancel-in-progress: false
+
+jobs:
+  prepare:
+    name: Prepare exact backmerge candidate
+    permissions:
+      contents: write
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    outputs:
+      outcome: ${{ steps.prepare.outputs.outcome }}
+      base_dev_sha: ${{ steps.prepare.outputs.base_dev_sha }}
+      candidate_branch: ${{ steps.prepare.outputs.candidate_branch }}
+      candidate_sha: ${{ steps.prepare.outputs.candidate_sha }}
+      release_commit: ${{ steps.prepare.outputs.release_commit }}
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+          ref: main
+
+      - name: Validate release and prepare merge commit
+        id: prepare
+        env:
+          GH_TOKEN: ${{ github.token }}
+          RELEASE_TAG: ${{ inputs.release_tag }}
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          if [[ ! "$RELEASE_TAG" =~ ^(android|server|desktop)-v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+            echo "::error::Release Backmerge accepts stable SemVer production tags only; got $RELEASE_TAG"
+            exit 1
+          fi
+
+          git fetch origin \
+            "+refs/heads/main:refs/remotes/origin/main" \
+            "+refs/heads/dev:refs/remotes/origin/dev" \
+            "+refs/tags/${RELEASE_TAG}:refs/tags/${RELEASE_TAG}"
+          release_commit="$(git rev-parse "${RELEASE_TAG}^{commit}")"
+          base_dev_sha="$(git rev-parse origin/dev)"
+          echo "release_commit=$release_commit" >> "$GITHUB_OUTPUT"
+          echo "base_dev_sha=$base_dev_sha" >> "$GITHUB_OUTPUT"
+
+          if ! git merge-base --is-ancestor "$release_commit" origin/main; then
+            echo "::error::$RELEASE_TAG ($release_commit) is not contained in origin/main"
+            exit 1
+          fi
+
+          read -r is_draft is_prerelease < <(
+            gh release view "$RELEASE_TAG" --json isDraft,isPrerelease \
+              --jq '[.isDraft, .isPrerelease] | @tsv'
+          )
+          if [ "$is_draft" != "false" ] || [ "$is_prerelease" != "false" ]; then
+            echo "::error::$RELEASE_TAG is not a published stable GitHub release"
+            exit 1
+          fi
+
+          plan="$(
+            python3 scripts/plan_release_backmerge.py \
+              --release-commit "$release_commit" \
+              --dev-commit "$base_dev_sha"
+          )"
+          case "$plan" in
+            already-contained)
+              echo "outcome=noop" >> "$GITHUB_OUTPUT"
+              echo "## Release backmerge not needed" >> "$GITHUB_STEP_SUMMARY"
+              echo "\`$RELEASE_TAG\` is already contained in \`dev\`." >> "$GITHUB_STEP_SUMMARY"
+              exit 0
+              ;;
+            normal-release)
+              echo "outcome=noop" >> "$GITHUB_OUTPUT"
+              echo "## Normal release: no backmerge" >> "$GITHUB_STEP_SUMMARY"
+              echo "The released merge's integration parent is already contained in \`dev\`." >> "$GITHUB_STEP_SUMMARY"
+              exit 0
+              ;;
+            hotfix) ;;
+            *)
+              echo "::error::Unknown release-backmerge plan: $plan"
+              exit 1
+              ;;
+          esac
+
+          candidate_branch="chore/release-backmerge/${RELEASE_TAG}-${GITHUB_RUN_ID}"
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git switch --detach "$base_dev_sha"
+
+          set +e
+          git merge --no-ff -m "chore: back-merge ${RELEASE_TAG}" "$release_commit"
+          merge_status=$?
+          set -e
+          if [ "$merge_status" -ne 0 ]; then
+            conflicts="$(git diff --name-only --diff-filter=U | paste -sd ', ' -)"
+            echo "outcome=conflict" >> "$GITHUB_OUTPUT"
+            echo "::error::Automatic backmerge conflicts: ${conflicts:-unknown}. Open a reconciliation PR."
+            echo "## Manual reconciliation PR required" >> "$GITHUB_STEP_SUMMARY"
+            echo "\`$RELEASE_TAG\` conflicts with current \`dev\`: ${conflicts:-unknown}." >> "$GITHUB_STEP_SUMMARY"
+            git merge --abort || true
+            exit 1
+          fi
+
+          candidate_sha="$(git rev-parse HEAD)"
+          first_parent="$(git rev-parse HEAD^1)"
+          second_parent="$(git rev-parse HEAD^2)"
+          if [ "$first_parent" != "$base_dev_sha" ] || [ "$second_parent" != "$release_commit" ]; then
+            echo "::error::Candidate parents do not match dev + release commit"
+            exit 1
+          fi
+
+          git push origin "$candidate_sha:refs/heads/$candidate_branch"
+          echo "outcome=candidate" >> "$GITHUB_OUTPUT"
+          echo "candidate_branch=$candidate_branch" >> "$GITHUB_OUTPUT"
+          echo "candidate_sha=$candidate_sha" >> "$GITHUB_OUTPUT"
+
+          echo "## Backmerge candidate prepared" >> "$GITHUB_STEP_SUMMARY"
+          echo "- Release: \`$RELEASE_TAG\` (\`$release_commit\`)" >> "$GITHUB_STEP_SUMMARY"
+          echo "- Dev base: \`$base_dev_sha\`" >> "$GITHUB_STEP_SUMMARY"
+          echo "- Candidate: \`$candidate_sha\`" >> "$GITHUB_STEP_SUMMARY"
+          echo "- Temporary ref: \`$candidate_branch\`" >> "$GITHUB_STEP_SUMMARY"
+
+  gate:
+    name: Run exact-tree required checks
+    needs: prepare
+    if: needs.prepare.outputs.outcome == 'candidate'
+    permissions:
+      actions: write
+      contents: read
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+    outputs:
+      check_run_id: ${{ steps.gate.outputs.check_run_id }}
+    steps:
+      - name: Dispatch and await Required checks
+        id: gate
+        env:
+          GH_TOKEN: ${{ github.token }}
+          BASE_DEV_SHA: ${{ needs.prepare.outputs.base_dev_sha }}
+          CANDIDATE_BRANCH: ${{ needs.prepare.outputs.candidate_branch }}
+          CANDIDATE_SHA: ${{ needs.prepare.outputs.candidate_sha }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          gh workflow run ci-required.yml \
+            --repo "$GITHUB_REPOSITORY" \
+            --ref "$CANDIDATE_BRANCH" \
+            -f base_sha="$BASE_DEV_SHA" \
+            -f head_sha="$CANDIDATE_SHA"
+
+          check_run_id=""
+          for _ in {1..20}; do
+            check_run_id="$(
+              gh run list \
+                --repo "$GITHUB_REPOSITORY" \
+                --workflow ci-required.yml \
+                --branch "$CANDIDATE_BRANCH" \
+                --event workflow_dispatch \
+                --limit 20 \
+                --json databaseId,headSha \
+                --jq ".[] | select(.headSha == \"$CANDIDATE_SHA\") | .databaseId" \
+                | head -n 1
+            )"
+            if [ -n "$check_run_id" ]; then
+              break
+            fi
+            sleep 3
+          done
+          if [ -z "$check_run_id" ]; then
+            echo "::error::Required checks dispatch was not observed for $CANDIDATE_SHA"
+            exit 1
+          fi
+
+          echo "check_run_id=$check_run_id" >> "$GITHUB_OUTPUT"
+          gh run watch "$check_run_id" --repo "$GITHUB_REPOSITORY" --exit-status
+
+  promote:
+    name: Compare-and-swap dev
+    needs: [prepare, gate]
+    if: needs.prepare.outputs.outcome == 'candidate' && needs.gate.result == 'success'
+    permissions:
+      contents: write
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+          ref: main
+
+      - name: Fast-forward dev to the tested candidate
+        env:
+          BASE_DEV_SHA: ${{ needs.prepare.outputs.base_dev_sha }}
+          CANDIDATE_BRANCH: ${{ needs.prepare.outputs.candidate_branch }}
+          CANDIDATE_SHA: ${{ needs.prepare.outputs.candidate_sha }}
+          RELEASE_COMMIT: ${{ needs.prepare.outputs.release_commit }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          git fetch origin --no-tags \
+            "+refs/heads/dev:refs/remotes/origin/dev" \
+            "+refs/heads/$CANDIDATE_BRANCH:refs/remotes/origin/$CANDIDATE_BRANCH"
+          current_dev="$(git rev-parse origin/dev)"
+          remote_candidate="$(git rev-parse "origin/$CANDIDATE_BRANCH")"
+
+          if [ "$current_dev" != "$BASE_DEV_SHA" ]; then
+            echo "::error::dev moved from $BASE_DEV_SHA to $current_dev; rerun or open a reconciliation PR"
+            exit 1
+          fi
+          if [ "$remote_candidate" != "$CANDIDATE_SHA" ]; then
+            echo "::error::Candidate ref moved from $CANDIDATE_SHA to $remote_candidate"
+            exit 1
+          fi
+          if [ "$(git rev-parse "$CANDIDATE_SHA^1")" != "$BASE_DEV_SHA" ] || \
+             [ "$(git rev-parse "$CANDIDATE_SHA^2")" != "$RELEASE_COMMIT" ]; then
+            echo "::error::Candidate ancestry changed after verification"
+            exit 1
+          fi
+
+          # The explicit lease is the atomic stale-base guard. The update is a
+          # fast-forward from BASE_DEV_SHA; no unrelated history can be replaced.
+          git push \
+            --force-with-lease="refs/heads/dev:$BASE_DEV_SHA" \
+            origin "$CANDIDATE_SHA:refs/heads/dev"
+
+          git push origin --delete "$CANDIDATE_BRANCH" || \
+            echo "::warning::Could not remove temporary branch $CANDIDATE_BRANCH"
+
+          echo "## Release backmerge complete" >> "$GITHUB_STEP_SUMMARY"
+          echo "Fast-forwarded \`dev\` from \`$BASE_DEV_SHA\` to tested merge \`$CANDIDATE_SHA\`." >> "$GITHUB_STEP_SUMMARY"
+
+  fallback:
+    name: Report PR fallback
+    needs: [prepare, gate, promote]
+    if: always() && needs.prepare.outputs.outcome == 'candidate' && needs.promote.result != 'success'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Preserve safe fallback instructions
+        env:
+          CANDIDATE_BRANCH: ${{ needs.prepare.outputs.candidate_branch }}
+          CANDIDATE_SHA: ${{ needs.prepare.outputs.candidate_sha }}
+          CHECK_RUN_ID: ${{ needs.gate.outputs.check_run_id }}
+        run: |
+          echo "## Automatic backmerge stopped" >> "$GITHUB_STEP_SUMMARY"
+          echo "\`dev\` was not updated. Open or refresh a reconciliation PR after addressing the failed/stale gate." >> "$GITHUB_STEP_SUMMARY"
+          echo "- Candidate ref: \`${CANDIDATE_BRANCH:-not-created}\`" >> "$GITHUB_STEP_SUMMARY"
+          echo "- Candidate SHA: \`${CANDIDATE_SHA:-n/a}\`" >> "$GITHUB_STEP_SUMMARY"
+          echo "- Required-check run: \`${CHECK_RUN_ID:-n/a}\`" >> "$GITHUB_STEP_SUMMARY"
@@ -3,6 +3,12 @@ name: Hermes-Relay CLI+UI Release
 on:
  push:
    tags: ['desktop-v*']
+  workflow_dispatch:
+    inputs:
+      version:
+        description: "Approved CLI+UI version"
+        required: true
+        type: string

 permissions:
  contents: write
@@ -20,6 +26,7 @@ jobs:
      - uses: actions/checkout@v7
        with:
          fetch-depth: 0
+          ref: ${{ github.event_name == 'workflow_dispatch' && format('desktop-v{0}', inputs.version) || github.ref }}

      - name: Setup Node.js
        uses: actions/setup-node@v7
@@ -34,10 +41,16 @@ jobs:
      - name: Extract and validate tag version
        id: version
        shell: bash
+        env:
+          DISPATCHED_VERSION: ${{ inputs.version }}
        run: |
          set -euo pipefail
-          version="${GITHUB_REF_NAME#desktop-v}"
-          if [[ -z "$version" || "$version" == "$GITHUB_REF_NAME" ]]; then
+          if [ -n "$DISPATCHED_VERSION" ]; then
+            version="$DISPATCHED_VERSION"
+          else
+            version="${GITHUB_REF_NAME#desktop-v}"
+          fi
+          if [ -z "$version" ] || { [ -z "$DISPATCHED_VERSION" ] && [ "$version" = "$GITHUB_REF_NAME" ]; }; then
            echo "Expected a desktop-v* tag, got $GITHUB_REF_NAME" >&2
            exit 1
          fi
@@ -51,11 +64,12 @@ jobs:
      - name: Verify tag belongs to the correct integration branch
        shell: bash
        working-directory: .
+        env:
+          TAG_VERSION: ${{ steps.version.outputs.version }}
        run: |
          set -euo pipefail
-          version="${GITHUB_REF_NAME#desktop-v}"
-          tag_commit="$(git rev-parse "${GITHUB_REF_NAME}^{commit}")"
-          if [[ "$version" == *-* ]]; then
+          tag_commit="$(git rev-parse HEAD)"
+          if [[ "$TAG_VERSION" == *-* ]]; then
            git fetch origin dev --no-tags
            if ! git merge-base --is-ancestor "$tag_commit" origin/dev; then
              echo "CLI+UI prereleases must be tagged from dev; $tag_commit is not in origin/dev" >&2
@@ -78,6 +92,8 @@ jobs:
        working-directory: desktop
    steps:
      - uses: actions/checkout@v7
+        with:
+          ref: ${{ github.event_name == 'workflow_dispatch' && format('desktop-v{0}', inputs.version) || github.ref }}

      - name: Setup Node.js (for npm ci + tsc)
        uses: actions/setup-node@v7
@@ -271,6 +287,8 @@ jobs:
        working-directory: desktop
    steps:
      - uses: actions/checkout@v7
+        with:
+          ref: ${{ github.event_name == 'workflow_dispatch' && format('desktop-v{0}', inputs.version) || github.ref }}

      - name: Setup Node.js
        uses: actions/setup-node@v7
@@ -289,6 +307,18 @@ jobs:
      - name: Setup Rust
        uses: dtolnay/rust-toolchain@stable

+      - name: Restore exact-source tray build cache
+        uses: actions/cache@v6
+        with:
+          path: |
+            ~/.cargo/registry/index
+            ~/.cargo/registry/cache
+            ~/.cargo/git/db
+            desktop/tray/target
+          key: ${{ runner.os }}-tray-rust-${{ hashFiles('desktop/tray/Cargo.lock') }}-${{ hashFiles('desktop/tray/Cargo.toml', 'desktop/tray/build.rs', 'desktop/tray/src/**/*.rs') }}
+          restore-keys: |
+            ${{ runner.os }}-tray-rust-${{ hashFiles('desktop/tray/Cargo.lock') }}-
+
      - name: Install deps
        run: npm ci && npm --prefix tray ci

@@ -411,6 +441,11 @@ jobs:
            if ($versionOutput -ne "hermes-relay $env:EXPECTED_DESKTOP_VERSION") {
              throw "installed CLI version mismatch: expected $env:EXPECTED_DESKTOP_VERSION, got '$versionOutput'"
            }
+            $tray = Join-Path $installDir 'hermes-relay-tray.exe'
+            $trayVersion = (Get-Item -LiteralPath $tray).VersionInfo.ProductVersion
+            if ($trayVersion -ne $env:EXPECTED_DESKTOP_VERSION) {
+              throw "installed UI version mismatch: expected $env:EXPECTED_DESKTOP_VERSION, got '$trayVersion'"
+            }
            $helpOutput = (& $cli --help | Out-String)
            if ($LASTEXITCODE -ne 0 -or $helpOutput -notmatch 'Usage:') {
              throw 'installed CLI --help smoke failed'
@@ -451,7 +486,7 @@ jobs:
              throw "installer lifecycle changed the pre-existing tray startup preference"
            }

-            Write-Host "packaged installer lifecycle smoke OK version=$versionOutput install=$installDir"
+            Write-Host "packaged installer lifecycle smoke OK cli=$versionOutput ui=$trayVersion install=$installDir"
          } finally {
            Get-Process -Name 'hermes-relay-tray' -ErrorAction SilentlyContinue |
              Stop-Process -Force -ErrorAction SilentlyContinue
@@ -483,6 +518,7 @@ jobs:
    name: Publish GitHub Release
    runs-on: ubuntu-latest
    needs:
+      - validate-release
      - build-cli-binaries
      - smoke-windows-cli-release-asset
      - smoke-macos-cli-release-asset
@@ -492,10 +528,8 @@ jobs:
      # Needed so CLI_RELEASE_NOTES.md is available to render into the release body
      # (the other publish-release steps only consume downloaded build artifacts).
      - uses: actions/checkout@v7
-
-      - name: Extract CLI+UI version
-        id: version
-        run: echo "version=${GITHUB_REF_NAME#desktop-v}" >> "$GITHUB_OUTPUT"
+        with:
+          ref: ${{ github.event_name == 'workflow_dispatch' && format('desktop-v{0}', inputs.version) || github.ref }}

      - uses: actions/download-artifact@v8
        with:
@@ -515,8 +549,8 @@ jobs:
      # (desktop-v0.3.0) so install/pin commands stay accurate without manual edits.
      - name: Render release notes
        env:
-          VERSION: ${{ steps.version.outputs.version }}
-          TAG: ${{ github.ref_name }}
+          VERSION: ${{ needs.validate-release.outputs.version }}
+          TAG: desktop-v${{ needs.validate-release.outputs.version }}
        run: |
          sed -e "s/__VERSION__/${VERSION}/g" -e "s/__TAG__/${TAG}/g" \
            CLI_RELEASE_NOTES.md > cli_release_notes_rendered.md
@@ -525,10 +559,10 @@ jobs:
      - name: Publish GitHub Release
        uses: softprops/action-gh-release@v3
        with:
-          name: Hermes-Relay CLI+UI v${{ steps.version.outputs.version }}
-          tag_name: ${{ github.ref_name }}
+          name: Hermes-Relay CLI+UI v${{ needs.validate-release.outputs.version }}
+          tag_name: desktop-v${{ needs.validate-release.outputs.version }}
          draft: false
-          prerelease: ${{ contains(steps.version.outputs.version, 'alpha') || contains(steps.version.outputs.version, 'beta') || contains(steps.version.outputs.version, 'rc') }}
+          prerelease: ${{ contains(needs.validate-release.outputs.version, '-') }}
          fail_on_unmatched_files: true
          body_path: cli_release_notes_rendered.md
          files: |
@@ -539,3 +573,22 @@ jobs:
            release-assets/cli-binaries/hermes-relay-darwin-arm64
            release-assets/cli-windows-installer/hermes-relay-windows-x64-setup.exe
            release-assets/SHA256SUMS.txt
+
+  request-backmerge:
+    name: Request stable release backmerge
+    needs: [validate-release, publish-release]
+    if: ${{ !contains(needs.validate-release.outputs.version, '-') }}
+    permissions:
+      actions: write
+      contents: read
+    runs-on: ubuntu-latest
+    steps:
+      - name: Dispatch fail-closed release reconciliation
+        env:
+          GH_TOKEN: ${{ github.token }}
+          RELEASE_TAG: desktop-v${{ needs.validate-release.outputs.version }}
+        run: |
+          gh workflow run release-backmerge.yml \
+            --repo "$GITHUB_REPOSITORY" \
+            --ref main \
+            -f release_tag="$RELEASE_TAG"
@@ -4,6 +4,12 @@ on:
  push:
    tags:
      - "server-v*"
+  workflow_dispatch:
+    inputs:
+      version:
+        description: "Approved Plugin version"
+        required: true
+        type: string

 permissions:
  contents: write
@@ -19,10 +25,19 @@ jobs:
      - uses: actions/checkout@v7
        with:
          fetch-depth: 0
+          ref: ${{ github.event_name == 'workflow_dispatch' && format('server-v{0}', inputs.version) || github.ref }}

      - name: Extract version from tag
        id: version
-        run: echo "version=${GITHUB_REF#refs/tags/server-v}" >> "$GITHUB_OUTPUT"
+        env:
+          DISPATCHED_VERSION: ${{ inputs.version }}
+        run: |
+          if [ -n "$DISPATCHED_VERSION" ]; then
+            version="$DISPATCHED_VERSION"
+          else
+            version="${GITHUB_REF#refs/tags/server-v}"
+          fi
+          echo "version=$version" >> "$GITHUB_OUTPUT"

      - name: Verify Plugin version sync and changelog
        run: |
@@ -61,6 +76,8 @@ jobs:
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@v7
+        with:
+          ref: ${{ github.event_name == 'workflow_dispatch' && format('server-v{0}', inputs.version) || github.ref }}

      - name: Set up Python 3.11
        uses: actions/setup-python@v7
@@ -85,11 +102,16 @@ jobs:
      - name: Run focused Plugin tests
        run: |
          python -m pytest \
+            plugin/tests/test_manifest_compatibility.py \
            plugin/tests/test_relay_security.py \
            plugin/tests/test_voice_routes.py \
            plugin/tests/test_session_grants.py \
            plugin/tests/test_proactive_channel.py \
-            plugin/tests/test_android_phone_status.py
+            plugin/tests/test_android_phone_status.py \
+            plugin/tests/test_android_tool.py \
+            plugin/tests/test_android_navigate.py \
+            plugin/tests/test_phone_platform.py \
+            plugin/tests/test_desktop_tool_availability.py

  package:
    name: Build and publish Plugin package
@@ -98,6 +120,8 @@ jobs:
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@v7
+        with:
+          ref: ${{ github.event_name == 'workflow_dispatch' && format('server-v{0}', inputs.version) || github.ref }}

      - name: Set up Python 3.11
        uses: actions/setup-python@v7
@@ -138,3 +162,22 @@ jobs:
            dist/*.whl
            dist/*.tar.gz
            dist/SHA256SUMS.txt
+
+  request-backmerge:
+    name: Request stable release backmerge
+    needs: [validate, package]
+    if: ${{ !contains(needs.validate.outputs.version, '-') }}
+    permissions:
+      actions: write
+      contents: read
+    runs-on: ubuntu-latest
+    steps:
+      - name: Dispatch fail-closed release reconciliation
+        env:
+          GH_TOKEN: ${{ github.token }}
+          RELEASE_TAG: server-v${{ needs.validate.outputs.version }}
+        run: |
+          gh workflow run release-backmerge.yml \
+            --repo "$GITHUB_REPOSITORY" \
+            --ref main \
+            -f release_tag="$RELEASE_TAG"
@@ -83,7 +83,7 @@ jobs:
        run: test "$(git rev-parse HEAD)" = "$EXPECTED_SHA"

      - name: Set up JDK 17
-        uses: actions/setup-java@v5
+        uses: actions/setup-java@v6
        with:
          distribution: temurin
          java-version: 17
@@ -24,10 +24,7 @@ Thumbs.db
 local.properties
 /build/
 /app/build/
-/relay-core/build/
-/relay-ui/build/
-/ui-preview/build/
-/quest/build/
+/experiments/quest/**/build/
 /app/release/
 *.apk
 *.aab
@@ -7,14 +7,17 @@ coding agent (Claude Code, Codex, Cursor, etc.).

 This file is the provider-neutral canonical agent context. Read it before
 touching code, then `docs/spec.md` and `docs/decisions.md`. Provider adapters
-such as **[CLAUDE.md](CLAUDE.md)** may add tool-specific guidance, but they do
-not redefine the branch, release, or hotfix policy here and in `RELEASE.md`.
+such as **[CLAUDE.md](CLAUDE.md)** import this file instead of duplicating
+policy. They do not redefine the branch, release, hotfix, or verification
+contract here and in `RELEASE.md`.

 - Release process → **[RELEASE.md](RELEASE.md)**
 - Contributor setup → **[CONTRIBUTING.md](CONTRIBUTING.md)**
 - Gateway/session/reconnect testing → **[docs/gateway-contract-testing.md](docs/gateway-contract-testing.md)**
+- Android local/cloud verification → **[docs/android-build-lane.md](docs/android-build-lane.md)**
+- Android emulator lanes → **[docs/android-emulator-testing.md](docs/android-emulator-testing.md)** — suggest the smallest relevant API 36 lanes; never run the full matrix automatically
 - `android_*` toolset + MCP → **[docs/mcp-tooling.md](docs/mcp-tooling.md)**
- Follow-ups / deferred work / known gaps → **[TODO.md](TODO.md)** (the single home for "what's next" — never DEVLOG, never scattered code comments)
+- Follow-ups / deferred work / known gaps → **[docs/project/TODO.md](docs/project/TODO.md)** (the single home for "what's next" — never DEVLOG, never scattered code comments)

 ## Branch contract

@@ -28,7 +31,7 @@ not redefine the branch, release, or hotfix policy here and in `RELEASE.md`.
 | Staging source | An exact tested `dev` SHA or release-candidate tag; staging is an environment, never a branch |
 | Production source | Immutable `android-v*`, `server-v*`, or `desktop-v*` tags, selected by surface |
 | Hotfix base | The immutable production tag for the affected surface |
-| Back-merge target | `dev`; merge `main` back immediately after every hotfix |
+| Back-merge target | `dev`; stable hotfixes reconcile automatically when the exact tested merge is conflict-free, otherwise through a PR |

 Feature completion means merged and verified on `dev`; it does not mean
 released. A release train is separate work owned by a Forge release
@@ -37,6 +40,14 @@ open the `dev` → `main` release PR, tag the resulting `main` tip, publish the
 surface artifacts, deploy or roll out, and verify the live result. Never create
 a staging branch.

+A normal `dev` → `main` release needs no back-merge: the released integration
+parent is already in `dev`. A production-tag hotfix is different. After its
+stable release succeeds, `Release Backmerge` prepares a `dev`-first merge
+commit, runs the same path-aware required checks on that exact SHA, verifies
+that `dev` has not moved, and fast-forwards `dev`. Conflicts, failed checks,
+stale refs, or denied branch updates fail closed and require a reconciliation
+PR; never resolve those cases by choosing a side automatically.
+
 ### Local integration discipline

 - Fetch `origin/dev` before creating a task branch or worktree; do not base new
@@ -54,8 +65,10 @@ a staging branch.

 - **Vanilla Hermes path = upstream-only.** The standard (no-plugin) connection
  uses the upstream Dashboard/Gateway for chat, authentication, Manage, sessions,
-  and Vanilla Hermes voice. The API server is an optional automatic fallback and
-  advanced headless-compatibility surface; Relay adds optional extensions. This
+  and Vanilla Hermes voice. The API server is an explicit API-only/headless
+  compatibility surface; Relay adds optional extensions. A Gateway-owned
+  conversation never changes transport because Gateway auth or reachability
+  changes. This
  path must work against unmodified upstream hermes-agent. Server-side needs go
  through upstream PRs or the optional relay plugin, never fork patches.
 - **Verify endpoints against upstream** (`gateway/platforms/api_server.py` /
@@ -75,11 +88,21 @@ a staging branch.
  Version bumps happen only on a release-prep branch targeting `dev`, and
  production tags are cut only from `main`.
 - **Android:** Jetpack Compose only (no XML), kotlinx.serialization (no Gson),
-  OkHttp (no Ktor), `wss://` only. Run `./gradlew lint` before pushing Kotlin.
+  OkHttp (no Ktor), `wss://` only. While editing, use only the narrow local
+  compile or focused test needed for feedback, through `scripts/android-lane.ps1`
+  on Windows. Once an exact commit is already pushed, prefer the `Android
+  On-Demand` workflow for lint, the focused shards, both-flavor assemblies, and
+  release smoke; isolated cloud jobs may run concurrently. Do not push solely
+  to obtain cloud compute without push authorization, and do not duplicate a
+  preset already running for the same SHA. Full local verification remains
+  available through `scripts/dev.bat prepush` (or `./scripts/dev.sh prepush`)
+  when explicitly wanted or when cloud execution is unavailable.
+  Physical-device checks and APK installation remain separately owned local
+  evidence.
 - **Plugin (Python 3.11+):** aiohttp + asyncio (no threading), type hints
  everywhere, structured `logging` (no `print`). **Desktop CLI (Node ≥21):**
-  zero runtime deps, strict TS + ES modules, ship compiled `dist/`. Full
-  per-language style and the dev loop live in CLAUDE.md → "Code Style".
+  zero runtime deps, strict TS + ES modules, ship compiled `dist/`. Contributor
+  commands and the development loop live in `CONTRIBUTING.md`.

 ## Review guidelines

@@ -94,6 +117,40 @@ a staging branch.
 - Prioritize findings that warrant holding the merge. State the impacted path
  and the concrete failure mode.

+## Automated public issue triage
+
+New public issues may receive one clearly labeled **Hermes-Relay automated
+triage** reply. That first response may classify the report with existing
+type/area labels, point to related issues or current code/docs, ask for safe
+sanitized diagnostics, and flag the thread for maintainer review.
+
+GitHub attributes that reply to the repository-scoped
+`hermes-relay-triage[bot]` App, never to a maintainer's personal account.
+
+The automated lane may assign only the fixed maintainer account `Codename-11`
+as follow-up ownership; that assignment does not imply acceptance, priority,
+implementation, or a release commitment. It never closes, milestones,
+prioritizes, promises a fix/release/timeline, chooses another assignee, or
+continues replying after its first response. A related issue is not
+automatically a duplicate. Human maintainer comments and decisions remain
+authoritative; read the complete live thread before acting on an issue.
+
+## Automated public PR intake
+
+New external-contributor, non-draft pull requests may receive one clearly
+labeled **Hermes-Relay automated PR intake** reply from
+`hermes-relay-triage[bot]`. Owner-authored `Codename-11` PRs and bot PRs are
+dropped before model dispatch. For eligible PRs, the intake compares the live PR
+metadata/body and changed-path list with trusted `origin/dev` policy and
+`.github/pull_request_template.md` without checking out or executing contributor
+code. It may add genuine area labels plus `documentation`, `ci`, or
+`needs-maintainer-review` and point out missing intake evidence.
+
+The automated lane never approves, requests changes, merges, closes, assigns,
+requests reviewers, milestones, prioritizes, pushes commits, edits PR text,
+reruns workflows, applies `review-candidate`, or claims code correctness. Human
+maintainer review and CI remain authoritative.
+
 ## Public-repo writing hygiene

 Everything committed is public. In CHANGELOG, DEVLOG, README, docs, and release
@@ -6,8 +6,197 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/), and this

 ## [Unreleased]

+### Added
+
+- Provider usage shows Grok subscription periods, product usage, and on-demand credit state for hosts signed in with `xai-oauth`. Android shows SuperGrok by default when no provider visibility choice is saved.
+- Guided Secure Link setup in Dashboard and the Desktop Relay pane, with shared read-only host CLI checks, restart instructions, and signed pairing handoff.
+
 ### Fixed

+- Desktop tray notices, screenshot evidence, and grant prompts stay reusable after dismissal; screenshot evidence keeps the most recently selected image. (#606)
+- Proactive phone Thread messages render relay-token and host-path media as attachments while preserving multiline text; notification previews omit media markers. (#485)
+- Desktop computer screenshots attach validated image bytes to the host tool result instead of returning base64 as plain text.
+- Relay-owned media uploads are removed on token expiry, eviction, and shutdown; media activity logs omit tokens, file paths, and screenshot bytes.
+- Plugin screenshot and navigation tools resolve Android's authenticated media token, attach the actual bounded image to host vision, and keep legacy inline screenshots readable. (#593)
+- Android Chat can open the model picker before the first turn, loads Gateway models when opened, and distinguishes loading, unavailable, and empty catalogs.
+- Secure Link configuration failures leave ordinary Relay available; route details and pairing previews resolve the advertised service namespaces.
+- Dashboard pairing QR codes support larger certificate-bearing Secure Link invites.
+- Secure Link preserves Gateway ticket authentication and Dashboard login paths, bounds rewritten responses, and serves compatible health information without additional loopback probes.
+- Android Secure Link enforces the paired certificate pin for HTTP, Gateway, and voice traffic, retains the correct TLS policy during Gateway route changes, and displays the active HTTPS Dashboard route.
+- Android cold start restores the saved Appearance palette and platform light/dark mode before the first app frame.
+- Android Gateway onboarding verifies Dashboard access without overstating Chat or voice readiness, explains common authentication setup failures, and requires exact-address consent before using HTTP. Custom Dashboard ports are accepted and shown throughout setup and route editing. (#604)
+- Android safely settles Gateway foreground-service starts before stopping local retention, preventing the startup/shutdown race reported in #603. Turning off always-on connectivity preserves active turns.
+- Android Standard Voice speaks live background completions in its active conversation after the original reply finishes. Stop and conversation changes discard pending speech. (#545)
+
+## [Android 1.17.0] - 2026-09-13
+
+### Added
+
+- Optional voice controls over other apps in Google Play, with contextual permission setup, a persistent Stop voice notification, and session shutdown on screen lock or permission loss. Phone control remains sideload-only.
+
+### Fixed
+
+- Android shows standalone response cards without an outer bubble, uses subtler assistant surfaces, and places delivery status beside message timestamps.
+- Android answers upstream Clarify batches one question at a time, with independent choices, custom answers, and confirmed progress preserved across reconnects. (#474)
+- Android context previews mark phone status and turn context as unavailable in Gateway chats instead of claiming they are sent. Settings clarify that automatic phone-status sharing applies to API-only chats. (#556)
+- Android shows Hermes profile display names and groups the resolved server default under its agent identity, while preserving explicit profile selection and saved conversations.
+
+## [Plugin 1.11.3] - 2026-09-13
+
+### Fixed
+
+- Relay Dashboard WebSockets work with current Hermes authentication helpers while preserving older-host compatibility, single-use tickets, Host/Origin/IP checks, and Relay session authentication.
+
+## [Android 1.16.1] - 2026-09-12
+
+### Fixed
+
+- Android Dashboard-only connections start the profile-scoped session directory before Gateway readiness, so a cold launch no longer leaves both the directory and passive Gateway socket waiting on each other. (#495, #528)
+
+## [Android 1.16.0] - 2026-09-10
+
+### Fixed
+
+- Android no longer crashes when a route probe finishes while a network change invalidates the endpoint cache.
+- Android opens an authenticated Gateway chat on the first foreground launch instead of waiting for a background-and-resume cycle to leave the waking state. (#495, #528)
+- Android Dashboard sign-in removes pasted line breaks from username and password fields, matching the browser login while preserving every other credential character. (#541)
+- Android keeps saved Dashboard sign-ins bound to their connection when switching gateways, rather than letting a stale resolver route invalidate another connection's session.
+- Bot Mode no longer crashes when different connections have bots with the same profile name. Both the conversation list and Active Now strip preserve each bot's connection, and opening progress appears only on the selected bot.
+- Android feedback uses themed banners and action cards instead of platform toasts and default snackbars. Dashboard errors no longer misidentify missing resources as an outdated Relay. Developer settings includes local-only message previews.
+- Missing chat attachments show their error and retry in the attachment card without repeated global popups. Global action messages occupy the top message area instead of covering the composer.
+- Chat distinguishes session preparation from response streaming and retains initialization errors that arrive before the session acknowledgement. Long-press the agent header to open a live session-diagnostics drawer.
+- Delegated-agent activity survives parent replies and leaves compact history entries for later read-only review. The activity strip appears only while work runs; historical process views cannot stop or dismiss live work. (#447)
+
+## [Plugin 1.11.2] - 2026-09-10
+
+### Fixed
+
+- **Relay tool availability avoids repeated Windows loopback delays and preserves multi-PC capabilities.** Host-local Android, Desktop, and Phone paths use explicit IPv4 loopback, while Desktop checks share a bounded health snapshot that preserves per-client advertisements and fails closed when Hermes-Relay is unavailable. (#562, #563)
+- **`android_*` tools resolve bridge credentials written after host startup.** Requests retry profile-scoped env and active bridge-session credentials after a stale token is rejected, and vision navigation now shares the same current Relay transport instead of the retired standalone default.
+- **`android_setup` accepts both its canonical and legacy schema keys.** `bridge_session_token` and `pairing_code` are accepted, while a missing token returns a structured error.
+- **Android tool setup tests use a temporary Hermes home.** Test runs no longer write bridge settings into a developer environment.
+
+## [Android 1.15.1] - 2026-09-02
+
+### Changed
+
+- Chat and Bot Chat offer a compact Correct now / Queue next tray behind the composer. Chat settings sets the default; each message can override it. Stop pauses pending work until Resume, and editing or removing queued messages preserves the remaining order.
+- Wider Chat and Voice layouts keep text and controls centered and readable, including landscape Voice Focus.
+
+### Fixed
+
+- Delivery and correction labels remain readable inside user-message bubbles.
+- Voice errors use a scrollable dialog with separate Retry and Dismiss actions.
+- Attachment previews stay open through rotation, and videos retain their original proportions. (#483)
+- Release builds preserve the native configuration names required for wake-word startup. (#444)
+- Standard Hermes attachments stream to disk while enforcing download size limits. (#531)
+- Session refresh no longer sustains a request loop. History loads, chat rendering, image previews, and media exports keep memory use bounded.
+- Image-generation progress remains visible between interim replies and media delivery.
+- New Gateway chats wait for session readiness before the first prompt; ownership refusals preserve the retryable prompt and server error.
+
+## [0.4.0-beta.7] - 2026-09-02
+
+### Fixed
+
+- Windows updates detect a colocated management UI, report both installed versions, and update the CLI and UI together through the verified bundle installer. CLI-only installations keep their standalone updater.
+
+## [Android 1.15.0] - 2026-08-31
+
+### Changed
+
+- **Android prefers current upstream Hermes for standard media, Git, usage, and notices.** Authenticated Dashboard file delivery, current-session `/api/git/*`, Gateway `usage.bars`, and keyed agent notices work without the optional Hermes-Relay Plugin; Relay remains additive for older-host media compatibility, sensitivity metadata, repository discovery and guarded mutations, multi-provider usage, and true Relay tools.
+- **Android Settings separates standard Hermes from Relay tools.** Media now sits with Chat and Voice under Hermes, while proactive Threads, Terminal, Notification Companion, Relay sessions, and Device Control remain clearly grouped behind the optional plugin.
+- **Android Supervised Mode uses app-specific parent access.** Parents choose a six-digit PIN or password, receive a shareable six-word recovery phrase, and can remove the credential without losing their supervised profile, capability, appearance, visibility, session, or relock settings. Android device credentials and biometrics no longer grant parent access.
+- **Android What's New now provides a readable, complete release record.** One overall title and summary lead into selected highlights, every remaining user-visible addition, improvement, and fix, and relevant compatibility boundaries. Toast counts and previews are derived from that same inventory, so View all no longer promises details the expanded dialog and history cannot show.
+
+### Fixed
+
+- **Standard Hermes attachments no longer demand Relay pairing.** Host-local images, audio, video, and files download through the authenticated Dashboard, stay loaded across history reconciliation, and fall back to one neutral compatibility card on older hosts instead of flashing `Relay URL not configured` or retrying indefinitely.
+- **Removing optional Relay does not strand Standard voice or leak preferences across connections.** Runtime fallback keeps Dashboard voice usable, preserves configured choices through temporary outages, and normalizes only connection-scoped named-profile settings after explicit Relay removal.
+- **Passively observed Desktop/TUI turns now show live activity in the Android session drawer.** A uniquely matched selected session projects Working or Waiting without Android resuming, activating, or interrupting the external runtime; ambiguous cross-profile matches remain neutral. (Related: #365)
+- **Android Chat keeps one transport owner through sign-out and outages.** Dashboard/Gateway conversations now preserve their transcript, draft, profile, and session for sign-in or retry instead of silently sending the next turn to a reachable Direct API database. Legacy API-only connections and explicitly selected Direct API chats remain supported.
+- **Android keeps completed chat text visible when Dashboard sign-in expires.** Generic and reason-coded history `401` responses settle the local turn, preserve its transcript, and surface the existing sign-in recovery without reading another profile's API history.
+- **Android keeps long-running context compaction alive.** A client-visible compaction status extends and refreshes the Gateway turn watchdog instead of interrupting healthy compression after the ordinary idle window. (Supersedes #484.)
+- **Android Bot Chats render loaded history immediately.** Route-owned chat screens observe their own handler state from first composition, including fast history loads that settle before another frame. (Supersedes #453.)
+- **Android Chat settles an owned Gateway turn when its terminal frame is lost.** An exact idle `session.active_list` snapshot now completes the matching local stream, reconciles durable history, and drains its queued follow-up without interrupting or claiming Desktop/TUI work.
+- **Supervised Gateway setup stays parent-owned.** Add Gateway is single-flight and checks live parent authority before allocating a draft, relock/back cancels the exact pending setup, and the locked Chat footer no longer attempts protected navigation.
+- **Generated images stay visible and use their intended Chat animation.** Completed image media survives a marker-lagging history refresh, and both the built-in `image_generate` tool and profile tools ending in `_create_image` use the image-generation presentation.
+
+## [Plugin 1.11.1] - 2026-08-31
+
+### Fixed
+
+- **Hermes-Relay Plugin installs through the native Hermes command again.** The manifest remains fully described for current hosts while avoiding the installer/runtime schema mismatch in affected Hermes releases.
+- **Relay prompt context advertises only real callable phone tools.** Phone-control and cross-platform delivery guidance now follows the exact selected session/profile tool catalog instead of implying unavailable `android_*` or `send_message` capabilities.
+
+## [Android 1.14.0] - 2026-08-30
+
+### Added
+
+- **Android can preview delegated agent work without leaving the parent chat.** The current-chat activity sheet shows bounded lifecycle, progress, and tool previews for concurrent children, opens vanilla Hermes child history read-only when the Gateway exposes it, and stays explicit when reconnect gaps or older routes leave details unavailable. (#447)
+- **Android presents Relay Git as a first-class native workspace.** A compact optional Chat rail opens repository status, line totals, filters, diffs, branches, staging, commits, and remotes; the full workspace remains available from Settings when Chat controls are hidden. An updated optional Hermes-Relay Plugin is required for Git operations.
+
+### Changed
+
+- **Connections now explain and recover each Dashboard, Relay, and optional API route independently.** LAN, Tailscale, and public HTTPS can fail over without allowing an unauthenticated or different-origin Relay route to borrow Dashboard credentials. Protected same-origin Relay health challenges are recognized as authentication boundaries instead of outages. An updated optional Hermes-Relay Plugin is required for same-origin Relay ingress. (Related: #399)
+- **Android What's New leads with one curated release highlight without interrupting startup.** A timed post-update toast can be swiped or closed, previews additional feature/fix counts when a release has meaningful secondary items, expands into the centered highlight view on request, and keeps the full technical history available. Each release can present one plain-language summary, up to three primary benefits, and up to two quieter improvements, while release checks keep the structured entry, fallback, Play copy, and public release records aligned.
+
+### Fixed
+
+- **Android wake-word detection now loads a compatible native ONNX Runtime.** Packaged sherpa and Java JNI consumers are checked against the shared runtime for every supported ABI before release. (#444)
+- **Android Continuous voice waits for barge-in microphone teardown before listening again.** Multi-turn hands-free conversations no longer lose the microphone after a response finishes with barge-in enabled. (#464)
+- **Opening Android no longer claims or interrupts a turn already running in Hermes Desktop/TUI.** Passive foreground and session browsing now use read-only Gateway status plus profile-scoped history; live-session resume remains reserved for explicit Android actions and exact Android-owned recovery. (Related: #365)
+- **Android provisional Threads can be removed without touching server history.** The drawer now offers a local-only removal action, reconciles promoted phone sessions without duplicate rows, and keeps Thread routing isolated to the active saved connection. (#461)
+- **Android Clarify cards make custom answers explicit and keyboard-friendly.** Choice prompts label their Other answer field, submit trimmed text from the keyboard, and do not restore an authoritatively expired prompt after session navigation. (#446)
+- **The visible Android Sphere keeps its smooth procedural motion across startup and chat.** Backgrounded and motion-disabled surfaces remain still without reducing foreground animation to a stepped ambient pulse.
+- **Android Voice Focus keeps Stop and immediate spoken steering available across every interaction mode.** Hold-to-talk now interrupts Thinking and Transcribing turns before capturing the replacement direction, remains operable through TalkBack, Switch Access, and keyboard controls, preserves pointer press-and-release behavior across floating controls, and Google Play no longer offers the sideload-only system overlay action.
+- **Android Assistant sessions explain when no speech was captured instead of appearing stuck at Ready.** Retry feedback survives the separate system overlay process, recreated session UI requests the current turn state, and locked sessions keep transcript, response, and technical error text private. (Related: #424)
+- **Android New Chat keeps the current profile and stays fresh across profile switches.** Starting from All Profiles no longer forces the literal default profile, choosing another profile from an empty draft no longer reopens that profile's previous session after route settlement or restart, and leaving a provisional phone Thread cannot route the next turn to its old chat under the new profile. (#436)
+- **Android Dashboard connections and profile drawers no longer wait on unavailable optional routes.** Dashboard, API fallback, and Relay probes run independently; API/Relay never gate a normal Dashboard connection, Gateway auth/ticket failures are not blindly retried, and authenticated session history remains available without a live Gateway socket. Concurrent route probes are shared and generation-safe, healthy same-priority routes win immediately, superseded session reads cancel their HTTP calls, and optional PR decoration stays outside the session-list critical path.
+
+### Removed
+
+- **Android Chat no longer includes the hidden clean-focus presentation.** The long-press gesture, overlapping instructional pill, reduced composer, and alternate fading transcript were removed so Chat keeps one complete interaction model. Voice Focus remains available.
+
+## [Plugin 1.11.0] - 2026-08-30
+
+### Added
+
+- **Hermes-Relay Plugin provides a bounded Git workspace API for authenticated Dashboard clients.** Configured repository roots, path validation, tracked line totals, scoped write grants, and explicit confirmation protect repository reads and mutations.
+- **Relay extensions can use the authenticated Dashboard origin as one network ingress.** Fixed allowlisted HTTP and WebSocket paths proxy to the local Relay while Dashboard admission and Relay session authentication remain separate. (Related: #399)
+
+### Changed
+
+- **Hermes-Relay Dashboard management is organized around operator tasks.** Overview, Devices, Activity, Remote Access, Git, and Settings now have separate native Dashboard surfaces; pairing is QR-first, paired clients use responsive cards, and token-backed media is labeled as a bounded diagnostic instead of a health counter. (#486)
+- **Dashboard, CLI, and TUI pairing advertise the same explicit route set.** Recommended Tailscale uses dedicated HTTPS `:10443` for local Dashboard `:9119`, public HTTPS and LAN stay visible fallbacks, and old `:443`/`:9119` plus direct `:8767` remain migration compatibility.
+- **Pairing receipts explain transport protection before exposing an invite.** Per-surface probes distinguish application TLS, tailnet encryption, optional API fallback, and authenticated Relay ingress.
+
+### Fixed
+
+- **Public and roaming pairing no longer invent closed direct Relay or Dashboard ports.** Exact Dashboard origins own their same-origin Relay paths, ambiguous or plaintext public candidates fail closed, and inactive optional API routes are omitted.
+- **Dense pairing QRs scan reliably.** Dashboard, CLI, and TUI render integer-sized modules with a full quiet zone.
+- **Remote-access migration keeps existing listeners safe.** Recommended setup avoids taking over `:443`, explicit legacy cleanup remains available, and default disable actions remove only the listeners they own.
+
+## [0.4.0-beta.6] - 2026-08-31
+
+### Changed
+
+- **Hermes-Relay CLI+UI preserves the complete multi-route pairing topology.** Dashboard, Relay, optional API, priorities, and transport protection remain attached to one saved host across LAN, Tailscale, and public routes. (Related: #399)
+
+### Fixed
+
+- **Desktop rejects Dashboard-ingress Relay dials until it can mint Dashboard WebSocket tickets.** The daemon and host selector choose a compatible direct Relay fallback instead of attempting an unauthenticated same-origin ingress.
+- **API-less pairing remains valid.** Dashboard and direct Relay routes can pair without inventing an optional API server, while secure-first ranking keeps plain LAN as the final fallback.
+
+## [Android 1.13.2] - 2026-08-25
+
+### Added
+
+- **Android Supervised Mode presents a parent-controlled, profile-pinned chat surface.** Parents can limit attachments, Standard voice, generated media, conversation history, actions, and technical metadata while device authentication protects full settings. Hermes-Relay can identify and revoke a paired supervised client without becoming the policy enforcement boundary.
+
+### Fixed
+
+- **Android session rows stay neutral when optional live activity is unavailable or still loading.** Directory refreshes no longer restore a persistent Checking state, and full-row activity borders are reserved for actual Starting or Working turns.
 - **Returning from parent settings keeps Supervised Chat rendered.** Parent access now relocks without rebuilding the active navigation graph, and full Settings keeps a prominent shortcut back to Supervised Mode controls.

 ## [Android 1.13.1] - 2026-08-25
@@ -23,7 +212,6 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/), and this
 - **Provider usage and limits are available from top-level Settings.** Codex credential pools, Nous balances, and OpenCode Go account windows share one provider-neutral screen with Summary, Expanded, and Hidden presentation modes. Provider credentials remain on the Hermes host.
 - **Android Bot Mode provides one messenger-style workspace across saved Hermes gateways.** Bots and read-only group rooms aggregate without changing the foreground connection, Bot Chats retain exact gateway/profile ownership, and unavailable gateways keep clearly marked last-known roster entries.
 - **Android Assistant screen context.** Compatible unlocked assistant-button invocations can open Hermes, begin listening, and include bounded visible text plus an available screenshot in the first Standard voice turn. Ordinary wake and keyguard invocations remain screen-context free.
- **Android Supervised Mode presents a parent-controlled, profile-pinned chat surface.** Parents can limit attachments, Standard voice, generated media, conversation history, actions, and technical metadata while device authentication protects full settings. Hermes-Relay can identify and revoke a paired supervised client without becoming the policy enforcement boundary.

 ### Changed

@@ -1177,7 +1365,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/), and this

 - **Voice-exit chime firing on every Add-connection tap.** `ConnectionSwitchCoordinator.switchConnection` fires the `voiceStopCallback` unconditionally at step 3 (correct for connection-to-connection switches while voice is active), but `beginAddConnection` also routes through `switchConnection` to bind the placeholder Connection's auth store before the pair wizard runs — and `VoiceViewModel.exitVoiceMode()` was playing `sfxPlayer.playExit()` regardless of whether voice mode was actually on. Logcat confirmed the chime on every Add-connection FAB tap. Fix adds an idempotence guard at the top of `exitVoiceMode()`: early-return when `_uiState.value.voiceMode` is already false. Teardown is still safe to skip because every inner statement is null-guarded + try/catch-wrapped and would be a no-op on an already-stopped voice session; the only meaningful line is the `playExit()` SFX, which is what we're silencing.
 - **500 ms freeze on every Add-connection tap.** `ConnectionSwitchCoordinator.switchConnection` runs a `withTimeoutOrNull(AUTH_HYDRATE_TIMEOUT_MS = 500L)` block at step 10 to wait for the freshly-bound `AuthManager` to flip `AuthState` from `Loading` to `Paired`. The comment acknowledged Add-connection is the common path and the 500 ms was meant to be "imperceptible," but on-device it wasn't — the user perceived the delay (and the voice chime masking it) on every tap. The placeholder Connection created by `beginAddConnection` has `pairedAt == null` and an empty EncryptedSharedPreferences store, so `AuthState` will NEVER reach `Paired` — the 500 ms is pure stall. Fix short-circuits the hydrate wait when `target.pairedAt == null`: skip `withTimeoutOrNull` entirely for placeholders and log at DEBUG instead of the misleading "auth hydrate timeout" INFO. Real paired-to-paired switches still run the full hydrate wait because both sides have `pairedAt != null`.
- **KDoc nested-comment trap in `ConnectionViewModel.relayReady` doc block.** A literal `/voice/*` path pattern inside the `relayReady` KDoc opened a nested block comment (Kotlin supports nested `/* */`, Java does not) whose `*/` then closed only the nested level — leaving the outer `/**` open for the remaining ~2200 lines of the file. Symptom: `MainActivity.kt:67` "Unresolved reference 'isReady'" plus ~50 cascading "Cannot infer type" errors across `PairedDevicesScreen`, `SettingsScreen`, `TerminalScreen`. Real errors (`Missing '}`, `Unclosed comment`) were the last two lines of `./gradlew compileGooglePlayDebugKotlin` output, easy to miss. Fix was a two-character rewrite: path patterns now wrapped in backticks AND `/*` → `/...` so the glob-looking character isn't in a block-comment position. Lesson logged in `DEVLOG.md` 2026-04-21; worth a sweep of other KDoc blocks for shell/regex-looking patterns before the next large diff.
+- **KDoc nested-comment trap in `ConnectionViewModel.relayReady` doc block.** A literal `/voice/*` path pattern inside the `relayReady` KDoc opened a nested block comment (Kotlin supports nested `/* */`, Java does not) whose `*/` then closed only the nested level — leaving the outer `/**` open for the remaining ~2200 lines of the file. Symptom: `MainActivity.kt:67` "Unresolved reference 'isReady'" plus ~50 cascading "Cannot infer type" errors across `PairedDevicesScreen`, `SettingsScreen`, `TerminalScreen`. Real errors (`Missing '}`, `Unclosed comment`) were the last two lines of `./gradlew compileGooglePlayDebugKotlin` output, easy to miss. Fix was a two-character rewrite: path patterns now wrapped in backticks AND `/*` → `/...` so the glob-looking character isn't in a block-comment position. Lesson logged in `docs/project/DEVLOG.md` 2026-04-21; worth a sweep of other KDoc blocks for shell/regex-looking patterns before the next large diff.

 - **Orphan placeholder connections from abandoned Add-connection flows.** The `beginAddConnection` path pre-creates a placeholder Connection and switches to it before the pair wizard runs — so `applyPairingPayload` lands the token in the right auth store. Previously, cleanup of the placeholder was wired only to the explicit Cancel button and TopAppBar back arrow. System back (gesture back / predictive back) bypassed that branch, leaving the placeholder in the connection list forever. Two-part fix: (a) `PairScreen` now installs a `BackHandler` that routes system back through the same `onCancel` → `discardPlaceholderConnection` branch the explicit back arrow uses; (b) `ConnectionViewModel.init` sweeps for any existing orphans (tuple: `pairedAt == null && apiServerUrl.isBlank() && label == PLACEHOLDER_LABEL`) on cold start and removes them — the tuple cannot be produced by any real pairing, so the sweep is safe without a dry-run. If the active connection at startup points at an orphan, the sweep switches to the first surviving real connection before deleting. Fixes the "why does my chip say 'New connection…'" symptom on devices that were affected pre-fix.
 - **Pair flow now auto-starts the camera on Add connection.** `ConnectionWizard` gains an `autoStart: String?` param (currently only `"scan"` is honored). The Add-connection FAB on `ConnectionsSettingsScreen` passes it so the wizard fires the camera permission launcher on first composition instead of forcing users through the Method chooser — one obvious next step, one-tap flow. Re-pair surfaces intentionally leave `autoStart` null so the full Scan / Enter code / Show code chooser stays available there. The deep-link arg is plumbed through `Screen.Pair`'s route (`pair?connectionId=...&autoStart=...`) and `PairScreen`'s new `autoStart` param; unrecognized values fall through to the default Method step so future builds can add more targets without breaking old ones.
@@ -1994,7 +2182,7 @@ picker.
 - **`CLAUDE.md`** — updated Git section with the new branching policy,
  added file-table entries for `hermes-relay-update`,
  `register_code_command`, and the expanded `install.sh`
- **`TODO.md`** — captures open research questions around proper
+- **`docs/project/TODO.md`** — captures open research questions around proper
  Hermes plugin/skill/tool distribution
 - **`user-docs` vitepress site** — new "For AI Agents" copy-paste
  block on the home view, Feature Matrix component, two-track explainer,
@@ -1,525 +1 @@
-# Hermes-Relay — Claude Code Adapter
-
-> Read [AGENTS.md](AGENTS.md) first. It is the provider-neutral canonical agent
-> context. Branch, release, staging, and hotfix rules live in `AGENTS.md` and
-> [RELEASE.md](RELEASE.md); this file only adds Claude-specific project and tool
-> guidance. Then read `docs/spec.md` and `docs/decisions.md`.
-
-## What This Is
-
-A native Android app (Kotlin + Jetpack Compose) paired with an optional Python relay plugin/server (aiohttp) for the Hermes agent platform. Vanilla Hermes chat, Manage, and dashboard voice work against unmodified upstream Hermes. The Relay plugin adds phone control, terminal, remote desktop tooling, extra voice engines, and dashboard Relay management via the official Hermes web dashboard.
-
-**Current state:** Reference latest released version for stable state and current dev branch for working state. The default no-plugin path supports chat, Manage, and voice on vanilla upstream Hermes. Chat auto-prefers the dashboard `/api/ws` gateway transport when Manage auth is ready, then falls back to API-server SSE routes. Vanilla Hermes voice uses dashboard `/api/audio/*` with the Manage session. Relay remains an additive power path for terminal, bridge/device control, notification companion, extra/provider-native voice, remote access, and desktop tooling. Two Android product flavors ship: `googlePlay` (conservative, no unattended Device Control surface) and `sideload` (full-capability).
-
-## Architecture
-
-```
-Phone (WS)       -> Hermes dashboard (:9119)     [vanilla Hermes gateway chat, live thinking]
-Phone (HTTP/SSE) -> Hermes API Server (:8642)    [vanilla Hermes chat fallback, sessions, runs]
-Phone (HTTP)     -> Hermes dashboard (:9119)     [vanilla Hermes Manage + voice]
-Phone (WSS/HTTP) -> Relay plugin/server (:8767)  [optional bridge, terminal, relay voice, remote tools]
-```
-
-The Vanilla Hermes path must stay upstream-only. API-server bearer auth and dashboard cookie auth are separate. Terminal and bridge require Relay pairing; Vanilla Hermes chat, Manage, and dashboard voice must not.
-
-### Upstream Hermes API Reference
-
-**IMPORTANT:** Always verify endpoints against the actual hermes-agent source (`gateway/platforms/api_server.py`). The upstream repo is the source of truth — not our docs, not our memory, not assumptions from other frontends.
-
-**Vanilla Hermes endpoints (confirmed in hermes-agent source):**
-
-
-| Endpoint                                | Purpose                                                  | Tool Call Format                                                                                                               |
-| --------------------------------------- | -------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------ |
-| `POST /v1/chat/completions`             | OpenAI-compatible chat (stream=true for SSE)             | Inline markdown text (``💻 terminal``) — no separate tool events                                                               |
-| `POST /v1/runs`                         | Start an agent run                                       | Returns `run_id`                                                                                                               |
-| `GET /v1/runs/{run_id}/events`          | SSE stream of run lifecycle events                       | **Structured events**: `tool.started`, `tool.completed`, `message.delta`, `reasoning.available`, `run.completed`, `run.failed` |
-| `POST /v1/responses`                    | OpenAI Responses API format                              | Structured `function_call` objects (non-streaming only)                                                                        |
-| `GET /v1/capabilities`                  | Machine-readable feature + endpoint discovery            | Use before assuming optional surfaces exist                                                                                    |
-| `GET /v1/models`                        | List available models                                    | —                                                                                                                              |
-| `GET /v1/skills`                        | Read-only skill list for the API-server agent            | `{"object":"list","data":[...]}`                                                                                               |
-| `GET /v1/toolsets`                      | Read-only API-server toolset inventory                   | `{"object":"list","platform":"api_server","data":[...]}`                                                                       |
-| `GET/POST/PATCH/DELETE /api/sessions/*` | Native session CRUD, messages, fork, sync chat, SSE chat | Upstream merged via NousResearch/hermes-agent PR #33134                                                                        |
-| `GET /health`                           | Health check                                             | —                                                                                                                              |
-| `GET/POST/PATCH/DELETE /api/jobs/*`     | Cron job management (api_server surface)                 | —                                                                                                                              |
-
-
-**Compatibility endpoints (not all native upstream API-server routes):**
-
-Upstream main now contains the focused session-control API (`#33134`) and read-only skills/toolsets (`#33016`). The original broad PR [#8556](https://github.com/NousResearch/hermes-agent/pull/8556) was closed as superseded. Keep these distinctions straight:
-
-1. **Native upstream** — `/api/sessions`, `/api/sessions/{id}/messages`, `/api/sessions/{id}/chat`, `/api/sessions/{id}/chat/stream`, `/v1/capabilities`, `/v1/skills`, and `/v1/toolsets` exist in current `gateway/platforms/api_server.py`.
-2. **Bootstrap compatibility** (`plugin/hermes_relay_bootstrap/`) — monkey-patches aiohttp on startup via `.pth` file, injecting only compatibility-only surfaces (session search, memory, legacy skill detail/toggle, config, available-models, slash middleware). Sessions CRUD/messages/fork and the legacy skills list are **retired** — native upstream owns them (#33134/#33016) and the bootstrap carries no fallback for old builds. Native routes still win per method/path for the remaining set. The repo-root `hermes_relay_bootstrap/` package is a legacy import shim.
-3. **Legacy fork branches** — useful as lineage only. Do not cite `feat/session-api` / `#8556` as the current upstream contract.
-
-
-| Endpoint                               | Purpose                                | Provided by                                                                            |
-| -------------------------------------- | -------------------------------------- | -------------------------------------------------------------------------------------- |
-| `GET /api/sessions` (CRUD)             | Session list/create/rename/delete/fork | Native upstream (#33134); bootstrap injection retired                                  |
-| `GET /api/sessions/{id}/messages`      | Conversation history                   | Native upstream (#33134); bootstrap injection retired                                  |
-| `POST /api/sessions/{id}/chat`         | Synchronous session chat               | Native upstream (#33134)                                                               |
-| `POST /api/sessions/{id}/chat/stream`  | Session-based SSE chat                 | Native upstream (#33134); bootstrap does NOT inject                                    |
-| `GET /v1/skills`, `GET /v1/toolsets`   | Read-only skill/toolset discovery      | Native upstream (#33016)                                                               |
-| `GET /api/sessions/search`             | Full-text message search               | Bootstrap/fork legacy; not in current upstream main                                    |
-| `GET /api/config`, `PATCH /api/config` | Personalities + model config           | Bootstrap/fork legacy or dashboard web-server surface; not current API-server upstream |
-| `GET /api/skills/{name}`               | Legacy skill detail                    | Bootstrap compat; list (`GET /api/skills`) retired — use native `/v1/skills`           |
-| `PUT /api/skills/toggle`               | Enable/disable installed skill         | `hermes_cli/web_server.py` dashboard surface; bootstrap stub returns 501               |
-| `GET/POST/PATCH/DELETE /api/memory`    | Memory CRUD                            | Bootstrap/fork legacy; not current API-server upstream                                 |
-| `GET /api/available-models`            | Provider model list                    | Bootstrap/fork legacy; not current API-server upstream                                 |
-
-
-The Android client probes per-endpoint capability via `HermesApiClient.probeCapabilities()` (returns `ServerCapabilities`). When `streamingEndpoint = "auto"`, `ConnectionViewModel.resolveStreamingEndpoint()` picks `sessions`, `completions`, or `runs` based on the capability snapshot.
-
-**Dashboard web server (separate surface — standard Manage / Desktop remote gateway):**
-
-hermes-agent ships a second web server at `hermes_cli/web_server.py` that hosts the React admin dashboard at `hermes_cli/web_dist/`. It has its **own** `/api/*` routes that **do not live on `api_server.py`** — notably: `GET/PUT /api/config` (full tree), `GET /api/config/schema`, `GET /api/config/defaults`, `GET/PUT /api/config/raw` (YAML text), `GET/PUT/DELETE /api/env` + `POST /api/env/reveal`, `PUT /api/skills/toggle`, `/api/cron/jobs/*` (different shape from `/api/jobs/*`), `/api/providers/oauth/*`, `/api/dashboard/themes`, `/api/dashboard/plugins`, `/api/model/info` + `/api/model/options` + `POST /api/model/set`, `/api/profiles/*` (CRUD, `POST /api/profiles/active`, per-profile soul/description/model), `/api/mcp/*`, `/api/logs`, `/api/analytics/usage`, and `**POST /api/audio/transcribe` + `POST /api/audio/speak`** (base64 data-url contract, built for hermes-desktop voice). The API server has **no audio routes** — its `/v1/capabilities` advertises `audio_api: false`; PR #8199 (`/v1/audio/*`) is the canonical future surface but is unmerged. Android's **Vanilla Hermes (no-plugin) voice** therefore rides this dashboard surface via `StandardHermesVoiceClient` with the per-connection dashboard cookie session (Manage sign-in unlocks voice); `AutoVoiceAudioClient` prefers Relay when paired and falls back to standard.
-
-Current upstream supports two auth modes on this surface. Loopback dashboards still use the injected `window.__HERMES_SESSION_TOKEN__` path. Remote/non-loopback dashboards use the Desktop-style dashboard auth gate: `/api/status` advertises `auth_required` and providers, `/auth/password-login` handles password providers, `/auth/login?provider=...` handles Nous/OIDC redirects, `/api/auth/me` returns the verified session, and `/api/auth/ws-ticket` mints a short-lived ticket for `/api/ws` / `/api/pty`. This dashboard session is **not** an `API_SERVER_KEY`. Android uses it for Manage, Vanilla Hermes voice, and the gateway chat transport. `/api/ws` is backed by `tui_gateway/server.py` (what hermes-desktop + the Ink TUI speak) and is the only upstream surface with **live** `reasoning.delta`/`thinking.delta` streaming; the api_server SSE paths remain the SSE fallback. Relay-only capabilities remain behind Relay pairing. **Do not proxy dashboard auth or dashboard admin APIs over the relay.**
-
-**Tool call rendering paths:**
-
-1. **Runs API** — Emits `tool.started`/`tool.completed` as real SSE events → `ToolProgressCard` in real-time.
-2. **Sessions API** — Native upstream emits structured SSE (`run.started`, `message.started`, `assistant.delta`, `tool.progress`, `tool.started/completed/failed`, `assistant.completed`, `run.completed`, `done`). `run.completed.messages` can reconcile authoritative per-turn transcript.
-3. **Annotation parser** — Fallback for servers emitting inline markdown annotations (``💻 terminal``).
-
-## Key Instructions
-
- **Vanilla Hermes path = upstream-only.** The default (no-plugin) connection path — gateway/API chat, Manage, and Vanilla Hermes voice via the dashboard surface — must work against **unmodified upstream hermes-agent**: no fork patches, no bespoke server config as a dependency. The app ships on Google Play to users whose servers we don't control. Features that need server-side changes go through upstream PRs (with graceful degradation until merged) or live behind the opt-in relay plugin.
- **Always verify upstream before assuming an endpoint exists.** Check `gateway/platforms/api_server.py` in hermes-agent. If an endpoint isn't there, document whether bootstrap injects it or it requires the fork.
- If we use a non-standard endpoint, ensure `probeCapabilities()` covers it and the auto-resolver degrades gracefully.
- **Bootstrap maintenance:** Retire `plugin/hermes_relay_bootstrap/` per surface. Done: sessions CRUD/messages/fork and the legacy skills list are retired from the bootstrap (native upstream #33134/#33016, no old-build fallback kept). Remaining: config, memory, legacy skill detail/toggle, available-models, session search, and slash middleware still need explicit replacement decisions before full removal.
-
-## Repository Layout
-
-```
-hermes-android/
-├── app/src/main/kotlin/com/hermesandroid/relay/
-│   ├── ui/                  # Screens, components, theme
-│   ├── network/             # ConnectionManager, ChannelMultiplexer, handlers
-│   ├── auth/                # AuthManager (pairing + tokens)
-│   ├── viewmodel/           # ChatViewModel, ConnectionViewModel
-│   ├── data/                # ChatMessage, ToolCall models, FeatureFlags
-│   ├── audio/               # VoiceRecorder, VoicePlayer, VoiceSfxPlayer
-│   ├── voice/               # VoiceViewModel, VoiceBridgeIntentHandler
-│   ├── accessibility/       # HermesAccessibilityService, ScreenReader, ActionExecutor
-│   ├── bridge/              # BridgeSafetyManager, BridgeForegroundService, BridgeStatusOverlay
-│   └── notifications/       # HermesNotificationCompanion
-├── relay-core/              ← [EXPERIMENTAL] Quest/XR shared core lib (com.axiomlabs.hermesrelay.core) — pairing, transport, terminal, voice, wire
-├── relay-ui/                ← [EXPERIMENTAL] Quest/XR shared Compose UI lib — sphere, terminal WebView, QR scanner
-├── quest/                   ← [EXPERIMENTAL] Meta Spatial SDK Quest/XR app (gradle includeBuild; in development, not shipped)
-├── ui-preview/              ← Desktop Compose Hot Reload harness for PC UI iteration (NOT shipped; shares MorphingSphereCore)
-├── desktop/                 ← Node thin-client CLI (`@hermes-relay/cli`)
-│   ├── bin/hermes-relay.js  # #!/usr/bin/env node shim → dist/cli.js
-│   ├── src/
-│   │   ├── cli.ts           # argv parser + subcommand dispatcher (bare → shell)
-│   │   ├── commands/        # chat, shell, pair, status, tools, devices
-│   │   ├── banner.ts        # contextual connect line (LAN / Tailscale / Plain / Secure)
-│   │   ├── renderer.ts      # GatewayEvent → plain-line stdout formatter (chat only)
-│   │   ├── endpoint.ts      # ADR 24 EndpointCandidate + role helpers
-│   │   ├── pairingQr.ts     # v3 QR decode + priority-raced reachability probe
-│   │   ├── pairing.ts       # readline 6-char prompt + payload validator
-│   │   ├── credentials.ts   # token → pair-qr → code → stored → prompt precedence
-│   │   ├── certPin.ts       # TOFU SPKI sha256 extract / pinKey / compare
-│   │   ├── tools/           # desktop.command router + fs/terminal/search handlers + consent
-│   │   ├── transport/       # RelayTransport (reconnect state machine + TLS probe TOFU)
-│   │   └── lib/             # gracefulExit, rpc, circularBuffer (vendored)
-│   └── scripts/             # install.sh + install.ps1 curl/iwr one-liners
-├── website/                 ← Astro product/marketing site (static Coolify/Nixpacks deployment)
-├── plugin/                  ← Hermes agent plugin
-│   ├── android_tool.py      # 18 android_* tool handlers
-│   ├── pair.py              # QR pairing implementation
-│   ├── relay/               # Canonical WSS relay (server.py, auth.py, channels/, media.py, voice.py)
-│   ├── tools/               # android_navigate.py, android_notifications.py
-│   └── dashboard/           # hermes-agent dashboard plugin — manifest, React UI, FastAPI proxy
-├── relay_server/            ← Thin compat shim → plugin.relay (legacy entrypoint)
-├── hermes_relay_bootstrap/  ← Legacy import shim for older startup hooks
-├── skills/devops/hermes-relay-pair/  ← /hermes-relay-pair slash command
-├── scripts/                 ← dev.bat, bridge-smoke.sh, bump-version.sh
-└── docs/                    ← spec, decisions, security, relay-server, mcp-tooling
-```
-
-## Project Conventions
-
-### File Structure
-
- **Root-level:** README.md, CLAUDE.md, AGENTS.md, DEVLOG.md, TODO.md, .gitignore
- **docs/** — spec, decisions, security, and any other long-form documentation
- **DEVLOG.md** — update at end of each work session with what was done + verification (the factual record of *what happened*). It churns; do NOT park forward work here.
- **TODO.md** — the single home for follow-ups / deferred work / known gaps ("what's next"). Record them here — never buried in DEVLOG or scattered through code/doc comments where they get lost.
- **CLAUDE.md hygiene:** Key Files entries must stay one line — implementation detail belongs in the file or `docs/`. Run `/revise-claude-md` after feature-heavy sessions to trim drift.
-
-### Public-repo writing hygiene
-
-This is a **public, distributed repo** — every committed file (CHANGELOG, DEVLOG, README, docs, release notes) is public-facing. Write accordingly:
-
- **No personal names** in prose — attribute impersonally ("a user reported", "observed"). Author identity lives in git history + the signing cert, not the changelog.
- **No private infrastructure** — real server hostnames/IPs, internal deployment names, `~/SYSTEM.md` contents. (Generic example IPs like `192.168.1.100` in setup docs are fine.)
- **No AI/assistant process self-narration** — no "I should have…", no course-correction confessionals. State the technical conclusion, not the path to it.
- **No internal jargon / fork-branch plumbing** in user-facing notes — keep *what changed*, drop *where we staged it*.
- **CHANGELOG** uses Keep-a-Changelog grouping (Added / Changed / Fixed). Detail may accumulate during iteration, but at **release-prep the version block is condensed to crisp public bullets** (1–2 lines each) — deep "how we debugged it" stays in commits/DEVLOG. See [RELEASE.md](RELEASE.md) §2 "Scrub for public distribution".
- **DEVLOG.md** is a committed, factual engineering log — what changed, why, and verification — depersonalized and third-person, not a diary.
-
-### Code Style — Android (Kotlin)
-
- **Jetpack Compose** — no XML layouts. Material 3 / Material You.
- **kotlinx.serialization** — not Gson. Type-safe, faster.
- **OkHttp** for WebSocket + SSE — `okhttp` for WSS relay, `okhttp-sse` for API streaming
- **Single-activity** — Compose Navigation for all routing
- **Namespace (Kotlin source tree):** `com.hermesandroid.relay` — stable, drives on-disk layout + class FQCNs
- **applicationId:** `com.axiomlabs.hermesrelay` (googlePlay), `com.axiomlabs.hermesrelay.sideload` (sideload)
- **Min SDK 26, Target SDK 35, Compile SDK 37** / **Kotlin 2.0+**, JVM toolchain 17
-
-### Code Style — Desktop CLI (Node/TypeScript)
-
- **Node ≥21** — uses built-in global `WebSocket` (no `ws`/`undici` dep). Strict TS, ES modules, `NodeNext` resolution.
- **Zero runtime deps** — `@types/node` + `tsx`/`rimraf`/`typescript` are devDeps only. Ship compiled `dist/`, not tsx.
- **One binary, subcommands** — idiomatic for Node CLIs (codex, continue, vite pattern). Bare invocation is `chat`.
- **Vendor-for-now** — transport/gateway/types are copied verbatim from `hermes-agent-tui-smoke/ui-tui/src/` with a header note. Extract to a shared package when the TUI and CLI stabilize.
- **Dev loop:** `npx tsx src/cli.ts <args>` (no rebuild). `npm run build` + `npm link` before pushing to verify the bin shim. Never ship tsx in the published tarball — pre-build with `tsc` so Windows `npm install -g` can cmd-shim the JS directly.
-
-### Code Style — Server (Python)
-
- **aiohttp** — async, matches existing Hermes relay patterns
- **Type hints everywhere** — Python 3.11+ syntax
- **asyncio** — no threading; **structured logging** — use `logging`, not print()
-
-### Git
-
- **Conventional Commits:** `feat`, `fix`, `docs`, `refactor`, `test`, `chore`
- **Branch/release policy:** follow the branch-contract table in `AGENTS.md` and
-  the executable release and hotfix procedures in `RELEASE.md`. Do not maintain
-  a Claude-specific parallel policy here.
-
-### Testing
-
- **Android:** JUnit + Compose testing for UI, MockK for mocks
- **Gateway/session/reconnect work:** follow the on-demand scenario,
-  current-upstream conformance, Android instrumentation, and physical-proof
-  routing in `docs/gateway-contract-testing.md`; do not infer device behavior
-  from fixture or source checks.
- **Python:** `python -m unittest plugin.tests.test_<name>` — avoid bare `pytest` (conftest imports `responses` which may not be installed in the venv)
- **CI and release gates:** follow the repository-wide requirements in
-  `AGENTS.md` and `RELEASE.md`; Claude-specific guidance does not redefine them.
-
-## Key Files
-
-
-| File                                                        | Why                                                                                                                                                                                                                                                                                                 |
-| ----------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `docs/spec.md`                                              | Full specification — protocol, UI layouts, phases, dependencies                                                                                                                                                                                                                                     |
-| `docs/decisions.md`                                         | Architecture decisions — framework choice, channel design, auth model                                                                                                                                                                                                                               |
-| `docs/gateway-contract-testing.md`                          | On-demand reusable Gateway scenarios, upstream conformance, Android instrumentation, and ADB certification                                                                                                                                                                                         |
-| `AGENTS.md`                                                 | Universal agent entry point — points here + the non-negotiables (standard-path, commits, writing hygiene)                                                                                                                                                                                           |
-| `docs/mcp-tooling.md`                                       | MCP server setup — android-tools-mcp + mobile-mcp; `android_*` tool usage patterns                                                                                                                                                                                                                  |
-| **App — Core**                                              |                                                                                                                                                                                                                                                                                                     |
-| `ui/RelayApp.kt`                                            | Main scaffold (Scaffold + Compose nav); Chat is home — no mode strip, Manage/Bridge reached via Settings; `bottomBar` is a status pill, not a NavigationBar                                                                                                                                         |
-| `viewmodel/ChatViewModel.kt`                                | Chat orchestration — send, stream, cancel, slash commands                                                                                                                                                                                                                                           |
-| `viewmodel/ConnectionViewModel.kt`                          | Dual connection model (API + relay); `resolveStreamingEndpoint()`; derived `relayUiState` flow + `markPaired` hook stamp the active Connection                                                                                                                                                      |
-| `viewmodel/RelayUiState.kt`                                 | Shared sealed state for the relay row — 5 cases + `asBadgeState()` / `statusText()` extensions; 5s grace window before Stale                                                                                                                                                                        |
-| `network/HermesApiClient.kt`                                | Direct HTTP/SSE — `sendRunStream()`, `sendChatStream()`, `probeCapabilities()`                                                                                                                                                                                                                      |
-| `network/GatewayChatClient.kt`                              | Gateway chat transport — JSON-RPC over dashboard `/api/ws` (tui_gateway); live `reasoning.delta`; fresh ws-ticket per connect; per-turn SSE fallback via `onPreflightFailure`; `prewarm()` (connect+resume off the send path); `setKeepAliveInBackground()` suppresses the 120s idle-close          |
-| `network/GatewayKeepAliveService.kt`                        | Opt-in `specialUse` foreground service (BOTH flavors; declared in main manifest; Play needs a Console FGS declaration) holding the process up so the gateway socket survives background/Doze; driven by ConnectionViewModel from the `KEY_GATEWAY_KEEP_ALIVE` toggle; stops on task-removal         |
-| `data/GatewayKeepAlivePrefs.kt`                             | Shared `KEY_GATEWAY_KEEP_ALIVE` pref key + `Context.setGatewayKeepAlive()` — used by ConnectionViewModel (StateFlow/setter) and the FGS Stop action                                                                                                                                                 |
-| `network/GatewayEventMapper.kt`                             | Pure-JVM gateway event→callback mapping for one turn; unknown event types silently ignored; tui_gateway usage-key translation                                                                                                                                                                       |
-| `network/GatewayModels.kt`                                  | `GatewayAvailability`, `ActiveTurnHandle`, `GatewayTurnCallbacks` (all members REQUIRED — forces dispatchOn main-thread wrap), `GatewayAsk`, `GatewaySubagentEvent`, `resolveStreamingEndpointPreference()`                                                                                         |
-| `ui/components/ChatInputBar.kt`                             | Redesigned input bar — pill field, one trailing slot morphing Send/Voice/Stop/Steer/Queue, no slash button (long-press + opens palette)                                                                                                                                                             |
-| `ui/components/SubagentLane.kt`                             | Per-taskIndex subagent progress lane — guide rail, compact tool rows, auto-collapse                                                                                                                                                                                                                 |
-| `notifications/TurnCompleteNotifier.kt`                     | Turn-complete local notification when backgrounded — channel `chat_turn_complete`, cancel on resume, settings-gated                                                                                                                                                                                 |
-| `network/ConnectionManager.kt`                              | WSS to relay with auto-reconnect; rebuilds OkHttpClient with fresh CertPinner on connect                                                                                                                                                                                                            |
-| `network/ChannelMultiplexer.kt`                             | Envelope routing by channel; `sendNotification()` for notification outbound                                                                                                                                                                                                                         |
-| `network/handlers/ChatHandler.kt`                           | Chat message state, streaming events, tool annotation parser                                                                                                                                                                                                                                        |
-| `network/models/SessionModels.kt`                           | Session, message, SSE event data models                                                                                                                                                                                                                                                             |
-| `data/FeatureFlags.kt`                                      | Feature gating — DEV_MODE + DataStore overrides; `BuildFlavor` (googlePlay/sideload Tier flags)                                                                                                                                                                                                     |
-| **App — Auth**                                              |                                                                                                                                                                                                                                                                                                     |
-| `auth/AuthManager.kt`                                       | Wires SessionTokenStore + CertPinStore; parses auth.ok; `applyServerIssuedCodeAndReset()`                                                                                                                                                                                                           |
-| `auth/SessionTokenStore.kt`                                 | Keystore (StrongBox) + EncryptedSharedPrefs fallback; lossless migration on upgrade                                                                                                                                                                                                                 |
-| `auth/CertPinStore.kt`                                      | TOFU cert pinning — SHA-256 SPKI per host:port in DataStore                                                                                                                                                                                                                                         |
-| `auth/PairedSession.kt`                                     | PairedSession state + PairedDeviceInfo wire model                                                                                                                                                                                                                                                   |
-| `data/Endpoint.kt`                                          | `EndpointCandidate` / `ApiEndpoint` / `RelayEndpoint` — multi-endpoint pairing (ADR 24); `displayLabel()` for LAN/Tailscale/Public/Custom chips                                                                                                                                                     |
-| `network/RelayHttpClient.kt`                                | OkHttp for /media, /sessions (list/revoke/extend), /health                                                                                                                                                                                                                                          |
-| **App — Bridge**                                            |                                                                                                                                                                                                                                                                                                     |
-| `network/handlers/BridgeCommandHandler.kt`                  | Routes `bridge.command` → ActionExecutor; full path inventory + safety-rail integration                                                                                                                                                                                                             |
-| `viewmodel/BridgeViewModel.kt`                              | BridgeScreen VM — masterToggle, bridgeStatus, permissionStatus, activityLog                                                                                                                                                                                                                         |
-| `bridge/BridgeSafetyManager.kt`                             | Connection-scoped capabilities + timed screen expiry + blocklist + destructive confirmation; unknown, denied, and expired commands fail closed                                                                                                                                                     |
-| `bridge/BridgeCapabilities.kt` / `data/BridgeCapabilityPolicyRepository.kt` | Closed method/path registry + no-backup-bound per-Connection Always/Never/Timed policy; global safety vocabulary and timer duration remain in `BridgeSafetyPreferences.kt`                                                                                                                       |
-| `ui/screens/BridgeScreen.kt`                                | Bridge cockpit — master → Agent access posture/setup → single Unattended Access control → capability-scoped Android readiness (expandable full matrix) → Advanced safety/full editor → activity log                                                                                               |
-| `ui/components/BridgeAccessCards.kt`                        | Native access cockpit + first-use preset and screen-lease sheets (renewable idle limits or warned Until-off dedicated-device mode); preserves full permission/safety drilldowns while keeping selected policy/readiness above the fold                                                             |
-| `ui/components/UnattendedAccessRow.kt`                      | Unattended toggle card (sideload); `enabled=masterEnabled`; inline `KeyguardDetectedAlert`                                                                                                                                                                                                          |
-| `ui/components/UnattendedGlobalBanner.kt`                   | 28dp amber strip at scaffold top when master+unattended on (sideload); tap → Bridge tab                                                                                                                                                                                                             |
-| `bridge/BridgeStatusOverlay.kt`                             | WindowManager overlay; `ConfirmationOverlayHost`; requires `SavedStateRegistryOwner` init order (CREATED→restore→RESUMED)                                                                                                                                                                           |
-| `accessibility/HermesAccessibilityService.kt`               | AccessibilityService subclass; `@Volatile instance` singleton for BridgeCommandHandler                                                                                                                                                                                                              |
-| `accessibility/ScreenReader.kt`                             | UI tree → ScreenContent; `findNodeBoundsByText()`, `findFocusedInput()`                                                                                                                                                                                                                             |
-| `accessibility/ActionExecutor.kt`                           | Gesture/text dispatch via GestureDescription + ACTION_SET_TEXT; pressKey maps vocab only                                                                                                                                                                                                            |
-| **App — Voice**                                             |                                                                                                                                                                                                                                                                                                     |
-| `voice/VoiceViewModel.kt`                                   | Voice turn state machine; TTS queue; `ignoreAssistantId`; `errorEvents: SharedFlow`                                                                                                                                                                                                                 |
-| `audio/VoiceRecorder.kt`                                    | MediaRecorder wrapper; perceptual amplitude curve; `.m4a` at 16kHz/64kbps                                                                                                                                                                                                                           |
-| `audio/VoicePlayer.kt`                                      | Media3 ExoPlayer (gapless TTS queue) + Visualizer; amplitude StateFlow; `awaitCompletion()` via coroutine; `audioSessionId` is a thread-safe `@Volatile` cache                                                                                                                                      |
-| `network/RelayVoiceClient.kt`                               | OkHttp for `/voice/transcribe`, `/synthesize`, `/config`                                                                                                                                                                                                                                            |
-| `voice/VoiceBridgeIntentHandler.kt`                         | Interface routing voice utterances to bridge; impls per flavor via factory                                                                                                                                                                                                                          |
-| `voice/VoiceIntentClassifier.kt`                            | Regex phone-control classifier (sideload only); false-negatives preferred over false-positives                                                                                                                                                                                                      |
-| `ui/components/VoiceModeOverlay.kt`                         | Full-screen voice UI — MorphingSphere + VoiceWaveform + mic button                                                                                                                                                                                                                                  |
-| `ui/components/MorphingSphere.kt`                           | Compose renderer for the agent sphere — delegates math to `MorphingSphereCore`                                                                                                                                                                                                                      |
-| `ui/components/MorphingSphereCore.kt`                       | Platform-agnostic sphere algorithm (`kotlin.math` only) — single source of truth; mirrored byte-for-byte in `preview/web/sphere.js`                                                                                                                                                                 |
-| `preview/web/`                                              | Zero-dep browser harness — live `index.html` preview + `parity-check.mjs`; paired with `MorphingSphereCoreParityTest` (JVM) for struct/full checksum diffing                                                                                                                                        |
-| `user-docs/.vitepress/theme/components/SphereMark.vue`      | Docs-site sphere embed — imports `preview/web/sphere.js` directly; autonomous fbm drift + pointer-proximity gaze/state blend; `<ClientOnly>` + `IntersectionObserver` + `prefers-reduced-motion` aware                                                                                              |
-| **App — Media + Notifications**                             |                                                                                                                                                                                                                                                                                                     |
-| `util/MediaCacheWriter.kt`                                  | `cacheDir/hermes-media/` LRU writer; returns FileProvider URIs                                                                                                                                                                                                                                      |
-| `util/MediaSaver.kt`                                        | Save/share/open for chat media — MediaStore scoped-storage save (Pictures/Download `Hermes-Relay`, no perms on API 29+; pre-Q → share sheet); FileProvider share staging; remote-byte fetch; magic-byte image-MIME sniff for correct extensions                                                     |
-| `ui/components/ChatImageViewer.kt`                          | Full-screen image viewer — pinch-zoom/pan (`detectTransformGestures`), double-tap 1×/2.5×, Share/Save/Close; `ChatImageViewerSource` decouples Coil-model/bitmap display from a suspend `bytesProvider` so Save keeps original bytes                                                                |
-| `ui/components/InboundAttachmentCard.kt`                    | Discord-style attachment card for images/video/audio/pdf/text/generic; image tap → ChatImageViewer, file card long-press → Open/Share/Save menu                                                                                                                                                     |
-| `ui/components/ChatImageContent.kt`                         | Parses `![alt](src)` out of assistant content; remote http(s) → Coil (tap → ChatImageViewer), server-local/failed → inline "can't render" notice with the path                                                                                                                                      |
-| `data/HermesCard.kt`                                        | `CARD:{json}` envelope (ADR 26) — type/accent/fields/actions; kotlinx.serialization                                                                                                                                                                                                                 |
-| `ui/components/HermesCardBubble.kt`                         | Rich-card renderer — accent stripe + FlowRow actions + dispatch stamp collapse                                                                                                                                                                                                                      |
-| `viewmodel/CardDispatchSyncBuilder.kt`                      | Twin of VoiceIntentSyncBuilder — synthesizes card dispatches as `hermes_card_action` OpenAI pairs for session memory                                                                                                                                                                                |
-| `notifications/HermesNotificationCompanion.kt`              | NotificationListenerService; cold-start buffer (50); forwards via ChannelMultiplexer                                                                                                                                                                                                                |
-| `util/RelayErrorClassifier.kt`                              | `classifyError(Throwable, context) → HumanError`; used by Voice/Chat/Connection                                                                                                                                                                                                                     |
-| `util/TurnLatencyTracer.kt`                                 | One `TurnLatency` INFO line per chat turn — `warm/cold` + `connect/session/submit/ttfe/ttft/done@…ms`; gateway + 3 SSE paths use it for desktop-comparable latency diagnosis; durations only                                                                                                        |
-| **Relay — Server**                                          |                                                                                                                                                                                                                                                                                                     |
-| `plugin/relay/server.py`                                    | Canonical relay — WSS + HTTP routes; bridge, media, voice, session, pairing handlers. `handle_pairing_mint` mirrors `pair.py:762` — top-level = API server, `relay.{url,code}` nested                                                                                                               |
-| `plugin/relay/auth.py`                                      | PairingManager, SessionManager, RateLimiter; `math.inf` for never-expire                                                                                                                                                                                                                            |
-| `plugin/relay/channels/bridge.py`                           | Bridge handler — `handle_command()` mints request_id, awaits response, 30s timeout                                                                                                                                                                                                                  |
-| `plugin/relay/channels/notifications.py`                    | Bounded deque (100) of notification metadata; in-memory only                                                                                                                                                                                                                                        |
-| `plugin/relay/media.py`                                     | MediaRegistry — LRU token store; `strict_sandbox` off by default for `/media/by-path`                                                                                                                                                                                                               |
-| `plugin/relay/voice.py`                                     | Voice endpoints — transcribe, synthesize, voice_config; lazy tool imports                                                                                                                                                                                                                           |
-| `plugin/relay/qr_sign.py`                                   | HMAC-SHA256 QR signing; secret at `~/.hermes/hermes-relay-qr-secret`; canonical form preserves `endpoints` array order + role strings verbatim (ADR 24)                                                                                                                                             |
-| `plugin/relay/tailscale.py`                                 | First-class Tailscale helper (ADR 25) — `status()` / `enable(port)` / `disable(port)` / `canonical_upstream_present()`; safe-absent via shell-out to `tailscale` CLI                                                                                                                                |
-| `plugin/relay/_env_bootstrap.py`                            | Loads `~/.hermes/.env` before relay imports; called from both entry points                                                                                                                                                                                                                          |
-| **Plugin — Tools + Installer**                              |                                                                                                                                                                                                                                                                                                     |
-| `plugin/tools/android_tool.py`                              | 18 `android_*` tool handlers (14 baseline + send_sms, call, search_contacts, return_to_hermes); `android_screenshot` first consumer of `register_media()`                                                                                                                                           |
-| `plugin/tools/android_navigate.py`                          | Vision-driven navigation loop; up to 20 iterations; `llm_gap` error until vision client wired                                                                                                                                                                                                       |
-| `plugin/pair.py`                                            | QR payload builder + CLI; `build_payload(sign=True)`; `--register-code` fallback                                                                                                                                                                                                                    |
-| `plugin/doctor.py`                                          | `hermes relay doctor`; checks standard upstream API/dashboard reachability, Relay loopback state, plugin layout, and compat hook state                                                                                                                                                              |
-| `plugin/compat.py`                                          | `hermes relay compat status/install/remove`; owns the optional `hermes_relay_bootstrap.pth` lifecycle                                                                                                                                                                                               |
-| `plugin/hermes_relay_bootstrap/`                            | Plugin-owned runtime compatibility patch — compat-only surfaces (session search, memory, skill detail/toggle, config, available-models, slash middleware); sessions + skills-list injection retired (#33134/#33016)                                                                                 |
-| `install.sh`                                                | Canonical installer — 6 steps; idempotent; drops `hermes-relay-update` shim                                                                                                                                                                                                                         |
-| `uninstall.sh`                                              | Canonical uninstaller; reverses install.sh; never touches `.env` or `state.db`                                                                                                                                                                                                                      |
-| `hermes_relay_bootstrap/`                                   | Legacy import shim for old `.pth` files and editable installs                                                                                                                                                                                                                                       |
-| **Plugin — Dashboard**                                      |                                                                                                                                                                                                                                                                                                     |
-| `plugin/dashboard/manifest.json`                            | Declares tab, entry bundle, and FastAPI module for hermes-agent discovery                                                                                                                                                                                                                           |
-| `plugin/dashboard/plugin_api.py`                            | FastAPI router proxying 5 routes to relay over loopback; `/pairing` body = API-server overrides (host/port/tls/api_key), relay URL auto-derived                                                                                                                                                     |
-| `plugin/dashboard/src/index.jsx`                            | React root registering `hermes-relay` plugin with 4-tab shell                                                                                                                                                                                                                                       |
-| `plugin/dashboard/dist/index.js`                            | Committed IIFE bundle loaded verbatim by dashboard                                                                                                                                                                                                                                                  |
-| **Desktop CLI**                                             |                                                                                                                                                                                                                                                                                                     |
-| `desktop/package.json`                                      | `@hermes-relay/cli` package manifest — Node ≥21, one `hermes-relay` bin, pre-built dist                                                                                                                                                                                                             |
-| `desktop/bin/hermes-relay.js`                               | Tiny shim: `import('../dist/cli.js').then(m => m.main())` + error surfacing                                                                                                                                                                                                                         |
-| `desktop/src/chatAttach.ts`                                 | captureClipboardImage / captureScreenshot / readImageFile; ships base64 to server via `image.attach.bytes` RPC before next prompt.submit                                                                                                                                                            |
-| `desktop/src/cli.ts`                                        | argv parser + subcommand dispatcher — bare → `shell` (PTY), positional-only → `chat`; command-scoped `--help` falls through to each command                                                                                                                                                         |
-| `desktop/src/lib/theme.ts`                                  | Shared ANSI palette + `colorEnabled()` + `Theme` (semantic helpers, `statusDot`) — single visual language; `--no-color`/`NO_COLOR`/TTY aware                                                                                                                                                        |
-| `desktop/src/lib/table.ts`                                  | Zero-dep column-aligned table renderer (ANSI-width aware, last column flexes to terminal width) — used by devices/sessions/audit                                                                                                                                                                    |
-| `desktop/src/lib/spinner.ts`                                | Stderr braille spinner for slow ops (pair probe, gateway connect); no-op when piped/quiet/json                                                                                                                                                                                                      |
-| `desktop/src/lib/usage.ts`                                  | `UsageSpec` + `renderUsage`/`printUsage`/`unknownSubcommand` — per-subcommand `--help` + self-documenting sub-verb fallback                                                                                                                                                                         |
-| `desktop/src/lib/hints.ts`                                  | `suggestedFix(err, ctx)` → next-step command (re-pair on auth fail, etc.); `formatError` renders error + hint                                                                                                                                                                                       |
-| `desktop/src/lib/logo.ts`                                   | Slim box-drawing "Hermes Relay" wordmark; shown atop `--help`, first-run welcome, REPL header, and `hermes-relay logo`; theme/no-color aware                                                                                                                                                        |
-| `desktop/src/lib/auditLog.ts`                               | Local desktop-tool audit JSONL (`~/.hermes/desktop-audit.jsonl`); router appends per dispatch; backs `audit` command (relay's ring is loopback-only)                                                                                                                                                |
-| `desktop/src/lib/daemonStatus.ts`                           | Daemon heartbeat file (`~/.hermes/daemon-status.json`) + `isPidAlive` liveness; backs `daemon --status`                                                                                                                                                                                             |
-| `desktop/src/commands/audit.ts`                             | `hermes-relay audit` — tails the local audit log into a table (WHEN/TOOL/STATUS/DETAIL); `--limit`, `--json`                                                                                                                                                                                        |
-| `desktop/src/commands/relay.ts`                             | `hermes-relay relay info/security/context/queue` — relay-server management surface; info/security/queue loopback-only, context works remote with bearer; `queue` lists/cancels the agent→phone outbound buffer (`--clear` / `--cancel <id>`)                                                        |
-| `desktop/src/commands/chat.ts`                              | REPL + one-shot + piped-stdin; `runOneTurn` returns `{promise, cancel}` for safe SIGINT; auto-wires `DesktopToolRouter` when consented                                                                                                                                                              |
-| `desktop/src/commands/shell.ts`                             | Pipes the `terminal` relay channel to raw-mode stdin/stdout; post-attach `exec hermes` 350ms after tmux settles; `Ctrl+A .` detach / `Ctrl+A k` kill / `Ctrl+A Ctrl+A` literal                                                                                                                      |
-| `desktop/src/commands/pair.ts`                              | Either 6-char code + `--remote`, or full v3 QR via `--pair-qr` — probes + picks endpoint, records role; `--grant-tools` (TTY prompt) / `--auto-grant-tools` (silent) stamp `toolsConsented` so `daemon` works without a `shell` round-trip                                                          |
-| `desktop/src/commands/tools.ts`                             | `tools.list` RPC → enabled/available toolsets; `--verbose` lists individual tools                                                                                                                                                                                                                   |
-| `desktop/src/commands/status.ts`                            | Local read of `~/.hermes/remote-sessions.json`; renders `grants:` + `expires:` + `route:`; `--json` redacts tokens, `--reveal-tokens` opts in                                                                                                                                                       |
-| `desktop/src/commands/devices.ts`                           | Server-side session management — `GET/DELETE/PATCH /sessions` via `fetch` over http(s)://host:port; `list` / `revoke <prefix>` / `extend <prefix> --ttl <s>`                                                                                                                                        |
-| `desktop/src/banner.ts`                                     | `buildConnectBanner({url, meta, endpointRole})` → "Connected via LAN (plain) — server 0.6.0"; `humanExpiry()` for TTL formatting                                                                                                                                                                    |
-| `desktop/src/endpoint.ts`                                   | `EndpointCandidate` / `EndpointRole` types + `displayLabel()` — mirrors Android `data/Endpoint.kt`                                                                                                                                                                                                  |
-| `desktop/src/pairingQr.ts`                                  | `decodePairingPayload` (JSON or base64), `payloadToCandidates` (v3 verbatim / v1–v2 synthesized), `probeCandidatesByPriority` (`Promise.any` within tier, `AbortSignal.any`, 4s timeout, 60s cache)                                                                                                 |
-| `desktop/src/certPin.ts`                                    | `extractSpkiSha256(der)` via `crypto.X509Certificate` + `publicKey.export({type:'spki'})`; `pinKey(url)`, `comparePins()`, `isSecureUrl()`                                                                                                                                                          |
-| `desktop/src/tools/router.ts`                               | `DesktopToolRouter.attach(relay)` — `onChannel('desktop')` dispatch under 30s `AbortController`; heartbeat enriched with host/platform/version/uptime_ms + sticky `last_error` for `desktop_health`                                                                                                 |
-| `desktop/src/tools/handlerSet.ts`                           | Single source of truth for the desktop tool map — `DESKTOP_HANDLERS` + `DESKTOP_ADVERTISED_TOOLS`; consumed by `chat.ts` / `shell.ts` / `daemon.ts` so adding a tool is a one-file change                                                                                                           |
-| `desktop/src/tools/consent.ts`                              | `ensureToolsConsent(url)` — stored per-URL in `toolsConsented`; TTY prompt; non-TTY fails closed                                                                                                                                                                                                    |
-| `desktop/src/tools/handlers/fs.ts`                          | `readFileHandler` / `writeFileHandler` / `patchHandler` — strict unified-diff applier, no fuzz                                                                                                                                                                                                      |
-| `desktop/src/tools/handlers/terminal.ts`                    | `bash -lc` / `cmd /c`, SIGKILL on timeout or abort, returns `{stdout, stderr, exit_code, duration_ms}`                                                                                                                                                                                              |
-| `desktop/src/tools/handlers/powershell.ts`                  | Spawns `pwsh`/`powershell` directly with `-Command -`, script piped via stdin — no cmd.exe quote-mangling; auto-picks pwsh &gt; powershell                                                                                                                                                          |
-| `desktop/src/tools/handlers/process.ts`                     | `spawn_detached` (unref'd, returns pid+log_path), `list_processes` (tasklist /FO CSV — no /V to dodge window-title latency), `kill_process`, `find_pid_by_port` (netstat/lsof/ss)                                                                                                                   |
-| `desktop/src/tools/handlers/jobs.ts`                        | Job API — `~/.hermes/desktop-jobs/<id>/{stdout.log, stderr.log, meta.json}` is source of truth across daemon restarts; `taskkill /T` on Windows so build trees die fully                                                                                                                            |
-| `desktop/src/tools/handlers/transfer.ts`                    | `copy_directory` via `fs.cp`, `zip`/`unzip` via tar &gt; zip &gt; PowerShell probe, `checksum` streamed (sha256/sha1/md5)                                                                                                                                                                           |
-| `desktop/src/tools/handlers/search.ts`                      | ripgrep with pure-Node fallback, skips `.git`/`node_modules`/`dist`/`.next`/`.cache`                                                                                                                                                                                                                |
-| `desktop/src/renderer.ts`                                   | Streams `message.delta` → stdout, tool events → decorated lines; NO_COLOR / --json / --quiet aware                                                                                                                                                                                                  |
-| `desktop/src/pairing.ts`                                    | readline-based 6-char prompt (`A-Z0-9`); headless mirror of TUI's Ink prompt; `validatePairingPayloadString` discriminated-union wrapper                                                                                                                                                            |
-| `desktop/src/credentials.ts`                                | Precedence: `--token` → `--pair-qr` (probe+pair) → `--code` → stored → prompt; returns `Credentials{sessionToken?, pairingCode?, resolvedEndpoint?}`                                                                                                                                                |
-| `desktop/src/transport/RelayTransport.ts`                   | Fork of ui-tui's transport + reconnect state machine (`idle/connecting/connected/reconnecting`, exp backoff 1→30s, 5min on 429, gate re-check post-sleep) + pre-WS TLS probe for TOFU                                                                                                               |
-| `desktop/src/remoteSessions.ts`                             | Same file path as TUI (`~/.hermes/remote-sessions.json`, 0600); schema widened with `grants`, `ttlExpiresAt`, `endpointRole`, `toolsConsented`; `saveSession` back-compat overload                                                                                                                  |
-| `desktop/src/commands/daemon.ts`                            | Headless WSS + tool router for always-on access; JSON-line logs; fails closed on missing consent unless `--allow-tools` with explicit `--token`                                                                                                                                                     |
-| `desktop/src/commands/doctor.ts`                            | Local-only diagnostic report — version / binary path / PATH / sessions / daemon detection; `--json` for support-paste; omits tokens entirely                                                                                                                                                        |
-| `desktop/src/relayUrlPrompt.ts`                             | First-run URL fallback — `resolveFirstRunUrl()` auto-picks single stored session, numbered picker for multiple, welcome banner for zero; throws on non-interactive + ambiguous                                                                                                                      |
-| `desktop/src/version.ts`                                    | Build-time-generated constant (`npm run gen:version` before every build) — Bun compiled binaries can't read package.json via `__dirname` so version is embedded at build                                                                                                                            |
-| `desktop/scripts/install.sh` / `install.ps1`                | curl/iwr one-liner installers — download prebuilt Bun binary (no Node required), SHA256-verified, API-resolver for `latest` that includes prereleases, version-aware pre/post-install readback                                                                                                      |
-| `desktop/scripts/uninstall.sh` / `uninstall.ps1`            | 3-tier removal — default (binary + PATH), `--purge` (also wipes `~/.hermes/remote-sessions.json`), `--service` (stub for future service installers); Windows iex-safe env-var fallback                                                                                                              |
-| `desktop/README.md`                                         | User-facing install + usage reference                                                                                                                                                                                                                                                               |
-| **Desktop CLI — dev iteration**                             |                                                                                                                                                                                                                                                                                                     |
-| `npm run smoke` (in `desktop/`)                             | Builds Windows binary + runs `--version` / `--help` / `doctor`, fails loud on zero-output. Local pre-flight before cutting any tag.                                                                                                                                                                 |
-| `npm run gen:version`                                       | Regenerates `src/version.ts` from `package.json`. Runs automatically before every `build` / `build:bin:*`.                                                                                                                                                                                          |
-| `release-cli.yml → Smoke-test Linux binary` step            | CI-side equivalent: runs compiled Linux binary through the same 3-command check before uploading assets. Catches silent-exit-0 + segfault classes.                                                                                                                                                  |
-| **Server — Desktop tool routing (Phase B)**                 |                                                                                                                                                                                                                                                                                                     |
-| `plugin/relay/channels/desktop.py`                          | Mirrors `bridge.py` — `desktop.command`/`desktop.response`/`desktop.status`, UUID-correlated futures, 30s timeout, single-client MVP, per-session advertised-tools set                                                                                                                              |
-| `plugin/tools/desktop_tool.py`                              | 24 `desktop_*` tools (fs/shell/powershell/process/jobs/transfer/health) — registers with `tools.registry` under `desktop` toolset; per-tool `check_fn` pings `/desktop/_ping?tool=<name>`; `desktop_health` is `_RELAY_ONLY` and pings `/desktop/health` so it works even when the client is wedged |
-| **Gradle modules — experimental Quest/XR (in development)** |                                                                                                                                                                                                                                                                                                     |
-| `relay-core/`                                               | [EXPERIMENTAL] Android library (`com.axiomlabs.hermesrelay.core`) — shared pairing/transport/terminal/voice/wire for the Quest port; not yet wired into the shipped `:app`                                                                                                                          |
-| `relay-ui/`                                                 | [EXPERIMENTAL] Android library (`com.axiomlabs.hermesrelay.ui`) — shared Compose UI (sphere, terminal WebView, QR scanner) for the Quest port; carries its own sphere copy                                                                                                                          |
-| `quest/`                                                    | [EXPERIMENTAL] Meta Spatial SDK Quest/XR app — gradle `includeBuild("quest")`; needs further development, not shipped                                                                                                                                                                               |
-| **Tooling — dev iteration (not shipped)**                   |                                                                                                                                                                                                                                                                                                     |
-| `ui-preview/`                                               | Desktop Compose Hot Reload harness — JVM Compose for Desktop; source-shares `MorphingSphereCore` from `:relay-ui`; `Main.kt` gallery; see `ui-preview/README.md`                                                                                                                                    |
-| `app/src/test/.../screenshots/StoreScreenshotTest.kt`       | Roborazzi host-side store/docs screenshot renderer — deterministic, no device, exact 1080×2160; reuses real components+chrome with mock data; `capture(name, themeId){…}` renders any view; see `docs/screenshot-automation.md` §Deterministic rendering (JDK-21 + no-plugin gotchas)               |
-
-
-## What NOT to Do
-
- **Don't use XML layouts** — Compose only
- **Don't use Gson** — kotlinx.serialization
- **Don't use Ktor for networking** — OkHttp for WebSocket
- **Don't use plaintext WebSocket** — `wss://` only, even in development
- **Don't put documentation in root** — long-form docs go in `docs/`
- **Don't forget DEVLOG.md** — update it (record *what happened*)
- **Don't bury follow-ups** — deferred work / known gaps go in `TODO.md`, never in DEVLOG or one-off code/doc comments
- **Don't touch production / remote hosts** — automation and orchestrated agents must NEVER SSH into, deploy to, pull/restart/reconfigure, or push code to a live/remote Hermes host. Building, on-device testing, and server deployment are owner-driven (see Server Deployment). Stop at committing on your branch; surface "this needs a deploy/on-device check" rather than doing it.
-
-## MCP Tooling
-
-Two MCP servers are configured for AI-assisted development. See `docs/mcp-tooling.md` for full reference.
-
-
-| Server              | Layer                                                           | Requires                                 |
-| ------------------- | --------------------------------------------------------------- | ---------------------------------------- |
-| `android-tools-mcp` | IDE/Build — Compose previews, Gradle, code search, Android docs | Android Studio running with project open |
-| `mobile-mcp`        | Device/Runtime — tap, swipe, screenshot, app management         | ADB + connected device/emulator          |
-
-
-## Dev Workflow
-
-```bash
-scripts/dev.bat build      # Build debug APK (DEV_MODE=true)
-scripts/dev.bat release    # Build signed release APK (DEV_MODE=false)
-scripts/dev.bat bundle     # Build release AAB for Google Play upload
-scripts/dev.bat run        # Build + install + launch + logcat
-scripts/dev.bat test       # Run unit tests
-scripts/dev.bat version    # Show current version from libs.versions.toml
-scripts/dev.bat relay      # Start relay server (dev mode, no SSL)
-```
-
-### Bridge smoke test (run on hermes-host, not local PC)
-
-```bash
-scripts/bridge-smoke.sh                   # full suite, destructive ON
-scripts/bridge-smoke.sh --no-destructive  # read-only paths only
-scripts/bridge-smoke.sh --filter open_app # re-run a single test
-scripts/bridge-smoke.sh --pair ABCDEF     # register pairing code first
-```
-
-Curls every bridge HTTP route via `localhost:8767`. Catches the silent-drop regression class (Python relay registers a route but Kotlin dispatcher's `when (path)` has no matching branch). Run after every relay restart.
-
-### Typical Dev Loop
-
-1. **Edit locally** — Windows checkout. Both plugin (`plugin/`) and app (`app/`) live here.
-2. **Python syntax check** — `python -m py_compile plugin/<file>.py`. Full tests run on the server.
-3. **Kotlin changes** — do NOT run `gradle build`. Bailey builds via Android Studio's ▶ button. Never `adb install` from Claude.
-4. **Before pushing Kotlin changes** — run `./gradlew lint` locally. It's the exact task CI runs and catches errors Android Studio's live inspections miss — e.g. `UnsafeOptInUsageError` with `kotlin.OptIn` vs `androidx.annotation.OptIn`, `FlowOperatorInvokedInComposition` (mapped flows inside Composables), Media3 `@UnstableApi` propagation. Android CI runs lint alongside build/test for faster feedback, but a local lint run still surfaces issues before the workflow spends runner time compiling and packaging.
-5. **Commit + push** — follow `AGENTS.md` and `RELEASE.md`; normal work PRs to `dev`.
-6. **Pull + restart on server** — see Server Deployment below.
-7. **Test on phone** — Bailey builds from Studio, installs to Samsung device, pairs via `/hermes-relay-pair`.
-
-### Server Deployment
-
-Server is a Linux box running hermes-agent with hermes-relay editable-installed (`pip install -e`). Sensitive details (IP, user, secrets) in `~/SYSTEM.md` on the server — not in this repo.
-
-
-| What               | Where                                                              |
-| ------------------ | ------------------------------------------------------------------ |
-| hermes-agent repo  | `~/.hermes/hermes-agent/`                                          |
-| hermes-relay clone | `~/.hermes/hermes-relay/`                                          |
-| Plugin symlink     | `~/.hermes/plugins/hermes-relay` → `~/.hermes/hermes-relay/plugin` |
-| Config             | `~/.hermes/config.yaml` + `~/.hermes/.env`                         |
-| Relay log          | `journalctl --user -u hermes-relay -f`                             |
-
-
-**Update:** `hermes-relay-update` (idempotent, re-fetches install.sh). Or manually: `git pull --ff-only && systemctl --user restart hermes-relay`.
-
-**Compat hook:** `hermes relay compat status/install/remove` manages only the
-
-optional `hermes_relay_bootstrap.pth` startup hook. New installs load the
-
-plugin-owned bootstrap from `plugin/hermes_relay_bootstrap/`; the repo-root
-
-package is only a legacy import shim. Vanilla Hermes chat, Manage, and dashboard voice
-
-must not depend on this hook.
-
-**Key conventions:**
-
- Phone pairing **survives** relay restart — `SessionManager` persists sessions to `~/.hermes/hermes-relay-sessions.json` (`server.py:88-90`, `persistence_path` from `RelayConfig.from_env`); a trusted-device refresh token recovers a lost/revoked/reset session without a new QR scan. (Only the in-memory *live-connection presence* clears on restart; the phone reconnects automatically.)
- Use `python -m unittest` not `pytest` — conftest imports `responses` which may not be installed
- `_env_bootstrap.py` loads `~/.hermes/.env` on every relay start — no stale API keys
-
-### Where Python vs. Kotlin changes land
-
-
-| Change type                          | Who restarts?            | Command                                            |
-| ------------------------------------ | ------------------------ | -------------------------------------------------- |
-| Plugin tool (`android_tool.py` etc.) | `hermes-gateway.service` | `systemctl --user restart hermes-gateway`          |
-| Relay code (`plugin/relay/*.py`)     | `hermes-relay.service`   | `systemctl --user restart hermes-relay`            |
-| Pair CLI / skill files               | —                        | No restart — fresh process / scanned on invocation |
-| Android app                          | Bailey (Studio)          | Studio run button                                  |
-
-
-### Release Process
-
-See [AGENTS.md](AGENTS.md) for the canonical branch contract and
-[RELEASE.md](RELEASE.md) for version sources, release trains, surface tags,
-hotfixes, secrets, publishing, and verification. Claude-specific automation
-must not infer release authority from feature completion.
-
-## Integration Points
-
-
-| Surface                        | Endpoint                                                                                                            | Notes                                                                                                                                                                                                                                                                                       |
-| ------------------------------ | ------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| Chat (gateway)                 | Dashboard `POST /api/auth/ws-ticket` -&gt; WS `/api/ws`                                                             | Vanilla Hermes dashboard/tui_gateway path; live thinking/reasoning; requires dashboard auth                                                                                                                                                                                                 |
-| Chat streaming                 | `POST /v1/runs` → `GET /v1/runs/{id}/events`                                                                        | Structured tool events; async run-control path                                                                                                                                                                                                                                              |
-| Chat (sessions)                | `POST /api/sessions/{id}/chat/stream`                                                                               | Native upstream session-persisted SSE; preferred when capability probe finds it                                                                                                                                                                                                             |
-| Chat (compat)                  | `POST /v1/chat/completions` (stream=true)                                                                           | Inline tool annotations only                                                                                                                                                                                                                                                                |
-| Session CRUD                   | `GET/POST/PATCH/DELETE /api/sessions`                                                                               | Native upstream (#33134); bootstrap fallback retired                                                                                                                                                                                                                                        |
-| Manage                         | Dashboard `/api/status`, `/api/auth/me`, `/api/config`, `/api/profiles/*`, `/api/env`, `/api/model/*`, `/api/mcp/*` | Vanilla Hermes dashboard surface; do not proxy through Relay                                                                                                                                                                                                                                |
-| Vanilla Hermes voice           | Dashboard `POST /api/audio/transcribe`, `POST /api/audio/speak`                                                     | Vanilla Hermes no-plugin voice; uses dashboard session from Manage                                                                                                                                                                                                                          |
-| Pairing (QR)                   | `POST /pairing/register` (loopback only)                                                                            | Via `/hermes-relay-pair` or `hermes-pair` shim; accepts optional `endpoints` for multi-endpoint QRs                                                                                                                                                                                         |
-| Pairing (multi-endpoint)       | QR `endpoints` array (ADR 24)                                                                                       | `hermes: 3` schema; ordered `lan`/`tailscale`/`public`/... candidates; phone re-probes on network change                                                                                                                                                                                    |
-| Pairing auth                   | WSS `auth.ok` payload                                                                                               | Includes `expires_at`, `grants`, `transport_hint`                                                                                                                                                                                                                                           |
-| Tailscale Serve (ADR 25)       | `hermes-relay-tailscale enable|disable|status` CLI                                                                  | Fronts loopback `:8767` with `tailscale serve --bg --https=<port>`; auto-retires on upstream PR #9295                                                                                                                                                                                       |
-| Inbound media (token)          | `GET /media/{token}`                                                                                                | Bearer auth; 24h TTL                                                                                                                                                                                                                                                                        |
-| Inbound media (path)           | `GET /media/by-path?path=<abs>`                                                                                     | Permissive by default; `RELAY_MEDIA_STRICT_SANDBOX=1` to restrict                                                                                                                                                                                                                           |
-| Session management             | `GET /sessions`, `DELETE /sessions/{prefix}`, `PATCH /sessions/{prefix}`                                            | List/revoke/extend; RelayHttpClient                                                                                                                                                                                                                                                         |
-| Voice transcribe               | `POST /voice/transcribe`                                                                                            | multipart/form-data; bearer auth                                                                                                                                                                                                                                                            |
-| Voice synthesize               | `POST /voice/synthesize`                                                                                            | JSON → audio/mpeg; max 5000 chars                                                                                                                                                                                                                                                           |
-| Voice config                   | `GET /voice/config`                                                                                                 | Returns current tts/stt provider info                                                                                                                                                                                                                                                       |
-| Plugin diagnostics             | `hermes relay doctor --json`                                                                                        | Reports upstream route reachability, Relay loopback state, plugin layout, and legacy bootstrap state                                                                                                                                                                                        |
-| Compat hook lifecycle          | `hermes relay compat status/install/remove`                                                                         | Optional legacy API compatibility hook; not required for the standard path                                                                                                                                                                                                                  |
-| Notifications                  | `GET /notifications/recent?limit=N`                                                                                 | Loopback callers skip bearer                                                                                                                                                                                                                                                                |
-| Relay health                   | `GET /health` on `:8767`                                                                                            | Used by `RelayHttpClient.probeHealth()`                                                                                                                                                                                                                                                     |
-| Capabilities                   | `GET /v1/capabilities` plus targeted `HEAD` probes                                                                  | Prefer capabilities when present; HEAD probes keep mixed-version fallback working                                                                                                                                                                                                           |
-| Desktop CLI (tui channel)      | WSS `tui.attach` / `tui.rpc.request` / `tui.rpc.event`                                                              | Same channel + envelopes as the Ink TUI — the CLI just renders events as plain lines. Zero server changes.                                                                                                                                                                                  |
-| Desktop CLI (terminal channel) | WSS `terminal.attach` / `terminal.input` / `terminal.output` / `terminal.resize` / `terminal.detached`              | Existing channel (shared with Android). CLI `shell` subcommand attaches, injects `clear; exec hermes\n` 350ms after ack, pipes raw bytes. `Ctrl+A .` detaches (tmux preserved), `Ctrl+A k` kills.                                                                                           |
-| Desktop CLI tool visibility    | `tools.list` RPC on the shared tui channel                                                                          | Returns `{toolsets: [{name, description, tool_count, enabled, tools:[]}]}`; surfaced by `hermes-relay tools`                                                                                                                                                                                |
-| Desktop CLI devices            | HTTP `GET/DELETE/PATCH /sessions` on the relay's same port                                                          | Wrapped by `hermes-relay devices list                                                                                                                                                                                                                                                       |
-| Desktop tool routing (Phase B) | WSS `desktop.command` (s→c) + `desktop.response` (c→s) + `desktop.status` (c→s heartbeat)                           | New channel. Hermes calls `desktop_read_file(path)` → Python handler POSTs to `/desktop/desktop_read_file` → relay forwards over `desktop.command` → Node client's `DesktopToolRouter` runs the handler locally → response bubbles back. Mirror of Android's `bridge.command` pattern.      |
-| Desktop tool check_fn          | HTTP `GET /desktop/_ping?tool=<name>`                                                                               | Returns 200 if a client is connected AND advertises this tool; 503 otherwise. Hermes uses this to fail the tool quickly when no desktop client is live, instead of waiting 30s for the dispatch timeout.                                                                                    |
-| Desktop health                 | HTTP `GET /desktop/health`                                                                                          | Returns full status snapshot — connected/host/platform/version/pid/uptime/advertised_tools/last_error/recent_commands. Loopback-only. Backs the `desktop_health` agent tool, which intentionally does NOT round-trip through the client so it remains callable when other tools are wedged. |
-
-
-## Upstream References
-
-
-| Topic                      | Upstream File                                                                 |
-| -------------------------- | ----------------------------------------------------------------------------- |
-| API endpoints              | `gateway/platforms/api_server.py` — all registered HTTP routes                |
-| Platform adapter interface | `gateway/platforms/base.py` — `BasePlatformAdapter` abstract class            |
-| Adding a platform          | `gateway/platforms/ADDING_A_PLATFORM.md` — 16-step checklist                  |
-| Platform registration      | `gateway/run.py` → `_create_adapter()`, `gateway/config.py` → `Platform` enum |
-| Channel directory          | `gateway/channel_directory.py` — how platforms/channels are enumerated        |
-| Send message routing       | `tools/send_message_tool.py` → `platform_map` dict                            |
-| SSE streaming (runs)       | `gateway/platforms/api_server.py` → runs endpoint, `_on_tool_progress`        |
-
-
-## Related Projects
-
- [**hermes-agent**](https://github.com/NousResearch/hermes-agent) — the agent platform (gateway, WebAPI, plugin system)
- [**android-tools-mcp**](https://github.com/Codename-11/android-tools-mcp) — our fork of Android Studio MCP bridge (Compose previews, Gradle, docs)
- [**mobile-mcp**](https://github.com/mobile-next/mobile-mcp) — device control MCP server (ADB, tap/swipe, screenshots)
-
+@AGENTS.md
@@ -1,33 +1,18 @@
 # Hermes-Relay CLI+UI v__VERSION__

-**Release Date:** 2026-08-25
+**Release Date:** 2026-09-02

-This beta makes the Desktop connector resilient through Relay interruptions,
-aligns Windows computer control with current CUA Driver releases, adds a native
-Linux ARM64 build, and hardens installation and update discovery.
+This beta fixes Windows updates so the installed CLI and management UI advance together. Explicit CLI-only installations keep their standalone update path.

 **Beta phase.** Assets remain unsigned, so Windows SmartScreen and macOS Gatekeeper may warn on first launch. Standalone CLI binaries ship for Windows x64, Linux x64/arm64, and macOS x64/arm64; the management UI is Windows-only.

 ## What's changed

-### Added
-
- **Linux ARM64 is a first-class release target.** The one-line installer,
-  updater, checksums, and release artifacts now cover both Linux x64 and arm64.
- **The public site shows the real Windows CLI UI.** Deterministic screenshots
-  cover connections, host access, activity, computer control, and updates.
-
-### Changed
-
- **Public naming is aligned.** Releases use `Hermes-Relay CLI+UI` while the
-  beta keeps its existing `desktop-v*` tag and updater contract.
-
 ### Fixed

- **The daemon reconnects instead of exiting after an interrupted Relay socket.** Relay restarts and repeated transient replacement failures stay on bounded automatic backoff, and terminal failures persist an accurate stopped reason for the UI.
- **Oversized desktop-tool output no longer closes the shared connection.** PowerShell output and every serialized desktop response stay inside the Relay WebSocket budget.
- **Current CUA Driver releases remain compatible by contract.** Driver 0.20 and newer are accepted when their manifest and required tools match Hermes, and Windows uses the manifest-declared direct standard-mode runtime instead of a stale machine-wide daemon.
- **Install and update discovery paginates the multi-surface release history.** Desktop releases remain discoverable after more Android and Server releases, Windows cooperative updates clean their released backup, and unsigned installers retain the normal SmartScreen warning.
+- `hermes-relay update` detects an installed management UI beside the CLI and reports both installed versions.
+- Bundle installations use the checksum-verified Windows installer to update and restart the affected CLI and UI together.
+- Explicit CLI-only installations continue to use the standalone binary updater.

 ## Install

@@ -58,9 +43,4 @@ hermes-relay --version
 hermes-relay hosts list --json
 hermes-relay daemon start
 hermes-relay daemon status --json
-hermes-relay computer-use status --json
 ```
-
-On Windows, click the Hermes-Relay CLI UI notification-area icon to open the management popup directly above it.
-
-See the [CLI and tray guide](https://hermes-relay.dev/docs/desktop/) for installation, access modes, grants, and troubleshooting.
@@ -61,6 +61,15 @@ configuration between invocations and do not add `--no-daemon` to normal dev
 commands; a different heap or Java home starts a separate daemon and discards
 the warm-process benefit.

+On Windows, all repository dev helpers serialize Android build and device work
+through one machine-wide lane shared by every Hermes-Relay worktree. Use
+`scripts/android-lane.ps1` for ad hoc Gradle, connected-test, and APK-install
+commands, and keep Android Studio idle while another owner holds the lane. For
+an exact commit that is already pushed, prefer the `Android On-Demand` workflow
+for heavy verification so concurrent worktrees use isolated GitHub-hosted
+runners. See [Android build execution](docs/android-build-lane.md) for cloud
+presets, the optional full local gate, status, and recovery modes.
+
 Use the narrowest command that proves the change:

 1. `scripts/dev.bat compile` for a Kotlin compile check.
@@ -68,7 +77,15 @@ Use the narrowest command that proves the change:
 3. `scripts/dev.bat install-fast` when the result must run on the connected
   arm64 phone. This passes `-Phermes.devAbi=arm64-v8a`, avoiding the x86,
   x86_64, and armeabi-v7a native libraries in the local APK.
-4. `scripts/dev.bat prepush` before pushing Android work.
+4. `Android On-Demand` after an exact commit is pushed for lint, broad checks,
+   assemblies, or release smoke.
+5. `scripts/dev.bat prepush` only when full local verification is explicitly
+   wanted or cloud execution is unavailable.
+
+Android release preparation uses `python scripts/android-prepush.py
+--release-prep` while version notes are changing. It keeps local feedback to
+metadata and release-presentation tests; the exact pushed commit still goes
+through required CI and Play preflight before publication.

 `install-fast` is intentionally phone-specific. Use `install` for a universal
 sideload debug APK or when the target ABI is not arm64. Release builds remain
@@ -104,6 +121,24 @@ The legacy `relay_server/` directory is a thin compatibility shim around `plugin
 | **CI/CD** | GitHub Actions (lint, build, test, signed APK artifacts) |
 | **Min SDK** | 26 (Android 8.0) / Target SDK 36 |

+## Issues and automated triage
+
+New issues may receive one first response headed **Hermes-Relay automated
+triage**. It reads the live report against current code, documentation, related
+issues, and public release state; it may add existing type/area labels and ask
+for a focused, safe diagnostic such as the app version, interaction mode, or a
+sanitized log excerpt.
+
+GitHub displays the response as authored by `hermes-relay-triage[bot]`, a
+repository-scoped App rather than a maintainer's personal account.
+
+That reply is an acknowledgement and initial analysis, not a maintainer
+decision. The automated path may assign `Codename-11` as the fixed owner for
+follow-up, but assignment does not mean acceptance, priority, implementation,
+or a release commitment. It does not close issues, choose another assignee, set
+milestones or priority, promise a fix or release, or continue the conversation.
+A maintainer will follow up on the thread.
+
 ## Running the Relay Locally

 Only needed if you're working on the bridge, voice, notifications, or media features. Chat alone doesn't need the relay.
@@ -145,6 +180,23 @@ documentation fixes.
 `main` is release history, not the normal contribution target; it receives
 approved release PRs from `dev` and focused hotfix PRs based on production tags.

+Pull requests use [the repository template](.github/pull_request_template.md).
+Keep the body grounded: describe the outcome and focused changes, list exact
+verification, include visual evidence when applicable, state compatibility or
+risk, and preserve contributor lineage when replacing or salvaging prior work.
+Check an item when it is satisfied or when its N/A rationale is written in the
+body; do not use checked boxes as a substitute for evidence.
+
+New external-contributor, non-draft pull requests may receive one
+**Hermes-Relay automated PR intake** reply from `hermes-relay-triage[bot]`.
+Owner-authored `Codename-11` PRs and bot PRs skip this lane. For eligible PRs,
+the bot checks the live body, base branch, changed-path areas, template
+completeness, stated verification, visual proof, and lineage without checking
+out or executing contributor code. It may add bounded area/intake labels and
+identify missing evidence, but it does not review code correctness, approve,
+request changes, merge, close, assign, request reviewers, push commits, edit the
+PR, rerun workflows, or select review bundles.
+
 `origin/dev` is the canonical integration ref. Keep local `dev` as a clean,
 fast-forward-only mirror and create each task in its own branch/worktree from the
 current `origin/dev`. Do not accumulate unpublished commits on local `dev`. If a
@@ -207,28 +259,36 @@ translations may ship as `ai-translated`; do not claim fluent review unless a
 review reference is recorded. Focused correction PRs from fluent contributors
 are the canonical way to improve wording and can advance a locale to
 `community-reviewed` or `verified` under `docs/translation-playbook.md`.
-Translated READMEs use separate `README.<locale>.md` files; `README.md` remains
-the canonical project description. User docs may be added incrementally under
-`user-docs/<locale>/`, with links back to canonical English reference material.
+Translated README entrypoints live under `docs/readme/` as
+`README.<locale>.md`; root `README.md` remains the canonical project
+description. Keep translated entrypoints concise: summarize onboarding and
+core capabilities, link to localized user docs where available, and link back
+to English for fast-moving architecture, security, and operator detail. User
+docs may be added incrementally under `user-docs/<locale>/`, with links back to
+canonical English reference material.

 ## Changelog & writing conventions

-This is a **public repo** — `CHANGELOG.md`, `DEVLOG.md`, the README, and everything under `docs/` ship publicly. Keep them clean:
+This is a **public repo** — `CHANGELOG.md`, `docs/project/DEVLOG.md`, the README, and everything under `docs/` ship publicly. Keep them clean:

- **`CHANGELOG.md`** follows [Keep a Changelog](https://keepachangelog.com/) (Added / Changed / Fixed). Append your change to the `## [Unreleased]` block in the PR. Entries can carry detail while they accumulate, but at release-prep the version block is **condensed to crisp public bullets** (1–2 lines each) — the deep "how we debugged it" narrative belongs in commit messages and `DEVLOG.md`, not the public changelog.
- **`DEVLOG.md`** is a factual engineering log — what changed, why, and how it was verified. Keep it depersonalized and third-person; it's a record, not a diary.
+- **`CHANGELOG.md`** follows [Keep a Changelog](https://keepachangelog.com/) (Added / Changed / Fixed). Append your change to the `## [Unreleased]` block in the PR. Entries can carry detail while they accumulate, but at release-prep the version block is **condensed to crisp public bullets** (1–2 lines each) — the deep "how we debugged it" narrative belongs in commit messages and `docs/project/DEVLOG.md`, not the public changelog.
+- **`docs/project/DEVLOG.md`** is a factual engineering log — what changed, why, and how it was verified. Keep it depersonalized and third-person; it's a record, not a diary.
 - **No non-public wording anywhere committed:** no personal names (attribute impersonally — identity lives in git history), no real server hostnames/IPs or internal deployment names, no AI/assistant process self-narration, no fork/branch plumbing in user-facing notes. Generic example IPs in setup docs are fine.

 Release notes (`RELEASE_NOTES.md`, `app/src/main/assets/whats_new.txt`, `docs/play-store-listing.md`) are theme-framed and user-facing; see [RELEASE.md](RELEASE.md) §2 "Scrub for public distribution" for the full checklist.

 ## Testing

- **Android pre-push gate:** `scripts\dev.bat prepush` on Windows or
-  `./scripts/dev.sh prepush` on macOS/Linux. This runs the Android repository
-  checks, Google Play debug lint, and the same focused unit-test shard used by
-  CI in one cached Gradle invocation. Run it before pushing Android PR updates
-  to catch common hosted failures without waiting for another full Actions
-  cycle; hosted CI remains the exhaustive all-variant gate.
+- **Android cloud verification (preferred for pushed work):** dispatch the
+  registered `Required checks` workflow with an exact base/head SHA pair and
+  `android_preset` set to `focused`, `lint`, `assemble-debug`, `release-smoke`,
+  or `all-final`. It calls the reusable Android workflow from `dev`. Check for
+  an existing run before dispatching the same SHA/preset again. The four
+  `all-final` compute jobs use isolated runners and may execute concurrently.
+- **Full local Android gate (optional):** `scripts\dev.bat prepush` on Windows
+  or `./scripts/dev.sh prepush` on macOS/Linux. This retains the repository
+  checks, full Android lint, and both focused flavor shards for an explicit local
+  run or cloud outage. On Windows it acquires the machine-wide lane.
 - **Focused Android unit test:** `scripts/dev.bat test-one "<fully-qualified-class-or-pattern>"`
 - **Android unit tests:** `scripts/dev.bat test` (runs the sideload debug JUnit + MockK + Compose suite)
 - **Gateway contract lab:** [`docs/gateway-contract-testing.md`](docs/gateway-contract-testing.md)
@@ -237,7 +297,7 @@ Release notes (`RELEASE_NOTES.md`, `app/src/main/assets/whats_new.txt`, `docs/pl
  device lane is scheduled automatically.
 - **Python tests:** `python -m unittest plugin.tests.test_<name>` from the repo root with the hermes-agent venv active. `pytest` works too but the pre-existing `conftest.py` imports a module that isn't always installed — `unittest` avoids that entirely.

-CI is split into path-filtered workflows: `.github/workflows/ci-android.yml` (lint + build + test on app/Gradle changes), `.github/workflows/ci-server.yml` (syntax check + focused server tests on plugin/Python changes), and `.github/workflows/ci-desktop.yml` (desktop type/build/smoke checks). They run on pushes to `main` and `dev` and on PRs targeting either when their paths are touched.
+CI is split into path-filtered workflows: `.github/workflows/ci-android.yml` (lint + build + test on app/Gradle changes), `.github/workflows/ci-server.yml` (syntax check + focused server tests on plugin/Python changes), and `.github/workflows/ci-desktop.yml` (desktop type/build/smoke checks). They run on pushes to `main` and `dev` and on PRs targeting either when their paths are touched. The registered `ci-required.yml` dispatcher calls `android-on-demand.yml` as the trusted manual compute lane for an exact pushed commit; it does not replace required PR checks.
 Superseded Android runs on `dev` and PR refs are canceled automatically; `main`
 runs are never canceled because each release-branch commit must complete its
 independent validation.
@@ -1,26 +1,14 @@
 # Hermes-Relay Plugin v__VERSION__

-**Release Date:** August 25, 2026
+**Release Date:** September 13, 2026

 ## Summary

-This release adds a provider-neutral account-usage surface for Android and Dashboard clients. Relay resolves Codex credential pools, structured Nous balances, and OpenCode Go windows on the Hermes host without returning provider credentials.
-
-Standard chat, session history, and Vanilla Hermes voice remain upstream-owned and do not require this plugin.
-
-## Added
-
- **Provider-neutral usage snapshots.** Authenticated Dashboard clients can resolve the exact active Codex pool entry, Nous balances, and OpenCode Go account windows through one normalized schema.
- **Bounded paired-client fallback.** Operators may explicitly enable the Relay usage route for paired standalone clients while credentials remain host-side.
-
-## Changed
-
- **Usage capabilities are explicit.** Responses identify Relay-enhanced credential pools, structured balances, and provider adapters instead of implying unsupported upstream data.
- **Public product naming is aligned.** Releases use `Hermes-Relay Plugin` while retaining the `server-v*` tag and installation contract.
+Dashboard WebSocket connections work again with current Hermes authentication helpers, while older Hermes hosts remain supported.

 ## Fixed

- **Custom Hermes homes resolve correctly.** Relay profile discovery and session persistence follow `HERMES_HOME` by default while preserving the explicit `RELAY_HERMES_CONFIG` override.
+- Resolve WebSocket guards from their current upstream module and retain the older-host fallback. Single-use tickets, Host/Origin/IP checks, and independent Hermes-Relay session authentication remain enforced. Missing or incomplete helper contracts deny admission.

 ## Install / update

@@ -32,6 +20,8 @@ Standard chat, session history, and Vanilla Hermes voice remain upstream-owned a
    # or, if already installed:
    hermes-relay-update

+Restart or reload the Hermes Dashboard and Relay after updating so the new manifest and prompt context are active.
+
 ## Verify

    hermes relay doctor
@@ -1,5 +1,5 @@
 <p align="center">
-  <img src="assets/play-store-feature-1024x500.png" alt="Hermes-Relay — your Hermes agent, in your pocket" width="800">
+  <img src="assets/readme-hero-v2.jpg" alt="Hermes-Relay — Your Hermes agent. Wherever you are. Android, Voice, Desktop." width="1000">
 </p>

 <p align="center">
@@ -21,7 +21,13 @@
 </p>

 <p align="center">
-  <strong>English</strong> · <a href="README.zh-CN.md">简体中文</a><br>
+  <strong>English</strong> ·
+  <a href="docs/readme/README.de.md">Deutsch</a> ·
+  <a href="docs/readme/README.es.md">Español</a> ·
+  <a href="docs/readme/README.ja.md">日本語</a> ·
+  <a href="docs/readme/README.pt-BR.md">Português (Brasil)</a> ·
+  <a href="docs/readme/README.ru.md">Русский</a> ·
+  <a href="docs/readme/README.zh-CN.md">简体中文</a><br>
  <a href="https://hermes-relay.dev/docs/">Documentation</a> ·
  <a href="https://github.com/Codename-11/hermes-relay/releases">Releases</a> ·
  <a href="https://github.com/Codename-11/hermes-relay/discussions">Discussions</a> ·
@@ -38,10 +44,10 @@ Hermes-Relay puts your [Hermes agent](https://github.com/NousResearch/hermes-age
 - **📱 Android app** — streaming chat, hands-free voice, native plugin pages, and the full Hermes dashboard (models, keys, skills, profiles), rebuilt native. Add a floating Petdex companion or optionally make Hermes your Android assistant; sideload builds can also let the agent read and act on your screen.
 - **⌨️ Hermes-Relay CLI** *(beta)* — a single binary that gives the agent **hands on any machine you pair**: files, terminal, search, screenshots — consent-gated.

-A vanilla [hermes-agent](https://github.com/NousResearch/hermes-agent) install is enough for the upstream standard path: chat, management, voice, Petdex, and ordinary installed-plugin pages. The Hermes-Relay plugin is optional for that base but encouraged for the complete current experience: Terminal/TUI, notifications, media, desktop tools, enhanced voice, Relay sessions, page drafts, and optional Device Control. Hermes-Relay prefers compatible upstream surfaces as they become available instead of keeping duplicate extension paths. **Connect Hermes first, then grant Hermes-Relay separately; the same one-time invite contract pairs Android or the Desktop CLI.**
+A vanilla [hermes-agent](https://github.com/NousResearch/hermes-agent) install is enough for the upstream standard path: chat, management, voice, inbound files, Petdex, and ordinary installed-plugin pages. The Hermes-Relay plugin is optional for that base but encouraged for the complete current experience: Terminal/TUI, notifications, desktop tools, enhanced voice, Relay sessions, page drafts, optional Device Control, and media compatibility or metadata. Hermes-Relay prefers compatible upstream surfaces as they become available instead of keeping duplicate extension paths. **Connect Hermes first, then grant Hermes-Relay separately; the same one-time invite contract pairs Android or the Desktop CLI.**

 <p align="center">
-  <img src="docs/diagrams/architecture-homepage.png" alt="How Hermes-Relay connects — upstream Hermes owns Chat, Manage, and standard Voice; the encouraged Relay extension fills current gaps for Terminal, notifications, media, enhanced voice, sessions, desktop tools, and optional Device Control." width="900">
+  <img src="assets/readme-connection-map-v2.png" alt="How Hermes-Relay connects — Dashboard and Gateway own the standard Android path for Chat, Manage, Voice, and inbound files; the optional Relay plugin separately adds Android enhancements plus CLI and UI tools; sideload adds Device Control." width="1000">
 </p>

 ## Quick Start (Android)
@@ -50,7 +56,7 @@ Install → connect → talk, in about two minutes.

 ### 1 · Install the app

- **Google Play** *(easiest — auto-updates)* — [**install from Google Play**](https://play.google.com/store/apps/details?id=com.axiomlabs.hermesrelay). Chat, voice, sessions, and Manage work with standard Hermes; pairing the Hermes-Relay plugin adds Terminal/TUI, media, notifications, and Relay sessions.
+- **Google Play** *(easiest — auto-updates)* — [**install from Google Play**](https://play.google.com/store/apps/details?id=com.axiomlabs.hermesrelay). Chat, voice, sessions, Manage, and inbound files work with standard Hermes; pairing the Hermes-Relay plugin adds Terminal/TUI, notifications, Relay sessions, and media enhancements.
 - **APK** *(full phone-control feature set)* — download the file ending in **`-sideload-release.apk`** from the newest `android-v*` release on [GitHub Releases](https://github.com/Codename-11/hermes-relay/releases) and open it (allow your browser to install unknown apps the first time). Integrity verification, signing fingerprint, and per-build details are in the [Sideload guide](https://hermes-relay.dev/docs/guide/getting-started.html#sideload-apk).

 Sideload builds check GitHub for updates and show a one-tap banner when you're behind; Play builds update through the Store. See [Release tracks](https://hermes-relay.dev/docs/guide/release-tracks) for the capability matrix.
@@ -58,7 +64,7 @@ Sideload builds check GitHub for updates and show a one-tap banner when you're b
 ### 2 · Have the Hermes Dashboard running

 The normal Android connection uses the upstream Hermes Dashboard/Gateway for
-chat, sign-in, sessions, Manage, and voice. Installing Hermes and choosing a
+chat, sign-in, sessions, Manage, voice, and inbound files. Installing Hermes and choosing a
 provider is vanilla Hermes setup:

 ```bash
@@ -77,16 +83,15 @@ the [remote-access guide](https://hermes-relay.dev/docs/guide/remote-access/).

 ### 3 · Connect and talk

-For a plugin-enabled host, open the Web Dashboard's **Relay** page, click
-**Connect mobile app**, and scan that tokenless QR from Android **Connect → Scan
-Hermes setup QR**. It contains only the Dashboard address and configures the
-upstream Chat, sessions, Manage, sign-in, and standard voice connection.
-
-Without the Dashboard plugin, use **Find Hermes on LAN** or enter the Dashboard
-address manually (conventionally `http://<host>:9119`). Sign in through the
+Use **Find Hermes on LAN** or enter the Dashboard address manually
+(conventionally `http://<host>:9119`). Sign in through the
 Dashboard's configured provider when prompted. The app probes the available
 upstream capabilities and finishes with a connection summary.

+If the Relay Dashboard page is already installed, **Connect mobile app** offers
+the same standard connection as a tokenless QR. It contains only the Dashboard
+address and does not install, enable, or pair Relay.
+
 The separate API server can be discovered automatically or added later under
 **Advanced** as a chat fallback or for a headless compatibility setup. Its API
 key is requested only when that optional endpoint is configured. Existing
@@ -99,19 +104,19 @@ The wizard probes everything and finishes with a capability card:
 | **Chat** | Dashboard/Gateway ready — you can talk |
 | **Manage** | Models, keys, skills, and profiles are available from the phone |
 | **Voice** | Speech ready via your server (or one Manage sign-in away) |
-| **API fallback** | Optional API route available/unavailable |
+| **Direct API** | Optional API-only compatibility route available/unavailable |
 | **Relay** | Recommended extensions paired/unpaired; never blocks the upstream path |

 One dashboard sign-in unlocks Chat, Manage, sessions, and standard voice. That's
 the whole Vanilla Hermes setup.

-> **Going places?** Add the Dashboard's Tailscale address — for example `http://100.x.y.z:9119` or a separately published `https://host.ts.net` URL — under **Settings → Connections → Routes**. Android tests it as a Dashboard route; no API server or API key is required. The app uses LAN at home and switches routes automatically when you leave. See [Remote access](https://hermes-relay.dev/docs/guide/remote-access).
+> **Going places?** Add the Dashboard's Tailscale address — for example `http://100.x.y.z:9119` or a separately published `https://host.ts.net` URL — under **Settings → Gateways → Routes**. Android tests it as a Dashboard route; no API server or API key is required. The app uses LAN at home and switches routes automatically when you leave. See [Remote access](https://hermes-relay.dev/docs/guide/remote-access).

 ### 4 · Recommended: pair Relay for the complete experience

-Install Relay for Terminal/TUI, notifications, media handoff, desktop tools,
-enhanced voice, Relay sessions, approval-gated page drafts, and optional Device
-Control:
+Install Relay for Terminal/TUI, notifications, desktop tools, enhanced voice,
+Relay sessions, approval-gated page drafts, optional Device Control, and media
+compatibility or sensitivity metadata:

 ```bash
 hermes plugins install Codename-11/hermes-relay/plugin --enable
@@ -124,7 +129,7 @@ Use `--no-ssl` only on a trusted LAN or VPN. Use the
 exposing any Hermes surface beyond that network.

 Refresh or restart the Dashboard/Gateway, open **Relay → Pair new device**, and
-scan the one-time QR from Android **Settings → Connections → Pair Hermes Relay**.
+scan the one-time QR from Android **Settings → Gateways → Access → Pair Relay**.
 Leave mode on **Auto** for the recommended route discovery. The same dialog
 shows a copyable invite for Desktop CLI clients:

@@ -140,7 +145,7 @@ manual fallbacks when QR or clipboard transfer is unavailable.
 [Desktop CLI pairing](https://hermes-relay.dev/docs/desktop/pairing) ·
 [server, TLS, legacy install, and uninstall reference](https://hermes-relay.dev/docs/reference/relay-server)

-**Requirements:** Android 8.0+ (SDK 26) · current upstream [hermes-agent](https://github.com/NousResearch/hermes-agent) with the Dashboard/Gateway enabled · Python 3.11+ when installing the Hermes-Relay plugin. The API fallback is optional; the Hermes-Relay plugin is encouraged for the complete experience.
+**Requirements:** Android 8.0+ (SDK 26) · current upstream [hermes-agent](https://github.com/NousResearch/hermes-agent) with the Dashboard/Gateway enabled · Python 3.11+ when installing the Hermes-Relay plugin. Direct API is optional; the Hermes-Relay plugin is encouraged for the complete experience.

 ## Screenshots

@@ -154,11 +159,16 @@ manual fallbacks when QR or clipboard transfer is unavailable.
  <tr>
    <td align="center" width="25%"><img src="assets/screenshots/05_themes.png" alt="App themes" width="100%"><br><sub><b>App themes</b></sub></td>
    <td align="center" width="25%"><img src="assets/screenshots/06_manage.png" alt="Manage your agent" width="100%"><br><sub><b>Manage your agent</b></sub></td>
-    <td align="center" width="25%"><img src="assets/screenshots/07_connections.png" alt="Connections and routes" width="100%"><br><sub><b>Connections &amp; routes</b></sub></td>
+    <td align="center" width="25%"><img src="assets/screenshots/07_connections.png" alt="Gateways and routes" width="100%"><br><sub><b>Gateways &amp; routes</b></sub></td>
    <td align="center" width="25%"><img src="assets/screenshots/08_appearance.png" alt="Agent avatar &amp; skins" width="100%"><br><sub><b>Avatars &amp; skins</b></sub></td>
  </tr>
 </table>

+<p align="center">
+  <img src="assets/screenshots/supplemental/15_git_workspace.png" alt="Native Git workspace showing repository changes, an inline diff, and staging controls" width="260"><br>
+  <sub><b>Native Git workspace</b> — upstream session context with optional Relay discovery and operations</sub>
+</p>
+
 ### Simplified Chinese

 <table>
@@ -210,7 +220,7 @@ hermes-relay update                            # self-update via GitHub Releases

 It pairs against the **same relay and credential store** as the Android app — pair once from either, both work. Tagged on the `desktop-v*` [release track](https://github.com/Codename-11/hermes-relay/releases?q=desktop), with historical releases still visible under `cli-v*`.

-On Windows, the default installer adds the optional compact **Hermes-Relay CLI UI** tray popup for host selection and pairing, connection and daemon state, per-host Ask/Trusted/Full Access, local grant dialogs, authorized-client revocation, activity, settings, and emergency stop. It is a management surface only—chat, TUI, plugins, voice, and agent sessions remain CLI/upstream concerns.
+On Windows, the default installer adds the optional compact **Hermes-Relay CLI UI** tray popup for host selection and pairing, connection and daemon state, per-host Ask/Trusted/Full Access, local grant dialogs, authorized-client revocation, activity, settings, and emergency stop. `hermes-relay update` detects this bundle and updates the CLI and UI together; explicit CLI-only installations stay headless and continue using the standalone binary updater. The UI is a management surface only—chat, TUI, plugins, voice, and agent sessions remain CLI/upstream concerns.

 <table>
  <tr>
@@ -234,17 +244,17 @@ remote tool surface. See the [desktop tools guide](https://hermes-relay.dev/docs
 ## How It Works

 ```
-Phone        (HTTP/WSS) --> Hermes Dashboard  (:9119)   [chat gateway, manage, vanilla voice]
-Phone        (HTTP/SSE) --> Hermes API Server (:8642)   [chat fallback, sessions, runs]
-Phone        (WSS/HTTP) --> Relay             (:8767)   [terminal, bridge, media, relay voice, sessions]
+Phone        (HTTP/WSS) --> Hermes Dashboard  (:9119)   [chat gateway, manage, vanilla voice, inbound files]
+Phone        (HTTP/SSE) --> Hermes API Server (:8642)   [Direct API chat, sessions, runs]
+Phone        (WSS/HTTP) --> Relay             (:8767)   [terminal, bridge, media enhancements, relay voice, sessions]
 CLI          (WSS)      --> Relay             (:8767)   [machine tools, tui, terminal]
 ```

-Chat prefers the Hermes dashboard gateway when Manage auth is ready, then falls
-back to the upstream API server SSE path with the API key. Manage and Vanilla Hermes
+Standard connections keep Chat on the Hermes Dashboard/Gateway. Explicit API-only
+connections use the upstream Direct API SSE path with an API key. Manage and Vanilla Hermes
 voice ride the Hermes dashboard with its own one-time sign-in, so a vanilla
-install needs no plugin for either. The optional relay on `:8767` adds the power
-surfaces: terminal, bridge phone control, media handoff, machine tools, and
+install needs no plugin for those surfaces or ordinary inbound files. The optional relay on `:8767` adds
+terminal, bridge phone control, media compatibility/metadata, machine tools, and
 relay-side voice, which is preferred automatically when paired. One QR can
 configure API, dashboard, and relay routes without merging their auth models.

@@ -1,109 +0,0 @@
-<p align="center">
-  <img src="assets/play-store-feature-1024x500.png" alt="Hermes-Relay — 随身携带您的 Hermes 代理" width="800">
-</p>
-
-<p align="center">
-  <strong>运行在您的电脑上，连接到您的设备。</strong><br>
-  Hermes-Relay 是 <a href="https://github.com/NousResearch/hermes-agent">Hermes Agent</a> 的原生 Android 客户端，提供流式聊天、免手动语音和代理管理；另有单文件 CLI，让代理在已配对的电脑上安全使用终端、文件和截图工具。
-</p>
-
-<p align="center">
-  <strong>简体中文</strong> · <a href="README.md">English</a><br>
-  <a href="https://hermes-relay.dev/docs/zh-CN/">中文文档</a> ·
-  <a href="https://github.com/Codename-11/hermes-relay/releases">版本下载</a> ·
-  <a href="https://github.com/Codename-11/hermes-relay/discussions">社区讨论</a> ·
-  <a href="CHANGELOG.md">更新日志</a>
-</p>
-
-> 英文 [README.md](README.md) 是最新、完整的项目说明。本页维护中文安装入口和核心功能摘要；协议、架构和维护者文档以英文版本为准。
-
-## 功能简介
-
- **Android 应用**：流式聊天、会话历史、文件附件、Hermes 管理、语音模式、原生插件页面、Petdex 悬浮宠物、多连接和配置文件；也可将 Hermes 设为 Android 助手。
- **无需插件的标准路径**：聊天、管理和标准语音可直接连接未修改的上游 Hermes Agent。
- **可选 Relay 插件**：增加终端、手机控制、媒体传输、通知助手、Relay 语音、电脑工具，以及需确认的代理创建插件页面草稿。
- **安全连接**：二维码配对、Android Keystore、证书固定、按通道授权和可配置会话有效期。
- **远程使用**：可配置 Tailscale 或 HTTPS 地址，在家庭局域网和远程路由之间自动切换。
- **两种 Android 发行渠道**：Google Play 版本适合日常使用；sideload 版本包含完整手机控制能力。
-
-## 快速开始
-
-### 1. 安装 Android 应用
-
- [Google Play](https://play.google.com/store/apps/details?id=com.axiomlabs.hermesrelay)：自动更新，包含聊天、语音、管理、终端、媒体和通知功能。
- [GitHub Releases](https://github.com/Codename-11/hermes-relay/releases)：下载最新 `android-v*` 版本中以 `-sideload-release.apk` 结尾的文件，获得完整手机控制功能。
-
-### 2. 启动 Hermes API 服务
-
-手机需要能够访问 Hermes API 服务，并使用 API 密钥进行身份验证：
-
-```bash
-hermes setup --portal
-
-mkdir -p ~/.hermes
-API_SERVER_KEY="$(openssl rand -hex 32)"
-cat >> ~/.hermes/.env <<EOF
-API_SERVER_ENABLED=true
-API_SERVER_HOST=0.0.0.0
-API_SERVER_PORT=8642
-API_SERVER_KEY=$API_SERVER_KEY
-EOF
-chmod 600 ~/.hermes/.env
-
-echo "Android API URL: http://<电脑IP>:8642   key: $API_SERVER_KEY"
-hermes gateway
-```
-
-`0.0.0.0` 会让同一网络中的设备访问 API。请保留强密钥；离开可信局域网时，应使用 Tailscale 或 HTTPS 反向代理，不要直接把端口暴露到互联网。
-
-### 3. 在手机上连接
-
-打开应用后，可以：
-
- 扫描局域网中的 Hermes；
- 手动输入 `http://<主机>:8642` 和 API 密钥；
- 扫描包含 API、Dashboard 和可选 Relay 地址的设置二维码。
-
-如需在手机上管理模型、密钥、技能和配置文件，请运行 Hermes Dashboard，并在应用的 **管理** 页面登录一次。同一登录会话也会启用标准语音。
-
-### 4. 可选：安装 Relay
-
-仅在需要终端、手机控制、媒体路由、Relay 会话、实时语音、电脑工具或代理创建插件页面草稿时安装：
-
-```bash
-hermes plugins install Codename-11/hermes-relay/plugin --enable
-hermes relay doctor
-hermes relay start --no-ssl
-hermes pair
-```
-
-已安装的 Hermes 插件可通过已认证的 Dashboard 向 Android 提供由应用安全渲染的原生页面，无需在手机上运行插件代码。Relay 1.5.0 另支持需用户确认的代理创建页面草稿。
-
-完整说明请阅读[中文快速开始](https://hermes-relay.dev/docs/zh-CN/guide/quick-start)；远程访问、协议和高级配置暂时链接到英文参考文档。
-
-安装问题、早期想法、一般交流和作品分享请使用 [GitHub Discussions](https://github.com/Codename-11/hermes-relay/discussions)。可复现的错误和明确、可执行的功能请求请提交到 [Issues](https://github.com/Codename-11/hermes-relay/issues/new)。
-
-## 中文界面
-
-<table>
-  <tr>
-    <td align="center" width="33%"><img src="assets/screenshots/Zh01.jpg" alt="中文设置界面" width="100%"><br><sub><b>设置</b></sub></td>
-    <td align="center" width="33%"><img src="assets/screenshots/Zh02.jpg" alt="中文管理界面" width="100%"><br><sub><b>管理</b></sub></td>
-    <td align="center" width="33%"><img src="assets/screenshots/Zh03.jpg" alt="中文导航界面" width="100%"><br><sub><b>导航</b></sub></td>
-  </tr>
-</table>
-
-## 参与翻译
-
-Android 英文资源是规范来源。新增语言必须保持资源名称、类型和格式参数一致，并通过：
-
-```bash
-python scripts/check-android-locales.py
-./gradlew lint
-```
-
-翻译规范、目录命名、复数和占位符规则见 [docs/localization.md](docs/localization.md)。
-
-## 许可证
-
-[MIT](LICENSE) — Copyright (c) 2026 [Axiom-Labs](https://codename-11.dev)
@@ -200,6 +200,11 @@ never create a staging branch. Stable production tags are cut only from the new
 10. Build and publish that surface's artifacts, roll out or deploy from the
    immutable tag, and verify the release and live environment.

+Do not back-merge a normal release. The `main` release merge already has the
+released `dev` tip as its integration parent, so merging it back only adds
+history noise. The release-backmerge workflow detects this topology and exits
+successfully without changing `dev`.
+
 ### Branch names

 | Prefix | When | Example |
@@ -258,7 +263,9 @@ The intended settings are:
 - **`main`** — PRs required; `Required checks` required and current; force push
  and deletion blocked. Normal work does not target this branch.
 - **`dev`** — PRs and `Required checks` required; force push and deletion
-  blocked. This is the normal contribution target.
+  blocked. This is the normal contribution target. The release-backmerge
+  workflow is the sole exception: its automation identity may compare-and-swap
+  `dev` to an exact checked merge commit after a stable hotfix release.
 - **Merge policy** — merge commits allowed; squash and rebase merges disabled so
  the no-ff contract cannot be bypassed in the GitHub UI.
 - **Default branch** — `main`, which remains the release-history branch and the
@@ -523,10 +530,17 @@ the new app version and a higher `appVersionCode`.
  run Android's retrace tool with the matching flavor mapping:
  `retrace <mapping.txt> <obfuscated-trace.txt>`. Play reports can additionally
  use the mapping bundled into the uploaded AAB through Play Console.
- `app/src/main/assets/whats_new.txt` — in-app "What's New" content
-  shown in the settings/about screen. Update with the version number
-  and a brief feature summary. Gets stale silently if forgotten
-  (v0.4.0 shipped with 0.1.0 content until caught post-release).
+- `app/src/main/assets/changelog.json` — curated source for the in-app
+  **What's New** dialog and Android release history. Prepend one schema-3 entry
+  with a single descriptive release `title`, a plain-language `summary`, and a
+  complete `changes` inventory. Every user-visible change has a stable `id`, a
+  `kind` (`added`, `improved`, or `fixed`), a short title, a useful explanation,
+  and an optional `highlight: true`; select 1–4 highlights. Add `compatibility`
+  bullets only when users need an availability, migration, flavor, or Plugin
+  boundary, plus Android-only `playNotes`. The app derives toast counts and
+  previews from the same inventory and renders every change exactly once.
+- `app/src/main/assets/whats_new.txt` — legacy in-app fallback generated from
+  the newest structured entry. Do not edit it independently.
 - `app/src/googlePlay/play/release-notes/en-US/default.txt` — the Play
  Console **"What's new"** text, which gradle-play-publisher reads at
  upload to fill the Production-draft release notes. This is **separate**
@@ -534,19 +548,62 @@ the new app version and a higher `appVersionCode`.
  this file is missing or stale, the Play draft ships with empty/wrong
  notes (shipped empty in v1.1.0 until caught post-release). Keep it
  **≤500 chars per language**, user-facing, Android-only.
- `docs/play-store-listing.md` — Play Store listing copy. Update
-  the version reference and the "Release Notes" section that gets
-  pasted into the Play Console "What's new" field. Keep the Play
-  "What's new" within **500 characters** and framed around the
-  release's themes, not a feature dump. Compare its **Foreground service
+- `docs/play-store-listing.md` — Play Store listing copy. Its release-note
+  block and the Gradle Play Publisher note are generated from `playNotes`.
+  After editing the newest structured entry, run
+  `python scripts/check-android-release-notes.py --write`, then run it again
+  without `--write` to validate complete unique change records, 1–4 highlights,
+  the current Android version, GitHub-release/changelog headings, derived files, and Play's
+  **500-character** limit. Frame Play copy around the release's themes, not a
+  feature dump. Compare its **Foreground service
  permissions** section with the merged `googlePlayRelease` manifest and
  complete Play Console declarations for every declared service type before
  approval; the Publisher API can upload a draft and still reject promotion
  when an App content declaration is missing.

+#### Generate release copy from the verified changes
+
+When release copy is generated with an agent, this section is the canonical
+authoring contract; do not maintain a separate prompt file.
+
+1. Read the exact Android version/SHA, the Android-only entries selected from
+   `[Unreleased]`, the implemented behavior, and any compatibility or security
+   boundary that users must understand. Do not generate from commit titles or
+   a mixed-surface changelog block alone.
+2. Before editing release files, show a temporary coverage ledger in the task
+   output. Map every selected Android source change to one stable change id and
+   one kind (`added`, `improved`, or `fixed`), and mark whether it is a
+   highlight. The ledger is review evidence, not a committed public artifact;
+   no selected user-visible change may disappear silently or be counted twice.
+3. Write one release title that describes the release as a whole. Do not let a
+   narrow feature name, internal project label, or poetic codename replace the
+   title users see in the toast and history. Follow it with a one- or two-sentence
+   summary that gives the release's overall outcome without becoming a feature dump.
+4. Select 1–4 highlights from the complete change inventory. A highlight is a
+   strong reason to care, not a second copy of the change: the app presents it
+   once in the highlight section and derives the remaining counts and previews
+   from non-highlighted changes.
+5. Include every meaningful user-visible addition, improvement, and fix in
+   `changes`, using plain titles and enough explanation for someone to recognize
+   the affected behavior. Internal refactors, tests, CI mechanics, branch work,
+   and debugging history stay in `RELEASE_NOTES.md`, `CHANGELOG.md`, or engineering
+   records unless they materially change reliability, security, or compatibility.
+6. Write each surface for its audience:
+   - `RELEASE_NOTES.md`: concise Summary plus Added/Changed/Fixed; keep the
+     deterministic Download and Install/Verify scaffolding intact.
+   - `CHANGELOG.md`: complete, crisp public history for the released surface.
+   - `changelog.json`: overall title/summary, complete typed changes, selected
+     highlights, compatibility boundaries, and Play copy. Counts and previews
+     are derived; never author a parallel digest.
+   - `playNotes`: Android-only themes within the rendered 500-character limit.
+7. Before presenting the draft, check that wording begins with user outcomes,
+   avoids unexplained implementation terminology, uses exact public product
+   names, makes no unverified device claim, and passes the public-distribution
+   scrub below.
+
 #### Scrub for public distribution

-This is a **public repo** and these four files are user-facing. Before
+This is a **public repo** and these release-note files are user-facing. Before
 promoting the `[Unreleased]` block and writing the notes, scrub the
 versioned CHANGELOG block and all three release-notes artifacts for
 wording that shouldn't ship publicly. The CHANGELOG accumulates in a
@@ -571,6 +628,21 @@ and the release notes and learn only what the software does.

 ### 3. Build and verify locally

+During release-note/version iteration, use the narrow release-prep lane:
+
+```powershell
+python scripts/android-prepush.py --release-prep
+```
+
+It runs release metadata checks plus the rendered Changelog/What's New tests in
+the serialized Android lane. Once the exact commit is pushed, current-head CI
+and Play preflight own lint, focused shards, both-flavor assemblies, signing,
+and final package scans. Do not repeat the complete local release build unless
+cloud execution is unavailable or explicit local artifact/device proof is
+needed.
+
+For that explicit full local proof:
+
 ```bat
 scripts\dev.bat bundle
 keytool -printcert -jarfile app\build\outputs\bundle\googlePlayRelease\hermes-relay-*-googlePlay-release.aab
@@ -604,14 +676,17 @@ The preflight workflow:
 3. builds and release-signs the same APK/AAB variants used by the public release;
 4. scans the final minified APK DEX for unsupported collection calls;
 5. uploads the Google Play AAB as a private **Production draft**; and
-6. records a 30-day preflight proof keyed to the version and Git tree hash.
+6. retains the exact signed sideload APK, Play AAB, R8 mappings, manifest, and
+   checksums as one immutable 30-day artifact keyed to version and Git tree.

 No sideload APK or GitHub Release is published by preflight. A successful signed
-build, final DEX scan, and Production-draft upload is the automated Play release
-gate. Play Console pre-review and pre-launch reports are informational and
-non-blocking because their detailed results are not exposed through the release
-automation API. If the release source changes after preflight, rerun it—the
-approval workflow matches the complete Git tree, not just the version number.
+build, final package scans, and Production-draft upload is the automated Play
+release gate. The private artifact is immutable and hash-verified again before
+publication; the stable release workflow does not rebuild those bytes. Play
+Console pre-review and pre-launch reports are informational and non-blocking
+because their detailed results are not exposed through the release automation
+API. If the release source changes after preflight, rerun it—the approval
+workflow matches the complete Git tree, not just the version number.

 GitHub exposes manual workflows only after their workflow file exists on the
 default branch. For the first release that introduces this process, merge the
@@ -632,7 +707,9 @@ git checkout dev
 git pull --ff-only origin dev

 git add gradle/libs.versions.toml RELEASE_NOTES.md CHANGELOG.md \
-        app/src/main/assets/whats_new.txt docs/play-store-listing.md
+        app/src/main/assets/changelog.json app/src/main/assets/whats_new.txt \
+        app/src/googlePlay/play/release-notes/en-US/default.txt \
+        docs/play-store-listing.md
 git commit -m "release(android): android-v0.6.2"
 git push origin dev

@@ -650,12 +727,13 @@ from `main`; every release job explicitly checks out and verifies the immutable
 an existing tag or changing its artifact tree. Manual stable tags are still
 guarded by the same preflight proof in the tag workflow.

-The tag-triggered `.github/workflows/release-android.yml` rebuilds and scans the
-artifacts, changes the existing Play Production draft to `completed` (submitting
-it for review), and only after Play accepts that operation creates the public
-GitHub Release with the sideload APK. A missing preflight, changed release tree,
-missing Play credential, or Play submission failure prevents public GitHub
-publication.
+The tag-triggered `.github/workflows/release-android.yml` downloads the exact
+private preflight artifact by ID, verifies its source workflow, manifest, tree,
+version, sizes, and hashes, reruns the package scanners, then changes the
+existing Play Production draft to `completed` (submitting it for review). Only
+after Play accepts that operation does it publish those same APK/AAB bytes on
+GitHub. A missing preflight, changed release tree, artifact mismatch, missing
+Play credential, or Play submission failure prevents public publication.

 Plugin/Python version files are intentionally not part of an Android app
 release unless the plugin package itself is also being released.
@@ -684,14 +762,19 @@ git commit -m "release(server): server-v0.6.2"
 git push origin dev

 # Open the release PR (dev -> main) and merge with --no-ff.
-# After merge, tag from the new main tip:
-git checkout main
-git pull --ff-only origin main
-git tag server-v0.6.2
-git push origin server-v0.6.2
+# Then run "Hermes-Relay Plugin and CLI+UI Release Approval" from main,
+# select plugin, and enter 0.6.2. The workflow selects and validates main
+# before it creates server-v0.6.2 and starts the immutable-tag release workflow.
 ```

-Pushing `server-v*` triggers `.github/workflows/release-plugin.yml`, which
+For a Plugin prerelease, keep the release-prepared commit on `dev` and run the
+same trusted approval workflow from `main`; the version suffix makes it select
+and validate the exact `origin/dev` tip before creating the tag. Stable versions
+select `origin/main` instead.
+Direct `server-v*` tag pushes remain a recovery path and are guarded by the same
+branch-containment and metadata checks.
+
+The approval workflow dispatches `.github/workflows/release-plugin.yml`, which
 validates all plugin-owned version metadata with
 `scripts/check-plugin-version-sync.py`. Run
 `python scripts/check-version-tracks.py` locally before tagging when a change
@@ -722,20 +805,25 @@ git add desktop/package.json desktop/package-lock.json desktop/src/version.ts `
 git commit -m "release(desktop): desktop-v0.4.0-alpha.2"
 git push origin dev

-# Open the release PR (dev -> main) and merge with --no-ff.
-# After merge, tag from main:
-git switch main
-git pull --ff-only origin main
-cd desktop
-npm run check:version-sync -- --expect 0.4.0-alpha.2
-cd ..
-git tag desktop-v0.4.0-alpha.2
-git push origin desktop-v0.4.0-alpha.2
+# This is a prerelease: run "Hermes-Relay Plugin and CLI+UI Release Approval"
+# from main, select desktop, and enter 0.4.0-alpha.2. The workflow validates dev
+# before it creates the tag and starts the immutable-tag release workflow.
 ```

-The tag workflow rejects version drift and tags whose commit is not in
-`origin/main`, reruns CLI tests, builds all four standalone binaries, tests and
-packages the Windows tray, generates checksums, and publishes the GitHub Release.
+For a stable CLI+UI version, first merge the release PR from `dev` to `main`,
+then run the approval workflow from `main`. The version determines the source:
+prereleases select the exact `origin/dev` tip and stable releases select the
+exact `origin/main` tip before creating any tag. Direct `desktop-v*` tag pushes
+remain a recovery path.
+
+The release workflow rejects version drift and requires prerelease tags to be
+contained in `origin/dev` and stable tags to be contained in `origin/main`. It
+reruns CLI tests, builds all four standalone binaries, tests and packages the
+Windows tray, generates checksums, and publishes the GitHub Release.
+Trusted desktop CI and the release installer job share a Cargo/target cache
+keyed by the lockfile and exact tray sources. A `main` push for the release tree
+warms the exact cache before the immutable tag build; a miss safely performs the
+ordinary Rust/Tauri build.

 ### 6. Play review and publishing behavior

@@ -836,7 +924,7 @@ gradlew promoteReleaseArtifact --from-track=internal --promote-track=production
  (This step was only needed as a retrofit for v0.1.0 — v0.1.1+ inherit
  the Download section automatically from `RELEASE_NOTES.md`.)
 - Confirm Play Console shows the new versionCode on the target track.
- Update `DEVLOG.md` with a short entry for the release.
+- Update `docs/project/DEVLOG.md` with a short entry for the release.

 ## CI Behavior

@@ -844,28 +932,40 @@ Android, Plugin, dashboard, and desktop now have separate CI/release lanes.
 This keeps a dashboard CSS fix from running the full server suite, and keeps
 plugin changes from forcing an Android app `versionCode` bump.

+Every successful `Required checks` run records a short-lived proof keyed to the
+checked Git tree. For the canonical `dev` → `main` release PR, CI first proves
+the simulated merge tree is identical to the `dev` tree. If an unexpired proof
+from a successful Required-checks run exists, the PR verifies and reuses it;
+otherwise it automatically falls back to the normal path-aware matrix. Content
+changes can never reuse an older proof because they change the tree hash.
+
 On every push of a tag matching `android-v*`, `.github/workflows/release-android.yml`:

 1. Verifies a stable tag resolves to a commit contained in `main`, or a
   prerelease tag resolves to a commit contained in `dev`, and that the tag matches `appVersionName` in
   `gradle/libs.versions.toml` (mismatches fail the workflow).
-2. Runs the Android debug build and the stable sideload pairing/connection
-   regression slice with explicit timeouts.
-3. Decodes `HERMES_KEYSTORE_BASE64` into `$RUNNER_TEMP/release.keystore`
-   and exports `HERMES_KEYSTORE_PATH` (skipped if the secret is unset).
-4. For stable releases, builds all four flavored release artifacts
-   (`./gradlew bundleRelease assembleRelease`); only the sideload APK and
-   googlePlay AAB are attached. For prereleases, builds only the side-by-side
-   `sideloadCandidate` APK.
-5. Generates `SHA256SUMS.txt` covering the two attached files.
-6. For stable releases only, promotes the exact preflighted Production draft to
+2. For stable releases, verifies and downloads the exact immutable Play
+   preflight artifact; prereleases run the focused CI slice and build the
+   side-by-side `sideloadCandidate` APK.
+3. Revalidates stable artifact hashes, DEX collection compatibility, packaged
+   native compatibility, and retained R8 mappings without recompiling.
+4. Generates candidate checksums when applicable; stable checksums come from
+   the verified preflight artifact and cover the two public files.
+5. For stable releases only, promotes the exact preflighted Production draft to
   `completed`; prereleases never upload to Play.
-7. Creates a GitHub Release named `Hermes-Relay Android v<version>` with `RELEASE_NOTES.md` as
+6. Creates a GitHub Release named `Hermes-Relay Android v<version>` with `RELEASE_NOTES.md` as
   the body. Attaches the APK, AAB, and `SHA256SUMS.txt`. Tags any version
   containing a dash (e.g. `android-v0.2.0-beta.1`) as a prerelease automatically.
-8. Prints a `$GITHUB_STEP_SUMMARY` with the release and Play result.
+7. Prints a `$GITHUB_STEP_SUMMARY` with the release and Play result.

-On every push of a tag matching `server-v*`,
+For an approved multi-surface train, run **Hermes-Relay Coordinated Release
+Approval** from `main`, select the affected surfaces, and enter their prepared
+versions. It dispatches Android, Plugin, and CLI+UI approval jobs concurrently;
+each surface keeps its independent source, validation, tag, artifact, and
+publication workflow.
+
+On every direct push of a tag matching `server-v*`, or after an approved
+dispatch from `.github/workflows/approve-release-extensions.yml`,
 `.github/workflows/release-plugin.yml`:

 1. Verifies a stable tag commit is contained in `main`, or a prerelease tag is
@@ -878,7 +978,8 @@ On every push of a tag matching `server-v*`,
 5. Creates a GitHub Release named `Hermes-Relay Plugin v<version>` with the wheel,
   sdist, and checksum file attached.

-On every push of a tag matching `desktop-v*`,
+On every direct push of a tag matching `desktop-v*`, or after an approved
+dispatch from `.github/workflows/approve-release-extensions.yml`,
 `.github/workflows/release-cli.yml` builds and publishes the CLI binaries and
 Windows tray installer. Its GitHub Release body comes from `CLI_RELEASE_NOTES.md`
 (rewritten per release — the CLI counterpart of `RELEASE_NOTES.md`); the workflow
@@ -922,8 +1023,23 @@ When production has a bug, use the same invariant for every surface:
 4. Open the focused hotfix PR into `main` and merge with a merge commit/no-ff.
 5. Tag the new `main` tip with the affected surface's patch tag.
 6. Verify the artifacts and production rollout or deployment.
-7. Merge `main` back into `dev` immediately so integration inherits the fix and
-   version history.
+7. Let the stable release workflow dispatch `Release Backmerge`. A
+   conflict-free candidate runs the same path-aware `Required checks` against
+   its exact SHA, then compare-and-swaps `dev` only if the base ref is unchanged.
+   Conflicts, failed checks, stale refs, or a denied update require a normal
+   reconciliation PR.
+
+`Release Backmerge` accepts only published stable `android-v*`, `server-v*`, or
+`desktop-v*` SemVer tags contained in `main`. It exits without mutation for a
+normal release whose integration parent is already in `dev`. For a selective
+hotfix, it pushes a temporary merge ref, dispatches `Required checks` with full
+base/head SHAs, and updates `dev` with an explicit force-with-lease only after
+that exact candidate passes. The lease is a compare-and-swap guard, not
+permission to rewrite history: the candidate's first parent must be the
+unchanged `dev` tip and its second parent the released commit. The repository
+ruleset must allow this workflow's automation identity to perform that one
+checked branch update; if it does not, the workflow fails closed and the
+reconciliation uses a PR.

 For an Android app hotfix:

@@ -938,21 +1054,21 @@ For an Android app hotfix:
 6. `git tag android-v0.6.2` from the new `main` tip and `git push origin android-v0.6.2`
   so Android release CI builds and publishes.
 7. Verify the automated Play submission, GitHub artifacts, and rollout.
-8. Merge `main` back into `dev` (`git checkout dev && git merge --no-ff main`)
-   so `dev` picks up the hotfix and the versionCode bump. Without this,
-   `dev`'s `appVersionCode` lags behind `main` and the next app release
-   bump collides.
+8. Verify the automated release backmerge completed. If it stopped, open a
+   reconciliation PR so `dev` picks up the hotfix and versionCode bump. Without
+   reconciliation, `dev`'s `appVersionCode` lags behind `main` and the next app
+   release bump collides.

 For a Plugin hotfix, branch from the affected `server-v*` tag, apply
 the fix, run `bash scripts/bump-plugin-version.sh <next-version>`, merge to
-`main`, tag `server-v<next-version>`, verify the package/deployment, and merge
-`main` back to `dev`. Do not touch
+`main`, tag `server-v<next-version>`, verify the package/deployment, and verify
+the automated release backmerge. Do not touch
 `gradle/libs.versions.toml` unless an Android app release is also shipping.

 For a CLI+UI hotfix, branch from the affected `desktop-v*` tag, update only
 `desktop/package.json` and its generated lock/runtime/tray metadata, merge to
 `main`, tag `desktop-v<next-version>`, verify all binaries and the installer,
-then merge `main` back to `dev`.
+then verify the automated release backmerge or use the PR fallback.

 ## Troubleshooting

@@ -1,10 +1,10 @@
-# Hermes-Relay Android v1.13.1
+# Hermes-Relay Android v1.17.0

-**Release Date:** August 25, 2026
+**Release Date:** September 13, 2026

 ## Download

-> Installing on your phone? Download `hermes-relay-1.13.1-sideload-release.apk` and tap it for the full feature set, or install the conservative build from [Google Play](https://play.google.com/store/apps/details?id=com.axiomlabs.hermesrelay).
+> Installing on your phone? Download `hermes-relay-1.17.0-sideload-release.apk` and tap it for the full feature set, or install from [Google Play](https://play.google.com/store/apps/details?id=com.axiomlabs.hermesrelay).

 The `.aab` file is a Play Console upload bundle and cannot be installed by tapping it on a phone.

@@ -12,17 +12,28 @@ Verify the download against `SHA256SUMS.txt`. See the [sideload guide](https://h

 ## Summary

-This patch makes Android session activity follow live Hermes runtime state instead of a five-minute recency estimate. It keeps Working, Starting, Needs input, Idle, Checking, Unavailable, and Background work accurate while preserving stale state until a complete, unambiguous snapshot can safely replace it.
+Google Play gains optional voice controls over other apps. This release also makes Clarify batches, profile identity, and chat context easier to follow while preserving confirmed answers and saved conversations.
+
+## Added
+
+- Start Voice Overlay from Voice Focus after granting microphone, notification, and display-over-other-apps access. Permission grants require a separate Start action. Stop voice from the overlay or persistent notification; screen lock, task removal, and permission loss end the session.
+
+## Changed
+
+- Standalone response cards use one surface, assistant bubbles are subtler, and timestamps share a row with delivery status.

 ## Fixed

- Derive session activity from the authoritative live runtime snapshot rather than Dashboard recency.
- Preserve prior activity when a refresh is incomplete, unsupported, or ambiguously scoped.
- Keep session drawer labels, timestamps, and active-turn ownership aligned with the exact profile and session.
+- Answer upstream Clarify batches one question at a time, with independent choices, custom answers, and confirmed progress across reconnects. (#474)
+- Context previews show that Gateway chats cannot send phone status or general turn context. Automatic phone-status sharing remains supported for API-only chats. (#556)
+- Profiles display their Hermes names and group the resolved server default under its agent identity, preserving explicit selection and saved conversations.

 ## Install / Verify

- App version: **1.13.1** (versionCode **50**).
- Standard Chat, sessions, Manage, sharing, profile switching, and Vanilla Hermes voice continue to work against unmodified upstream Hermes.
- Granular Device Control remains sideload-only; the Google Play build continues to ship Hermes Bridge Core without AccessibilityService Device Control.
- The optional Relay plugin remains unnecessary for standard Android chat, sessions, Manage, and Vanilla Hermes voice.
+- App version: **1.17.0** (versionCode **57**).
+- Standard Chat, sessions, profiles, Manage, voice, and ordinary media use current upstream Hermes. Speech-to-text still requires a configured provider on the host.
+- Hermes-Relay Plugin **1.11.3** is the optional release for Hermes-Relay tools and current Dashboard WebSocket compatibility.
+- Explicit Direct API/API-only connections remain supported and are not used as silent failover for Dashboard-owned chats.
+- Voice Overlay is available in Google Play and sideload builds. Device Control remains sideload-only.
+- Gateway phone-status delivery and automatic Android identification remain unavailable pending upstream support.
+- Physical Android 14-16 and OEM voice-overlay testing was not performed for this release. Code, rendered UI, existing emulator evidence, CI, and signed-package preflight provide the recorded verification.
@@ -100,9 +100,9 @@ android {
    }

    // ─── Bridge release tracks ─────────────────────────────────────────────────
-    // Google Play ships Bridge Core only: pairing, chat, voice, terminal/TUI,
+    // Google Play ships Bridge Core and user-started voice-only overlay: pairing, chat, voice, terminal/TUI,
    // media, notification companion, relay sessions, and status. It does not
-    // declare AccessibilityService, overlay, MediaProjection, wake-lock device
+    // declare AccessibilityService, MediaProjection, wake-lock device
    // control, SMS/call/contact/location, or unattended-control permissions.
    //
    //   googlePlay  — canonical Play Store install. Bridge Core only.
@@ -249,6 +249,58 @@ android {
            it.systemProperty("roborazzi.test.record", "true")
            it.maxHeapSize = "2g"
        }
+
+        // On-demand only. Keep each form factor as an individually selected
+        // Gradle-managed device; there is deliberately no aggregate matrix
+        // task or scheduled emulator job. See docs/android-emulator-testing.md.
+        managedDevices {
+            localDevices {
+                create("compactPhoneApi36") {
+                    device = "Pixel 2"
+                    apiLevel = 36
+                    systemImageSource = "aosp"
+                    require64Bit = true
+                    testedAbi = "x86_64"
+                }
+                create("standardPhoneApi36") {
+                    device = "Pixel 6"
+                    apiLevel = 36
+                    systemImageSource = "aosp"
+                    require64Bit = true
+                    testedAbi = "x86_64"
+                }
+                create("largePhoneApi36") {
+                    device = "Pixel 7 Pro"
+                    apiLevel = 36
+                    systemImageSource = "aosp"
+                    require64Bit = true
+                    testedAbi = "x86_64"
+                }
+                create("foldableApi36") {
+                    device = "Pixel Fold"
+                    apiLevel = 36
+                    systemImageSource = "aosp"
+                    require64Bit = true
+                    testedAbi = "x86_64"
+                }
+                create("tabletApi36") {
+                    device = "Pixel Tablet"
+                    apiLevel = 36
+                    systemImageSource = "aosp"
+                    require64Bit = true
+                    testedAbi = "x86_64"
+                }
+                create("futureApi37Ps16k") {
+                    device = "Pixel 7 Pro"
+                    apiLevel = 37
+                    systemImageSource = "google_apis_playstore"
+                    require64Bit = true
+                    testedAbi = "x86_64"
+                    pageAlignment =
+                        com.android.build.api.dsl.ManagedVirtualDevice.PageAlignment.FORCE_16KB_PAGES
+                }
+            }
+        }
    }
 }

@@ -315,8 +367,9 @@ dependencies {
    implementation(libs.okhttp)
    implementation(libs.okhttp.sse)

-    // Media3 ExoPlayer — gapless TTS queue playback (replaces MediaPlayer in VoicePlayer)
+    // Media3 ExoPlayer + lifecycle-aware Compose video surface.
    implementation(libs.media3.exoplayer)
+    implementation(libs.media3.ui.compose)

    // android-vad Silero — on-device VAD for barge-in (B2)
    // Bundled ONNX Silero model (~2.2 MB); pulled from JitPack.
@@ -390,6 +443,12 @@ dependencies {
    // Konsist — enforces the ADR 34 upstream/relay/shared package fence as a JUnit test
    testImplementation(libs.konsist)
    androidTestImplementation(libs.compose.ui.test.junit4)
+    // Compose UI Test still declares Espresso 3.5.0 transitively. API 37
+    // removed the reflected InputManager.getInstance() seam; Espresso 3.7.0
+    // uses Context.getSystemService and is the current stable AndroidX line.
+    androidTestImplementation("androidx.test.espresso:espresso-core:3.7.0")
+    androidTestImplementation("androidx.test:runner:1.7.0")
+    androidTestImplementation("androidx.test.ext:junit:1.3.0")
    // On-device vanilla-Gateway contract tests exercise the production
    // Dashboard ticket + WebSocket stack over real loopback sockets.
    androidTestImplementation(libs.okhttp.mockwebserver)
@@ -399,8 +458,8 @@ dependencies {
    // [POC] Roborazzi host-side screenshot rendering (src/test, Robolectric).
    // Renders real composables on the JVM at an exact canvas — no device, no
    // status bar, no clipping. See StoreScreenshotTest.
-    testImplementation("io.github.takahirom.roborazzi:roborazzi:1.72.0")
-    testImplementation("io.github.takahirom.roborazzi:roborazzi-compose:1.72.0")
+    testImplementation("io.github.takahirom.roborazzi:roborazzi:1.74.0")
+    testImplementation("io.github.takahirom.roborazzi:roborazzi-compose:1.74.0")
    testImplementation(libs.compose.ui.test.junit4)
    testImplementation(libs.compose.ui.test.manifest)
    testImplementation("androidx.test.ext:junit:1.3.0")
@@ -55,6 +55,9 @@
 -keep class androidx.camera.** { *; }
 -dontwarn androidx.camera.**

+# sherpa-onnx JNI resolves Kotlin configuration classes and fields by name.
+-keep class com.k2fsa.sherpa.onnx.** { *; }
+
 # ── General ──────────────────────────────────────────────────────────
 -keepattributes SourceFile,LineNumberTable
 -renamesourcefileattribute SourceFile
@@ -0,0 +1,100 @@
+package com.hermesandroid.relay.network.shared
+
+import androidx.test.ext.junit.runners.AndroidJUnit4
+import com.hermesandroid.relay.data.ApiEndpoint
+import com.hermesandroid.relay.data.EndpointCandidate
+import kotlinx.coroutines.CoroutineStart
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.async
+import kotlinx.coroutines.runBlocking
+import kotlinx.coroutines.withTimeout
+import okhttp3.OkHttpClient
+import okhttp3.Protocol
+import okhttp3.Response
+import okhttp3.ResponseBody.Companion.toResponseBody
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertTrue
+import org.junit.Test
+import org.junit.runner.RunWith
+import java.io.InterruptedIOException
+import java.util.concurrent.CountDownLatch
+import java.util.concurrent.TimeUnit
+import java.util.concurrent.atomic.AtomicInteger
+
+@RunWith(AndroidJUnit4::class)
+class EndpointResolverConcurrencyInstrumentedTest {
+
+    @Test
+    fun probeCompletionRacingInvalidation_staysCrashFreeOnAndroidCollections() = runBlocking {
+        repeat(25) { iteration ->
+            val candidateCount = 8
+            val requestsStarted = CountDownLatch(candidateCount)
+            val releaseRequests = CountDownLatch(1)
+            val raceGate = CountDownLatch(1)
+            val requestSequence = AtomicInteger(0)
+            val client = OkHttpClient.Builder()
+                .addInterceptor { chain ->
+                    if (requestSequence.incrementAndGet() <= candidateCount) {
+                        requestsStarted.countDown()
+                        releaseRequests.await(5, TimeUnit.SECONDS)
+                        throw InterruptedIOException("instrumented invalidation race")
+                    }
+                    Response.Builder()
+                        .request(chain.request())
+                        .protocol(Protocol.HTTP_1_1)
+                        .code(200)
+                        .message("OK")
+                        .body("{}".toResponseBody())
+                        .build()
+                }
+                .build()
+            val resolver = EndpointResolver(client)
+            val candidates = (1..candidateCount).map { index ->
+                EndpointCandidate(
+                    role = "instrumented-$iteration-$index",
+                    priority = 0,
+                    api = ApiEndpoint(host = "127.0.0.1", port = 1, tls = false),
+                )
+            }
+
+            try {
+                val staleResolve = async(start = CoroutineStart.UNDISPATCHED) {
+                    resolver.resolve(candidates, EndpointSurface.Api)
+                }
+                assertTrue(requestsStarted.await(5, TimeUnit.SECONDS))
+
+                val invalidation = async(Dispatchers.Default) {
+                    raceGate.await(5, TimeUnit.SECONDS)
+                    resolver.clearCache()
+                }
+                val completions = async(Dispatchers.Default) {
+                    raceGate.await(5, TimeUnit.SECONDS)
+                    releaseRequests.countDown()
+                }
+                raceGate.countDown()
+
+                withTimeout(2_000L) {
+                    invalidation.await()
+                    completions.await()
+                    staleResolve.await()
+                }
+                assertTrue(resolver.cacheSnapshot().isEmpty())
+
+                resolver.clearCache()
+                val freshWinner = withTimeout(2_000L) {
+                    resolver.resolve(listOf(candidates.first()), EndpointSurface.Api)
+                }
+                assertEquals(candidates.first(), freshWinner)
+                assertTrue(
+                    resolver.probeOutcomes.value.getValue(
+                        EndpointResolver.cacheKey(candidates.first(), EndpointSurface.Api),
+                    ).reachable,
+                )
+            } finally {
+                raceGate.countDown()
+                releaseRequests.countDown()
+                client.dispatcher.executorService.shutdown()
+            }
+        }
+    }
+}
@@ -0,0 +1,111 @@
+package com.hermesandroid.relay.network.upstream
+
+import android.app.ActivityManager
+import android.app.NotificationManager
+import android.content.Context
+import android.os.Build
+import android.os.SystemClock
+import androidx.activity.ComponentActivity
+import androidx.compose.ui.test.junit4.v2.createAndroidComposeRule
+import androidx.test.platform.app.InstrumentationRegistry
+import com.hermesandroid.relay.data.KEY_GATEWAY_KEEP_ALIVE
+import com.hermesandroid.relay.data.relayDataStore
+import com.hermesandroid.relay.data.setGatewayKeepAlive
+import kotlinx.coroutines.flow.first
+import kotlinx.coroutines.runBlocking
+import org.junit.After
+import org.junit.Assert.assertTrue
+import org.junit.Before
+import org.junit.Rule
+import org.junit.Test
+import java.util.concurrent.CountDownLatch
+import java.util.concurrent.TimeUnit
+
+/** Real ActivityManager/notification lifecycle; no Gateway or personal data. */
+class GatewayKeepAliveServiceInstrumentedTest {
+    @get:Rule val activity = createAndroidComposeRule<ComponentActivity>()
+    private val instrumentation = InstrumentationRegistry.getInstrumentation()
+    private val context get() = instrumentation.targetContext
+
+    @Before fun setup() {
+        if (Build.VERSION.SDK_INT >= 33) {
+            instrumentation.uiAutomation.executeShellCommand(
+                "pm grant ${context.packageName} android.permission.POST_NOTIFICATIONS",
+            ).close()
+        }
+        runBlocking { context.setGatewayKeepAlive(false) }
+    }
+
+    @After fun cleanup() {
+        instrumentation.runOnMainSync {
+            GatewayKeepAliveService.stop(context)
+            ActiveTurnKeepAliveRegistry.releaseAll()
+        }
+        await("service shutdown") { serviceState() == null }
+        runBlocking { context.setGatewayKeepAlive(false) }
+    }
+
+    @Test fun immediateStopsAndOverlappingStartsSurviveThePlatformWatchdog() {
+        // All changes happen before Android can dispatch onCreate/onStartCommand.
+        instrumentation.runOnMainSync {
+            repeat(25) {
+                GatewayKeepAliveService.update(context, true, ActiveTurnKeepAliveRegistry.Snapshot())
+                GatewayKeepAliveService.stop(context)
+            }
+            GatewayKeepAliveService.update(context, false, ActiveTurnKeepAliveRegistry.Snapshot(2, 1))
+        }
+        await("foreground promotion") { serviceState()?.foreground == true }
+        instrumentation.runOnMainSync { GatewayKeepAliveService.stop(context) }
+        await("settled shutdown") { serviceState() == null }
+        // Observation window, not a startup workaround: an asynchronous system
+        // foreground-start crash fails the instrumentation process during it.
+        CountDownLatch(1).await(12, TimeUnit.SECONDS)
+        assertTrue(serviceState() == null)
+    }
+
+    @Test fun notificationDisablesAlwaysOnWhileANewerTurnStaysProtected() {
+        runBlocking { context.setGatewayKeepAlive(true) }
+        instrumentation.runOnMainSync {
+            GatewayKeepAliveService.update(context, true, ActiveTurnKeepAliveRegistry.Snapshot())
+        }
+        val manager = context.getSystemService(NotificationManager::class.java)
+        await("persistent notification") {
+            manager.activeNotifications.any { it.id == GatewayKeepAliveService.NOTIFICATION_ID }
+        }
+        val action = manager.activeNotifications.single {
+            it.id == GatewayKeepAliveService.NOTIFICATION_ID
+        }.notification.actions.single().actionIntent
+        instrumentation.runOnMainSync {
+            ActiveTurnKeepAliveRegistry.acquire("fixture::profile-a::session")
+            GatewayKeepAliveService.update(context, true, ActiveTurnKeepAliveRegistry.snapshot.value)
+        }
+        action.send()
+        await("persisted notification action") {
+            runBlocking { context.relayDataStore.data.first()[KEY_GATEWAY_KEEP_ALIVE] == false }
+        }
+        instrumentation.runOnMainSync {
+            GatewayKeepAliveService.update(context, false, ActiveTurnKeepAliveRegistry.snapshot.value)
+        }
+        assertTrue(serviceState()?.foreground == true)
+        assertTrue(ActiveTurnKeepAliveRegistry.snapshot.value.required)
+        await("active-turn notification without always-on action") {
+            manager.activeNotifications.singleOrNull {
+                it.id == GatewayKeepAliveService.NOTIFICATION_ID
+            }?.notification?.let { it.actions.isNullOrEmpty() } == true
+        }
+    }
+
+    @Suppress("DEPRECATION")
+    private fun serviceState(): ActivityManager.RunningServiceInfo? =
+        context.getSystemService(ActivityManager::class.java).getRunningServices(100)
+            .singleOrNull { it.service.className == GatewayKeepAliveService::class.java.name }
+
+    private fun await(description: String, condition: () -> Boolean) {
+        val deadline = SystemClock.uptimeMillis() + 10_000
+        while (!condition() && SystemClock.uptimeMillis() < deadline) {
+            instrumentation.waitForIdleSync()
+            SystemClock.sleep(20)
+        }
+        assertTrue(description, condition())
+    }
+}
@@ -6,8 +6,7 @@ import androidx.compose.runtime.Composable
 import androidx.compose.runtime.CompositionLocalProvider
 import androidx.compose.ui.Modifier
 import androidx.compose.ui.platform.testTag
-import androidx.compose.ui.test.junit4.createComposeRule
-import androidx.compose.ui.test.onNodeWithContentDescription
+import androidx.compose.ui.test.junit4.v2.createComposeRule
 import androidx.compose.ui.test.onNodeWithTag
 import androidx.compose.ui.test.onNodeWithText
 import androidx.test.platform.app.InstrumentationRegistry
@@ -28,50 +27,6 @@ class AmbientVisualizationVisibilityTest {
    @get:Rule
    val composeTestRule = createComposeRule()

-    @Test
-    fun cleanMode_backgroundOff_hidesSphereAndKeepsComposer() {
-        composeTestRule.setContent {
-            AmbientTestProviders(enabled = false) {
-                CleanChatMode(
-                    messages = emptyList(),
-                    isStreaming = false,
-                    sphereState = SphereState.Idle,
-                    streamingIntensity = 0f,
-                    toolCallBurst = 0f,
-                    animationEnabled = true,
-                    enabled = true,
-                    onSend = {},
-                    onExit = {},
-                )
-            }
-        }
-
-        composeTestRule.onNodeWithTag(AMBIENT_RENDERER_TAG).assertDoesNotExist()
-        composeTestRule.onNodeWithContentDescription(targetString(R.string.agent_text_send_cd))
-            .assertExists()
-    }
-
-    @Test
-    fun cleanMode_backgroundOn_rendersSphere() {
-        composeTestRule.setContent {
-            AmbientTestProviders(enabled = true) {
-                CleanChatMode(
-                    messages = emptyList(),
-                    isStreaming = false,
-                    sphereState = SphereState.Idle,
-                    streamingIntensity = 0f,
-                    toolCallBurst = 0f,
-                    animationEnabled = false,
-                    enabled = true,
-                    onSend = {},
-                    onExit = {},
-                )
-            }
-        }
-
-        composeTestRule.onNodeWithTag(AMBIENT_RENDERER_TAG).assertExists()
-    }
-
    @Test
    fun voiceMode_backgroundOff_hidesSphereAndKeepsVoiceUi() {
        composeTestRule.setContent {
@@ -3,224 +3,97 @@ package com.hermesandroid.relay.ui.onboarding
 import android.app.Application
 import androidx.compose.ui.test.assertIsDisplayed
 import androidx.compose.ui.test.assertIsEnabled
+import androidx.compose.ui.test.assertIsNotEnabled
 import androidx.compose.ui.test.junit4.createComposeRule
 import androidx.compose.ui.test.onNodeWithText
 import androidx.compose.ui.test.performClick
+import androidx.compose.ui.test.performScrollTo
+import androidx.compose.ui.test.performTextReplacement
 import androidx.test.core.app.ApplicationProvider
 import com.hermesandroid.relay.ui.theme.HermesRelayTheme
 import com.hermesandroid.relay.viewmodel.ConnectionViewModel
 import org.junit.Rule
 import org.junit.Test

-/**
- * Instrumented tests for the Standard-first onboarding pager.
- */
+/** Standard setup stays separate from Direct API and optional Relay grants. */
 class OnboardingFlowTest {
+    @get:Rule val compose = createComposeRule()

-    @get:Rule
-    val composeTestRule = createComposeRule()
-
-    private fun setOnboardingContent() {
-        val app = ApplicationProvider.getApplicationContext<Application>()
-        val connectionViewModel = ConnectionViewModel(app)
-        composeTestRule.setContent {
-            HermesRelayTheme {
-                OnboardingScreen(
-                    connectionViewModel = connectionViewModel,
-                    onComplete = {},
-                )
-            }
-        }
+    private fun start() {
+        val model = ConnectionViewModel(ApplicationProvider.getApplicationContext<Application>())
+        compose.setContent { HermesRelayTheme { OnboardingScreen(model, onComplete = {}) } }
    }

-    @Test
-    fun firstPage_showsHermesForAndroidTitle() {
-        setOnboardingContent()
-
-        composeTestRule
-            .onNodeWithText("Hermes-Relay for Android")
-            .assertIsDisplayed()
+    private fun connectPage() {
+        compose.onNodeWithText("Get started").performClick()
+        repeat(3) { compose.onNodeWithText("Next").performClick(); compose.waitForIdle() }
    }

-    @Test
-    fun firstPage_showsStandardFirstDescription() {
-        setOnboardingContent()
-
-        composeTestRule
-            .onNodeWithText("Chat with Hermes and manage your dashboard from your phone.")
-            .assertIsDisplayed()
-        composeTestRule
-            .onNodeWithText("Standard")
-            .assertIsDisplayed()
-        composeTestRule
-            .onNodeWithText("Advanced")
-            .assertIsDisplayed()
-        composeTestRule
-            .onNodeWithText("Setup Guide")
-            .assertIsDisplayed()
-        composeTestRule
-            .onNodeWithText("Hermes Docs")
-            .assertIsDisplayed()
+    @Test fun welcomeOffersStartAndDemo() {
+        start()
+        compose.onNodeWithText("Hermes,\nin your pocket").assertIsDisplayed()
+        compose.onNodeWithText("Get started").assertIsDisplayed().assertIsEnabled()
+        compose.onNodeWithText("Try the demo").assertIsDisplayed().assertIsEnabled()
+        compose.onNodeWithText("Back").assertDoesNotExist()
    }

-    @Test
-    fun nextButton_navigatesForward_toChatPage() {
-        setOnboardingContent()
-
-        composeTestRule.onNodeWithText("Next").performClick()
-        composeTestRule.waitForIdle()
-
-        composeTestRule
-            .onNodeWithText("Chat")
-            .assertIsDisplayed()
+    @Test fun introNavigationAndSkipRemainAvailable() {
+        start()
+        compose.onNodeWithText("Get started").performClick()
+        compose.onNodeWithText("Chat").assertIsDisplayed()
+        compose.onNodeWithText("Back").performClick()
+        compose.onNodeWithText("Get started").assertIsDisplayed()
+        compose.onNodeWithText("Get started").performClick()
+        compose.onNodeWithText("Skip").performClick()
+        compose.onNodeWithText("Skip setup?").assertIsDisplayed()
+        compose.onNodeWithText("Go back").performClick()
+        compose.onNodeWithText("Chat").assertIsDisplayed()
    }

-    @Test
-    fun canNavigateForward_throughStandardAndPowerPages() {
-        setOnboardingContent()
-
-        composeTestRule.onNodeWithText("Hermes-Relay for Android").assertIsDisplayed()
-        composeTestRule.onNodeWithText("Next").performClick()
-        composeTestRule.waitForIdle()
-
-        composeTestRule.onNodeWithText("Chat").assertIsDisplayed()
-        composeTestRule.onNodeWithText("Next").performClick()
-        composeTestRule.waitForIdle()
-
-        composeTestRule.onNodeWithText("Manage").assertIsDisplayed()
-        composeTestRule.onNodeWithText("Next").performClick()
-        composeTestRule.waitForIdle()
-
-        composeTestRule.onNodeWithText("Power tools").assertIsDisplayed()
-        composeTestRule.onNodeWithText("Connect").performClick()
-        composeTestRule.waitForIdle()
-
-        composeTestRule.onNodeWithText("Connect to Hermes").assertIsDisplayed()
+    @Test fun standardMethodsDoNotAskForApiCredentials() {
+        start(); connectPage()
+        compose.onNodeWithText("Hermes nearby").assertIsDisplayed()
+        compose.onNodeWithText("Remote gateway").assertIsDisplayed().performClick()
+        compose.onNodeWithText("Hermes address").assertIsDisplayed()
+        compose.onNodeWithText("API key").assertDoesNotExist()
+        compose.onNodeWithText("Find Hermes").performScrollTo().assertIsDisplayed()
    }

-    @Test
-    fun backButton_hiddenOnFirstPage() {
-        setOnboardingContent()
-
-        composeTestRule
-            .onNodeWithText("Back")
-            .assertDoesNotExist()
+    @Test fun publicHttpConsentResetsWhenAddressChanges() {
+        start(); connectPage()
+        compose.onNodeWithText("Remote gateway").performClick()
+        compose.onNodeWithText("Hermes address").performTextReplacement("http://11.0.0.1:9119")
+        compose.onNodeWithText("Find Hermes").performScrollTo().assertIsNotEnabled()
+        compose.onNodeWithText("I accept the risk and allow HTTP for this address").performScrollTo().performClick()
+        compose.onNodeWithText("Find Hermes").performScrollTo().assertIsEnabled()
+        compose.onNodeWithText("Hermes address").performScrollTo().performTextReplacement("http://11.0.0.1:9120")
+        compose.onNodeWithText("Find Hermes").performScrollTo().assertIsNotEnabled()
    }

-    @Test
-    fun backButton_navigatesBackward() {
-        setOnboardingContent()
-
-        composeTestRule.onNodeWithText("Next").performClick()
-        composeTestRule.waitForIdle()
-        composeTestRule.onNodeWithText("Chat").assertIsDisplayed()
-
-        composeTestRule.onNodeWithText("Back").performClick()
-        composeTestRule.waitForIdle()
-        composeTestRule.onNodeWithText("Hermes-Relay for Android").assertIsDisplayed()
+    @Test fun advancedKeepsApiAndRelaySeparate() {
+        start(); connectPage()
+        compose.onNodeWithText("Advanced").performScrollTo().performClick()
+        compose.onNodeWithText("API-only connection").assertIsDisplayed()
+        compose.onNodeWithText("Pair Relay by code").performScrollTo().assertIsDisplayed()
    }

-    @Test
-    fun connectPage_recommendsGeneralSetupQr() {
-        setOnboardingContent()
-        navigateToPage(4)
-
-        composeTestRule
-            .onNodeWithText("Scan Hermes setup QR")
-            .assertIsDisplayed()
-        composeTestRule
-            .onNodeWithText("Recommended")
-            .assertIsDisplayed()
+    @Test fun setupSkipIsScrollReachable() {
+        start(); connectPage()
+        compose.onNodeWithText("Skip for now — set up later in Settings").performScrollTo().assertIsDisplayed().performClick()
+        compose.onNodeWithText("Skip setup?").assertIsDisplayed()
    }

-    @Test
-    fun manualSetup_showsHermesAddressWithoutApiCredentials() {
-        setOnboardingContent()
-        navigateToPage(4)
-
-        composeTestRule.onNodeWithText("Server or VPS").performClick()
-        composeTestRule.waitForIdle()
-
-        composeTestRule
-            .onNodeWithText("Hermes address")
-            .assertIsDisplayed()
+    @Test fun hostedGatewayKeepsItsSeparateAddressEntry() {
+        start(); connectPage()
+        compose.onNodeWithText("Nous-hosted Hermes").performClick()
+        compose.onNodeWithText("Connect to Nous-hosted Hermes").assertIsDisplayed()
+        compose.onNodeWithText("Find Hermes").performScrollTo().assertIsNotEnabled()
    }

-    @Test
-    fun manualSetup_findButton_isShown() {
-        setOnboardingContent()
-        navigateToPage(4)
-
-        composeTestRule.onNodeWithText("Server or VPS").performClick()
-        composeTestRule.waitForIdle()
-
-        composeTestRule
-            .onNodeWithText("Find Hermes")
-            .assertIsDisplayed()
-    }
-
-    @Test
-    fun cloudSetup_requestsTheHostedDashboardAddress() {
-        setOnboardingContent()
-        navigateToPage(4)
-
-        composeTestRule.onNodeWithText("Nous-hosted Hermes").performClick()
-        composeTestRule.waitForIdle()
-
-        composeTestRule
-            .onNodeWithText("Connect to Nous-hosted Hermes")
-            .assertIsDisplayed()
-        composeTestRule
-            .onNodeWithText("Use the complete HTTPS address shown for your hosted agent.")
-            .assertIsDisplayed()
-    }
-
-    @Test
-    fun connectPage_keepsPairingOptional() {
-        setOnboardingContent()
-        navigateToPage(4)
-
-        composeTestRule.onNodeWithText("Advanced").performClick()
-        composeTestRule.waitForIdle()
-
-        composeTestRule
-            .onNodeWithText("Pair Relay by code")
-            .assertIsDisplayed()
-        composeTestRule
-            .onNodeWithText("Power-user path for Terminal, Bridge, Relay sessions, and grants")
-            .assertIsDisplayed()
-    }
-
-    @Test
-    fun powerPage_linksToPermissionReview() {
-        setOnboardingContent()
-        navigateToPage(3)
-
-        composeTestRule
-            .onNodeWithText("Review permissions")
-            .assertIsDisplayed()
-            .assertIsEnabled()
-    }
-
-    @Test
-    fun skipButton_visibleOnIntroPages_andWizardSkipOnConnectPage() {
-        setOnboardingContent()
-
-        repeat(4) {
-            composeTestRule.onNodeWithText("Skip").assertIsDisplayed()
-            composeTestRule.onNodeWithText(if (it == 3) "Connect" else "Next").performClick()
-            composeTestRule.waitForIdle()
-        }
-
-        composeTestRule
-            .onNodeWithText("Skip for now — set up later in Settings")
-            .assertIsDisplayed()
-    }
-
-    private fun navigateToPage(pageIndex: Int) {
-        repeat(pageIndex) {
-            composeTestRule.onNodeWithText(if (it == 3) "Connect" else "Next").performClick()
-            composeTestRule.waitForIdle()
-        }
+    @Test fun optionalPowerPermissionsRemainReachable() {
+        start()
+        compose.onNodeWithText("Get started").performClick()
+        repeat(2) { compose.onNodeWithText("Next").performClick(); compose.waitForIdle() }
+        compose.onNodeWithText("Review permissions").performScrollTo().assertIsDisplayed().assertIsEnabled()
    }
 }
@@ -0,0 +1,160 @@
+package com.hermesandroid.relay.ui.screens
+
+import android.os.Handler
+import android.os.Looper
+import android.view.accessibility.AccessibilityNodeInfo
+import androidx.activity.compose.setContent
+import androidx.compose.material3.MaterialTheme
+import androidx.lifecycle.Lifecycle
+import androidx.test.core.app.ActivityScenario
+import androidx.test.platform.app.InstrumentationRegistry
+import com.hermesandroid.relay.data.BotGatewayRoute
+import com.hermesandroid.relay.data.BotGatewayRouteKey
+import com.hermesandroid.relay.data.BotRosterEntry
+import com.hermesandroid.relay.data.Profile
+import com.hermesandroid.relay.network.upstream.ChatHandler
+import com.hermesandroid.relay.network.upstream.DashboardApiClient
+import com.hermesandroid.relay.network.upstream.GatewayChatClient
+import com.hermesandroid.relay.network.upstream.models.MessageItem
+import com.hermesandroid.relay.viewmodel.AndroidGatewayContractFixture
+import com.hermesandroid.relay.viewmodel.ChatViewModel
+import java.util.concurrent.TimeUnit
+import kotlinx.coroutines.CoroutineScope
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.SupervisorJob
+import kotlinx.coroutines.cancel
+import kotlinx.coroutines.flow.MutableStateFlow
+import kotlinx.serialization.json.JsonPrimitive
+import okhttp3.OkHttpClient
+import org.junit.After
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertTrue
+import org.junit.Before
+import org.junit.Test
+
+/** On-device proof for the route-owned first-composition collection boundary. */
+class BotChatScreenBindingInstrumentedTest {
+    private lateinit var fixture: AndroidGatewayContractFixture
+    private lateinit var gatewayScope: CoroutineScope
+    private lateinit var dashboardClient: DashboardApiClient
+    private lateinit var gatewayClient: GatewayChatClient
+    private lateinit var viewModel: ChatViewModel
+    private lateinit var handler: ChatHandler
+    private var activityScenario: ActivityScenario<BotChatBindingTestActivity>? = null
+
+    @Before
+    fun setUp() {
+        fixture = AndroidGatewayContractFixture()
+        gatewayScope = CoroutineScope(SupervisorJob() + Dispatchers.IO)
+        dashboardClient = DashboardApiClient(
+            baseUrl = fixture.server.url("/").toString().trimEnd('/'),
+            okHttpClient = OkHttpClient(),
+        )
+        gatewayClient = GatewayChatClient(
+            initialDashboardClient = dashboardClient,
+            okHttpClient = OkHttpClient(),
+            callbackDispatcher = { block -> Handler(Looper.getMainLooper()).post(block) },
+            scope = gatewayScope,
+            reconnectJitterUnit = { 0.0 },
+        )
+        viewModel = ChatViewModel()
+        handler = ChatHandler()
+    }
+
+    @After
+    fun tearDown() {
+        activityScenario?.close()
+        viewModel.updateGatewayClient(null)
+        gatewayClient.shutdown()
+        gatewayScope.cancel()
+        dashboardClient.shutdown()
+        fixture.shutdown()
+    }
+
+    @Test
+    fun fastInitialHistoryRendersBeforeNavigationAndSurvivesLifecycleResume() {
+        val route = BotGatewayRoute(
+            key = BotGatewayRouteKey("fixture-gateway", PROFILE_NAME),
+            connectionLabel = "Fixture gateway",
+        )
+        val bot = BotRosterEntry(
+            profile = Profile(
+                name = PROFILE_NAME,
+                model = "fixture-model",
+                description = "Fixture profile",
+            ),
+            displayName = "Research",
+            route = route,
+        )
+        val scenario = ActivityScenario.launch(BotChatBindingTestActivity::class.java)
+            .also { activityScenario = it }
+
+        scenario.onActivity { activity ->
+            activity.setContent {
+                MaterialTheme {
+                    BotChatScreen(
+                        route = route,
+                        bot = bot,
+                        sessionId = STORED_SESSION_ID,
+                        gatewayClient = gatewayClient,
+                        dashboardClient = dashboardClient,
+                        chatViewModel = viewModel,
+                        onBack = {},
+                        handlerFactory = { handler },
+                        historyLoader = { _, _, _ ->
+                            Result.success(
+                                listOf(
+                                    MessageItem(
+                                        id = HISTORY_ID,
+                                        sessionId = STORED_SESSION_ID,
+                                        role = "assistant",
+                                        content = JsonPrimitive(HISTORY_TEXT),
+                                        timestamp = 1.0,
+                                        finishReason = "stop",
+                                    ),
+                                ),
+                            )
+                        },
+                        profileIconFlow = { _, _ -> MutableStateFlow(null) },
+                    )
+                }
+            }
+        }
+
+        waitUntil { handler.messages.value.singleOrNull()?.content == HISTORY_TEXT }
+        waitUntil { renderedTextExists(HISTORY_TEXT) }
+
+        scenario.moveToState(Lifecycle.State.STARTED)
+        scenario.moveToState(Lifecycle.State.RESUMED)
+        waitUntil { renderedTextExists(HISTORY_TEXT) }
+        assertEquals(0, fixture.rpcCount("prompt.submit"))
+    }
+
+    private fun renderedTextExists(expected: String): Boolean {
+        val instrumentation = InstrumentationRegistry.getInstrumentation()
+        instrumentation.waitForIdleSync()
+        val root = instrumentation.uiAutomation.rootInActiveWindow ?: return false
+        return root.containsText(expected)
+    }
+
+    private fun AccessibilityNodeInfo.containsText(expected: String): Boolean {
+        if (text?.toString() == expected || contentDescription?.toString() == expected) return true
+        return (0 until childCount).any { index -> getChild(index)?.containsText(expected) == true }
+    }
+
+    private fun waitUntil(condition: () -> Boolean) {
+        val deadline = System.nanoTime() + TimeUnit.SECONDS.toNanos(5)
+        while (System.nanoTime() < deadline) {
+            if (condition()) return
+            Thread.sleep(25)
+        }
+        assertTrue("Condition was not satisfied within 5 seconds", condition())
+    }
+
+    private companion object {
+        const val PROFILE_NAME = "research"
+        const val STORED_SESSION_ID = "20260829_120000_bot_chat"
+        const val HISTORY_ID = "persisted-bot-history"
+        const val HISTORY_TEXT = "Durable Bot Chat history is ready."
+    }
+}
@@ -0,0 +1,65 @@
+package com.hermesandroid.relay.ui.screens
+
+import androidx.activity.ComponentActivity
+import androidx.compose.foundation.layout.Box
+import androidx.compose.foundation.layout.fillMaxSize
+import androidx.compose.foundation.layout.fillMaxWidth
+import androidx.compose.foundation.layout.height
+import androidx.compose.material3.Text
+import androidx.compose.runtime.getValue
+import androidx.compose.runtime.mutableStateOf
+import androidx.compose.runtime.remember
+import androidx.compose.runtime.setValue
+import androidx.compose.ui.Modifier
+import androidx.compose.ui.platform.testTag
+import androidx.compose.ui.test.assertIsDisplayed
+import androidx.compose.ui.test.junit4.v2.createAndroidComposeRule
+import androidx.compose.ui.test.longClick
+import androidx.compose.ui.test.onNodeWithContentDescription
+import androidx.compose.ui.test.onNodeWithTag
+import androidx.compose.ui.test.onNodeWithText
+import androidx.compose.ui.test.performClick
+import androidx.compose.ui.test.performTouchInput
+import androidx.compose.ui.unit.dp
+import com.hermesandroid.relay.network.upstream.GatewayConnectionState
+import com.hermesandroid.relay.ui.components.ChatDebugDrawer
+import com.hermesandroid.relay.ui.components.ChatDebugOverlay
+import com.hermesandroid.relay.ui.components.chatDebugHeaderGesture
+import com.hermesandroid.relay.ui.theme.HermesRelayTheme
+import org.junit.Assert.assertEquals
+import org.junit.Rule
+import org.junit.Test
+
+class ChatDebugDrawerInstrumentedTest {
+    @get:Rule val compose = createAndroidComposeRule<ComponentActivity>()
+
+    @Test
+    fun longPressOpensDiagnosticsBelowHeaderAndCloseRestoresChat() {
+        compose.setContent {
+            var open by remember { mutableStateOf(false) }
+            HermesRelayTheme(appThemeId = "hermes-relay", themePreference = "dark") {
+                Box(Modifier.fillMaxSize()) {
+                    Text("Hermes", Modifier.fillMaxWidth().height(64.dp).testTag("header")
+                        .chatDebugHeaderGesture(true, onClick = {}, onHold = { open = true }))
+                    ChatDebugOverlay(open, 64.dp, onClose = { open = false }) {
+                        ChatDebugDrawer(
+                            profile = "Server Default", model = "Example", sessionId = "session",
+                            gateway = true, signedIn = true, signInRequired = false,
+                            socketState = GatewayConnectionState.Ready, preparing = false,
+                            streaming = false, loadingHistory = false, directoryUnavailable = false,
+                            failure = null, onClose = { open = false }, onConnections = {},
+                        )
+                    }
+                }
+            }
+        }
+        val header = compose.onNodeWithTag("header")
+        val before = header.fetchSemanticsNode().boundsInRoot
+        header.performTouchInput { longClick() }
+        compose.onNodeWithText("Session diagnostics").assertIsDisplayed()
+        assertEquals(before, header.fetchSemanticsNode().boundsInRoot)
+        compose.onNodeWithContentDescription("Close session diagnostics").performClick()
+        compose.onNodeWithText("Session diagnostics").assertDoesNotExist()
+        header.assertIsDisplayed()
+    }
+}
@@ -0,0 +1,141 @@
+package com.hermesandroid.relay.ui.theme
+
+import android.app.UiModeManager
+import android.content.Context
+import android.os.SystemClock
+import androidx.appcompat.app.AppCompatDelegate
+import androidx.datastore.preferences.core.edit
+import androidx.test.core.app.ActivityScenario
+import androidx.test.core.app.ApplicationProvider
+import androidx.test.ext.junit.runners.AndroidJUnit4
+import androidx.test.platform.app.InstrumentationRegistry
+import com.hermesandroid.relay.HermesRelayApp
+import com.hermesandroid.relay.MainActivity
+import com.hermesandroid.relay.data.AppearancePreferences
+import com.hermesandroid.relay.data.CustomThemePreset
+import com.hermesandroid.relay.data.relayDataStore
+import com.hermesandroid.relay.runtime.HermesRuntimeInitializationState
+import kotlinx.coroutines.flow.first
+import kotlinx.coroutines.runBlocking
+import kotlinx.coroutines.withTimeout
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertFalse
+import org.junit.Assert.assertTrue
+import org.junit.Assert.fail
+import org.junit.Assume.assumeTrue
+import org.junit.Test
+import org.junit.runner.RunWith
+
+/** Real Activity/DataStore/Compose ownership, with the device set to dark mode. */
+@RunWith(AndroidJUnit4::class)
+class AppearanceColdStartInstrumentedTest {
+    @Test
+    fun savedAppearanceOwnsColdStartAndLaterModeChanges() {
+        val instrumentation = InstrumentationRegistry.getInstrumentation()
+        val app = ApplicationProvider.getApplicationContext<HermesRelayApp>()
+        val previousPreferences = runBlocking { app.relayDataStore.data.first() }
+        val originalNightMode =
+            (app.getSystemService(Context.UI_MODE_SERVICE) as UiModeManager).nightMode
+        assumeTrue(
+            originalNightMode == UiModeManager.MODE_NIGHT_AUTO ||
+                originalNightMode == UiModeManager.MODE_NIGHT_NO ||
+                originalNightMode == UiModeManager.MODE_NIGHT_YES,
+        )
+        val custom = CustomThemePreset(
+            id = "day",
+            name = "Day",
+            mode = CustomThemePreset.MODE_LIGHT,
+            backgroundHex = "#F5F5F5",
+            surfaceHex = "#FFFFFF",
+            accentHex = "#0E18D6",
+            textHex = "#111111",
+        )
+        instrumentation.uiAutomation.executeShellCommand("cmd uimode night yes").close()
+        try {
+            runBlocking {
+                app.relayDataStore.edit { preferences ->
+                    preferences[AppearancePreferences.themeKey] = "light"
+                    preferences[AppearancePreferences.appThemeKey] = AppThemes.DEFAULT_ID
+                }
+            }
+            instrumentation.runOnMainSync {
+                AppCompatDelegate.setDefaultNightMode(AppCompatDelegate.MODE_NIGHT_FOLLOW_SYSTEM)
+            }
+            ActivityScenario.launch(MainActivity::class.java).use {
+                runBlocking {
+                    withTimeout(30_000) {
+                        app.runtime.connectionViewModel.isReady.first { it }
+                        app.runtime.initializationState.first {
+                            it == HermesRuntimeInitializationState.Ready
+                        }
+                    }
+                }
+                awaitTheme(isDark = false, nightMode = AppCompatDelegate.MODE_NIGHT_NO)
+
+                runBlocking {
+                    app.relayDataStore.edit {
+                        it[AppearancePreferences.themeKey] = "dark"
+                    }
+                }
+                awaitTheme(isDark = true, nightMode = AppCompatDelegate.MODE_NIGHT_YES)
+
+                runBlocking {
+                    app.relayDataStore.edit {
+                        it[AppearancePreferences.themeKey] = "auto"
+                    }
+                }
+                awaitTheme(isDark = true, nightMode = AppCompatDelegate.MODE_NIGHT_FOLLOW_SYSTEM)
+
+                runBlocking {
+                    app.relayDataStore.edit {
+                        it[AppearancePreferences.customThemesKey] =
+                            AppearancePreferences.encodeCustomThemes(listOf(custom))
+                        it[AppearancePreferences.appThemeKey] = custom.appThemeId
+                    }
+                }
+                awaitTheme(isDark = false, nightMode = AppCompatDelegate.MODE_NIGHT_NO)
+            }
+        } finally {
+            runBlocking {
+                app.relayDataStore.edit { preferences ->
+                    previousPreferences[AppearancePreferences.themeKey]?.let {
+                        preferences[AppearancePreferences.themeKey] = it
+                    } ?: preferences.remove(AppearancePreferences.themeKey)
+                    previousPreferences[AppearancePreferences.appThemeKey]?.let {
+                        preferences[AppearancePreferences.appThemeKey] = it
+                    } ?: preferences.remove(AppearancePreferences.appThemeKey)
+                    previousPreferences[AppearancePreferences.customThemesKey]?.let {
+                        preferences[AppearancePreferences.customThemesKey] = it
+                    } ?: preferences.remove(AppearancePreferences.customThemesKey)
+                }
+            }
+            val restoreMode = when (originalNightMode) {
+                UiModeManager.MODE_NIGHT_YES -> "yes"
+                UiModeManager.MODE_NIGHT_NO -> "no"
+                else -> "auto"
+            }
+            instrumentation.uiAutomation.executeShellCommand("cmd uimode night $restoreMode").close()
+        }
+    }
+
+    private fun awaitTheme(isDark: Boolean, nightMode: Int) {
+        val instrumentation = InstrumentationRegistry.getInstrumentation()
+        val deadline = SystemClock.uptimeMillis() + 15_000
+        while (SystemClock.uptimeMillis() < deadline) {
+            instrumentation.waitForIdleSync()
+            if (RelayRefresh.activePalette.isDark == isDark &&
+                AppCompatDelegate.getDefaultNightMode() == nightMode
+            ) {
+                assertEquals(nightMode, AppCompatDelegate.getDefaultNightMode())
+                if (isDark) assertTrue(RelayRefresh.activePalette.isDark)
+                else assertFalse(RelayRefresh.activePalette.isDark)
+                return
+            }
+            SystemClock.sleep(25)
+        }
+        fail(
+            "Appearance did not settle: paletteDark=${RelayRefresh.activePalette.isDark}, " +
+                "nightMode=${AppCompatDelegate.getDefaultNightMode()}",
+        )
+    }
+}
@@ -0,0 +1,183 @@
+package com.hermesandroid.relay.viewmodel
+
+import android.os.Handler
+import android.os.Looper
+import androidx.activity.ComponentActivity
+import androidx.compose.foundation.layout.Column
+import androidx.compose.material3.MaterialTheme
+import androidx.compose.runtime.getValue
+import androidx.compose.runtime.mutableStateOf
+import androidx.compose.runtime.remember
+import androidx.compose.runtime.setValue
+import androidx.compose.ui.Modifier
+import androidx.compose.ui.platform.testTag
+import androidx.compose.ui.test.assertIsDisplayed
+import androidx.compose.ui.test.junit4.v2.createAndroidComposeRule
+import androidx.compose.ui.test.onNodeWithContentDescription
+import androidx.compose.ui.test.onNodeWithTag
+import androidx.compose.ui.test.onNodeWithText
+import androidx.compose.ui.test.performClick
+import androidx.lifecycle.Lifecycle
+import androidx.lifecycle.compose.collectAsStateWithLifecycle
+import com.hermesandroid.relay.data.AgentDisplay
+import com.hermesandroid.relay.data.ChatActivityPhase
+import com.hermesandroid.relay.data.InMemoryChatActivityStore
+import com.hermesandroid.relay.data.projectChatActivityReceipts
+import com.hermesandroid.relay.network.upstream.ChatHandler
+import com.hermesandroid.relay.network.upstream.DashboardApiClient
+import com.hermesandroid.relay.network.upstream.GatewayChatClient
+import com.hermesandroid.relay.network.upstream.HermesApiClient
+import com.hermesandroid.relay.ui.components.ChatActivityReceipt
+import com.hermesandroid.relay.ui.components.GatewayBackgroundProcessSheet
+import com.hermesandroid.relay.ui.components.GatewayBackgroundProcessStrip
+import com.hermesandroid.relay.ui.components.SubagentPreviewVisibility
+import kotlinx.coroutines.CoroutineScope
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.SupervisorJob
+import kotlinx.coroutines.cancel
+import kotlinx.coroutines.runBlocking
+import kotlinx.serialization.json.buildJsonObject
+import kotlinx.serialization.json.put
+import okhttp3.OkHttpClient
+import okhttp3.WebSocket
+import org.junit.After
+import org.junit.Assert.assertTrue
+import org.junit.Before
+import org.junit.Rule
+import org.junit.Test
+
+/** Real Gateway callbacks drive production activity surfaces through Android lifecycle changes. */
+class ChatActivityReceiptInstrumentedTest {
+    @get:Rule val compose = createAndroidComposeRule<ComponentActivity>()
+
+    private lateinit var fixture: AndroidGatewayContractFixture
+    private lateinit var gatewayScope: CoroutineScope
+    private lateinit var gateway: GatewayChatClient
+    private lateinit var handler: ChatHandler
+    private lateinit var viewModel: ChatViewModel
+    private lateinit var socket: WebSocket
+    private val owner = AgentDisplay.profileContextKey("fixture-connection", "research")
+
+    @Before
+    fun setUp() {
+        fixture = AndroidGatewayContractFixture().also { it.profileName = "research" }
+        gatewayScope = CoroutineScope(SupervisorJob() + Dispatchers.IO)
+        val http = OkHttpClient()
+        gateway = GatewayChatClient(
+            initialDashboardClient = DashboardApiClient(fixture.server.url("/").toString().trimEnd('/'), okHttpClient = http),
+            okHttpClient = http,
+            callbackDispatcher = { block -> Handler(Looper.getMainLooper()).post(block) },
+            scope = gatewayScope,
+            reconnectJitterUnit = { 0.0 },
+        )
+        handler = ChatHandler().also { it.setSessionId(STORED_SESSION_ID) }
+        viewModel = ChatViewModel().also {
+            it.initialize(HermesApiClient(fixture.server.url("/").toString(), "fixture-key"), handler)
+            it.streamingEndpoint = "gateway"
+            it.setSessionProfileNameProvider { "research" }
+            it.setProfileMessageLoader { Result.success(emptyList()) }
+            it.setChatActivityStore(InMemoryChatActivityStore())
+            it.switchProfileContext(owner, STORED_SESSION_ID)
+            it.updateGatewayClient(gateway)
+            it.setChatVisible(true)
+        }
+        compose.setContent {
+            val messages by viewModel.messages.collectAsStateWithLifecycle()
+            val records by viewModel.activityRecords.collectAsStateWithLifecycle()
+            val children by viewModel.subagentActivities.collectAsStateWithLifecycle()
+            val retained by viewModel.retainedActivityPreview.collectAsStateWithLifecycle()
+            val childPreview by viewModel.subagentChildPreview.collectAsStateWithLifecycle()
+            val session by viewModel.currentSessionId.collectAsStateWithLifecycle()
+            var sheetOpen by remember { mutableStateOf(false) }
+            MaterialTheme {
+                Column {
+                    GatewayBackgroundProcessStrip(
+                        processes = emptyList(), subagentActivities = children,
+                        subagentPreviewVisibility = SubagentPreviewVisibility(), loading = false,
+                        onClick = { viewModel.openCurrentActivityPreview(); sheetOpen = true },
+                        modifier = Modifier.testTag("active-activity"),
+                    )
+                    projectChatActivityReceipts(messages, records, owner, session).forEach { message ->
+                        message.activityRecord?.let { record ->
+                            ChatActivityReceipt(
+                                record = record,
+                                onClick = { sheetOpen = viewModel.openRetainedActivity(record) },
+                                modifier = Modifier.testTag("activity-receipt"),
+                            )
+                        }
+                    }
+                }
+                if (sheetOpen) {
+                    GatewayBackgroundProcessSheet(
+                        processes = retained?.processes.orEmpty(),
+                        subagentActivities = retained?.record?.previewActivities() ?: children,
+                        subagentChildPreview = childPreview,
+                        subagentPreviewVisibility = SubagentPreviewVisibility(),
+                        loading = false, stoppingProcessIds = emptySet(),
+                        onRefresh = viewModel::refreshBackgroundProcesses,
+                        onStop = viewModel::stopBackgroundProcess,
+                        onDismissProcess = viewModel::dismissBackgroundProcess,
+                        onOpenSubagentChild = viewModel::openSubagentChildPreview,
+                        onDismiss = { viewModel.closeActivityPreview(); sheetOpen = false },
+                        readOnlyHistory = retained != null,
+                        historyNotice = "Recorded activity. Available child history is read-only.",
+                    )
+                }
+            }
+        }
+        assertTrue(runBlocking { gateway.prewarmAwait(STORED_SESSION_ID) })
+        socket = fixture.awaitServerSocket()
+        fixture.awaitRpc("session.resume")
+    }
+
+    @After
+    fun tearDown() {
+        viewModel.updateGatewayClient(null)
+        gateway.shutdown()
+        gatewayScope.cancel()
+        fixture.shutdown()
+    }
+
+    @Test
+    fun detachedCompletionLeavesReopenableReceiptAcrossActivityResume() {
+        viewModel.sendMessage("Delegate a background task")
+        fixture.awaitRpc("prompt.submit")
+        socket.send(fixture.event("message.start", null, LIVE_SESSION_ID))
+        socket.send(fixture.event("subagent.start", buildJsonObject {
+            put("subagent_id", "receipt-child")
+            put("delegation_id", "receipt-delegation")
+            put("task_count", 1)
+            put("goal", "Inspect activity lifecycle")
+        }, LIVE_SESSION_ID))
+        compose.waitUntil(5_000) { viewModel.subagentActivities.value.size == 1 }
+        compose.onNodeWithTag("active-activity").assertIsDisplayed()
+        socket.send(fixture.event("message.complete", buildJsonObject { put("text", "Launched") }, LIVE_SESSION_ID))
+        compose.waitUntil(5_000) { !handler.isStreaming.value }
+        compose.onNodeWithTag("active-activity").assertIsDisplayed()
+
+        socket.send(fixture.event("subagent.complete", buildJsonObject {
+            put("subagent_id", "receipt-child")
+            put("delegation_id", "receipt-delegation")
+            put("status", "completed")
+        }, LIVE_SESSION_ID))
+        compose.waitUntil(5_000) { viewModel.activityRecords.value.singleOrNull()?.phase == ChatActivityPhase.COMPLETE }
+        compose.onNodeWithTag("active-activity").assertDoesNotExist()
+        compose.onNodeWithTag("activity-receipt").assertIsDisplayed().performClick()
+        compose.onNodeWithText("Chat activity").assertIsDisplayed()
+        compose.onNodeWithText("Recorded activity. Available child history is read-only.").assertIsDisplayed()
+        compose.onNodeWithText("Stop").assertDoesNotExist()
+        compose.onNodeWithContentDescription("Close activity preview").performClick()
+        compose.onNodeWithTag("activity-receipt").assertIsDisplayed()
+
+        compose.activityRule.scenario.moveToState(Lifecycle.State.STARTED)
+        compose.activityRule.scenario.moveToState(Lifecycle.State.RESUMED)
+        compose.onNodeWithTag("active-activity").assertDoesNotExist()
+        compose.onNodeWithTag("activity-receipt").assertIsDisplayed().performClick()
+        compose.onNodeWithText("Chat activity").assertIsDisplayed()
+    }
+
+    private companion object {
+        const val STORED_SESSION_ID = "20260821_120000_fixture"
+        const val LIVE_SESSION_ID = "fixture-live-1"
+    }
+}
@@ -0,0 +1,116 @@
+package com.hermesandroid.relay.viewmodel
+
+import android.os.Handler
+import android.os.Looper
+import androidx.activity.ComponentActivity
+import androidx.compose.foundation.layout.fillMaxSize
+import androidx.compose.foundation.lazy.LazyColumn
+import androidx.compose.material3.MaterialTheme
+import androidx.compose.runtime.getValue
+import androidx.compose.ui.Modifier
+import androidx.compose.ui.test.assertIsDisplayed
+import androidx.compose.ui.test.junit4.v2.createAndroidComposeRule
+import androidx.compose.ui.test.onNodeWithContentDescription
+import androidx.compose.ui.test.onNodeWithText
+import androidx.compose.ui.test.performClick
+import androidx.compose.ui.test.performImeAction
+import androidx.compose.ui.test.performTextInput
+import androidx.lifecycle.Lifecycle
+import androidx.lifecycle.compose.collectAsStateWithLifecycle
+import com.hermesandroid.relay.network.upstream.ChatHandler
+import com.hermesandroid.relay.network.upstream.DashboardApiClient
+import com.hermesandroid.relay.network.upstream.GatewayChatClient
+import com.hermesandroid.relay.network.upstream.HermesApiClient
+import com.hermesandroid.relay.ui.components.MessageBubble
+import kotlinx.coroutines.CoroutineScope
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.SupervisorJob
+import kotlinx.coroutines.cancel
+import kotlinx.coroutines.runBlocking
+import kotlinx.serialization.json.Json
+import kotlinx.serialization.json.JsonObject
+import kotlinx.serialization.json.JsonPrimitive
+import okhttp3.OkHttpClient
+import okhttp3.WebSocket
+import org.junit.After
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertTrue
+import org.junit.Before
+import org.junit.Rule
+import org.junit.Test
+
+/** Production socket, ViewModel, transcript, Compose and IME actions on a virtual device. */
+class ClarifyBatchInstrumentedTest {
+    @get:Rule val compose = createAndroidComposeRule<ComponentActivity>()
+    private lateinit var fixture: AndroidGatewayContractFixture
+    private lateinit var scope: CoroutineScope
+    private lateinit var gateway: GatewayChatClient
+    private lateinit var viewModel: ChatViewModel
+    private lateinit var handler: ChatHandler
+    private lateinit var socket: WebSocket
+
+    @Before fun setUp() {
+        fixture = AndroidGatewayContractFixture()
+        scope = CoroutineScope(SupervisorJob() + Dispatchers.IO)
+        val http = OkHttpClient()
+        gateway = GatewayChatClient(
+            initialDashboardClient = DashboardApiClient(fixture.server.url("/").toString().trimEnd('/'), http),
+            okHttpClient = http, scope = scope,
+            callbackDispatcher = { Handler(Looper.getMainLooper()).post(it) },
+        )
+        handler = ChatHandler().also { it.setSessionId("20260821_120000_fixture") }
+        viewModel = ChatViewModel().also {
+            it.initialize(HermesApiClient(fixture.server.url("/").toString(), "fixture-key"), handler)
+            it.streamingEndpoint = "gateway"
+            it.setProfileMessageLoader { Result.success(emptyList()) }
+            it.updateGatewayClient(gateway)
+        }
+        compose.setContent {
+            val messages by handler.messages.collectAsStateWithLifecycle()
+            MaterialTheme {
+                LazyColumn(Modifier.fillMaxSize()) {
+                    items(messages.size, key = { messages[it].id }) { index ->
+                        MessageBubble(messages[index], showTimestamps = false,
+                            onCardInput = viewModel::answerAsk, animationEnabled = false)
+                    }
+                }
+            }
+        }
+        assertTrue(runBlocking { gateway.prewarmAwait("20260821_120000_fixture") })
+        socket = fixture.awaitServerSocket()
+    }
+
+    @After fun tearDown() {
+        viewModel.updateGatewayClient(null)
+        gateway.shutdown()
+        scope.cancel()
+        fixture.shutdown()
+    }
+
+    @Test fun confirmedProgressSurvivesLifecycleAndCustomAnswerUsesIme() {
+        compose.runOnIdle { viewModel.sendMessage("Ask two questions") }
+        fixture.awaitRpc("prompt.submit")
+        socket.send(fixture.event("clarify.request", Json.parseToJsonElement("""
+            {"request_id":"batch-device","questions":[
+              {"qid":"route/a","question":"Which route?","choices":["Canary","Immediate"]},
+              {"qid":"notes:b","question":"Anything else?","choices":null}
+            ]}
+        """) as JsonObject, "fixture-live-1"))
+        compose.waitUntil(10_000) { viewModel.pendingAsk.value != null }
+        compose.onNodeWithText("Canary").performClick()
+        compose.waitUntil(10_000) { viewModel.pendingAsk.value?.ask?.answers?.get("route/a") == "Canary" }
+        assertEquals(JsonPrimitive("route/a"), fixture.awaitRpc("clarify.respond")["question_id"])
+        compose.activityRule.scenario.moveToState(Lifecycle.State.STARTED)
+        compose.activityRule.scenario.moveToState(Lifecycle.State.RESUMED)
+        compose.onNodeWithText("Question 2 of 2").assertIsDisplayed()
+        compose.onNodeWithContentDescription("Type an answer…").apply {
+            performClick()
+            performTextInput("  Keep rollback ready  ")
+            performImeAction()
+        }
+        compose.waitUntil(10_000) { viewModel.pendingAsk.value == null }
+        compose.onNodeWithText("All questions answered").assertIsDisplayed()
+        assertEquals(2, fixture.rpcCount("clarify.respond"))
+        assertEquals(1, fixture.rpcCount("prompt.submit"))
+    }
+}
@@ -15,6 +15,10 @@ import androidx.compose.ui.test.assertTextEquals
 import androidx.compose.ui.test.junit4.v2.createAndroidComposeRule
 import androidx.compose.ui.test.onAllNodesWithText
 import androidx.compose.ui.test.onNodeWithTag
+import androidx.compose.ui.test.onAllNodesWithContentDescription
+import androidx.compose.ui.test.onNodeWithContentDescription
+import androidx.compose.ui.test.onNodeWithText
+import androidx.compose.ui.test.performClick
 import androidx.test.platform.app.InstrumentationRegistry
 import androidx.lifecycle.compose.collectAsStateWithLifecycle
 import com.hermesandroid.relay.data.MessageRole
@@ -58,9 +62,17 @@ class GatewayExternalFixtureInstrumentedTest {
    private var gatewayScope: CoroutineScope? = null
    private var gatewayClient: GatewayChatClient? = null
    private var viewModel: ChatViewModel? = null
+    private var voiceViewModel: VoiceViewModel? = null
+    private var voicePlayer: com.hermesandroid.relay.audio.VoicePlayer? = null
+    private var voiceSfx: com.hermesandroid.relay.audio.VoiceSfxPlayer? = null

    @After
    fun tearDown() {
+        compose.runOnUiThread {
+            voiceViewModel?.exitVoiceMode()
+            voicePlayer?.release()
+            voiceSfx?.release()
+        }
        viewModel?.updateGatewayClient(null)
        gatewayClient?.shutdown()
        gatewayScope?.cancel()
@@ -171,6 +183,155 @@ class GatewayExternalFixtureInstrumentedTest {
        }
    }

+    @Test
+    fun queuedStopResume_preservesWorkAcrossLifecycleAndUsesExplicitResume() {
+        val base = InstrumentationRegistry.getArguments().getString(ARG_FIXTURE_BASE_URL)?.trimEnd('/')
+        assumeTrue("Pass a queued_stop_resume fixture URL", !base.isNullOrBlank())
+        requireNotNull(base)
+        val http = OkHttpClient.Builder().callTimeout(10, TimeUnit.SECONDS).build()
+        assertEquals("queued_stop_resume", readFixtureJson(http, "$base/__fixture__/state")["scenario"]?.jsonString())
+        val dashboard = DashboardApiClient(base, http)
+        val scope = CoroutineScope(SupervisorJob() + Dispatchers.IO).also { gatewayScope = it }
+        val gateway = GatewayChatClient(
+            initialDashboardClient = dashboard, okHttpClient = http, scope = scope,
+            callbackDispatcher = { block -> Handler(Looper.getMainLooper()).post(block) },
+            reconnectJitterUnit = { 0.0 },
+        ).also { gatewayClient = it }
+        val handler = ChatHandler().also { it.setSessionId(STORED_SESSION_ID) }
+        val vm = ChatViewModel().also {
+            it.initialize(null, handler)
+            it.streamingEndpoint = "gateway"
+            it.setProfileMessageLoaderWithMode { profile, session, mode -> dashboard.getSessionMessages(session, profile, mode) }
+            it.updateGatewayClient(gateway)
+            it.switchProfileContext(com.hermesandroid.relay.data.AgentDisplay.profileContextKey("fixture-queue", null), STORED_SESSION_ID)
+        }.also { viewModel = it }
+        compose.setContent {
+            val queue by vm.queuedMessages.collectAsStateWithLifecycle()
+            val paused by vm.queuePaused.collectAsStateWithLifecycle()
+            com.hermesandroid.relay.ui.theme.HermesRelayTheme(themePreference = "dark") {
+                androidx.compose.material3.Surface {
+                    Column {
+                        com.hermesandroid.relay.ui.components.ChatBusyActionSelector(
+                            com.hermesandroid.relay.data.BusyMessageAction.QueueNext, {}, onStop = vm::cancelStream,
+                        )
+                        com.hermesandroid.relay.ui.components.ChatMessageQueue(
+                            queue, paused, vm::resumeQueue, vm::clearQueue, {}, vm::removeQueuedAt, canEdit = true,
+                        )
+                    }
+                }
+            }
+        }
+        assertTrue(runBlocking { gateway.prewarmAwait(STORED_SESSION_ID) })
+        compose.runOnIdle { vm.sendMessage("Original work") }
+        compose.waitUntil(10_000) { handler.isStreaming.value && vm.steerableTurn.value }
+        compose.runOnIdle {
+            vm.sendMessage("Remove this follow-up", com.hermesandroid.relay.data.BusyMessageAction.QueueNext)
+            vm.sendMessage("Keep this follow-up", com.hermesandroid.relay.data.BusyMessageAction.QueueNext)
+        }
+        compose.onAllNodesWithContentDescription("Remove queued message")[0].performClick()
+        compose.onNodeWithContentDescription("Stop streaming").performClick()
+        compose.onNodeWithText("Queue paused").assertIsDisplayed()
+        assertEquals(listOf("Keep this follow-up"), vm.queuedMessages.value)
+
+        compose.activityRule.scenario.moveToState(androidx.lifecycle.Lifecycle.State.CREATED)
+        compose.activityRule.scenario.moveToState(androidx.lifecycle.Lifecycle.State.RESUMED)
+        compose.onNodeWithText("Keep this follow-up").assertIsDisplayed()
+        compose.onNodeWithText("Resume").performClick()
+        try {
+            compose.waitUntil(15_000) {
+                vm.queuedMessages.value.isEmpty() && !handler.isStreaming.value &&
+                    handler.messages.value.any { it.content == "Resumed follow-up." }
+            }
+        } catch (error: androidx.compose.ui.test.ComposeTimeoutException) {
+            throw AssertionError(
+                "Synthetic queue fixture did not settle: queued=${vm.queuedMessages.value.size}, " +
+                    "paused=${vm.queuePaused.value}, streaming=${handler.isStreaming.value}, " +
+                    "messages=${handler.messages.value.map { it.role to it.content }}, " +
+                    "error=${handler.error.value}",
+                error,
+            )
+        }
+        val evidence = readFixtureJson(http, "$base/__fixture__/evidence")["entries"] as JsonArray
+        assertEquals(2, evidence.rpcCount("prompt.submit"))
+        assertEquals(1, evidence.rpcCount("session.interrupt"))
+        assertEquals(0, evidence.rpcCount("session.redirect"))
+        assertEquals("gateway", vm.streamingEndpoint)
+    }
+
+    @Test
+    fun unsolicitedVoiceCompletions_surviveActivityPauseWithoutHistorySpeech() {
+        val base = InstrumentationRegistry.getArguments().getString(ARG_FIXTURE_BASE_URL)
+            ?.trim()?.trimEnd('/')
+        assumeTrue("Pass the unsolicited_voice_completions fixture URL", !base.isNullOrBlank())
+        requireNotNull(base)
+        val http = OkHttpClient.Builder().callTimeout(10, TimeUnit.SECONDS).build()
+        assertEquals("unsolicited_voice_completions", readFixtureJson(http, "$base/__fixture__/state")["scenario"]?.jsonString())
+        val dashboard = DashboardApiClient(base, http)
+        val scope = CoroutineScope(SupervisorJob() + Dispatchers.IO).also { gatewayScope = it }
+        val gateway = GatewayChatClient(
+            initialDashboardClient = dashboard, okHttpClient = http,
+            callbackDispatcher = { Handler(Looper.getMainLooper()).post(it) }, scope = scope,
+        ).also { gatewayClient = it }
+        val handler = ChatHandler().also { it.setSessionId(STORED_SESSION_ID) }
+        val spoken = java.util.concurrent.CopyOnWriteArrayList<String>()
+        lateinit var vm: ChatViewModel
+        compose.runOnUiThread {
+            val app = compose.activity.application
+            vm = ChatViewModel().also {
+                it.initialize(null, handler)
+                it.streamingEndpoint = "gateway"
+                it.setProfileMessageLoaderWithMode { profile, id, mode ->
+                    dashboard.getSessionMessages(id, profile, mode)
+                }
+                it.updateGatewayClient(gateway)
+                viewModel = it
+            }
+            val audio = object : com.hermesandroid.relay.network.shared.VoiceAudioClient {
+                override val route = com.hermesandroid.relay.data.VoiceAudioRoute.Standard
+                override suspend fun transcribe(audioFile: java.io.File) = Result.success("")
+                override suspend fun synthesize(text: String): Result<java.io.File> {
+                    spoken.add(text)
+                    // A short silent WAV exercises the production play/drain path without a provider.
+                    val pcm = ByteArray(3200)
+                    val header = java.nio.ByteBuffer.allocate(44).order(java.nio.ByteOrder.LITTLE_ENDIAN)
+                        .put("RIFF".toByteArray()).putInt(36 + pcm.size).put("WAVEfmt ".toByteArray())
+                        .putInt(16).putShort(1).putShort(1).putInt(16000).putInt(32000)
+                        .putShort(2).putShort(16).put("data".toByteArray()).putInt(pcm.size).array()
+                    val file = java.io.File.createTempFile("fixture-voice", ".wav", app.cacheDir)
+                    file.writeBytes(header + pcm)
+                    return Result.success(file)
+                }
+            }
+            val player = com.hermesandroid.relay.audio.VoicePlayer(app).also { voicePlayer = it }
+            val sfx = com.hermesandroid.relay.audio.VoiceSfxPlayer(app).also { voiceSfx = it }
+            voiceViewModel = VoiceViewModel(app).also {
+                it.initialize(
+                    voiceClient = com.hermesandroid.relay.network.relay.RelayVoiceClient(app, http, { null }, { null }),
+                    voiceAudioClient = audio, chatViewModel = vm,
+                    recorder = com.hermesandroid.relay.audio.VoiceRecorder(app, scope),
+                    player = player, sfxPlayer = sfx,
+                )
+                it.enterVoiceMode()
+            }
+        }
+        compose.setContent {
+            val messages by vm.messages.collectAsStateWithLifecycle()
+            Text(messages.joinToString("\n") { it.content }, Modifier.testTag("voice-fixture-history"))
+        }
+        assertTrue(runBlocking { gateway.prewarmAwait(STORED_SESSION_ID) })
+        compose.runOnUiThread { vm.sendMessage("Start background work.") }
+        compose.waitUntil(10_000) { handler.messages.value.any { it.content == "Work started." } }
+        compose.activityRule.scenario.moveToState(androidx.lifecycle.Lifecycle.State.STARTED)
+        compose.waitUntil(15_000) { spoken.size == 3 }
+        compose.activityRule.scenario.moveToState(androidx.lifecycle.Lifecycle.State.RESUMED)
+        compose.runOnUiThread { voiceViewModel?.onAppResumed() }
+        compose.waitForIdle()
+        assertEquals(listOf("Process finished.", "Watch matched.", "Delegated work finished."), spoken.toList())
+        assertEquals(1, readFixtureJson(http, "$base/__fixture__/evidence")["entries"].let { it as JsonArray }.rpcCount("prompt.submit"))
+        assertTrue(handler.messages.value.any { it.content == "Delegated work finished." })
+        assertEquals("gateway", vm.streamingEndpoint)
+    }
+
    private fun JsonArray.rpcCount(method: String): Int = count { element ->
        val entry = element as? JsonObject ?: return@count false
        entry["kind"]?.jsonString() == "rpc" && entry["method"]?.jsonString() == method
@@ -4,11 +4,13 @@ import android.os.Handler
 import android.os.Looper
 import androidx.activity.ComponentActivity
 import androidx.compose.foundation.layout.Column
-import androidx.compose.runtime.getValue
-import androidx.compose.ui.platform.testTag
-import androidx.compose.ui.Modifier
+import androidx.compose.material3.Button
 import androidx.compose.material3.MaterialTheme
 import androidx.compose.material3.Text
+import androidx.compose.runtime.LaunchedEffect
+import androidx.compose.runtime.getValue
+import androidx.compose.ui.Modifier
+import androidx.compose.ui.platform.testTag
 import androidx.compose.ui.test.assertIsDisplayed
 import androidx.compose.ui.test.assertTextEquals
 import androidx.compose.ui.test.junit4.v2.createAndroidComposeRule
@@ -16,16 +18,29 @@ import androidx.compose.ui.test.onAllNodesWithTag
 import androidx.compose.ui.test.onNodeWithTag
 import androidx.lifecycle.Lifecycle
 import androidx.lifecycle.compose.collectAsStateWithLifecycle
+import com.hermesandroid.relay.data.AgentDisplay
+import com.hermesandroid.relay.data.ChatTurnAssistantCheckpoint
+import com.hermesandroid.relay.data.ChatTurnCheckpoint
+import com.hermesandroid.relay.data.ChatTurnCheckpointStore
+import com.hermesandroid.relay.data.ChatTurnUserCheckpoint
 import com.hermesandroid.relay.data.MessageRole
 import com.hermesandroid.relay.network.upstream.ChatHandler
 import com.hermesandroid.relay.network.upstream.DashboardApiClient
+import com.hermesandroid.relay.network.upstream.GatewayAvailability
 import com.hermesandroid.relay.network.upstream.GatewayChatClient
+import com.hermesandroid.relay.network.upstream.GatewayConnectionState
 import com.hermesandroid.relay.network.upstream.HermesApiClient
 import com.hermesandroid.relay.network.upstream.models.MessageItem
+import com.hermesandroid.relay.network.upstream.models.SessionItem
+import com.hermesandroid.relay.ui.components.GatewayBackgroundProcessStrip
+import com.hermesandroid.relay.ui.components.SubagentPreviewVisibility
+import com.hermesandroid.relay.ui.screens.shouldOwnVisibleGateway
+import kotlinx.coroutines.CompletableDeferred
 import kotlinx.coroutines.CoroutineScope
 import kotlinx.coroutines.Dispatchers
 import kotlinx.coroutines.SupervisorJob
 import kotlinx.coroutines.cancel
+import kotlinx.coroutines.flow.MutableStateFlow
 import kotlinx.coroutines.runBlocking
 import kotlinx.serialization.json.Json
 import kotlinx.serialization.json.JsonObject
@@ -44,6 +59,7 @@ import okhttp3.mockwebserver.RecordedRequest
 import org.junit.After
 import org.junit.Assert.assertEquals
 import org.junit.Assert.assertFalse
+import org.junit.Assert.assertNull
 import org.junit.Assert.assertTrue
 import org.junit.Before
 import org.junit.Rule
@@ -74,10 +90,13 @@ class GatewayForegroundRecoveryInstrumentedTest {

    @Volatile
    private var persistedHistory: List<MessageItem> = emptyList()
+    private val historySignInRequired = MutableStateFlow(false)
+    private val coldStartAdmissionEnabled = MutableStateFlow(false)
+    private val coldStartGatewayAvailability = MutableStateFlow(GatewayAvailability.Unknown)

    @Before
    fun setUp() {
-        fixture = AndroidGatewayContractFixture()
+        fixture = AndroidGatewayContractFixture().also { it.profileName = PROFILE_NAME }
        gatewayScope = CoroutineScope(SupervisorJob() + Dispatchers.IO)
        val okHttp = OkHttpClient()
        gatewayClient = GatewayChatClient(
@@ -97,6 +116,7 @@ class GatewayForegroundRecoveryInstrumentedTest {
                handler,
            )
            it.streamingEndpoint = "gateway"
+            it.setSessionProfileNameProvider { PROFILE_NAME }
            it.setProfileMessageLoader { Result.success(persistedHistory) }
            it.updateGatewayClient(gatewayClient)
            it.setChatVisible(true)
@@ -105,8 +125,31 @@ class GatewayForegroundRecoveryInstrumentedTest {
        compose.setContent {
            val messages by viewModel.messages.collectAsStateWithLifecycle()
            val streaming by viewModel.isStreaming.collectAsStateWithLifecycle()
+            val children by viewModel.subagentActivities.collectAsStateWithLifecycle()
+            val signInRequired by historySignInRequired.collectAsStateWithLifecycle()
+            val admissionEnabled by coldStartAdmissionEnabled.collectAsStateWithLifecycle()
+            val admissionAvailability by coldStartGatewayAvailability.collectAsStateWithLifecycle()
+            LaunchedEffect(admissionEnabled, admissionAvailability) {
+                if (admissionEnabled) {
+                    viewModel.setChatVisible(
+                        shouldOwnVisibleGateway(
+                            appForeground = true,
+                            isGatewayTransport = true,
+                            gatewayAvailability = admissionAvailability,
+                        ),
+                    )
+                }
+            }
            MaterialTheme {
                Column(Modifier.testTag("contract-transcript")) {
+                    GatewayBackgroundProcessStrip(
+                        processes = emptyList(),
+                        subagentActivities = children,
+                        subagentPreviewVisibility = SubagentPreviewVisibility(),
+                        loading = false,
+                        onClick = {},
+                        modifier = Modifier.testTag("child-activity"),
+                    )
                    Text(
                        text = if (streaming) "STREAMING" else "IDLE",
                        modifier = Modifier.testTag("stream-state"),
@@ -117,6 +160,14 @@ class GatewayForegroundRecoveryInstrumentedTest {
                            modifier = Modifier.testTag("message-${message.id}"),
                        )
                    }
+                    if (signInRequired) {
+                        Button(
+                            onClick = {},
+                            modifier = Modifier.testTag("dashboard-sign-in-recovery"),
+                        ) {
+                            Text("SIGN IN")
+                        }
+                    }
                }
            }
        }
@@ -126,6 +177,122 @@ class GatewayForegroundRecoveryInstrumentedTest {
        fixture.awaitRpc("session.resume")
    }

+    @Test
+    fun authenticatedUnknownColdLaunch_opensObservationSocketWithoutLifecycleBounce() {
+        viewModel.setChatVisible(false)
+        viewModel.updateGatewayClient(null)
+        gatewayClient.shutdown()
+        gatewayScope.cancel()
+
+        val controlMethods = setOf(
+            "session.resume",
+            "session.activate",
+            "prompt.submit",
+            "session.interrupt",
+        )
+        val baseline = controlMethods.associateWith(fixture::rpcCount)
+        val ticketMintsBefore = fixture.requestsTo("/api/auth/ws-ticket")
+        gatewayScope = CoroutineScope(SupervisorJob() + Dispatchers.IO)
+        val okHttp = OkHttpClient()
+        gatewayClient = GatewayChatClient(
+            initialDashboardClient = DashboardApiClient(
+                baseUrl = fixture.server.url("/").toString().trimEnd('/'),
+                okHttpClient = okHttp,
+            ),
+            okHttpClient = okHttp,
+            callbackDispatcher = { block -> Handler(Looper.getMainLooper()).post(block) },
+            scope = gatewayScope,
+            reconnectJitterUnit = { 0.0 },
+        )
+        viewModel.setChatTurnCheckpointStore(null)
+        viewModel.updateGatewayClient(gatewayClient)
+
+        coldStartGatewayAvailability.value = GatewayAvailability.Unknown
+        coldStartAdmissionEnabled.value = true
+
+        compose.waitUntil(5_000) {
+            gatewayClient.connectionState.value == GatewayConnectionState.Ready
+        }
+        serverSocket = fixture.awaitServerSocket()
+        assertEquals(ticketMintsBefore + 1, fixture.requestsTo("/api/auth/ws-ticket"))
+        controlMethods.forEach { method ->
+            assertEquals(
+                "cold observation sent $method",
+                baseline.getValue(method),
+                fixture.rpcCount(method),
+            )
+        }
+    }
+
+    @Test
+    fun dashboardOnlyColdLaunch_waitsForExactDirectoryThenOpensObservationSocket() {
+        viewModel.setChatVisible(false)
+        viewModel.updateGatewayClient(null)
+        gatewayClient.shutdown()
+        gatewayScope.cancel()
+
+        val directoryStarted = CompletableDeferred<Unit>()
+        val directoryResult = CompletableDeferred<Result<List<SessionItem>>>()
+        viewModel.setProfileSessionLister { profile ->
+            assertEquals(PROFILE_NAME, profile)
+            directoryStarted.complete(Unit)
+            directoryResult.await()
+        }
+        handler.setSessionId(null)
+        viewModel.switchProfileContext(
+            AgentDisplay.profileContextKey("fixture-connection", PROFILE_NAME),
+            STORED_SESSION_ID,
+        )
+
+        val controlMethods = setOf(
+            "session.resume",
+            "session.activate",
+            "prompt.submit",
+            "session.interrupt",
+        )
+        val baseline = controlMethods.associateWith(fixture::rpcCount)
+        val ticketMintsBefore = fixture.requestsTo("/api/auth/ws-ticket")
+        gatewayScope = CoroutineScope(SupervisorJob() + Dispatchers.IO)
+        val okHttp = OkHttpClient()
+        gatewayClient = GatewayChatClient(
+            initialDashboardClient = DashboardApiClient(
+                baseUrl = fixture.server.url("/").toString().trimEnd('/'),
+                okHttpClient = okHttp,
+            ),
+            okHttpClient = okHttp,
+            callbackDispatcher = { block -> Handler(Looper.getMainLooper()).post(block) },
+            scope = gatewayScope,
+            reconnectJitterUnit = { 0.0 },
+        )
+        viewModel.setChatTurnCheckpointStore(null)
+        viewModel.updateGatewayClient(gatewayClient)
+        viewModel.setChatVisible(true)
+
+        // This is the production binder's Dashboard/profile hydration edge.
+        // The socket must stay passive and closed until the exact-owner REST
+        // directory publishes, then open without a lifecycle bounce.
+        viewModel.refreshSessions()
+        compose.waitUntil(5_000) { directoryStarted.isCompleted }
+        assertEquals(ticketMintsBefore, fixture.requestsTo("/api/auth/ws-ticket"))
+
+        directoryResult.complete(
+            Result.success(listOf(SessionItem(id = STORED_SESSION_ID, title = "Fixture session"))),
+        )
+
+        compose.waitUntil(5_000) {
+            gatewayClient.connectionState.value == GatewayConnectionState.Ready
+        }
+        serverSocket = fixture.awaitServerSocket()
+        assertEquals(ticketMintsBefore + 1, fixture.requestsTo("/api/auth/ws-ticket"))
+        controlMethods.forEach { method ->
+            assertEquals(
+                "directory-gated cold observation sent $method",
+                baseline.getValue(method),
+                fixture.rpcCount(method),
+            )
+        }
+    }
+
    @After
    fun tearDown() {
        viewModel.updateGatewayClient(null)
@@ -134,6 +301,37 @@ class GatewayForegroundRecoveryInstrumentedTest {
        fixture.shutdown()
    }

+    @Test
+    fun detachedChildActivity_survivesParentTerminalAndActivityResume() {
+        viewModel.sendMessage("Delegate a background task")
+        fixture.awaitRpc("prompt.submit")
+        serverSocket.send(fixture.event("message.start", null, LIVE_SESSION_ID))
+        serverSocket.send(fixture.event("subagent.start", buildJsonObject {
+            put("subagent_id", "detached-child")
+            put("goal", "Inspect")
+        }, LIVE_SESSION_ID))
+        compose.waitUntil(5_000) { viewModel.subagentActivities.value.size == 1 }
+        compose.onNodeWithTag("child-activity").assertIsDisplayed()
+        serverSocket.send(fixture.event("message.complete", buildJsonObject { put("text", "Launched") }, LIVE_SESSION_ID))
+        compose.waitUntil(5_000) { !handler.isStreaming.value }
+        compose.activityRule.scenario.moveToState(Lifecycle.State.STARTED)
+        serverSocket.send(fixture.event("subagent.progress", buildJsonObject {
+            put("subagent_id", "detached-child")
+            put("text", "Still working")
+        }, LIVE_SESSION_ID))
+        compose.activityRule.scenario.moveToState(Lifecycle.State.RESUMED)
+        compose.waitUntil(5_000) { viewModel.subagentActivities.value.single().events.last().text == "Still working" }
+        compose.onNodeWithTag("child-activity").assertIsDisplayed()
+        assertFalse(viewModel.subagentActivities.value.single().isTerminal)
+        compose.onNodeWithTag("stream-state").assertTextEquals("IDLE")
+        serverSocket.send(fixture.event("subagent.complete", buildJsonObject {
+            put("subagent_id", "detached-child")
+            put("status", "completed")
+        }, LIVE_SESSION_ID))
+        compose.waitUntil(5_000) { viewModel.subagentActivities.value.single().isTerminal }
+        compose.onNodeWithTag("child-activity").assertDoesNotExist()
+    }
+
    @Test
    fun terminalGapActivate_recoversForegroundTurnWithoutNavigationOrCrossSessionLeak() {
        viewModel.sendMessage("Run a long foreground task")
@@ -239,6 +437,243 @@ class GatewayForegroundRecoveryInstrumentedTest {
        assertEquals(0, fixture.requestsTo("/v1/chat/completions"))
    }

+    @Test
+    fun terminalGapActiveList_settlesExactOwnedTurnAndRendersAuthoritativeHistory() {
+        viewModel.sendMessage("Run an Android-owned task")
+        fixture.awaitRpc("prompt.submit")
+        serverSocket.send(fixture.event("message.start", null, LIVE_SESSION_ID))
+        serverSocket.send(
+            fixture.event(
+                "message.delta",
+                buildJsonObject { put("text", PARTIAL_ANSWER) },
+                LIVE_SESSION_ID,
+            ),
+        )
+        compose.waitUntil(5_000) { handler.isStreaming.value }
+        compose.onNodeWithTag("stream-state").assertTextEquals("STREAMING")
+
+        persistedHistory = listOf(
+            MessageItem(
+                id = PERSISTED_ANSWER_ID,
+                sessionId = STORED_SESSION_ID,
+                role = "assistant",
+                content = JsonPrimitive(AUTHORITATIVE_ANSWER),
+            ),
+        )
+        fixture.activeSessionStatus = "idle"
+        runBlocking { gatewayClient.listActiveSessions() }
+
+        compose.waitUntil(5_000) {
+            !handler.isStreaming.value &&
+                !gatewayClient.hasActiveTurn() &&
+                handler.messages.value.singleOrNull()?.id == PERSISTED_ANSWER_ID
+        }
+        compose.onNodeWithTag("stream-state").assertTextEquals("IDLE")
+        compose.onNodeWithTag("message-$PERSISTED_ANSWER_ID")
+            .assertTextEquals("${MessageRole.ASSISTANT.name}:$AUTHORITATIVE_ANSWER")
+        assertEquals(1, fixture.rpcCount("prompt.submit"))
+        assertEquals(0, fixture.rpcCount("session.interrupt"))
+        assertEquals(0, fixture.rpcCount("session.activate"))
+        assertEquals(0, fixture.requestsTo("/v1/chat/completions"))
+    }
+
+    @Test
+    fun desktopOwnedTurn_remainsReadOnlyAcrossAndroidForegroundLifecycle() {
+        viewModel.setChatVisible(false)
+        viewModel.updateGatewayClient(null)
+        gatewayClient.shutdown()
+        gatewayScope.cancel()
+
+        val controlMethods = setOf(
+            "session.resume",
+            "session.activate",
+            "session.interrupt",
+            "prompt.submit",
+        )
+        gatewayScope = CoroutineScope(SupervisorJob() + Dispatchers.IO)
+        val okHttp = OkHttpClient()
+        gatewayClient = GatewayChatClient(
+            initialDashboardClient = DashboardApiClient(
+                baseUrl = fixture.server.url("/").toString().trimEnd('/'),
+                okHttpClient = okHttp,
+            ),
+            okHttpClient = okHttp,
+            callbackDispatcher = { block -> Handler(Looper.getMainLooper()).post(block) },
+            scope = gatewayScope,
+            reconnectJitterUnit = { 0.0 },
+        )
+        viewModel.setChatTurnCheckpointStore(null)
+        viewModel.updateGatewayClient(gatewayClient)
+        assertTrue(runBlocking { gatewayClient.observeAwait() })
+        serverSocket = fixture.awaitServerSocket()
+        viewModel.switchProfileContext(
+            AgentDisplay.profileContextKey("fixture-connection", PROFILE_NAME),
+            STORED_SESSION_ID,
+        )
+        viewModel.updateSessionActivityDirectory(listOf(PROFILE_NAME to STORED_SESSION_ID))
+
+        val baseline = controlMethods.associateWith(fixture::rpcCount)
+        val baselineActiveList = fixture.rpcCount("session.active_list")
+        fixture.activeSessionStatus = "working"
+
+        viewModel.setChatVisible(true)
+        compose.activityRule.scenario.moveToState(Lifecycle.State.STARTED)
+        compose.activityRule.scenario.moveToState(Lifecycle.State.RESUMED)
+        viewModel.setChatVisible(false)
+        viewModel.setChatVisible(true)
+        fixture.awaitRpcCount("session.active_list", baselineActiveList + 1)
+
+        controlMethods.forEach { method ->
+            assertEquals(
+                "passive lifecycle sent $method",
+                baseline.getValue(method),
+                fixture.rpcCount(method),
+            )
+        }
+        viewModel.updateGatewayClient(null)
+        gatewayClient.shutdown()
+        assertEquals(
+            "observer teardown interrupted the Desktop turn",
+            baseline.getValue("session.interrupt"),
+            fixture.rpcCount("session.interrupt"),
+        )
+    }
+
+    @Test
+    fun normalCompletion_genericHistory401RetainsTranscriptAndRequiresProfileSignIn() {
+        bindDashboardHistoryFailure(
+            body = "Unauthorized",
+            profileName = PROFILE_NAME,
+        )
+
+        viewModel.sendMessage("Keep this local transcript")
+        fixture.awaitRpc("prompt.submit")
+        serverSocket.send(fixture.event("message.start", null, LIVE_SESSION_ID))
+        serverSocket.send(
+            fixture.event(
+                "message.delta",
+                buildJsonObject { put("text", LOCAL_COMPLETION) },
+                LIVE_SESSION_ID,
+            ),
+        )
+        serverSocket.send(
+            fixture.event(
+                "message.complete",
+                buildJsonObject { put("text", LOCAL_COMPLETION) },
+                LIVE_SESSION_ID,
+            ),
+        )
+
+        compose.waitUntil(15_000) {
+            historySignInRequired.value &&
+                !handler.isStreaming.value &&
+                handler.messages.value.any { it.content == LOCAL_COMPLETION }
+        }
+        compose.activityRule.scenario.moveToState(Lifecycle.State.STARTED)
+        compose.activityRule.scenario.moveToState(Lifecycle.State.RESUMED)
+
+        compose.onNodeWithTag("contract-transcript").assertIsDisplayed()
+        compose.onNodeWithTag("stream-state").assertTextEquals("IDLE")
+        compose.onNodeWithTag("dashboard-sign-in-recovery").assertIsDisplayed()
+        assertFalse(viewModel.isLoadingHistory.value)
+        assertTrue(handler.messages.value.any { it.content == "Keep this local transcript" })
+        assertTrue(handler.messages.value.any { it.content == LOCAL_COMPLETION })
+        assertNull(viewModel.chatFailure.value)
+        assertExactProfileHistoryOnly(PROFILE_NAME)
+    }
+
+    @Test
+    fun recoveredCompletion_sessionExpiredHistoryRetainsSettledTranscript() {
+        bindDashboardHistoryFailure(
+            body = """{"reason":"session_expired"}""",
+            profileName = PROFILE_NAME,
+        )
+        val now = System.currentTimeMillis()
+        val contextKey = AgentDisplay.profileContextKey("fixture-connection", PROFILE_NAME)
+        viewModel.setChatTurnCheckpointStore(
+            MemoryCheckpointStore(
+                ChatTurnCheckpoint(
+                    contextKey = contextKey,
+                    profileKey = PROFILE_NAME,
+                    sessionId = STORED_SESSION_ID,
+                    liveSessionId = LIVE_SESSION_ID,
+                    transport = "gateway",
+                    user = ChatTurnUserCheckpoint("recovered-user", "Resume this turn", now - 2_000L),
+                    assistant = ChatTurnAssistantCheckpoint(
+                        id = "recovered-assistant",
+                        content = "Recovered partial",
+                        timestamp = now - 1_900L,
+                    ),
+                    priorUserMessageCount = 0,
+                    baselineAssistantCount = 0,
+                    startedAt = now - 2_000L,
+                    updatedAt = now,
+                ),
+            ),
+        )
+        fixture.recoveryRunning = true
+        handler.setSessionId(null)
+        viewModel.switchProfileContext(contextKey, STORED_SESSION_ID)
+        fixture.awaitRpc("session.activate")
+
+        serverSocket.send(
+            fixture.event(
+                "message.delta",
+                buildJsonObject { put("text", RECOVERED_COMPLETION) },
+                LIVE_SESSION_ID,
+            ),
+        )
+        serverSocket.send(
+            fixture.event(
+                "message.complete",
+                buildJsonObject { put("text", RECOVERED_COMPLETION) },
+                LIVE_SESSION_ID,
+            ),
+        )
+
+        compose.waitUntil(15_000) {
+            historySignInRequired.value && !handler.isStreaming.value
+        }
+        compose.activityRule.scenario.moveToState(Lifecycle.State.STARTED)
+        compose.activityRule.scenario.moveToState(Lifecycle.State.RESUMED)
+
+        compose.onNodeWithTag("contract-transcript").assertIsDisplayed()
+        compose.onNodeWithTag("stream-state").assertTextEquals("IDLE")
+        compose.onNodeWithTag("dashboard-sign-in-recovery").assertIsDisplayed()
+        assertFalse(viewModel.isLoadingHistory.value)
+        assertTrue(
+            "recovered completion was not retained: ${handler.messages.value}",
+            handler.messages.value.any { it.content.contains(RECOVERED_COMPLETION.trim()) },
+        )
+        assertFalse(handler.messages.value.any { it.isStreaming || it.isThinkingStreaming })
+        assertNull(viewModel.chatFailure.value)
+        assertExactProfileHistoryOnly(PROFILE_NAME)
+    }
+
+    private fun bindDashboardHistoryFailure(body: String, profileName: String) {
+        fixture.profileName = profileName
+        fixture.historyFailureBody = body
+        val dashboard = DashboardApiClient(
+            baseUrl = fixture.server.url("/").toString().trimEnd('/'),
+            okHttpClient = OkHttpClient(),
+        )
+        viewModel.setProfileMessageLoaderWithMode { profile, sessionId, mode ->
+            dashboard.getSessionMessages(sessionId, profile, mode)
+        }
+        viewModel.setDashboardSignInRequiredHandler {
+            historySignInRequired.value = true
+        }
+    }
+
+    private fun assertExactProfileHistoryOnly(profileName: String) {
+        val historyRequests = fixture.historyRequestPaths()
+        assertTrue("no Dashboard history request was observed", historyRequests.isNotEmpty())
+        assertTrue(
+            "history escaped the exact profile: $historyRequests",
+            historyRequests.all { it.contains("profile=$profileName") },
+        )
+    }
+
    private companion object {
        const val STORED_SESSION_ID = "20260821_120000_fixture"
        const val LIVE_SESSION_ID = "fixture-live-1"
@@ -247,6 +682,23 @@ class GatewayForegroundRecoveryInstrumentedTest {
        const val PARTIAL_ANSWER = "Partial foreground answer"
        const val AUTHORITATIVE_ANSWER = "Foreground task finished."
        const val FOREIGN_ANSWER = "Wrong session content"
+        const val PROFILE_NAME = "research"
+        const val LOCAL_COMPLETION = "Completed before Dashboard auth expired."
+        const val RECOVERED_COMPLETION = " and then recovered to completion."
+    }
+}
+
+private class MemoryCheckpointStore(
+    private var checkpoint: ChatTurnCheckpoint?,
+) : ChatTurnCheckpointStore {
+    override suspend fun read(): ChatTurnCheckpoint? = checkpoint
+
+    override suspend fun write(checkpoint: ChatTurnCheckpoint) {
+        this.checkpoint = checkpoint
+    }
+
+    override suspend fun clear() {
+        checkpoint = null
    }
 }

@@ -263,6 +715,15 @@ internal class AndroidGatewayContractFixture {
    @Volatile
    var recoveryRunning = false

+    @Volatile
+    var activeSessionStatus: String? = null
+
+    @Volatile
+    var historyFailureBody: String? = null
+
+    @Volatile
+    var profileName: String = "default"
+
    private val listener = object : WebSocketListener() {
        override fun onOpen(webSocket: WebSocket, response: Response) {
            sockets.add(webSocket)
@@ -282,6 +743,18 @@ internal class AndroidGatewayContractFixture {
                "session.activate" -> sessionSnapshot(
                    (params["session_id"] as? JsonPrimitive)?.contentOrNull ?: "fixture-live-1",
                )
+                "session.active_list" -> buildJsonObject {
+                    put("sessions", kotlinx.serialization.json.buildJsonArray {
+                        activeSessionStatus?.let { status ->
+                            add(buildJsonObject {
+                                put("id", LIVE_SESSION_ID)
+                                put("session_key", STORED_SESSION_ID)
+                                put("status", status)
+                                put("last_active", 1.0)
+                            })
+                        }
+                    })
+                }
                "prompt.submit", "session.interrupt" -> buildJsonObject { put("ok", true) }
                else -> JsonObject(emptyMap())
            }
@@ -308,6 +781,11 @@ internal class AndroidGatewayContractFixture {
                            """{"ticket":"device-${ticketCount.incrementAndGet()}","ttl_seconds":30}""",
                        )
                    path.startsWith("/api/ws") -> MockResponse().withWebSocketUpgrade(listener)
+                    path.startsWith("/api/sessions/") && path.contains("/messages") &&
+                        historyFailureBody != null -> MockResponse()
+                        .setResponseCode(401)
+                        .setHeader("Content-Type", "application/json")
+                        .setBody(historyFailureBody.orEmpty())
                    else -> MockResponse().setResponseCode(404)
                }
            }
@@ -319,7 +797,7 @@ internal class AndroidGatewayContractFixture {
        put("session_id", sessionId)
        put("running", recoveryRunning)
        put("status", if (recoveryRunning) "streaming" else "idle")
-        put("info", buildJsonObject { put("profile_name", "default") })
+        put("info", buildJsonObject { put("profile_name", profileName) })
    }

    fun event(type: String, payload: JsonObject?, sessionId: String?): String =
@@ -337,7 +815,7 @@ internal class AndroidGatewayContractFixture {
        sockets.poll(5, TimeUnit.SECONDS) ?: error("Gateway WebSocket did not open")

    fun awaitRpc(method: String): JsonObject {
-        val deadline = System.nanoTime() + TimeUnit.SECONDS.toNanos(5)
+        val deadline = System.nanoTime() + TimeUnit.SECONDS.toNanos(15)
        while (System.nanoTime() < deadline) {
            rpcLog.firstOrNull { it.first == method }?.let { return it.second }
            Thread.sleep(20)
@@ -345,12 +823,30 @@ internal class AndroidGatewayContractFixture {
        error("Gateway RPC $method not observed; saw ${rpcLog.map { it.first }}")
    }

+    fun awaitRpcCount(method: String, count: Int) {
+        val deadline = System.nanoTime() + TimeUnit.SECONDS.toNanos(15)
+        while (System.nanoTime() < deadline) {
+            if (rpcCount(method) >= count) return
+            Thread.sleep(20)
+        }
+        error("Gateway RPC $method count $count not observed; saw ${rpcLog.map { it.first }}")
+    }
+
    fun requestsTo(path: String): Int = requestPaths.count { it.startsWith(path) }

+    fun historyRequestPaths(): List<String> = requestPaths.filter {
+        it.startsWith("/api/sessions/") && it.contains("/messages")
+    }
+
    fun rpcCount(method: String): Int = rpcLog.count { it.first == method }

    fun shutdown() {
        allSockets.forEach { socket -> runCatching { socket.close(1001, "teardown") } }
        runCatching { server.shutdown() }
    }
+
+    private companion object {
+        const val STORED_SESSION_ID = "20260821_120000_fixture"
+        const val LIVE_SESSION_ID = "fixture-live-1"
+    }
 }
@@ -1,6 +1,10 @@
 <?xml version="1.0" encoding="utf-8"?>
 <manifest xmlns:android="http://schemas.android.com/apk/res/android">
    <application>
+        <activity
+            android:name="com.hermesandroid.relay.ui.screens.BotChatBindingTestActivity"
+            android:exported="false"
+            android:screenOrientation="portrait" />
        <activity
            android:name="com.hermesandroid.relay.ui.screens.VoiceSettingsDesignQaActivity"
            android:exported="true"
@@ -0,0 +1,6 @@
+package com.hermesandroid.relay.ui.screens
+
+import androidx.activity.ComponentActivity
+
+/** Empty debug-only host populated by the Bot Chat lifecycle instrumentation. */
+class BotChatBindingTestActivity : ComponentActivity()
@@ -8,7 +8,7 @@
    Google Play ships Hermes Bridge Core only. It intentionally does not merge
    any Device Control services or permissions.

-    This file is intentionally kept as an empty overlay so future flavor-specific
+    This overlay owns the voice-only special access so future flavor-specific
    permissions / activities have an obvious home. Mirror structural additions
    in `app/src/sideload/AndroidManifest.xml` unless the change is intentionally
    track-specific.
@@ -22,6 +22,9 @@
        android:name="android.permission.WAKE_LOCK"
        tools:node="remove" />

+    <!-- User-started voice controls only; does not enable Device Control. -->
+    <uses-permission android:name="android.permission.SYSTEM_ALERT_WINDOW" />
+
    <application />

 </manifest>
@@ -23,7 +23,7 @@ GOOGLE PLAY AND SIDELOAD

 The Google Play build includes Chat, voice, sessions, Manage, profiles, notifications, media, and Terminal/TUI when the Hermes-Relay plugin is paired.

-Google Play does not include Android Device Control. It cannot read the phone screen, tap, type, swipe, take device screenshots, send SMS, place calls, or access contacts or location.
+Google Play does not include Android Device Control. It cannot tap, type, swipe, send SMS, place calls, or access contacts or location. Optional Voice Overlay provides user-started voice controls over other apps, with microphone notification and Stop voice. Selecting Hermes as Android Digital Assistant can provide bounded screen text and a screenshot for an explicit unlocked assistant invocation; this context goes to your configured server and AI provider.

 Device Control is available only in the signed Sideload build on this project's GitHub Releases. It requires the Sideload app, a paired Hermes-Relay plugin, explicit Android accessibility permission, and the app's safety controls.

@@ -32,9 +32,6 @@ FEATURES
 - Streaming Chat with reasoning, markdown, tool progress, attachments, mid-turn steering, edit-and-resend, and searchable commands.
 - Manage models and provider keys, edit profiles, and browse, install, or update skills through the Hermes Dashboard.
 - Hands-free voice through your server's speech providers. Hermes-Relay pairing adds per-profile voices and an experimental realtime engine.
- Create, switch, search, rename, pin, archive, and continue sessions.
- Connect multiple Hermes servers and switch in one tap; add LAN, Tailscale, or public routes.
- Pair the Hermes-Relay plugin for Terminal/TUI, notifications, media, enhanced voice, Relay sessions, and per-feature grants.
 - Inspect connection readiness, routes, response timing, token usage, and stream health without exposing credentials.

 SECURITY AND PRIVACY
@@ -1 +1,3 @@
-Session activity now follows live Hermes runtime state instead of a recent-activity estimate. Working, Starting, Needs input, Idle, Checking, Unavailable, and Background work stay accurate, and stale state clears only after a complete, unambiguous update.
+v1.17.0 - Voice over other apps and clearer conversations
+
+Use optional voice controls over other apps, with clear permission setup and an immediate Stop action. Answer Clarify batches one question at a time, with progress preserved across reconnects. Enjoy cleaner chat cards, recognizable profile names, and context previews that show what your connection supports. Phone control remains sideload-only.
@@ -1 +1,3 @@
-会话活动现在依据 Hermes 的实时运行状态，而不是最近活动时间估算。工作中、启动中、需要输入、空闲、检查中、不可用和后台工作等状态会保持准确；只有完整且明确的更新才会清除旧状态。
+v1.17.0 - 跨应用语音与更清晰的对话
+
+可选的语音悬浮控件让你在使用其他应用时继续语音会话，提供清晰的权限说明和随时停止操作。逐题回答 Clarify 批量问题，重连后保留已确认的进度。聊天卡片更简洁，配置文件显示名称更易辨认，上下文预览准确说明当前连接支持发送哪些信息。设备控制仍仅限侧载版本。
@@ -1,5 +1,455 @@
 {
+ "schema": 3,
 "versions": [
+  {
+   "version": "1.17.0",
+   "title": "Voice over other apps and clearer conversations",
+   "date": "2026-09-13",
+   "summary": "Google Play gains optional voice controls over other apps. Clarify questions, profile names, and chat context are easier to follow without losing confirmed answers or saved conversations.",
+   "changes": [
+    {"id": "play-voice-overlay", "kind": "added", "title": "Keep voice controls over other apps", "summary": "Start Voice Overlay from Voice Focus after granting microphone, notification, and display-over-other-apps access. Stop voice from its controls or persistent notification; screen lock and permission loss end the session.", "highlight": true},
+    {"id": "clarify-batches", "kind": "fixed", "title": "Answer Clarify questions one at a time", "summary": "Multi-question requests support separate choices and custom answers. Confirmed progress survives reconnects, and failed sends keep the current answer available.", "highlight": true},
+    {"id": "chat-card-surfaces", "kind": "improved", "title": "Read cleaner chat cards", "summary": "Standalone response cards lose the extra outer bubble, assistant messages use quieter surfaces, and delivery status sits beside the timestamp."},
+    {"id": "transport-context-preview", "kind": "fixed", "title": "See which context your chat can send", "summary": "Gateway previews mark phone status and turn context as unavailable. Automatic phone-status sharing is labeled for API-only chats, where it remains supported."},
+    {"id": "profile-display-names", "kind": "fixed", "title": "Recognize profiles by their display names", "summary": "Profiles use their Hermes display names, and the resolved server default appears under its agent identity. Explicit profile choices and saved conversations are preserved.", "highlight": true}
+   ],
+   "compatibility": [
+    "Voice Overlay is now available in Google Play and sideload builds. Device Control remains sideload-only.",
+    "Standard Chat and voice use upstream Hermes without requiring Hermes-Relay Plugin. Gateway phone-status delivery and automatic Android identification remain unavailable."
+   ],
+   "playNotes": "Use optional voice controls over other apps, with clear permission setup and an immediate Stop action. Answer Clarify batches one question at a time, with progress preserved across reconnects. Enjoy cleaner chat cards, recognizable profile names, and context previews that show what your connection supports. Phone control remains sideload-only.",
+   "sections": []
+  },
+  {
+   "version": "1.16.1",
+   "title": "Dashboard-only cold starts recover",
+   "date": "2026-09-12",
+   "summary": "Dashboard-only connections can now prepare the selected profile and open Gateway chat without waiting for a background, resume, or network-route change.",
+   "changes": [
+    {
+     "id": "gateway-directory-bootstrap",
+     "kind": "fixed",
+     "title": "Open Gateway chat from a Dashboard-only cold start",
+     "summary": "The selected profile's session directory starts before Gateway readiness, so it cannot wait on the same passive socket that depends on its result.",
+     "highlight": true
+    }
+   ],
+   "compatibility": [
+    "Standard Dashboard and Gateway chat continue to use current upstream Hermes without requiring the optional Hermes-Relay Plugin.",
+    "Hermes-Relay Plugin 1.11.2 remains the matching optional release for Relay tools."
+   ],
+   "playNotes": "Dashboard-only connections now prepare the selected profile before Gateway readiness, fixing a remaining cold-start path that could stay on waking or waiting for Gateway until the app resumed or its network route changed.",
+   "sections": []
+  },
+  {
+   "version": "1.16.0",
+   "title": "Safer startup, connections, and activity",
+   "date": "2026-09-10",
+   "summary": "Gateway chat opens reliably from a cold launch, saved sign-ins stay with the correct connection, and network changes no longer race the route cache. Bot Mode and delegated-work feedback also remain stable across multiple gateways and later review.",
+   "changes": [
+    {
+     "id": "gateway-cold-start",
+     "kind": "fixed",
+     "title": "Open Gateway chat on the first launch",
+     "summary": "An authenticated Gateway wakes and opens from a cold foreground start instead of waiting for the app to background and resume.",
+     "highlight": true
+    },
+    {
+     "id": "connection-owned-signin",
+     "kind": "fixed",
+     "title": "Keep saved sign-ins with their connection",
+     "summary": "Switching gateways cannot reuse an outgoing resolver route to invalidate another connection's saved Dashboard session.",
+     "highlight": true
+    },
+    {
+     "id": "network-change-invalidation",
+     "kind": "fixed",
+     "title": "Recover safely when the network changes",
+     "summary": "Route-probe completion and endpoint-cache invalidation are serialized so Wi-Fi, mobile-data, VPN, or Tailscale changes do not trigger the reported crash.",
+     "highlight": true
+    },
+    {
+     "id": "bot-mode-connection-identity",
+     "kind": "fixed",
+     "title": "Open same-named bots from multiple gateways",
+     "summary": "Bot Mode and Active Now keep connection and profile identity together, avoiding duplicate list keys and opening progress on the selected bot."
+    },
+    {
+     "id": "delegated-activity-receipts",
+     "kind": "improved",
+     "title": "Review delegated work after it finishes",
+     "summary": "Compact, bounded activity receipts survive parent replies and remain available read-only, while the live strip appears only during active work.",
+     "highlight": true
+    },
+    {
+     "id": "chat-feedback-surfaces",
+     "kind": "improved",
+     "title": "Keep feedback with the surface that owns it",
+     "summary": "Themed banners and action cards replace platform popups, global actions stay clear of the composer, and local Developer previews make feedback states inspectable."
+    },
+    {
+     "id": "attachment-error-recovery",
+     "kind": "fixed",
+     "title": "Retry missing attachments in place",
+     "summary": "A missing attachment keeps its error and Retry action in the attachment card without producing repeated global messages."
+    },
+    {
+     "id": "session-preparation-diagnostics",
+     "kind": "improved",
+     "title": "See session preparation and initialization failures",
+     "summary": "Chat distinguishes session preparation from response streaming, retains early initialization errors, and opens session diagnostics from the agent header."
+    },
+    {
+     "id": "pasted-dashboard-credentials",
+     "kind": "fixed",
+     "title": "Paste Dashboard credentials without hidden line breaks",
+     "summary": "Username and password fields remove pasted carriage returns and line feeds while preserving every other credential character."
+    }
+   ],
+   "compatibility": [
+    "Standard Chat, sessions, profiles, Manage, voice, Bot Mode, and delegated activity continue to use current upstream Hermes without requiring the optional Hermes-Relay Plugin.",
+    "Hermes-Relay Plugin 1.11.2 is the matching optional release for Relay tools. Existing erased or revoked Dashboard credentials still require a legitimate sign-in.",
+    "Granular Device Control and the system Voice Focus overlay remain sideload-only."
+   ],
+   "playNotes": "Gateway chat now opens reliably on a cold launch. Saved Dashboard sign-ins stay bound to the correct connection, pasted credentials ignore accidental line breaks, and network changes no longer race the route cache. Bot Mode supports duplicate profile names across gateways, while delegated work, session setup, attachment errors, and feedback remain visible and easier to review.",
+   "sections": []
+  },
+  {
+   "version": "1.15.1",
+   "title": "Steadier chat, media, and voice",
+   "date": "2026-09-02",
+   "summary": "Chats use less memory, attachment previews stay in place, and voice failures are easier to recover from. Follow-up controls make it clear whether a message changes the current response or waits for the next turn.",
+   "changes": [
+    {
+     "id": "follow-up-controls",
+     "kind": "improved",
+     "title": "Choose when follow-up messages are sent",
+     "summary": "A slim tray behind the composer offers Correct now or Queue next. Chat settings sets the default, and a composer choice applies to one message. Stop pauses pending work until Resume; editing or removing an item keeps the remaining queue usable.",
+     "highlight": true
+    },
+    {
+     "id": "tablet-layouts",
+     "kind": "improved",
+     "title": "Make better use of wider screens",
+     "summary": "Chat and Voice keep text and controls on readable centered layouts. Landscape Voice Focus separates identity controls from conversation activity."
+    },
+    {
+     "id": "delivery-labels",
+     "kind": "fixed",
+     "title": "Read message delivery status clearly",
+     "summary": "Correction and delivery labels use contrasting text instead of disappearing into the message bubble."
+    },
+    {
+     "id": "voice-error-dialog",
+     "kind": "fixed",
+     "title": "Read and dismiss voice errors",
+     "summary": "Voice errors open in a contained dialog with scrollable details and separate Retry and Dismiss actions, without overlapping chat controls."
+    },
+    {
+     "id": "attachment-previews",
+     "kind": "fixed",
+     "title": "Keep attachment previews open through rotation",
+     "summary": "Image, video, audio, PDF, text, and file previews stay open as the screen rotates. Videos retain their original proportions.",
+     "highlight": true
+    },
+    {
+     "id": "wake-word-startup",
+     "kind": "fixed",
+     "title": "Fix wake-word startup in release builds",
+     "summary": "Release optimization now preserves the native speech configuration names needed to initialize wake-word detection."
+    },
+    {
+     "id": "attachment-downloads",
+     "kind": "fixed",
+     "title": "Download attachments with less memory",
+     "summary": "Standard Hermes attachments stream into the on-disk cache while download size limits remain enforced."
+    },
+    {
+     "id": "chat-memory-safety",
+     "kind": "fixed",
+     "title": "Keep large chats and media manageable",
+     "summary": "Automatic session refresh no longer loops. Routine history loads, chat rendering, image previews, and media exports use bounded memory instead of allocating entire large responses.",
+     "highlight": true
+    },
+    {
+     "id": "image-progress",
+     "kind": "fixed",
+     "title": "Keep image-generation progress visible",
+     "summary": "The working indicator stays visible between interim replies and the generated image, including gateways that omit tool activity events."
+    },
+    {
+     "id": "first-message-readiness",
+     "kind": "fixed",
+     "title": "Wait for new chats to be ready",
+     "summary": "The first message waits for the Gateway session to initialize. Ownership refusals keep the prompt retryable and show the server's error."
+    }
+   ],
+   "compatibility": [
+    "Standard Chat, sessions, media, and voice continue to use upstream Hermes. Voice transcription still requires a configured speech-to-text provider on the Hermes host.",
+    "Paused text queues can be restored. Attachment bytes are not stored in preferences; an attachment queue that cannot be restored must be reviewed and sent again."
+   ],
+   "playNotes": "More reliable chats and media: fewer memory-heavy refreshes, smoother large histories, and attachment previews that survive rotation. Choose whether follow-ups correct the current response or wait in a queue. Voice errors are easier to read, image-generation progress stays visible, and wake-word startup and first-message readiness are fixed.",
+   "sections": []
+  },
+  {
+   "version": "1.15.0",
+   "title": "Standard Hermes first, with clearer Relay boundaries",
+   "date": "2026-08-31",
+   "summary": "Chat, voice, attachments, inbound files, current-session Git, usage, and Hermes notices now prefer current upstream Dashboard and Gateway support. Relay stays optional for compatibility and the tools it uniquely provides.",
+   "changes": [
+    {
+     "id": "upstream-standard-surfaces",
+     "kind": "improved",
+     "title": "Use standard Hermes without Relay prompts",
+     "summary": "Chat attachments, inbound files, current-session Git, Nous usage, and Hermes notices use upstream routes first.",
+     "highlight": true
+    },
+    {
+     "id": "stable-inbound-media",
+     "kind": "fixed",
+     "title": "Keep returned files loaded",
+     "summary": "Images, audio, video, and documents download through the Dashboard and no longer flash Relay errors or return to Loading.",
+     "highlight": true
+    },
+    {
+     "id": "supervised-parent-access",
+     "kind": "improved",
+     "title": "Use app-specific parent access",
+     "summary": "A parent PIN or password plus recovery phrase protects Supervised Mode without trusting the phone unlock credential.",
+     "highlight": true
+    },
+    {
+     "id": "settings-relay-boundaries",
+     "kind": "improved",
+     "title": "See which features need Relay",
+     "summary": "Media sits with standard Hermes settings while Threads, Terminal, notifications, enhanced voice, and device tools stay under Relay tools."
+    },
+    {
+     "id": "complete-release-history",
+     "kind": "improved",
+     "title": "Read the complete release record",
+     "summary": "What's New shows one release summary, selected highlights, every remaining change, and relevant compatibility notes."
+    },
+    {
+     "id": "relay-removal-voice",
+     "kind": "fixed",
+     "title": "Keep Standard voice after removing Relay",
+     "summary": "Dashboard voice remains ready, temporary outages preserve choices, and shared default-profile settings stay isolated."
+    },
+    {
+     "id": "passive-external-activity",
+     "kind": "fixed",
+     "title": "Observe another client's activity safely",
+     "summary": "A uniquely matched Desktop or TUI turn can show Working or Waiting without Android taking control."
+    },
+    {
+     "id": "chat-transport-ownership",
+     "kind": "fixed",
+     "title": "Keep each chat on its chosen transport",
+     "summary": "Dashboard chats preserve their transcript, draft, profile, and session through sign-out or outages instead of silently changing databases."
+    },
+    {
+     "id": "history-auth-recovery",
+     "kind": "fixed",
+     "title": "Preserve completed replies at sign-in expiry",
+     "summary": "A Dashboard history authentication failure keeps completed text visible and opens the existing sign-in recovery path."
+    },
+    {
+     "id": "compaction-watchdog",
+     "kind": "fixed",
+     "title": "Let long context compaction finish",
+     "summary": "Visible compaction activity refreshes the turn watchdog instead of being interrupted as idle."
+    },
+    {
+     "id": "bot-chat-binding",
+     "kind": "fixed",
+     "title": "Render Bot Chat history immediately",
+     "summary": "Route-owned Bot Chats observe their bound history from first composition."
+    },
+    {
+     "id": "missing-terminal-recovery",
+     "kind": "fixed",
+     "title": "Settle turns after a lost terminal frame",
+     "summary": "An exact idle live-session snapshot reconciles the Android-owned turn and drains its queued follow-up."
+    },
+    {
+     "id": "supervised-gateway-setup",
+     "kind": "fixed",
+     "title": "Keep Gateway setup parent-owned",
+     "summary": "Relock and back navigation cancel the exact pending setup without bypassing parent authority."
+    },
+    {
+     "id": "generated-image-retention",
+     "kind": "fixed",
+     "title": "Keep completed generated images visible",
+     "summary": "Generated media survives marker persistence lag and retains its intended Chat animation."
+    }
+   ],
+   "compatibility": [
+    "Current upstream Hermes provides standard Chat, sessions, Manage, voice, attachments, inbound files, current-session Git reads, usage, and notices without the optional Hermes-Relay Plugin.",
+    "Hermes-Relay Plugin 1.11.1 remains required for Terminal, proactive Threads and offline delivery, Notification Companion, Relay sessions, enhanced voice, Secure Link, and phone or device control.",
+    "Granular Device Control and the system Voice Focus overlay remain sideload-only."
+   ],
+   "playNotes": "Standard Chat, Voice, attachments, returned files, current-session Git, usage, and Hermes notices now prefer upstream Dashboard and Gateway support without requiring Relay. Returned media stays loaded, voice survives Relay removal, and Settings clearly separates standard Hermes from Relay tools. Supervised Mode also gains app-specific parent access and recovery.",
+   "sections": []
+  },
+  {
+   "version": "1.14.0",
+   "title": "Connections, delegated work, Git, and voice",
+   "date": "2026-08-30",
+   "summary": "Connections now recover cleanly across networks. You can also follow delegated agents, work with Git repositories, and rely on steadier voice, sessions, Threads, profiles, Assistant, and Clarify controls.",
+   "changes": [
+    {
+     "id": "route-aware-connections",
+     "kind": "improved",
+     "title": "Connections recover independently",
+     "summary": "Move between LAN, Tailscale, and public HTTPS without mixing Dashboard and Relay authentication.",
+     "highlight": true
+    },
+    {
+     "id": "delegated-agent-previews",
+     "kind": "added",
+     "title": "Follow delegated-agent activity",
+     "summary": "See lifecycle, progress, tool previews, and available read-only child history from the parent chat.",
+     "highlight": true
+    },
+    {
+     "id": "native-git-workspace",
+     "kind": "added",
+     "title": "Work with repositories from Android",
+     "summary": "Review status, diffs, branches, staging, commits, and remotes from Chat or Settings.",
+     "highlight": true
+    },
+    {
+     "id": "voice-focus-controls",
+     "kind": "improved",
+     "title": "Steer voice at any time",
+     "summary": "Stop or redirect Hermes while it is Thinking, Transcribing, or Speaking, including with accessibility controls.",
+     "highlight": true
+    },
+    {
+     "id": "non-blocking-release-notice",
+     "kind": "improved",
+     "title": "Release notes stay out of your way",
+     "summary": "A dismissible post-update notice keeps startup usable and leaves the complete history available from Settings."
+    },
+    {
+     "id": "single-chat-presentation",
+     "kind": "improved",
+     "title": "Chat uses one consistent presentation",
+     "summary": "The overlapping clean-focus mode was removed while the separate Voice Focus experience remains available."
+    },
+    {
+     "id": "wake-word-runtime",
+     "kind": "fixed",
+     "title": "Wake-word detection starts reliably",
+     "summary": "Compatible native voice components are now packaged for every supported phone architecture."
+    },
+    {
+     "id": "sphere-motion",
+     "kind": "fixed",
+     "title": "The visible Sphere keeps moving smoothly",
+     "summary": "Foreground animation no longer falls back to a stepped ambient pulse."
+    },
+    {
+     "id": "continuous-microphone-handoff",
+     "kind": "fixed",
+     "title": "Continuous voice keeps the microphone",
+     "summary": "The next listening turn waits for barge-in recording to release cleanly."
+    },
+    {
+     "id": "fresh-profile-drafts",
+     "kind": "fixed",
+     "title": "New chats keep the selected profile",
+     "summary": "Fresh drafts no longer reopen an older session or carry a Thread route into another profile."
+    },
+    {
+     "id": "provisional-thread-removal",
+     "kind": "fixed",
+     "title": "Provisional Threads can be removed safely",
+     "summary": "Local removal and later session promotion no longer risk duplicate rows or server history."
+    },
+    {
+     "id": "clarify-custom-answers",
+     "kind": "fixed",
+     "title": "Clarify keeps custom answers reachable",
+     "summary": "Other answers, keyboard Send, and expired prompts now behave consistently."
+    },
+    {
+     "id": "passive-session-observation",
+     "kind": "fixed",
+     "title": "Browsing no longer interrupts another client",
+     "summary": "Passive Android observation does not claim a turn owned by Desktop, TUI, or another client."
+    },
+    {
+     "id": "assistant-recovery-privacy",
+     "kind": "fixed",
+     "title": "Assistant sessions recover more clearly",
+     "summary": "No-speech feedback, recreated session state, and keyguard privacy now remain intact."
+    },
+    {
+     "id": "relay-auth-boundaries",
+     "kind": "fixed",
+     "title": "Protected Relay routes report the right problem",
+     "summary": "Authentication challenges are no longer presented as outages, while unsafe routes still fail closed."
+    },
+    {
+     "id": "connection-session-readiness",
+     "kind": "fixed",
+     "title": "Connections and sessions become ready sooner",
+     "summary": "Unavailable optional API and Relay routes no longer delay a healthy Dashboard or authenticated session history."
+    }
+   ],
+   "compatibility": [
+    "Standard Chat, sessions, profiles, Manage, and standard voice continue to work without the optional Hermes-Relay Plugin.",
+    "The Git workspace and same-origin Relay extensions require Hermes-Relay Plugin 1.11.0.",
+    "Granular Device Control and the system Voice Focus overlay remain available only in the sideload build."
+   ],
+   "playNotes": "Connections now recover independently across LAN, Tailscale, and public HTTPS without mixing Dashboard and Relay authentication. Preview delegated agents, use the optional native Git workspace, and get safer Continuous voice, Voice Focus, Assistant, Threads, profile drafts, and Clarify controls. Wake-word detection also packages a compatible native runtime.",
+   "sections": []
+  },
+  {
+   "version": "1.13.2",
+   "title": "Supervised Mode and clearer activity",
+   "date": "2026-08-25",
+   "highlight": {
+    "title": "Supervised Mode",
+    "summary": "Create a simpler, profile-focused chat and choose which features remain available.",
+    "bullets": [
+     "Protect parent settings with your phone's device authentication.",
+     "Choose access to attachments, Standard voice, generated media, history, actions, and technical details.",
+     "Keep Supervised Chat open when returning from parent settings."
+    ]
+   },
+   "improvements": [
+    "Activity indicators now appear only while Hermes is genuinely working."
+   ],
+   "toastDigest": {
+    "additionalFeatureCount": 0,
+    "fixCount": 2,
+    "preview": [
+     "Accurate activity",
+     "safer return"
+    ]
+   },
+   "playNotes": "Supervised Mode creates a simpler, profile-focused chat with device-protected parent settings and control over attachments, Standard voice, generated media, history, actions, and technical details. Activity indicators now appear only while Hermes is genuinely working, and returning from parent settings keeps Supervised Chat open.",
+   "sections": [
+    {
+     "header": "Use a supervised chat",
+     "bullets": [
+      "Configure a profile-pinned restricted chat with parent-controlled attachments, voice, media, history, actions, and technical details.",
+      "Protect full settings with device authentication and keep Supervised Chat visible when parent access relocks."
+     ]
+    },
+    {
+     "header": "Show only confirmed activity",
+     "bullets": [
+      "Keep session rows neutral while optional live activity is unavailable or still loading.",
+      "Show full-row activity borders only during actual Starting or Working turns."
+     ]
+    }
+   ]
+  },
  {
   "version": "1.13.1",
   "title": "Accurate session activity",
@@ -1,5 +1,19 @@
-v1.13.1 - Accurate session activity
+v1.17.0 - Voice over other apps and clearer conversations

-* Follow live Hermes runtime state for Working, Starting, Needs input, and Idle.
-* Keep stale activity visible until a complete, unambiguous snapshot clears it.
-* Distinguish Checking, Unavailable, and Background work in the session drawer.
+Summary
+* Google Play gains optional voice controls over other apps. Clarify questions, profile names, and chat context are easier to follow without losing confirmed answers or saved conversations.
+
+Highlights
+* Keep voice controls over other apps — Start Voice Overlay from Voice Focus after granting microphone, notification, and display-over-other-apps access. Stop voice from its controls or persistent notification; screen lock and permission loss end the session.
+* Answer Clarify questions one at a time — Multi-question requests support separate choices and custom answers. Confirmed progress survives reconnects, and failed sends keep the current answer available.
+* Recognize profiles by their display names — Profiles use their Hermes display names, and the resolved server default appears under its agent identity. Explicit profile choices and saved conversations are preserved.
+
+Improved
+* Read cleaner chat cards — Standalone response cards lose the extra outer bubble, assistant messages use quieter surfaces, and delivery status sits beside the timestamp.
+
+Fixed
+* See which context your chat can send — Gateway previews mark phone status and turn context as unavailable. Automatic phone-status sharing is labeled for API-only chats, where it remains supported.
+
+Compatibility
+* Voice Overlay is now available in Google Play and sideload builds. Device Control remains sideload-only.
+* Standard Chat and voice use upstream Hermes without requiring Hermes-Relay Plugin. Gateway phone-status delivery and automatic Android identification remain unavailable.
@@ -13,10 +13,15 @@ import coil3.network.okhttp.OkHttpNetworkFetcherFactory
 import coil3.request.crossfade
 import com.hermesandroid.relay.bridge.UnattendedAccessManager
 import com.hermesandroid.relay.data.AppAnalytics
+import com.hermesandroid.relay.data.relayDataStore
 import com.hermesandroid.relay.power.WakeLockManager
 import com.hermesandroid.relay.runtime.HermesProcessRuntime
+import com.hermesandroid.relay.ui.theme.AppearanceNightMode
 import com.hermesandroid.relay.util.AppForegroundTracker
 import com.hermesandroid.relay.util.CrashReporter
+import kotlinx.coroutines.flow.first
+import kotlinx.coroutines.runBlocking
+import kotlinx.coroutines.withTimeoutOrNull

 class HermesRelayApp : Application(), SingletonImageLoader.Factory {

@@ -57,6 +62,10 @@ class HermesRelayApp : Application(), SingletonImageLoader.Factory {
        // Install the crash handler FIRST so any failure in the rest of app
        // init (or anywhere later) is captured and surfaced on next launch.
        CrashReporter.install(this)
+        // Apply saved Light/Dark/Auto before the first Activity frame so DayNight
+        // does not briefly follow the system when Appearance is explicitly Light.
+        // Bounded + best-effort: HermesRelayTheme SideEffect is the durable path.
+        applyPersistedAppearanceNightMode()
        AppAnalytics.initialize(this)
        // A8 — wire the bridge-gesture wake-lock wrapper so
        // ActionExecutor.tap/tapText/typeText/swipe/scroll can hold
@@ -76,6 +85,19 @@ class HermesRelayApp : Application(), SingletonImageLoader.Factory {
        AppForegroundTracker.initialize()
    }

+    private fun applyPersistedAppearanceNightMode() {
+        try {
+            runBlocking {
+                val preferences = withTimeoutOrNull(400L) {
+                    relayDataStore.data.first()
+                } ?: return@runBlocking
+                AppearanceNightMode.applyFromPreferences(preferences)
+            }
+        } catch (_: Throwable) {
+            // Non-fatal — theme root reapplies once DataStore is ready.
+        }
+    }
+
    private fun isMainApplicationProcess(): Boolean {
        val processName = if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.P) {
            getProcessName()
@@ -39,14 +39,38 @@ enum class AssistantSessionPhase {
    Closed,
 }

+enum class AssistantSessionNotice {
+    NoSpeech,
+}
+
 data class AssistantSessionSnapshot(
    val phase: AssistantSessionPhase = AssistantSessionPhase.Launching,
    val transcript: String? = null,
    val response: String = "",
+    val notice: AssistantSessionNotice? = null,
    val error: String? = null,
    val screenContextSupported: Boolean = false,
 )

+internal fun assistantSnapshotForPresentation(
+    snapshot: AssistantSessionSnapshot,
+    locked: Boolean,
+): AssistantSessionSnapshot = if (locked) {
+    snapshot.copy(
+        transcript = null,
+        response = "",
+        error = null,
+        screenContextSupported = false,
+    )
+} else {
+    snapshot
+}
+
+internal fun assistantSnapshotMatchesActivation(
+    expectedActivationId: String?,
+    receivedActivationId: String?,
+): Boolean = expectedActivationId != null && expectedActivationId == receivedActivationId
+
 object AssistantRole {
    fun status(context: Context): AssistantRoleStatus {
        val component = ComponentName(context, HermesVoiceInteractionService::class.java)
@@ -209,6 +233,7 @@ object AssistantSessionProtocol {
            onFailure = { failure ->
                publish(
                    application,
+                    activation.id,
                    AssistantSessionSnapshot(
                        phase = AssistantSessionPhase.Error,
                        error = failure.message ?: "Hermes voice could not start",
@@ -219,13 +244,19 @@ object AssistantSessionProtocol {
        return true
    }

-    fun publish(context: Context, snapshot: AssistantSessionSnapshot) {
+    fun publish(
+        context: Context,
+        activationId: String,
+        snapshot: AssistantSessionSnapshot,
+    ) {
        context.sendBroadcast(
            Intent(context, AssistantSessionStateReceiver::class.java).apply {
                action = ACTION_STATUS
+                putExtra(EXTRA_ACTIVATION_ID, activationId)
                putExtra(EXTRA_PHASE, snapshot.phase.name)
                putExtra(EXTRA_TRANSCRIPT, snapshot.transcript)
                putExtra(EXTRA_RESPONSE, snapshot.response)
+                putExtra(EXTRA_NOTICE, snapshot.notice?.name)
                putExtra(EXTRA_ERROR, snapshot.error)
                putExtra(EXTRA_SCREEN_CONTEXT_SUPPORTED, snapshot.screenContextSupported)
            }
@@ -238,10 +269,6 @@ object AssistantSessionProtocol {
        }
    }

-    fun publish(context: Context, state: VoiceUiState) {
-        publish(context, snapshotFromVoiceState(state))
-    }
-
    internal fun snapshotFromVoiceState(state: VoiceUiState): AssistantSessionSnapshot {
        val phase = when {
            !state.voiceMode -> AssistantSessionPhase.Closed
@@ -256,7 +283,10 @@ object AssistantSessionProtocol {
            phase = phase,
            transcript = state.transcribedText?.take(MAX_SESSION_TEXT_CHARS),
            response = state.responseText.take(MAX_SESSION_TEXT_CHARS),
-            error = state.error?.take(MAX_SESSION_ERROR_CHARS),
+            notice = state.assistantNotice,
+            error = state.error
+                ?.takeIf { phase == AssistantSessionPhase.Error }
+                ?.take(MAX_SESSION_ERROR_CHARS),
        )
    }

@@ -350,6 +380,9 @@ object AssistantSessionProtocol {
            phase = phase,
            transcript = intent.getStringExtra(EXTRA_TRANSCRIPT),
            response = intent.getStringExtra(EXTRA_RESPONSE).orEmpty(),
+            notice = intent.getStringExtra(EXTRA_NOTICE)?.let { raw ->
+                runCatching { AssistantSessionNotice.valueOf(raw) }.getOrNull()
+            },
            error = intent.getStringExtra(EXTRA_ERROR),
            screenContextSupported = intent.getBooleanExtra(
                EXTRA_SCREEN_CONTEXT_SUPPORTED,
@@ -360,24 +393,33 @@ object AssistantSessionProtocol {

    private const val MAX_SESSION_TEXT_CHARS = 4_000
    private const val MAX_SESSION_ERROR_CHARS = 1_000
+    private const val EXTRA_NOTICE = "notice"
 }

 object AssistantSessionState {
    private val _snapshot = MutableStateFlow(AssistantSessionSnapshot())
    val snapshot: StateFlow<AssistantSessionSnapshot> = _snapshot.asStateFlow()
+    @Volatile private var activationId: String? = null

-    internal fun update(snapshot: AssistantSessionSnapshot) {
+    internal fun update(receivedActivationId: String?, snapshot: AssistantSessionSnapshot) {
+        if (!assistantSnapshotMatchesActivation(activationId, receivedActivationId)) return
        _snapshot.value = snapshot
    }

-    internal fun reset() {
+    internal fun reset(activationId: String) {
+        this.activationId = activationId
        _snapshot.value = AssistantSessionSnapshot()
    }
 }

 class AssistantSessionStateReceiver : BroadcastReceiver() {
    override fun onReceive(context: Context, intent: Intent) {
-        AssistantSessionState.update(AssistantSessionProtocol.readSnapshot(intent))
+        AssistantSessionState.update(
+            receivedActivationId = intent.getStringExtra(
+                AssistantSessionProtocol.EXTRA_ACTIVATION_ID
+            ),
+            snapshot = AssistantSessionProtocol.readSnapshot(intent),
+        )
    }
 }

@@ -423,6 +465,7 @@ class AssistantSessionLifecycleReceiver : BroadcastReceiver() {
                onFailure = { failure ->
                    AssistantSessionProtocol.publish(
                        application,
+                        id,
                        AssistantSessionSnapshot(
                            phase = AssistantSessionPhase.Error,
                            error = failure.message ?: "Hermes voice could not start",
@@ -430,6 +473,7 @@ class AssistantSessionLifecycleReceiver : BroadcastReceiver() {
                    )
                },
            )
+            application.runtime.republishAssistantSnapshot(id)
            return
        }
        if (AssistantSessionProtocol.isStartAction(intent.action)) {
@@ -3,6 +3,11 @@ package com.hermesandroid.relay.assistant
 import android.graphics.Bitmap
 import android.graphics.BitmapFactory
 import android.graphics.drawable.ColorDrawable
+import android.app.KeyguardManager
+import android.content.BroadcastReceiver
+import android.content.Context
+import android.content.Intent
+import android.content.IntentFilter
 import android.os.Bundle
 import android.service.voice.VoiceInteractionSession
 import android.service.voice.VoiceInteractionSessionService
@@ -67,6 +72,7 @@ import androidx.compose.ui.res.stringResource
 import androidx.compose.ui.text.font.FontWeight
 import androidx.compose.ui.text.style.TextOverflow
 import androidx.compose.ui.unit.dp
+import androidx.core.content.ContextCompat
 import androidx.lifecycle.Lifecycle
 import androidx.lifecycle.LifecycleOwner
 import androidx.lifecycle.LifecycleRegistry
@@ -108,6 +114,11 @@ internal fun shouldCancelVoiceWhenSessionUiEnds(
    presentation: AssistantSessionPresentation,
 ): Boolean = presentation == AssistantSessionPresentation.Overlay

+internal fun assistantPresentationLocked(
+    currentKeyguardLocked: Boolean?,
+    fallbackLocked: Boolean,
+): Boolean = currentKeyguardLocked ?: fallbackLocked
+
 private class HermesVoiceInteractionSession(
    private val service: HermesVoiceInteractionSessionService,
 ) : VoiceInteractionSession(service) {
@@ -118,12 +129,19 @@ private class HermesVoiceInteractionSession(
    private var surfaceExpanded by mutableStateOf(false)
    private var activationId: String? = null
    private var manualMic = false
+    private var keyguardLocked by mutableStateOf(false)
    private var expectScreenContext: Boolean? = null
    private var pendingSemantic = AssistantSemanticContext()
    private var pendingScreenshot: ByteArray? = null
    private var screenContextUi by mutableStateOf(AssistantScreenContextUi())
    private val contextStore = assistantContextStore(service)
    private var heartbeatJob: Job? = null
+    private var keyguardReceiverRegistered = false
+    private val keyguardReceiver = object : BroadcastReceiver() {
+        override fun onReceive(context: Context?, intent: Intent?) {
+            refreshKeyguardState()
+        }
+    }

    init {
        scope.launch {
@@ -139,6 +157,17 @@ private class HermesVoiceInteractionSession(

    override fun onCreate() {
        super.onCreate()
+        ContextCompat.registerReceiver(
+            service,
+            keyguardReceiver,
+            IntentFilter().apply {
+                addAction(Intent.ACTION_SCREEN_OFF)
+                addAction(Intent.ACTION_SCREEN_ON)
+                addAction(Intent.ACTION_USER_PRESENT)
+            },
+            ContextCompat.RECEIVER_NOT_EXPORTED,
+        )
+        keyguardReceiverRegistered = true
        window.window?.apply {
            setBackgroundDrawable(ColorDrawable(android.graphics.Color.TRANSPARENT))
            clearFlags(WindowManager.LayoutParams.FLAG_DIM_BEHIND)
@@ -155,6 +184,7 @@ private class HermesVoiceInteractionSession(
            PersistedHermesRelayTheme {
                AssistantSessionSurface(
                    expanded = surfaceExpanded,
+                    locked = keyguardLocked,
                    screenContext = screenContextUi,
                    onExpandedChange = { surfaceExpanded = it },
                    onCancel = { finishSession(cancelVoice = true) },
@@ -183,11 +213,22 @@ private class HermesVoiceInteractionSession(

    override fun onShow(args: Bundle?, showFlags: Int) {
        super.onShow(args, showFlags)
-        if (args?.getBoolean(HermesVoiceInteractionService.EXTRA_FROM_KEYGUARD, false) == true) {
+        refreshKeyguardState(
+            fallbackLocked = args?.getBoolean(
+                HermesVoiceInteractionService.EXTRA_FROM_KEYGUARD,
+                false,
+            ) == true,
+        )
+        if (keyguardLocked) {
            window.window?.addFlags(
                WindowManager.LayoutParams.FLAG_SHOW_WHEN_LOCKED or
                    WindowManager.LayoutParams.FLAG_TURN_SCREEN_ON
            )
+        } else {
+            window.window?.clearFlags(
+                WindowManager.LayoutParams.FLAG_SHOW_WHEN_LOCKED or
+                    WindowManager.LayoutParams.FLAG_TURN_SCREEN_ON
+            )
        }
        setUiEnabled(true)
        val startsNewLifecycle = presentation == AssistantSessionPresentation.Inactive
@@ -195,10 +236,10 @@ private class HermesVoiceInteractionSession(
        if (!startsNewLifecycle) return

        surfaceExpanded = false
-        AssistantSessionState.reset()
        screenContextUi = AssistantScreenContextUi()
        activationId = args?.getString(AssistantSessionProtocol.EXTRA_ACTIVATION_ID)
            ?: UUID.randomUUID().toString()
+        AssistantSessionState.reset(activationId!!)
        manualMic = args?.getBoolean(AssistantSessionProtocol.EXTRA_MANUAL_MIC, false) ?: false
        expectScreenContext = args?.getBoolean(
            AssistantSessionProtocol.EXTRA_EXPECT_SCREEN_CONTEXT,
@@ -300,6 +341,10 @@ private class HermesVoiceInteractionSession(
        pendingSemantic = AssistantSemanticContext()
        pendingScreenshot = null
        screenContextUi = AssistantScreenContextUi()
+        if (keyguardReceiverRegistered) {
+            runCatching { service.unregisterReceiver(keyguardReceiver) }
+            keyguardReceiverRegistered = false
+        }
        viewOwner.stop()
        scope.cancel()
        super.onDestroy()
@@ -319,6 +364,7 @@ private class HermesVoiceInteractionSession(
            )
        }.onFailure {
            AssistantSessionState.update(
+                activationId,
                AssistantSessionSnapshot(
                    phase = AssistantSessionPhase.Error,
                    error = it.message ?: "Hermes could not open the voice session.",
@@ -337,6 +383,7 @@ private class HermesVoiceInteractionSession(
            setUiEnabled(false)
        }.onFailure {
            AssistantSessionState.update(
+                activationId,
                AssistantSessionSnapshot(
                    phase = AssistantSessionPhase.Error,
                    error = it.message ?: "Hermes could not open full voice.",
@@ -377,6 +424,14 @@ private class HermesVoiceInteractionSession(
        }
    }

+    private fun refreshKeyguardState(fallbackLocked: Boolean = keyguardLocked) {
+        keyguardLocked = assistantPresentationLocked(
+            currentKeyguardLocked = service.getSystemService(KeyguardManager::class.java)
+                ?.isKeyguardLocked,
+            fallbackLocked = fallbackLocked,
+        )
+    }
+
    @RequiresApi(android.os.Build.VERSION_CODES.Q)
    private fun stageAssistState(state: AssistState) {
        stageAssistData(state.assistStructure, state.assistContent)
@@ -463,6 +518,7 @@ private class AssistantSessionViewOwner :
@Composable
 private fun AssistantSessionSurface(
    expanded: Boolean,
+    locked: Boolean,
    screenContext: AssistantScreenContextUi,
    onExpandedChange: (Boolean) -> Unit,
    onCancel: () -> Unit,
@@ -471,7 +527,8 @@ private fun AssistantSessionSurface(
    onOpenFullVoice: () -> Unit,
    onSurfaceBoundsChanged: (android.graphics.Rect) -> Unit,
 ) {
-    val snapshot by AssistantSessionState.snapshot.collectAsState()
+    val rawSnapshot by AssistantSessionState.snapshot.collectAsState()
+    val snapshot = assistantSnapshotForPresentation(rawSnapshot, locked)
    val status = assistantStatus(snapshot.phase)
    val transmittedScreenContext = if (snapshot.screenContextSupported) {
        screenContext
@@ -650,6 +707,13 @@ private fun ExpandedAssistantSurface(
                color = MaterialTheme.colorScheme.onSurface,
            )
        }
+        snapshot.notice?.let { notice ->
+            Text(
+                text = assistantNoticeText(notice),
+                color = MaterialTheme.colorScheme.onSurfaceVariant,
+                style = MaterialTheme.typography.bodyMedium,
+            )
+        }
        snapshot.error?.let { error ->
            Text(
                text = error,
@@ -896,5 +960,11 @@ private fun assistantStatus(phase: AssistantSessionPhase): String = when (phase)
 private fun compactAssistantText(snapshot: AssistantSessionSnapshot): String =
    snapshot.transcript?.takeIf { it.isNotBlank() }
        ?: snapshot.response.takeIf { it.isNotBlank() }
+        ?: snapshot.notice?.let { assistantNoticeText(it) }
        ?: snapshot.error?.takeIf { it.isNotBlank() }
        ?: assistantStatus(snapshot.phase)
+
+@Composable
+private fun assistantNoticeText(notice: AssistantSessionNotice): String = when (notice) {
+    AssistantSessionNotice.NoSpeech -> stringResource(R.string.voice_no_speech_try_again)
+}
@@ -994,7 +994,7 @@ class AuthManager(
                    val serverSource = if (serverIssuedCode != null) "QR" else "local-fallback"
                    Log.i(
                        TAG,
-                        "authenticate: sending pairing_code=$codeToSend source=$serverSource " +
+                        "authenticate: sending pairing credential source=$serverSource " +
                            "ttl=$pendingTtlSeconds grants=${pendingGrants?.keys}"
                    )
                    buildJsonObject {
@@ -1063,7 +1063,8 @@ class AuthManager(
        _currentPairedSession.value = null
        Log.i(
            TAG,
-            "applyServerIssuedCodeAndReset: code=$normalized relayUrl=$relayUrl " +
+            "applyServerIssuedCodeAndReset: credential=present " +
+                "relayConfigured=${!relayUrl.isNullOrBlank()} " +
                "prevState=${prevState::class.simpleName} → Unpaired"
        )
        scope.launch {
@@ -10,6 +10,16 @@ package com.hermesandroid.relay.data
 */
 object AgentDisplay {
    const val SERVER_DEFAULT_PROFILE_KEY: String = "__server_default__"
+    private const val PROFILE_CONTEXT_SEPARATOR = "::"
+
+    data class ProfileContextIdentity(
+        val connectionId: String,
+        val profileKey: String,
+    ) {
+        /** Null means the upstream request must inherit Server Default. */
+        val requestProfileName: String?
+            get() = profileRequestName(profileKey)
+    }
    private val GENERIC_MODEL_ALIASES = setOf(
        "hermes-agent",
        "hermes_agent",
@@ -24,9 +34,7 @@ object AgentDisplay {
        profiles: List<Profile>,
    ): Profile? = selectedProfile

-    // Display can use the root default profile's metadata without making it a
-    // request/session override. Verbose SOUL summaries are filtered by
-    // profileDisplayName below, so this is safe for headers/cards.
+    // Display resolution never changes selection or persistence identity.
    fun effectiveDisplayProfile(
        selectedProfile: Profile?,
        profiles: List<Profile>,
@@ -34,36 +42,22 @@ object AgentDisplay {
    ): Profile? {
        selectedProfile?.let { return it }
        val resolvedServerDefault = profileRequestName(serverDefaultProfileName)
-        return resolvedServerDefault
-            ?.let { activeName ->
-                profiles.firstOrNull { it.name.equals(activeName, ignoreCase = true) }
-            }
-            ?: profiles.firstOrNull { it.name.equals("default", ignoreCase = true) }
+        // An absent roster row is not authority to substitute the root profile.
+        // Retain the confirmed name while its display metadata is loading.
+        return resolvedServerDefault?.let { activeName ->
+            profiles.firstOrNull { it.name == activeName }
+                ?: Profile(name = activeName, model = "")
+        }
    }

-    // The NAME goes in the name slot. Non-default profiles use their profile
-    // name first. The synthetic default profile uses its description only when
-    // that description looks like a concise human agent name ("Victor"), not a
-    // verbose SOUL summary.
+    // Match upstream Desktop: presentation-only display_name, then exact request name.
    fun profileDisplayName(profile: Profile?): String? {
        if (profile == null) return null
-        if (profile.name.equals("default", ignoreCase = true)) {
-            return defaultProfileDisplayName(profile)
-        }
-        return when {
-            profile.name.isNotBlank() -> titleCase(profile.name.trim())
-            profile.description.isNotBlank() -> profile.description.trim()
-            else -> null
-        }
+        return profile.displayName.trim().takeIf(String::isNotEmpty)
+            ?: profile.name.trim().takeIf(String::isNotEmpty)
    }

-    fun defaultProfileDisplayName(profile: Profile?): String? =
-        profile
-            ?.description
-            ?.trim()
-            ?.takeIf { it.looksLikeConciseAgentName() }
-            ?.let(::titleCase)
-
+    @Suppress("UNUSED_PARAMETER") // connectionLabel retained for source compatibility.
    fun agentName(
        profile: Profile?,
        selectedPersonality: String,
@@ -76,7 +70,7 @@ object AgentDisplay {

        // "none"/"neutral" are the upstream "cleared overlay" aliases — treat
        // them like "default" for identity: fall through to the server default
-        // (or the base connection identity) rather than rendering the literal
+        // identity rather than rendering the literal
        // word as an agent name.
        val personalityName = if (
            isClearedPersonality(selectedPersonality) &&
@@ -92,7 +86,6 @@ object AgentDisplay {
        return when {
            personalityName.isNotBlank() && personalityName != "default" ->
                titleCase(personalityName.trim())
-            !connectionLabel.isNullOrBlank() -> connectionLabel.trim()
            else -> "Hermes"
        }
    }
@@ -163,7 +156,25 @@ object AgentDisplay {
        profileRequestName(profileName) ?: SERVER_DEFAULT_PROFILE_KEY

    fun profileContextKey(connectionId: String?, profileName: String?): String =
-        "${connectionId.orEmpty()}::${profileSessionKey(profileName)}"
+        "${connectionId.orEmpty()}$PROFILE_CONTEXT_SEPARATOR${profileSessionKey(profileName)}"
+
+    /**
+     * Parse the canonical profile/context identity used by persisted chat state.
+     *
+     * Legacy or malformed opaque keys deliberately return null: recovery may
+     * still use the exact key for ownership, but must not invent an upstream
+     * profile override from it. The first separator is authoritative so legal
+     * profile names containing `::` remain round-trippable.
+     */
+    fun parseProfileContextKey(contextKey: String?): ProfileContextIdentity? {
+        val raw = contextKey?.trim().orEmpty()
+        val separator = raw.indexOf(PROFILE_CONTEXT_SEPARATOR)
+        if (separator <= 0 || separator + PROFILE_CONTEXT_SEPARATOR.length >= raw.length) return null
+        val connectionId = raw.substring(0, separator).trim()
+        val profileKey = raw.substring(separator + PROFILE_CONTEXT_SEPARATOR.length).trim()
+        if (connectionId.isEmpty() || profileKey.isEmpty()) return null
+        return ProfileContextIdentity(connectionId, profileKey)
+    }

    fun localDisplayAlias(value: String?): String? =
        value
@@ -171,16 +182,6 @@ object AgentDisplay {
            ?.replace(Regex("\\s+"), " ")
            ?.takeIf { it.isNotEmpty() }

-    private fun String.looksLikeConciseAgentName(): Boolean {
-        if (isBlank() || length > 40 || contains('\n') || contains('\r')) {
-            return false
-        }
-        if (any { it == '.' || it == ':' || it == ';' }) {
-            return false
-        }
-        return trim().split(Regex("\\s+")).size <= 4
-    }
-
    private fun titleCase(value: String): String =
        value.replaceFirstChar { it.uppercase() }
 }
@@ -1,6 +1,7 @@
 package com.hermesandroid.relay.data

 import android.content.Context
+import androidx.datastore.preferences.core.Preferences
 import androidx.datastore.preferences.core.floatPreferencesKey
 import androidx.datastore.preferences.core.stringPreferencesKey
 import com.hermesandroid.relay.ui.theme.AppFont
@@ -35,23 +36,25 @@ internal object AppearancePreferences {
    private val serializer = ListSerializer(CustomThemePreset.serializer())

    fun state(context: Context): Flow<PersistedAppearance> = context.applicationContext.relayDataStore.data
-        .map { preferences ->
-            val customThemes = decodeCustomThemes(preferences[customThemesKey])
-            val requestedThemeId = preferences[appThemeKey]
-            val customTheme = CustomThemePreset.idFromAppTheme(requestedThemeId)
-                ?.let { id -> customThemes.firstOrNull { it.id == id } }
-            PersistedAppearance(
-                themePreference = preferences[themeKey]
-                    ?.takeIf { it == "auto" || it == "light" || it == "dark" }
-                    ?: "auto",
-                appThemeId = customTheme?.appThemeId ?: AppThemes.byId(requestedThemeId).id,
-                accentHex = normalizeAccentHex(preferences[accentKey]),
-                shapeId = AppearanceShape.fromId(preferences[shapeKey]).id,
-                appFontId = AppFont.byId(preferences[appFontKey]).id,
-                fontScale = (preferences[fontScaleKey] ?: 1.0f).coerceIn(0.85f, 1.3f),
-                customTheme = customTheme,
-            )
-        }
+        .map(::decode)
+
+    fun decode(preferences: Preferences): PersistedAppearance {
+        val customThemes = decodeCustomThemes(preferences[customThemesKey])
+        val requestedThemeId = preferences[appThemeKey]
+        val customTheme = CustomThemePreset.idFromAppTheme(requestedThemeId)
+            ?.let { id -> customThemes.firstOrNull { it.id == id } }
+        return PersistedAppearance(
+            themePreference = preferences[themeKey]
+                ?.takeIf { it == "auto" || it == "light" || it == "dark" }
+                ?: "auto",
+            appThemeId = customTheme?.appThemeId ?: AppThemes.byId(requestedThemeId).id,
+            accentHex = normalizeAccentHex(preferences[accentKey]),
+            shapeId = AppearanceShape.fromId(preferences[shapeKey]).id,
+            appFontId = AppFont.byId(preferences[appFontKey]).id,
+            fontScale = (preferences[fontScaleKey] ?: 1.0f).coerceIn(0.85f, 1.3f),
+            customTheme = customTheme,
+        )
+    }

    fun shape(context: Context): Flow<String> = state(context).map { it.shapeId }

@@ -0,0 +1,102 @@
+package com.hermesandroid.relay.data
+
+/** Presentation only: canonical rows retain their wire identity, role and content. */
+internal fun projectChatActivityReceipts(
+    messages: List<ChatMessage>,
+    records: List<ChatActivityRecord>,
+    scopeKey: String?,
+    sessionId: String?,
+): List<ChatMessage> {
+    val originals = messages.filterNot {
+        it.clientOnly && it.id.startsWith("activity:") && it.activityRecord != null
+    }
+    if (scopeKey.isNullOrBlank() || sessionId.isNullOrBlank()) {
+        return originals.map { it.copy(activityRecord = null) }
+    }
+    val owned = records.filter { it.scopeKey == scopeKey && it.sessionId == sessionId }
+        .sortedByDescending { it.updatedAt }
+        .distinctBy { it.id }
+    val represented = mutableSetOf<String>()
+    val canonical = originals.map { message ->
+        val process = message.hermesProcessNotificationOrNull()
+        val delegation = message.activitySourceId?.takeIf { it.startsWith("delegation:") }
+            ?.removePrefix("delegation:")?.takeIf { it.isNotBlank() }
+        val kind = when {
+            message.activitySourceId != null -> ChatActivityKind.SUBAGENTS
+            process != null -> ChatActivityKind.PROCESS
+            else -> return@map message.copy(activityRecord = null)
+        }
+        val sourceId = delegation ?: process?.processId
+        val processTerminal = process?.let { notice ->
+            PROCESS_TERMINAL_HEADLINE.matchEntire(notice.headline)?.let { match ->
+                match.groupValues[2].toIntOrNull()?.let { code ->
+                    val phase = when {
+                        match.groupValues[1].startsWith("terminated by ") -> ChatActivityPhase.CANCELLED
+                        code == 0 -> ChatActivityPhase.COMPLETE
+                        else -> ChatActivityPhase.FAILED
+                    }
+                    phase to code
+                }
+            }
+        }
+        // A process id can be reused after a registry restart. A canonical row has
+        // no start-generation field, so multiple generations must remain unmatched.
+        val matching = if (sourceId == null) emptyList() else owned.filter {
+            it.kind == kind && it.sourceId == sourceId
+        }
+        val record = matching.singleOrNull()?.also { represented += it.id }
+            ?: ChatActivityRecord(
+                id = "canonical:${message.id}",
+                scopeKey = scopeKey,
+                sessionId = sessionId,
+                kind = kind,
+                sourceId = sourceId ?: "unavailable:${message.id}",
+                title = process?.headline ?: message.content,
+                phase = when {
+                    kind == ChatActivityKind.PROCESS -> processTerminal?.first ?: ChatActivityPhase.UNKNOWN
+                    (message.activityFailedCount ?: 0) > 0 ->
+                        if (message.activityFailedCount == message.activityTaskCount) {
+                            ChatActivityPhase.FAILED
+                        } else ChatActivityPhase.UNKNOWN
+                    (message.activityTaskCount ?: 0) > 0 -> ChatActivityPhase.COMPLETE
+                    else -> ChatActivityPhase.UNKNOWN
+                },
+                createdAt = message.timestamp,
+                updatedAt = message.timestamp,
+                taskCount = message.activityTaskCount?.coerceAtLeast(0) ?: 0,
+                processId = process?.processId,
+                exitCode = processTerminal?.second,
+            )
+        // Aggregate completion metadata never rewrites captured child phases.
+        message.copy(activityRecord = record)
+    }
+    val pending = owned.filter { it.phase != ChatActivityPhase.RUNNING && it.id !in represented }
+        .sortedWith(compareBy<ChatActivityRecord> { it.updatedAt }.thenBy { it.id })
+        .map { record ->
+            ChatMessage(
+                id = "activity:${record.id}",
+                role = MessageRole.SYSTEM,
+                content = record.title,
+                timestamp = record.updatedAt,
+                clientOnly = true,
+                activityRecord = record,
+            )
+        }
+    // Stable merge: history order is authoritative even if server timestamps
+    // regress. Only insert local receipts; never sort canonical messages.
+    var next = 0
+    return buildList {
+        canonical.forEach { message ->
+            while (next < pending.size && pending[next].timestamp < message.timestamp) {
+                add(pending[next++])
+            }
+            add(message)
+        }
+        while (next < pending.size) add(pending[next++])
+    }
+}
+
+/** Upstream completion envelope only; never search arbitrary command/output text. */
+private val PROCESS_TERMINAL_HEADLINE = Regex(
+    """Background process \S+ (completed normally|exited|terminated by [^\r\n]+|marked lost because the process backend disappeared|failed to start) \(exit code (-?\d+)(?:, SIGTERM)?\)\.""",
+)
@@ -0,0 +1,222 @@
+package com.hermesandroid.relay.data
+
+import android.content.Context
+import androidx.datastore.core.DataStore
+import androidx.datastore.preferences.core.Preferences
+import androidx.datastore.preferences.core.edit
+import androidx.datastore.preferences.core.stringPreferencesKey
+import java.io.IOException
+import kotlinx.coroutines.flow.first
+import kotlinx.coroutines.sync.Mutex
+import kotlinx.coroutines.sync.withLock
+import kotlinx.serialization.Serializable
+import kotlinx.serialization.encodeToString
+import kotlinx.serialization.json.Json
+import kotlinx.serialization.json.JsonArray
+import kotlinx.serialization.json.JsonObject
+import kotlinx.serialization.json.jsonPrimitive
+import kotlinx.serialization.json.intOrNull
+
+@Serializable
+enum class ChatActivityKind { SUBAGENTS, PROCESS }
+
+@Serializable
+enum class ChatActivityPhase { RUNNING, COMPLETE, FAILED, CANCELLED, UNKNOWN }
+
+@Serializable
+data class ChatActivityChild(
+    val id: String,
+    val childSessionId: String? = null,
+    val goal: String = "",
+    val phase: ChatActivityPhase = ChatActivityPhase.UNKNOWN,
+    val summary: String? = null,
+)
+
+/** Local presentation metadata and exact references, never transcripts or process output. */
+@Serializable
+data class ChatActivityRecord(
+    val id: String,
+    val scopeKey: String,
+    val sessionId: String,
+    val kind: ChatActivityKind,
+    val sourceId: String,
+    val title: String,
+    val phase: ChatActivityPhase,
+    val createdAt: Long,
+    val updatedAt: Long,
+    val children: List<ChatActivityChild> = emptyList(),
+    val taskCount: Int = 0,
+    val processId: String? = null,
+    val processStartedAt: String? = null,
+    val exitCode: Int? = null,
+)
+
+interface ChatActivityStore {
+    /** Recovery is not live evidence: RUNNING becomes UNKNOWN, including child phases. */
+    suspend fun read(scopeKey: String, sessionId: String): List<ChatActivityRecord>
+    suspend fun upsert(record: ChatActivityRecord)
+    suspend fun removeRecord(scopeKey: String, sessionId: String, id: String)
+    suspend fun removeSession(scopeKey: String, sessionId: String)
+}
+
+/**
+ * Bounded app-private history references in the shared settings DataStore.
+ * Retains 30 days, 128 records overall, 32 per exact owner/session, and 32 children
+ * per record. Titles are 160 characters; goals/summaries 512. Identity fields are
+ * rejected above 512 characters (scope 2048), never truncated into another owner.
+ * The complete encoded envelope is capped at 1 MiB, evicting oldest records first.
+ * Five minutes of future skew allows monotonic local revisions within one clock tick.
+ * All read/modify/write operations occur inside DataStore's serialized edit.
+ */
+class DataStoreChatActivityStore(
+    private val dataStore: DataStore<Preferences>,
+    private val now: () -> Long = System::currentTimeMillis,
+) : ChatActivityStore {
+    constructor(context: Context) : this(context.applicationContext.relayDataStore)
+
+    override suspend fun read(scopeKey: String, sessionId: String): List<ChatActivityRecord> {
+        val raw = try {
+            dataStore.data.first()[CHAT_ACTIVITY_KEY]
+        } catch (_: IOException) {
+            return emptyList()
+        }
+        return boundChatActivities(decodeChatActivities(raw), now())
+            .filter { it.scopeKey == scopeKey && it.sessionId == sessionId }
+            .map(ChatActivityRecord::recovered)
+    }
+
+    override suspend fun upsert(record: ChatActivityRecord) {
+        dataStore.edit { preferences ->
+            val records = mergeChatActivity(decodeChatActivities(preferences[CHAT_ACTIVITY_KEY]), record, now())
+            preferences[CHAT_ACTIVITY_KEY] = encodeChatActivities(records)
+        }
+    }
+
+    override suspend fun removeSession(scopeKey: String, sessionId: String) {
+        dataStore.edit { preferences ->
+            val remaining = boundChatActivities(decodeChatActivities(preferences[CHAT_ACTIVITY_KEY]), now())
+                .filterNot { it.scopeKey == scopeKey && it.sessionId == sessionId }
+            if (remaining.isEmpty()) preferences.remove(CHAT_ACTIVITY_KEY)
+            else preferences[CHAT_ACTIVITY_KEY] = encodeChatActivities(remaining)
+        }
+    }
+
+    override suspend fun removeRecord(scopeKey: String, sessionId: String, id: String) {
+        dataStore.edit { preferences ->
+            val remaining = boundChatActivities(decodeChatActivities(preferences[CHAT_ACTIVITY_KEY]), now())
+                .filterNot { it.scopeKey == scopeKey && it.sessionId == sessionId && it.id == id }
+            if (remaining.isEmpty()) preferences.remove(CHAT_ACTIVITY_KEY)
+            else preferences[CHAT_ACTIVITY_KEY] = encodeChatActivities(remaining)
+        }
+    }
+}
+
+/** Test/ephemeral implementation with the same bounds and recovery semantics. */
+class InMemoryChatActivityStore(
+    private val now: () -> Long = System::currentTimeMillis,
+) : ChatActivityStore {
+    private val mutex = Mutex()
+    private var records = emptyList<ChatActivityRecord>()
+
+    override suspend fun read(scopeKey: String, sessionId: String): List<ChatActivityRecord> = mutex.withLock {
+        records = boundChatActivities(records, now())
+        records.filter { it.scopeKey == scopeKey && it.sessionId == sessionId }
+            .map(ChatActivityRecord::recovered)
+    }
+
+    override suspend fun upsert(record: ChatActivityRecord) = mutex.withLock {
+        records = mergeChatActivity(records, record, now())
+    }
+
+    override suspend fun removeSession(scopeKey: String, sessionId: String) = mutex.withLock {
+        records = boundChatActivities(records, now())
+            .filterNot { it.scopeKey == scopeKey && it.sessionId == sessionId }
+    }
+
+    override suspend fun removeRecord(scopeKey: String, sessionId: String, id: String) = mutex.withLock {
+        records = boundChatActivities(records, now())
+            .filterNot { it.scopeKey == scopeKey && it.sessionId == sessionId && it.id == id }
+    }
+}
+
+internal const val CHAT_ACTIVITY_MAX_AGE_MS = 30L * 24L * 60L * 60L * 1_000L
+private const val MAX_RECORDS = 128
+private const val MAX_SESSION_RECORDS = 32
+private const val MAX_PAYLOAD_BYTES = 1_048_576
+private val CHAT_ACTIVITY_KEY = stringPreferencesKey("chat_activity_records_v1")
+private val activityJson = Json { ignoreUnknownKeys = true; encodeDefaults = true }
+
+@Serializable
+private data class ChatActivityEnvelope(val version: Int = 1, val records: List<ChatActivityRecord>)
+
+private fun encodeChatActivities(records: List<ChatActivityRecord>): String =
+    activityJson.encodeToString(ChatActivityEnvelope(records = records))
+
+internal fun decodeChatActivities(raw: String?): List<ChatActivityRecord> {
+    if (raw == null || raw.length > MAX_PAYLOAD_BYTES || raw.toByteArray().size > MAX_PAYLOAD_BYTES) {
+        return emptyList()
+    }
+    val envelope = runCatching { activityJson.parseToJsonElement(raw) as? JsonObject }.getOrNull()
+        ?: return emptyList()
+    val version = runCatching { envelope["version"]?.jsonPrimitive?.intOrNull }.getOrNull()
+    if (version != 1) return emptyList()
+    val rows = envelope["records"] as? JsonArray ?: return emptyList()
+    // One corrupt or newer row must not hide independently valid records.
+    return rows.mapNotNull { row ->
+        runCatching { activityJson.decodeFromJsonElement(ChatActivityRecord.serializer(), row) }.getOrNull()
+    }
+}
+
+private fun ChatActivityRecord.identity() = Triple(scopeKey, sessionId, id)
+
+private fun mergeChatActivity(
+    existing: List<ChatActivityRecord>,
+    record: ChatActivityRecord,
+    now: Long,
+): List<ChatActivityRecord> {
+    // Sorting first also rejects a late write for an older generation of the same record.
+    return boundChatActivities(listOf(record) + existing, now)
+}
+
+internal fun boundChatActivities(records: List<ChatActivityRecord>, now: Long): List<ChatActivityRecord> {
+    val counts = mutableMapOf<Pair<String, String>, Int>()
+    val bounded = records.mapNotNull { it.bounded(now) }
+        .sortedByDescending(ChatActivityRecord::updatedAt)
+        .distinctBy { it.identity() }
+        .filter {
+            val owner = it.scopeKey to it.sessionId
+            val count = counts.getOrDefault(owner, 0)
+            counts[owner] = count + 1
+            count < MAX_SESSION_RECORDS
+        }.take(MAX_RECORDS).toMutableList()
+    while (bounded.isNotEmpty() && encodeChatActivities(bounded).toByteArray().size > MAX_PAYLOAD_BYTES) {
+        bounded.removeAt(bounded.lastIndex)
+    }
+    return bounded
+}
+
+private fun validIdentity(value: String, max: Int = 512) = value.isNotBlank() && value.length <= max
+
+private fun ChatActivityRecord.bounded(now: Long): ChatActivityRecord? {
+    if (!validIdentity(scopeKey, 2048) || !validIdentity(sessionId) || !validIdentity(id) ||
+        !validIdentity(sourceId) || (processId != null && !validIdentity(processId)) ||
+        (processStartedAt != null && !validIdentity(processStartedAt)) ||
+        createdAt < 0 || updatedAt < createdAt || updatedAt > now + 300_000L ||
+        now - updatedAt > CHAT_ACTIVITY_MAX_AGE_MS
+    ) return null
+    return copy(
+        title = title.take(160),
+        taskCount = taskCount.coerceIn(0, 10_000),
+        children = children.asSequence().filter {
+            validIdentity(it.id) && (it.childSessionId == null || validIdentity(it.childSessionId))
+        }.distinctBy(ChatActivityChild::id).take(32)
+            .map { it.copy(goal = it.goal.take(512), summary = it.summary?.take(512)) }.toList(),
+    )
+}
+
+private fun ChatActivityRecord.recovered() = copy(
+    phase = if (phase == ChatActivityPhase.RUNNING) ChatActivityPhase.UNKNOWN else phase,
+    children = children.map {
+        if (it.phase == ChatActivityPhase.RUNNING) it.copy(phase = ChatActivityPhase.UNKNOWN) else it
+    },
+)
@@ -22,6 +22,26 @@ enum class PhysicalKeyboardEnterBehavior(val storedValue: String) {
    }
 }

+/** Default intent for a message submitted while an agent is responding. */
+enum class BusyMessageAction(val storedValue: String) {
+    CorrectNow("correct_now"),
+    QueueNext("queue_next");
+
+    companion object {
+        fun fromStoredValue(value: String?): BusyMessageAction =
+            entries.firstOrNull { it.storedValue == value } ?: CorrectNow
+    }
+}
+
+fun canCorrectBusyMessage(
+    steerable: Boolean,
+    hasAttachments: Boolean,
+    hasPendingInput: Boolean,
+    status: String?,
+    text: String,
+): Boolean = steerable && !hasAttachments && !hasPendingInput &&
+    status?.contains("compact", ignoreCase = true) != true && !text.trimStart().startsWith("/")
+
 /** Device-level chat input preferences shared by every Hermes profile. */
 class ChatInputPreferencesRepository(
    private val dataStore: DataStore<Preferences>,
@@ -29,10 +49,13 @@ class ChatInputPreferencesRepository(
    constructor(context: Context) : this(context.relayDataStore)

    companion object {
+        internal val KEY_BUSY_MESSAGE_ACTION = stringPreferencesKey("busy_message_action")
        internal val KEY_PHYSICAL_KEYBOARD_ENTER =
            stringPreferencesKey("physical_keyboard_enter_behavior")
        internal val KEY_CONVERT_LARGE_PASTES =
            booleanPreferencesKey("convert_large_pastes_to_attachments")
+        internal val KEY_SHOW_GIT_WORKSPACE_IN_CHAT =
+            booleanPreferencesKey("show_git_workspace_in_chat")
    }

    val physicalKeyboardEnterBehavior: Flow<PhysicalKeyboardEnterBehavior> = dataStore.data
@@ -43,10 +66,22 @@ class ChatInputPreferencesRepository(
        }
        .distinctUntilChanged()

+    val busyMessageAction: Flow<BusyMessageAction> = dataStore.data
+        .map { BusyMessageAction.fromStoredValue(it[KEY_BUSY_MESSAGE_ACTION]) }
+        .distinctUntilChanged()
+
+    suspend fun setBusyMessageAction(action: BusyMessageAction) {
+        dataStore.edit { it[KEY_BUSY_MESSAGE_ACTION] = action.storedValue }
+    }
+
    val convertLargePastesToAttachments: Flow<Boolean> = dataStore.data
        .map { preferences -> preferences[KEY_CONVERT_LARGE_PASTES] ?: true }
        .distinctUntilChanged()

+    val showGitWorkspaceInChat: Flow<Boolean> = dataStore.data
+        .map { preferences -> preferences[KEY_SHOW_GIT_WORKSPACE_IN_CHAT] ?: true }
+        .distinctUntilChanged()
+
    suspend fun setPhysicalKeyboardEnterBehavior(behavior: PhysicalKeyboardEnterBehavior) {
        dataStore.edit { preferences ->
            preferences[KEY_PHYSICAL_KEYBOARD_ENTER] = behavior.storedValue
@@ -58,4 +93,10 @@ class ChatInputPreferencesRepository(
            preferences[KEY_CONVERT_LARGE_PASTES] = enabled
        }
    }
+
+    suspend fun setShowGitWorkspaceInChat(enabled: Boolean) {
+        dataStore.edit { preferences ->
+            preferences[KEY_SHOW_GIT_WORKSPACE_IN_CHAT] = enabled
+        }
+    }
 }
@@ -10,6 +10,16 @@ package com.hermesandroid.relay.data
 */
 enum class AttachmentState { LOADING, LOADED, FAILED }

+/**
+ * Gateway tool events do not yet expose an output kind before completion.
+ * Recognize the upstream built-in plus the profile-tool naming convention used
+ * for image generators without guessing from generic prompt arguments.
+ */
+internal fun isImageGenerationToolName(name: String): Boolean {
+    val normalized = name.trim().lowercase()
+    return normalized == "image_generate" || normalized.endsWith("_create_image")
+}
+
 /**
 * How the UI should render a loaded attachment. Derived from the MIME type.
 * - [IMAGE]  inline image (decode bytes / load URI).
@@ -160,6 +170,12 @@ data class ChatMessage(
     * but server history never owns these presentation blocks.
     */
    val moaReferences: List<MoaReference> = emptyList(),
+    /** Exact upstream identity on a persisted activity-completion marker. */
+    val activitySourceId: String? = null,
+    val activityTaskCount: Int? = null,
+    val activityFailedCount: Int? = null,
+    /** Read-only UI projection; never sent as model history or voice input. */
+    val activityRecord: ChatActivityRecord? = null,
 )

 data class MessageReaction(
@@ -5,6 +5,7 @@ import androidx.datastore.core.DataStore
 import androidx.datastore.preferences.core.Preferences
 import androidx.datastore.preferences.core.edit
 import androidx.datastore.preferences.core.stringPreferencesKey
+import com.hermesandroid.relay.network.upstream.GatewayClarifyQuestion
 import kotlinx.coroutines.flow.first
 import kotlinx.serialization.Serializable
 import kotlinx.serialization.encodeToString
@@ -23,6 +24,8 @@ import kotlinx.serialization.json.Json
 data class ChatTurnCheckpoint(
    val schemaVersion: Int = CURRENT_SCHEMA,
    val contextKey: String,
+    /** Explicit persisted profile identity; null only for legacy checkpoints. */
+    val profileKey: String? = null,
    val sessionId: String,
    val liveSessionId: String? = null,
    val transport: String,
@@ -33,6 +36,9 @@ data class ChatTurnCheckpoint(
    val baselineAssistantCount: Int,
    val pendingAsk: ChatTurnAskCheckpoint? = null,
    val queuedMessages: List<ChatQueuedMessageCheckpoint> = emptyList(),
+    val queuePaused: Boolean = false,
+    /** Only pending local work remains; never reattach the completed/stopped turn. */
+    val queueOnly: Boolean = false,
    val startedAt: Long,
    val updatedAt: Long,
 ) {
@@ -130,6 +136,9 @@ data class ChatTurnAskCheckpoint(
    val text: String,
    val choices: List<String>? = null,
    val multiSelect: Boolean = false,
+    val questions: List<GatewayClarifyQuestion> = emptyList(),
+    val answers: Map<String, String> = emptyMap(),
+    val ownerId: String? = null,
    val smartDenied: Boolean = false,
    val envVar: String? = null,
    val timeoutSeconds: Int,
@@ -29,3 +29,26 @@ val Connection.capabilities: ConnectionCapabilities
        apiServerConfigured = apiServerUrl.isNotBlank(),
        relayConfigured = relayUrl.isNotBlank(),
    )
+
+/**
+ * Stable owner for an Auto chat before a conversation is opened.
+ *
+ * A legacy API-only record has no persisted Dashboard route; the conventional
+ * same-host `:9119` derivation remains useful for an explicit upgrade, but it
+ * must not silently turn that compatibility record into a Gateway-owned chat.
+ * Once a Dashboard route (or authenticated Dashboard origin) is persisted,
+ * standard Chat belongs to Gateway even while that route is signed out or
+ * temporarily unreachable.
+ */
+val Connection.automaticChatTransport: SessionTransport
+    get() {
+        val dashboardPersisted = !dashboardUrl.isNullOrBlank() ||
+            !authenticatedDashboardOrigin.isNullOrBlank()
+        // An empty first-setup placeholder is standard Gateway intent, not an
+        // API-only conversation. Only an actual API endpoint selects legacy SSE.
+        return if (dashboardPersisted || apiServerUrl.isBlank()) SessionTransport.GATEWAY else SessionTransport.SSE
+    }
+
+fun Connection.chatTransportForPreference(preference: String): SessionTransport =
+    if (preference == "auto") automaticChatTransport
+    else SessionTransport.forEndpoint(preference)
@@ -1,6 +1,8 @@
 package com.hermesandroid.relay.data

 import kotlinx.serialization.Serializable
+import java.net.Inet6Address
+import java.net.InetAddress
 import java.net.URI

@Serializable
@@ -65,6 +67,16 @@ data class Connection(
     * "derive from [apiServerUrl] using the conventional same-host :9119".
     */
    val dashboardUrl: String? = null,
+    /** User-accepted cleartext origins. This does not assert or monitor VPN protection. */
+    val dashboardHttpConsentOrigins: Set<String> = emptySet(),
+    /**
+     * Credential-free origin that most recently completed Dashboard
+     * authentication for this connection. Public origins require HTTPS;
+     * loopback/private-overlay HTTP retains upstream's trusted-network mode.
+     * Dashboard/Gateway consumers prefer this origin, while [routeCandidates]
+     * continue to own only network route selection for API and Relay.
+     */
+    val authenticatedDashboardOrigin: String? = null,
    val dashboardAuthRequired: Boolean? = null,
    val dashboardAuthProviders: List<String> = emptyList(),
    val dashboardLastStatus: DashboardConnectionStatus? = null,
@@ -77,6 +89,11 @@ data class Connection(
    val routeCandidates: List<EndpointCandidate> = emptyList(),
    /** Optional user preference such as "lan" or "tailscale"; null means Auto. */
    val preferredRouteRole: String? = null,
+    /**
+     * Explicit per-installation consent for Relay Git repository discovery.
+     * Missing legacy values remain off; route/profile changes do not broaden it.
+     */
+    val gitRepoScanningEnabled: Boolean = false,
    /** Epoch milliseconds. Pass `System.currentTimeMillis()`; do not pass seconds. */
    val pairedAt: Long? = null,
    /** Last time the user explicitly selected this connection. */
@@ -86,21 +103,27 @@ data class Connection(
    /** Epoch milliseconds. The auth.ok `expires_at` field is seconds — multiply by 1000 at the call site. */
    val expiresAt: Long? = null,
 ) {
-    /**
-     * Effective Dashboard/Gateway endpoint. Legacy records did not persist a
-     * dashboard URL, so they retain the conventional same-host `:9119`
-     * derivation from the API server. Dashboard-only records persist an
-     * explicit URL and may leave [apiServerUrl] and [relayUrl] blank.
-     */
-    val resolvedDashboardUrl: String
+    /** Saved Dashboard/Gateway route before any authenticated-origin override. */
+    val configuredDashboardUrl: String
        get() = dashboardUrl
            ?.trim()
            ?.takeIf { it.isNotBlank() }
            ?: deriveDefaultDashboardUrl(apiServerUrl).orEmpty()

+    /**
+     * Effective Dashboard/Gateway endpoint. A verified authenticated origin
+     * wins without rewriting the saved network route. Legacy records retain
+     * the conventional same-host `:9119` derivation through
+     * [configuredDashboardUrl].
+     */
+    val resolvedDashboardUrl: String
+        get() = authenticatedDashboardOrigin
+            ?.let { normalizeCredentialFreeAuthenticatedDashboardOrigin(it, dashboardHttpConsentOrigins) }
+            ?: configuredDashboardUrl
+
    /** Stable display/host identity that does not depend on the API surface. */
    val primaryEndpointUrl: String
-        get() = resolvedDashboardUrl.takeIf { it.isNotBlank() }
+        get() = configuredDashboardUrl.takeIf { it.isNotBlank() }
            ?: apiServerUrl.trim().takeIf { it.isNotBlank() }
            ?: relayUrl.trim()

@@ -506,6 +529,12 @@ data class Connection(
            )
        }

+        /**
+         * Normalize a hand-typed Dashboard/Gateway address. Bare private,
+         * LAN, and Tailscale hosts use upstream's `http://…:9119` default;
+         * bare public hosts use `https://` on the standard HTTPS port.
+         * Explicit schemes and ports are preserved for precise validation.
+         */
        fun normalizeDashboardUrlInput(
            raw: String,
            defaultPort: Int = DEFAULT_DASHBOARD_PORT,
@@ -513,7 +542,10 @@ data class Connection(
            val trimmed = raw.trim().trimEnd('/')
            if (trimmed.isEmpty()) return trimmed
            if (SCHEME_REGEX.containsMatchIn(trimmed)) return trimmed
-            val withScheme = "http://$trimmed"
+            val provisionalHttpUrl = "http://$trimmed"
+            val publicAddress = inferRouteRole(provisionalHttpUrl) == "public"
+            val withScheme = if (publicAddress) "https://$trimmed" else provisionalHttpUrl
+            if (publicAddress) return withScheme
            val uri = runCatching { URI(withScheme) }.getOrNull()
            val canAppendPort = uri != null &&
                !uri.host.isNullOrBlank() &&
@@ -528,16 +560,41 @@ data class Connection(
                .getOrNull()
                ?.lowercase()
                ?: return "custom"
+            val normalizedHost = host.removePrefix("[").removeSuffix("]")
+            if (normalizedHost.contains(':')) {
+                val address = runCatching { InetAddress.getByName(normalizedHost) }
+                    .getOrNull() as? Inet6Address
+                    ?: return "public"
+                return when {
+                    isTailscaleIpv6(address) -> "tailscale"
+                    address.isAnyLocalAddress ||
+                        address.isLoopbackAddress ||
+                        address.isLinkLocalAddress ||
+                        isUniqueLocalIpv6(address) -> "lan"
+                    else -> "public"
+                }
+            }
            return when {
-                host.endsWith(".ts.net") || isTailscaleIpv4(host) -> "tailscale"
-                host == "localhost" ||
-                    host == "127.0.0.1" ||
-                    host == "::1" ||
-                    isPrivateLanIpv4(host) -> "lan"
+                normalizedHost.endsWith(".ts.net") || isTailscaleIpv4(normalizedHost) -> "tailscale"
+                normalizedHost == "localhost" ||
+                    normalizedHost == "127.0.0.1" ||
+                    normalizedHost.endsWith(".local") ||
+                    normalizedHost.endsWith(".lan") ||
+                    !normalizedHost.contains('.') ||
+                    isPrivateLanIpv4(normalizedHost) -> "lan"
                else -> "public"
            }
        }

+        private fun isTailscaleIpv6(address: Inet6Address): Boolean {
+            val bytes = address.address
+            val prefix = intArrayOf(0xfd, 0x7a, 0x11, 0x5c, 0xa1, 0xe0)
+            return prefix.indices.all { index -> bytes[index].toInt() and 0xff == prefix[index] }
+        }
+
+        private fun isUniqueLocalIpv6(address: Inet6Address): Boolean =
+            address.address.first().toInt() and 0xfe == 0xfc
+
        private fun isTailscaleIpv4(host: String): Boolean {
            val parts = host.split('.').mapNotNull { it.toIntOrNull() }
            if (parts.size != 4) return false
@@ -557,3 +614,48 @@ data class Connection(
        }
    }
 }
+
+/** Normalize an absolute, credential-free HTTPS origin for authenticated Dashboard use. */
+internal fun normalizeCredentialFreeHttpsOrigin(raw: String): String? {
+    val parsed = runCatching { URI(raw.trim()) }.getOrNull() ?: return null
+    if (!parsed.scheme.equals("https", ignoreCase = true)) return null
+    if (parsed.host.isNullOrBlank() || parsed.userInfo != null) return null
+    if (parsed.query != null || parsed.fragment != null) return null
+    if (parsed.port > 65_535) return null
+    return parsed.normalize().toASCIIString().trimEnd('/').takeIf { it.isNotBlank() }
+}
+
+/**
+ * Normalize a reviewed Dashboard credential owner. Public origins require
+ * HTTPS; cleartext is accepted only for literal loopback, RFC1918/link-local,
+ * or Tailscale CGNAT addresses.
+ */
+internal fun normalizeCredentialFreeAuthenticatedDashboardOrigin(
+    raw: String,
+    httpConsentOrigins: Set<String> = emptySet(),
+): String? {
+    normalizeCredentialFreeHttpsOrigin(raw)?.let { return it }
+    val parsed = runCatching { URI(raw.trim()) }.getOrNull() ?: return null
+    if (!parsed.scheme.equals("http", ignoreCase = true)) return null
+    val host = parsed.host
+        ?.lowercase()
+        ?.removePrefix("[")
+        ?.removeSuffix("]")
+        ?.takeIf { it.isNotBlank() }
+        ?: return null
+    if (parsed.userInfo != null || parsed.query != null || parsed.fragment != null) return null
+    if (parsed.port > 65_535) return null
+    val trustedHost = host == "localhost" || host == "127.0.0.1" || host == "::1" ||
+        host.split('.').mapNotNull(String::toIntOrNull).let { octets ->
+            octets.size == 4 && octets.all { it in 0..255 } && when {
+                octets[0] == 10 -> true
+                octets[0] == 172 && octets[1] in 16..31 -> true
+                octets[0] == 192 && octets[1] == 168 -> true
+                octets[0] == 169 && octets[1] == 254 -> true
+                octets[0] == 100 && octets[1] in 64..127 -> true
+                else -> false
+            }
+        }
+    if (!trustedHost && !dashboardHttpConsentMatches(raw, httpConsentOrigins)) return null
+    return parsed.normalize().toASCIIString().trimEnd('/').takeIf { it.isNotBlank() }
+}
@@ -18,6 +18,9 @@ package com.hermesandroid.relay.data
 */
 enum class SurfaceSecurityKind { Tls, Overlay, Plain }

+/** Whether a configured surface currently contributes traffic to the connection. */
+enum class SurfaceUseState { InUse, Available, Unavailable }
+
 /** Connection-level rollup across the surfaces actually in use. */
 enum class ConnectionSecurityLevel { Tls, Overlay, Mixed, Plain, Unknown }

@@ -28,6 +31,7 @@ data class SurfaceSecurity(
    /** Human mechanism: "TLS", "Tailscale", "WireGuard", "Proxy", "Plain". */
    val mechanism: String,
    val url: String,
+    val useState: SurfaceUseState = SurfaceUseState.InUse,
 )

 data class ConnectionSecurity(
@@ -86,6 +90,7 @@ fun classifySurfaceSecurity(
    url: String,
    activeEndpoint: EndpointCandidate?,
    isTailscaleDetected: Boolean,
+    useState: SurfaceUseState = SurfaceUseState.InUse,
 ): SurfaceSecurity {
    val secureLinkProtected = activeEndpoint.secureLinkProtects(label, url)
    val (kind, mechanism) = when {
@@ -96,7 +101,13 @@ fun classifySurfaceSecurity(
            SurfaceSecurityKind.Overlay to activeEndpoint.overlayMechanism(isTailscaleDetected)
        else -> SurfaceSecurityKind.Plain to "Plain"
    }
-    return SurfaceSecurity(label = label, kind = kind, mechanism = mechanism, url = url)
+    return SurfaceSecurity(
+        label = label,
+        kind = kind,
+        mechanism = mechanism,
+        url = url,
+        useState = useState,
+    )
 }

 private fun EndpointCandidate?.secureLinkProtects(label: String, url: String): Boolean {
@@ -112,8 +123,8 @@ private fun EndpointCandidate?.secureLinkProtects(label: String, url: String): B
        } ?: return false
    val normalized = url.trim().trimEnd('/')
    val service = when (label) {
-        "Chat & Manage" -> "dashboard"
-        "API / sessions" -> "api"
+        "Chat & Manage", "Dashboard & Gateway" -> "dashboard"
+        "API / sessions", "API fallback", "Direct API" -> "api"
        "Relay tools" -> "relay"
        else -> return false
    }
@@ -137,23 +148,67 @@ fun computeConnectionSecurity(
    relayConfigured: Boolean,
    activeEndpoint: EndpointCandidate?,
    isTailscaleDetected: Boolean,
+    dashboardInUse: Boolean = true,
+    apiInUse: Boolean = true,
+    apiAvailable: Boolean = apiInUse,
+    relayInUse: Boolean = relayConfigured,
+    apiEndpoint: EndpointCandidate? = activeEndpoint,
+    relayEndpoint: EndpointCandidate? = activeEndpoint,
 ): ConnectionSecurity {
    val surfaces = buildList {
        dashboardUrl.trim().takeIf { it.isNotBlank() }?.let {
-            add(classifySurfaceSecurity("Chat & Manage", it, activeEndpoint, isTailscaleDetected))
+            add(
+                classifySurfaceSecurity(
+                    label = "Dashboard & Gateway",
+                    url = it,
+                    activeEndpoint = activeEndpoint,
+                    isTailscaleDetected = isTailscaleDetected,
+                    useState = if (dashboardInUse) SurfaceUseState.InUse else SurfaceUseState.Unavailable,
+                )
+            )
        }
        apiUrl.trim().takeIf { it.isNotBlank() }?.let {
-            add(classifySurfaceSecurity("API / sessions", it, activeEndpoint, isTailscaleDetected))
+            add(
+                classifySurfaceSecurity(
+                    label = "Direct API",
+                    url = it,
+                    activeEndpoint = apiEndpoint,
+                    isTailscaleDetected = isTailscaleDetected,
+                    useState = when {
+                        apiInUse -> SurfaceUseState.InUse
+                        apiAvailable -> SurfaceUseState.Available
+                        else -> SurfaceUseState.Unavailable
+                    },
+                )
+            )
        }
        if (relayConfigured) {
            relayUrl.trim().takeIf { it.isNotBlank() }?.let {
-                add(classifySurfaceSecurity("Relay tools", it, activeEndpoint, isTailscaleDetected))
+                add(
+                    classifySurfaceSecurity(
+                        label = "Relay tools",
+                        url = it,
+                        activeEndpoint = relayEndpoint,
+                        isTailscaleDetected = isTailscaleDetected,
+                        useState = if (relayInUse) SurfaceUseState.InUse else SurfaceUseState.Unavailable,
+                    )
+                )
            }
        }
    }
    if (surfaces.isEmpty()) return ConnectionSecurity.UNKNOWN

-    val kinds = surfaces.map { it.kind }.toSet()
+    // Configured-but-unavailable fallbacks remain visible in the breakdown,
+    // but do not make the active transport look insecure.
+    val activeSurfaces = surfaces.filter { it.useState == SurfaceUseState.InUse }
+    if (activeSurfaces.isEmpty()) {
+        return ConnectionSecurity(
+            level = ConnectionSecurityLevel.Unknown,
+            mechanism = "",
+            surfaces = surfaces,
+        )
+    }
+    val kinds = activeSurfaces.map { it.kind }.toSet()
    val hasPlain = SurfaceSecurityKind.Plain in kinds
    val hasSecure = kinds.any { it != SurfaceSecurityKind.Plain }

@@ -167,7 +222,7 @@ fun computeConnectionSecurity(
    val mechanism = when (level) {
        ConnectionSecurityLevel.Tls -> "TLS"
        ConnectionSecurityLevel.Overlay ->
-            surfaces.firstOrNull { it.kind == SurfaceSecurityKind.Overlay }?.mechanism ?: "Encrypted"
+            activeSurfaces.firstOrNull { it.kind == SurfaceSecurityKind.Overlay }?.mechanism ?: "Encrypted"
        ConnectionSecurityLevel.Mixed -> "Mixed"
        ConnectionSecurityLevel.Plain -> when (activeEndpoint?.role?.lowercase()) {
            "lan" -> "LAN"
@@ -149,15 +149,15 @@ class ConnectionStore private constructor(
                // between the two names — `{"id": ..., "label": ..., ...}` —
                // so no per-record migration is needed.
                if (newJson == null && oldJson != null) {
+                    val restored = decodeConnections(oldJson)
                    dataStore.edit { p ->
-                        p[KEY_CONNECTIONS] = oldJson
+                        p[KEY_CONNECTIONS] = encodeConnections(restored)
                        p.remove(KEY_LEGACY_PROFILES)
                        if (activeNew == null && activeOld != null) {
                            p[KEY_ACTIVE_CONNECTION_ID] = activeOld
                            p.remove(KEY_LEGACY_ACTIVE_PROFILE_ID)
                        }
                    }
-                    val restored = decodeConnections(oldJson)
                    val validStartupId = startupId?.takeIf { id -> restored.any { it.id == id } }
                    _connections.value = restored
                    _startupConnectionId.value = validStartupId
@@ -168,6 +168,12 @@ class ConnectionStore private constructor(
                    )
                } else {
                    val restored = decodeConnections(newJson)
+                    if (newJson != null) {
+                        val normalizedJson = encodeConnections(restored)
+                        if (normalizedJson != newJson) {
+                            dataStore.edit { p -> p[KEY_CONNECTIONS] = normalizedJson }
+                        }
+                    }
                    val validStartupId = startupId?.takeIf { id -> restored.any { it.id == id } }
                    _connections.value = restored
                    _startupConnectionId.value = validStartupId
@@ -571,7 +577,17 @@ class ConnectionStore private constructor(
 internal fun Connection.withDashboardDefaults(): Connection {
    val derivedDashboardUrl = Connection.deriveDefaultDashboardUrl(apiServerUrl)
    val effectiveDashboardUrl = dashboardUrl?.takeIf { it.isNotBlank() } ?: derivedDashboardUrl
-    val storedOrDefaultRoutes = routeCandidates.ifEmpty {
+    val legacyAuthenticatedRoute = routeCandidates.firstOrNull {
+        it.role.equals(LEGACY_AUTHENTICATED_DASHBOARD_ROUTE_ROLE, ignoreCase = true)
+    }
+    val migratedAuthenticatedOrigin = authenticatedDashboardOrigin
+        ?.let { normalizeCredentialFreeAuthenticatedDashboardOrigin(it, dashboardHttpConsentOrigins) }
+        ?: legacyAuthenticatedRoute?.dashboard?.url
+            ?.let(::normalizeCredentialFreeAuthenticatedDashboardOrigin)
+    val routesWithoutLegacyAuthentication = routeCandidates.filterNot {
+        it.role.equals(LEGACY_AUTHENTICATED_DASHBOARD_ROUTE_ROLE, ignoreCase = true)
+    }
+    val storedOrDefaultRoutes = routesWithoutLegacyAuthentication.ifEmpty {
        Connection.buildRouteCandidates(
            apiServerUrl = apiServerUrl,
            relayUrl = relayUrl,
@@ -582,16 +598,18 @@ internal fun Connection.withDashboardDefaults(): Connection {
        dashboardUrl = effectiveDashboardUrl,
        candidates = storedOrDefaultRoutes,
    )
-    val normalizedPreferredRouteRole = preferredRouteRole?.takeIf { preferred ->
-        normalizedRoutes.any { it.role.equals(preferred, ignoreCase = true) }
-    }
+    val normalizedPreferredRouteRole = preferredRouteRole
+        ?.takeUnless { it.equals(LEGACY_AUTHENTICATED_DASHBOARD_ROUTE_ROLE, ignoreCase = true) }
+        ?.takeIf { preferred -> normalizedRoutes.any { it.role.equals(preferred, ignoreCase = true) } }
    return if (
        dashboardUrl != effectiveDashboardUrl ||
+        authenticatedDashboardOrigin != migratedAuthenticatedOrigin ||
        normalizedRoutes != routeCandidates ||
        normalizedPreferredRouteRole != preferredRouteRole
    ) {
        copy(
            dashboardUrl = effectiveDashboardUrl,
+            authenticatedDashboardOrigin = migratedAuthenticatedOrigin,
            routeCandidates = normalizedRoutes,
            preferredRouteRole = normalizedPreferredRouteRole,
        )
@@ -599,3 +617,5 @@ internal fun Connection.withDashboardDefaults(): Connection {
        this
    }
 }
+
+internal const val LEGACY_AUTHENTICATED_DASHBOARD_ROUTE_ROLE = "authenticated_dashboard"
@@ -0,0 +1,31 @@
+package com.hermesandroid.relay.data
+
+import okhttp3.HttpUrl.Companion.toHttpUrlOrNull
+
+/** An explicit HTTP exception is scoped to a connection and exact origin, never a VPN claim. */
+fun dashboardHttpOrigin(address: String): String? {
+    val url = address.trim().toHttpUrlOrNull() ?: return null
+    if (url.scheme != "http" || url.username.isNotEmpty() || url.password.isNotEmpty() ||
+        url.query != null || url.fragment != null
+    ) return null
+    return url.newBuilder().encodedPath("/").build().toString().trimEnd('/')
+}
+
+fun dashboardHttpConsentRequired(address: String): Boolean =
+    dashboardHttpOrigin(address) != null && Connection.inferRouteRole(address) == "public"
+
+fun dashboardHttpConsentMatches(address: String, approvedOrigins: Set<String>): Boolean =
+    dashboardHttpOrigin(address)?.let { it in approvedOrigins } == true
+
+/** Editing an origin retires its old exception; another address requires its own confirmation. */
+fun updatedDashboardHttpConsents(
+    previous: Set<String>,
+    oldAddress: String?,
+    newAddress: String,
+    confirmedOrigin: String?,
+): Set<String> {
+    val oldOrigin = oldAddress?.let(::dashboardHttpOrigin)
+    val newOrigin = dashboardHttpOrigin(newAddress)
+    val retained = if (oldOrigin != newOrigin) previous - setOfNotNull(oldOrigin) else previous
+    return if (newOrigin != null && confirmedOrigin == newOrigin) retained + newOrigin else retained
+}
@@ -25,7 +25,7 @@ import java.net.URI
 *
 * **Semantics (locked by ADR 24):**
 *  - [role] is an open string. Known values `lan` / `tailscale` / `public`
- *    get styled labels; anything else renders generically (`Custom VPN (<role>)`).
+ *    get styled labels; anything else renders generically (`Custom route (<role>)`).
 *    No enum, no normalization — the raw role string must round-trip exactly
 *    so HMAC canonicalization holds.
 *  - [priority] is strict, `0 = highest`. Reachability never promotes a lower
@@ -145,18 +145,19 @@ data class BrokerEndpoint(
 *
 * Unknown roles (`"wireguard"`, `"zerotier"`, `"netbird-eu"`, operator-defined
 * labels) return false so the UI can fall back to [displayLabel]'s generic
- * "Custom VPN" treatment.
+ * "Custom route" treatment.
 */
 fun EndpointCandidate.isKnownRole(): Boolean {
    return when (role.lowercase()) {
-        "lan", "tailscale", "public", "plugin_proxy", "plugin-proxy", "outbound_broker", "https" -> true
+        "lan", "tailscale", "public", "plugin_proxy", "plugin-proxy", "outbound_broker", "https",
+        "dashboard", "authenticated_dashboard" -> true
        else -> false
    }
 }

 /**
 * Human-readable label for the UI. Known roles get fixed-case styled labels;
- * unknown roles render as `"Custom VPN (<role>)"` with the raw role preserved
+ * unknown roles render as `"Custom route (<role>)"` with the raw role preserved
 * so an operator can see exactly what they labeled it.
 *
 * The raw [role] on the [EndpointCandidate] is NOT modified — it stays in its
@@ -172,19 +173,58 @@ fun EndpointCandidate.displayLabel(): String {
            "Public"
        }
        "https" -> "HTTPS"
+        "dashboard", "authenticated_dashboard" -> if (
+            primaryRouteUrl()?.startsWith("https://", ignoreCase = true) == true
+        ) {
+            "HTTPS Dashboard"
+        } else {
+            "Dashboard"
+        }
        "plugin_proxy", "plugin-proxy" -> "Hermes Secure Link"
        "outbound_broker", "broker", "relay_broker" -> "Hermes Reach · Experimental"
-        else -> "Custom VPN ($role)"
+        else -> displayName?.trim()?.takeIf { it.isNotBlank() } ?: "Custom route ($role)"
    }
 }

+/**
+ * True for a route created only to keep Dashboard/Gateway authentication on
+ * its canonical origin. It is a service address, not another selectable
+ * whole-connection or VPN route.
+ */
+fun EndpointCandidate.isDashboardOnlyRoute(): Boolean =
+    api == null && relay == null && proxy == null && broker == null && dashboard != null
+
 /** Dashboard-first URL identity for routing, diagnostics, and UI labels. */
 fun EndpointCandidate.primaryRouteUrl(): String? =
    dashboard?.url?.trim()?.trimEnd('/')?.takeIf { it.isNotBlank() }
+        ?: proxyDashboardBaseUrlOrNull()
        ?: api?.url
        ?: relay?.url?.trim()?.trimEnd('/')?.takeIf { it.isNotBlank() }
        ?: proxy?.url?.trim()?.trimEnd('/')?.takeIf { it.isNotBlank() }

+/**
+ * Dashboard/Gateway identity only; Relay and broker transports are extensions.
+ *
+ * Hermes Secure Link stores the dashboard surface under [ProxyEndpoint.surfaces]
+ * (`…/dashboard`), not [DashboardEndpoint.url]. Without that hop, Routes/Access
+ * fall back to the saved plain `:9119` URL while Overview already rides the
+ * live Secure Link origin.
+ */
+fun EndpointCandidate.gatewayRouteUrl(): String? =
+    dashboard?.url?.trim()?.trimEnd('/')?.takeIf { it.isNotBlank() }
+        ?: proxyDashboardBaseUrlOrNull()
+        ?: api?.url?.let(Connection::deriveDefaultDashboardUrl)
+
+/** Secure Link dashboard base when the proxy advertises a dashboard surface. */
+internal fun EndpointCandidate.proxyDashboardBaseUrlOrNull(): String? {
+    val proxy = proxy ?: return null
+    if (!proxy.isValidPinnedProxy()) return null
+    val surfaces = proxy.surfaces.map { it.trim().lowercase() }.toSet()
+    if ("dashboard" !in surfaces) return null
+    val base = proxy.url.trim().trimEnd('/').takeIf { it.isNotBlank() } ?: return null
+    return "$base/dashboard"
+}
+
 /** Stable host/port identity without assuming that an API surface exists. */
 fun EndpointCandidate.routeAuthority(): String? {
    val rawUrl = primaryRouteUrl() ?: return null
@@ -96,7 +96,8 @@ object FeatureFlags {
 * flavor ships AccessibilityService-backed Device Control. The `googlePlay`
 * flavor is Bridge Core: relay pairing, chat, voice, terminal, notification
 * companion, media, and session-grant surfaces without screen reading, taps,
- * typing, screenshots, overlays, or unattended control.
+ * typing, MediaProjection screenshots, or unattended control. Voice-only overlay
+ * presentation is a separate capability shared by both flavors.
 *
 * Device Control tier definitions (see `Phase 3 — Bridge Channel.md`):
 *   1. baseline          — sideload only (app open, tap, navigate within app)
@@ -126,6 +127,9 @@ object BuildFlavor {
     */
    val isSideload: Boolean get() = current == SIDELOAD

+    /** Voice presentation does not grant Device Control. Unknown distributions fail closed. */
+    val voiceSystemOverlay: Boolean get() = current == GOOGLE_PLAY || current == SIDELOAD
+
    val bridgeTier1: Boolean get() = current == SIDELOAD         // baseline device control
    val bridgeTier2: Boolean get() = current == SIDELOAD         // screen context
    val bridgeTier3: Boolean get() = current == SIDELOAD         // voice-first
@@ -1,7 +1,13 @@
 package com.hermesandroid.relay.data

 import com.hermesandroid.relay.network.upstream.DashboardApiClient
+import com.hermesandroid.relay.network.upstream.DashboardHttpException
 import com.hermesandroid.relay.plugins.runtime.ScopedPluginApiClient
+import java.io.IOException
+import java.net.URLEncoder
+import java.util.Locale
+import kotlinx.serialization.SerialName
+import kotlinx.serialization.Serializable
 import kotlinx.serialization.json.Json
 import kotlinx.serialization.json.JsonPrimitive
 import kotlinx.serialization.json.buildJsonArray
@@ -9,113 +15,178 @@ import kotlinx.serialization.json.buildJsonObject
 import kotlinx.serialization.json.decodeFromJsonElement
 import kotlinx.serialization.json.put

-// Read + write client for the Hermes-Relay Git State endpoints.
-// All requests are confined to the ``hermes-relay`` plugin namespace and the
-// ``git/*`` sub-path via ScopedPluginApiClient, which rejects traversal and
-// encodes query values.
-
 private fun pathsArray(paths: List<String>) = buildJsonArray { paths.forEach { add(JsonPrimitive(it)) } }

+/**
+ * Uses official Dashboard `/api/git/…` reads for the active session repository.
+ * Relay remains the discovery source and owns stronger write/preview extensions.
+ * Operational upstream failures are never hidden by a Relay retry; only a 404
+ * can fall back to a matching Relay-discovered repository.
+ */
 class GitStateApiClient(
-    dashboard: DashboardApiClient,
+    private val dashboard: DashboardApiClient,
 ) {
    private val scoped = ScopedPluginApiClient("hermes-relay", dashboard)
    private val json = Json { ignoreUnknownKeys = true }
+    private val reposById = linkedMapOf<String, GitRepo>()
+    private val relayRepoIdsByRoot = linkedMapOf<String, String>()

-    suspend fun repos(): Result<List<GitRepo>> = scoped
-        .get("git/repos")
-        .mapCatching { element ->
-            json.decodeFromJsonElement<ReposResponse>(element).repos
+    suspend fun repos(
+        sessionRepoPath: String? = null,
+        includeRelayDiscovery: Boolean = true,
+    ): Result<List<GitRepo>> {
+        reposById.clear()
+        relayRepoIdsByRoot.clear()
+        val path = sessionRepoPath?.trim().orEmpty()
+        if (path.isBlank()) {
+            return if (includeRelayDiscovery) relayRepos().onSuccess(::rememberRepos)
+            else Result.success(emptyList())
        }

-    suspend fun status(repo: String): Result<GitStatus> = scoped
-        .get("git/status", mapOf("repo" to repo))
-        .mapCatching { element -> json.decodeFromJsonElement<GitStatus>(element) }
-
-    suspend fun branches(repo: String): Result<List<GitBranch>> = scoped
-        .get("git/branches", mapOf("repo" to repo))
-        .mapCatching { element ->
-            json.decodeFromJsonElement<BranchesResponse>(element).branches
+        val upstream = upstreamStatus(path)
+        if (upstream.isFailure) {
+            val error = upstream.exceptionOrNull()!!
+            if (!error.isUnsupportedGitRoute()) return Result.failure(error)
+            return if (includeRelayDiscovery) relayRepos().onSuccess(::rememberRepos)
+            else Result.failure(error)
+        }
+        val status = upstream.getOrNull()
+        if (status == null) {
+            return if (includeRelayDiscovery) relayRepos().onSuccess(::rememberRepos)
+            else Result.success(emptyList())
        }

-    suspend fun diff(repo: String, path: String, kind: String): Result<GitDiff> = scoped
-        .get("git/diff", mapOf("repo" to repo, "path" to path, "kind" to kind))
-        .mapCatching { element -> json.decodeFromJsonElement<GitDiff>(element) }
+        val standardRepo = GitRepo(
+            id = UPSTREAM_SESSION_REPO_ID,
+            name = path.replace('\\', '/').trimEnd('/').substringAfterLast('/').ifBlank { path },
+            root = path,
+            currentBranch = status.branch,
+            dirty = status.changed > 0,
+            route = GitRepositoryRoute.UPSTREAM,
+        )

-    suspend fun file(repo: String, path: String): Result<GitFile> = scoped
-        .get("git/file", mapOf("repo" to repo, "path" to path))
-        .mapCatching { element -> json.decodeFromJsonElement<GitFile>(element) }
+        // Plugin discovery is an enhancement. Once upstream answered, plugin
+        // absence or breakage cannot take the standard session repository down.
+        val relay = if (includeRelayDiscovery) relayRepos().getOrDefault(emptyList()) else emptyList()
+        val merged = buildList {
+            add(standardRepo)
+            addAll(relay.filterNot { sameRoot(it.root, standardRepo.root) })
+        }
+        rememberRepos(merged)
+        rememberRelayRepos(relay)
+        return Result.success(merged)
+    }

-    // ── Write operations ───────────────────────────────────────────────────
-    // Every write requires the plugin.api.write grant, which the app enforces
-    // (see GitStateViewModel: a POST is never sent without the grant). The
-    // server additionally enforces per-use confirmation strings for destructive
-    // ops (discard/push/dirty-checkout) — the caller passes the echoed token.
+    suspend fun status(repo: String): Result<GitStatus> {
+        val target = reposById[repo]
+        if (target?.route != GitRepositoryRoute.UPSTREAM) return relayStatus(repo)
+        return fallbackOnUnsupported(target, upstreamStatusWithFiles(target.root), ::relayStatus)
+    }
+
+    suspend fun branches(repo: String): Result<List<GitBranch>> {
+        val target = reposById[repo]
+        if (target?.route != GitRepositoryRoute.UPSTREAM) return relayBranches(repo)
+        return fallbackOnUnsupported(target, upstreamBranches(target.root), ::relayBranches)
+    }
+
+    suspend fun diff(repo: String, path: String, kind: String): Result<GitDiff> {
+        val target = reposById[repo]
+        if (target?.route != GitRepositoryRoute.UPSTREAM) return relayDiff(repo, path, kind)
+        val upstream = dashboard.getJsonElement(
+            upstreamPath(
+                "/api/git/review/diff",
+                mapOf(
+                    "path" to target.root,
+                    "file" to path,
+                    "scope" to "uncommitted",
+                    "staged" to (kind == "staged").toString(),
+                ),
+            ),
+        ).mapCatching { element ->
+            GitDiff(
+                path = path,
+                kind = kind,
+                diff = json.decodeFromJsonElement<UpstreamDiffResponse>(element).diff,
+            )
+        }
+        return fallbackOnUnsupported(target, upstream) { relay -> relayDiff(relay, path, kind) }
+    }
+
+    /** Clean tracked-file preview is a Relay enhancement; file-diff is not equivalent. */
+    suspend fun file(repo: String, path: String): Result<GitFile> {
+        val relay = relayRepoId(repo)
+            ?: return Result.failure(IOException("Tracked-file preview requires the Relay plugin"))
+        return relayFile(relay, path)
+    }
+
+    // Writes intentionally stay on Relay. The upstream Desktop mutation shape
+    // does not carry plugin.api.write or the server-enforced confirmation echoes
+    // used by this mobile surface, so it is not an equivalent safety contract.

    suspend fun stage(repo: String, paths: List<String>): Result<GitMutationResult> =
-        scoped.post("git/stage", buildJsonObject {
-            put("repo", repo)
+        relayWrite(repo) { relay -> scoped.post("git/stage", buildJsonObject {
+            put("repo", relay)
            put("paths", pathsArray(paths))
-        }).mapCatching { json.decodeFromJsonElement<GitMutationResult>(it) }
+        }).decodeMutation() }

    suspend fun unstage(repo: String, paths: List<String>): Result<GitMutationResult> =
-        scoped.post("git/unstage", buildJsonObject {
-            put("repo", repo)
+        relayWrite(repo) { relay -> scoped.post("git/unstage", buildJsonObject {
+            put("repo", relay)
            put("paths", pathsArray(paths))
-        }).mapCatching { json.decodeFromJsonElement<GitMutationResult>(it) }
+        }).decodeMutation() }

    suspend fun discard(
        repo: String,
        paths: List<String>,
        confirmation: String,
        deleteUntracked: Boolean = false,
-    ): Result<GitMutationResult> = scoped.post("git/discard", buildJsonObject {
-        put("repo", repo)
+    ): Result<GitMutationResult> = relayWrite(repo) { relay -> scoped.post("git/discard", buildJsonObject {
+        put("repo", relay)
        put("paths", pathsArray(paths))
        put("confirmation", confirmation)
        put("delete_untracked", deleteUntracked)
-    }).mapCatching { json.decodeFromJsonElement<GitMutationResult>(it) }
+    }).decodeMutation() }

    suspend fun commit(repo: String, message: String): Result<GitMutationResult> =
-        scoped.post("git/commit", buildJsonObject {
-            put("repo", repo)
+        relayWrite(repo) { relay -> scoped.post("git/commit", buildJsonObject {
+            put("repo", relay)
            put("message", message)
-        }).mapCatching { json.decodeFromJsonElement<GitMutationResult>(it) }
+        }).decodeMutation() }

    suspend fun commitSelected(
        repo: String,
        message: String,
        paths: List<String>,
-    ): Result<GitMutationResult> = scoped.post("git/commit_selected", buildJsonObject {
-        put("repo", repo)
+    ): Result<GitMutationResult> = relayWrite(repo) { relay -> scoped.post("git/commit_selected", buildJsonObject {
+        put("repo", relay)
        put("message", message)
        put("paths", pathsArray(paths))
-    }).mapCatching { json.decodeFromJsonElement<GitMutationResult>(it) }
+    }).decodeMutation() }

    suspend fun fetch(repo: String, remote: String = "origin"): Result<GitMutationResult> =
-        scoped.post("git/fetch", buildJsonObject {
-            put("repo", repo)
+        relayWrite(repo) { relay -> scoped.post("git/fetch", buildJsonObject {
+            put("repo", relay)
            put("remote", remote)
-        }).mapCatching { json.decodeFromJsonElement<GitMutationResult>(it) }
+        }).decodeMutation() }

    suspend fun pull(repo: String, remote: String = "origin", branch: String = ""): Result<GitMutationResult> =
-        scoped.post("git/pull", buildJsonObject {
-            put("repo", repo)
+        relayWrite(repo) { relay -> scoped.post("git/pull", buildJsonObject {
+            put("repo", relay)
            put("remote", remote)
            put("branch", branch)
-        }).mapCatching { json.decodeFromJsonElement<GitMutationResult>(it) }
+        }).decodeMutation() }

    suspend fun push(
        repo: String,
        confirmation: String,
        remote: String = "origin",
        branch: String = "",
-    ): Result<GitMutationResult> = scoped.post("git/push", buildJsonObject {
-        put("repo", repo)
+    ): Result<GitMutationResult> = relayWrite(repo) { relay -> scoped.post("git/push", buildJsonObject {
+        put("repo", relay)
        put("remote", remote)
        put("branch", branch)
        put("confirmation", confirmation)
-    }).mapCatching { json.decodeFromJsonElement<GitMutationResult>(it) }
+    }).decodeMutation() }

    suspend fun checkout(
        repo: String,
@@ -123,41 +194,217 @@ class GitStateApiClient(
        confirmation: String? = null,
        newBranch: String = "",
        track: Boolean = false,
-    ): Result<GitMutationResult> = scoped.post("git/checkout", buildJsonObject {
-        put("repo", repo)
+    ): Result<GitMutationResult> = relayWrite(repo) { relay -> scoped.post("git/checkout", buildJsonObject {
+        put("repo", relay)
        put("ref", ref)
        if (confirmation != null) put("confirmation", confirmation)
        if (newBranch.isNotEmpty()) put("new_branch", newBranch)
        put("track", track)
-    }).mapCatching { json.decodeFromJsonElement<GitMutationResult>(it) }
+    }).decodeMutation() }

-    // ── Phase 3 extras ─────────────────────────────────────────────────────
+    suspend fun commitMessage(repo: String): Result<GitCommitMessage> = relayWrite(repo) { relay ->
+        scoped.post("git/commit_message", buildJsonObject { put("repo", relay) })
+            .mapCatching { json.decodeFromJsonElement<GitCommitMessage>(it) }
+    }

-    /** Generate a commit-message suggestion from the staged diff. */
-    suspend fun commitMessage(repo: String): Result<GitCommitMessage> =
-        scoped.post("git/commit_message", buildJsonObject {
-            put("repo", repo)
-        }).mapCatching { json.decodeFromJsonElement<GitCommitMessage>(it) }
+    suspend fun commitMessageSelected(repo: String, paths: List<String>): Result<GitCommitMessage> =
+        relayWrite(repo) { relay -> scoped.post("git/commit_message_selected", buildJsonObject {
+            put("repo", relay)
+            put("paths", pathsArray(paths))
+        }).mapCatching { json.decodeFromJsonElement<GitCommitMessage>(it) } }

-    /** Generate a commit-message suggestion from the given paths' staged diff. */
-    suspend fun commitMessageSelected(
-        repo: String,
-        paths: List<String>,
-    ): Result<GitCommitMessage> = scoped.post("git/commit_message_selected", buildJsonObject {
-        put("repo", repo)
-        put("paths", pathsArray(paths))
-    }).mapCatching { json.decodeFromJsonElement<GitCommitMessage>(it) }
-
-    /** Checkout that auto-stashes a dirty tree first. */
    suspend fun stashCheckout(
        repo: String,
        ref: String,
        newBranch: String = "",
        track: Boolean = false,
-    ): Result<GitStashCheckoutResult> = scoped.post("git/stash_checkout", buildJsonObject {
-        put("repo", repo)
+    ): Result<GitStashCheckoutResult> = relayWrite(repo) { relay -> scoped.post("git/stash_checkout", buildJsonObject {
+        put("repo", relay)
        put("ref", ref)
        if (newBranch.isNotEmpty()) put("new_branch", newBranch)
        put("track", track)
-    }).mapCatching { json.decodeFromJsonElement<GitStashCheckoutResult>(it) }
+    }).mapCatching { json.decodeFromJsonElement<GitStashCheckoutResult>(it) } }
+
+    private suspend fun relayRepos(): Result<List<GitRepo>> = scoped.get("git/repos").mapCatching {
+        json.decodeFromJsonElement<ReposResponse>(it).repos
+    }
+
+    private suspend fun relayStatus(repo: String): Result<GitStatus> = scoped
+        .get("git/status", mapOf("repo" to repo))
+        .mapCatching { json.decodeFromJsonElement<GitStatus>(it) }
+
+    private suspend fun relayBranches(repo: String): Result<List<GitBranch>> = scoped
+        .get("git/branches", mapOf("repo" to repo))
+        .mapCatching { json.decodeFromJsonElement<BranchesResponse>(it).branches }
+
+    private suspend fun relayDiff(repo: String, path: String, kind: String): Result<GitDiff> = scoped
+        .get("git/diff", mapOf("repo" to repo, "path" to path, "kind" to kind))
+        .mapCatching { json.decodeFromJsonElement<GitDiff>(it) }
+
+    private suspend fun relayFile(repo: String, path: String): Result<GitFile> = scoped
+        .get("git/file", mapOf("repo" to repo, "path" to path))
+        .mapCatching { json.decodeFromJsonElement<GitFile>(it) }
+
+    private suspend fun upstreamStatus(path: String): Result<UpstreamStatus?> = dashboard
+        .getJsonElement(upstreamPath("/api/git/status", mapOf("path" to path)))
+        .mapCatching { json.decodeFromJsonElement<UpstreamStatus?>(it) }
+
+    private suspend fun upstreamStatusWithFiles(path: String): Result<GitStatus> {
+        val status = upstreamStatus(path).mapCatching {
+            it ?: throw IOException("The active session path is not a Git repository")
+        }.getOrElse { return Result.failure(it) }
+        val review = dashboard.getJsonElement(
+            upstreamPath("/api/git/review/list", mapOf("path" to path, "scope" to "uncommitted")),
+        ).mapCatching { json.decodeFromJsonElement<UpstreamReviewList>(it) }
+            .getOrElse { return Result.failure(it) }
+        val statusByPath = status.files.associateBy { it.path }
+        val staged = mutableListOf<GitStatusEntry>()
+        val modified = mutableListOf<GitStatusEntry>()
+        val untracked = mutableListOf<GitStatusEntry>()
+        review.files.forEach { file ->
+            val entry = GitStatusEntry(file.path, file.added, file.removed)
+            val fileStatus = statusByPath[file.path]
+            if (fileStatus?.untracked == true) {
+                untracked += entry
+            } else {
+                if (file.staged || fileStatus?.staged == true) staged += entry
+                if (fileStatus?.unstaged == true || (!file.staged && fileStatus == null)) {
+                    modified += entry
+                }
+            }
+        }
+        return Result.success(
+            GitStatus(
+                counts = GitStatusCounts(
+                    staged = status.staged,
+                    modified = status.unstaged,
+                    untracked = status.untracked,
+                    changes = status.changed,
+                    additions = status.added,
+                    deletions = status.removed,
+                ),
+                staged = staged,
+                modified = modified,
+                untracked = untracked,
+            ),
+        )
+    }
+
+    private suspend fun upstreamBranches(path: String): Result<List<GitBranch>> = dashboard
+        .getJsonElement(upstreamPath("/api/git/branches", mapOf("path" to path)))
+        .mapCatching { element ->
+            json.decodeFromJsonElement<UpstreamBranches>(element).branches.map {
+                GitBranch(name = it.name, isCurrent = it.checkedOut)
+            }
+        }
+
+    private suspend fun <T> fallbackOnUnsupported(
+        target: GitRepo,
+        upstream: Result<T>,
+        relayCall: suspend (String) -> Result<T>,
+    ): Result<T> {
+        if (upstream.isSuccess) return upstream
+        val error = upstream.exceptionOrNull()!!
+        if (!error.isUnsupportedGitRoute()) return Result.failure(error)
+        val relay = relayRepoIdsByRoot[normalizedRoot(target.root)] ?: return Result.failure(error)
+        return relayCall(relay)
+    }
+
+    private suspend fun <T> relayWrite(repo: String, block: suspend (String) -> Result<T>): Result<T> {
+        val relay = relayRepoId(repo)
+            ?: return Result.failure(IOException("This Git action requires the Relay plugin enhancement"))
+        return block(relay)
+    }
+
+    private fun relayRepoId(repo: String): String? {
+        val target = reposById[repo] ?: return repo.takeUnless { it == UPSTREAM_SESSION_REPO_ID }
+        return if (target.route == GitRepositoryRoute.RELAY) target.id
+        else relayRepoIdsByRoot[normalizedRoot(target.root)]
+    }
+
+    private fun rememberRepos(repos: List<GitRepo>) {
+        repos.forEach { reposById[it.id] = it }
+        rememberRelayRepos(repos.filter { it.route == GitRepositoryRoute.RELAY })
+    }
+
+    private fun rememberRelayRepos(repos: List<GitRepo>) {
+        repos.forEach { relayRepoIdsByRoot[normalizedRoot(it.root)] = it.id }
+    }
+
+    private fun upstreamPath(path: String, query: Map<String, String>): String = buildString {
+        append(path)
+        if (query.isNotEmpty()) {
+            append('?')
+            append(query.entries.joinToString("&") { (key, value) -> "${encode(key)}=${encode(value)}" })
+        }
+    }
+
+    private fun encode(value: String): String =
+        URLEncoder.encode(value, Charsets.UTF_8.name()).replace("+", "%20")
+
+    private fun normalizedRoot(path: String): String {
+        val normalized = path.trim().replace('\\', '/').trimEnd('/')
+        return if (WINDOWS_ROOT.containsMatchIn(normalized) || normalized.startsWith("//")) {
+            normalized.lowercase(Locale.ROOT)
+        } else {
+            normalized
+        }
+    }
+
+    private fun sameRoot(first: String, second: String): Boolean =
+        normalizedRoot(first) == normalizedRoot(second)
+
+    private fun Result<kotlinx.serialization.json.JsonObject>.decodeMutation(): Result<GitMutationResult> =
+        mapCatching { json.decodeFromJsonElement<GitMutationResult>(it) }
+
+    private fun Throwable.isUnsupportedGitRoute(): Boolean =
+        this is DashboardHttpException && statusCode == 404
+
+    private companion object {
+        const val UPSTREAM_SESSION_REPO_ID = "__upstream_session__"
+        val WINDOWS_ROOT = Regex("^[A-Za-z]:/")
+    }
 }
+
+@Serializable
+private data class UpstreamStatus(
+    val branch: String? = null,
+    val staged: Int = 0,
+    val unstaged: Int = 0,
+    val untracked: Int = 0,
+    val changed: Int = 0,
+    val added: Int = 0,
+    val removed: Int = 0,
+    val files: List<UpstreamStatusFile> = emptyList(),
+)
+
+@Serializable
+private data class UpstreamStatusFile(
+    val path: String,
+    val staged: Boolean = false,
+    val unstaged: Boolean = false,
+    val untracked: Boolean = false,
+)
+
+@Serializable
+private data class UpstreamReviewList(val files: List<UpstreamReviewFile> = emptyList())
+
+@Serializable
+private data class UpstreamReviewFile(
+    val path: String,
+    val added: Int = 0,
+    val removed: Int = 0,
+    val staged: Boolean = false,
+)
+
+@Serializable
+private data class UpstreamBranches(val branches: List<UpstreamBranch> = emptyList())
+
+@Serializable
+private data class UpstreamBranch(
+    val name: String,
+    @SerialName("checkedOut") val checkedOut: Boolean = false,
+)
+
+@Serializable
+private data class UpstreamDiffResponse(val diff: String = "")
@@ -3,7 +3,7 @@ package com.hermesandroid.relay.data
 import kotlinx.serialization.SerialName
 import kotlinx.serialization.Serializable

-/** A repository discovered by the plugin's /git/repos endpoint. */
+/** A current-session upstream repository or a Relay-discovered repository. */
@Serializable
 data class GitRepo(
    val id: String,
@@ -11,9 +11,19 @@ data class GitRepo(
    val root: String,
    @SerialName("current_branch") val currentBranch: String? = null,
    val dirty: Boolean = false,
+    val route: GitRepositoryRoute = GitRepositoryRoute.RELAY,
 )

-/** Working-tree status from /git/status. */
+@Serializable
+enum class GitRepositoryRoute {
+    @SerialName("relay")
+    RELAY,
+
+    @SerialName("upstream")
+    UPSTREAM,
+}
+
+/** Normalized working-tree status from upstream or Relay Git routes. */
@Serializable
 data class GitStatus(
    val counts: GitStatusCounts = GitStatusCounts(),
@@ -28,11 +38,17 @@ data class GitStatusCounts(
    val staged: Int = 0,
    val modified: Int = 0,
    val untracked: Int = 0,
+    /** Unique changed paths. -1 means an older plugin did not provide it. */
+    val changes: Int = -1,
+    val additions: Int = 0,
+    val deletions: Int = 0,
 )

@Serializable
 data class GitStatusEntry(
    val path: String,
+    val additions: Int? = null,
+    val deletions: Int? = null,
 )

 /** A branch from /git/branches. */
@@ -71,6 +71,8 @@ data class HermesCard(
     * actions.
     */
    val input: HermesCardInput? = null,
+    /** Local Gateway batch; never an ordinary chat-message answer protocol. */
+    val clarifyBatch: HermesCardClarifyBatch? = null,
 ) {
    object BuiltInTypes {
        const val SKILL_RESULT = "skill_result"
@@ -96,6 +98,25 @@ data class HermesCard(
    }
 }

+@Serializable
+data class HermesCardClarifyBatch(
+    val questions: List<HermesCardClarifyQuestion>,
+    val expiresAtMillis: Long? = null,
+)
+
+@Serializable
+data class HermesCardClarifyQuestion(
+    val key: String,
+    val question: String,
+    val input: HermesCardInput,
+    val answer: String? = null,
+    val submitting: Boolean = false,
+)
+
+/** Local callback identity. The RPC always uses the original qid, never this UI key. */
+fun clarifyQuestionCardKey(cardKey: String, qid: String): String =
+    Json.encodeToString(listOf(cardKey, qid))
+
 /**
 * Interactive input slot on a [HermesCard]. The flags compose rather than
 * branch — a sudo ask can be `masked + holdToConfirm` (password field whose
@@ -38,6 +38,8 @@ data class ProactiveInboxEntry(
    val connectionId: String? = null,
    /** Relay proved this row came from its bounded offline queue. */
    val arrivedWhileAway: Boolean = false,
+    /** Exact Android notification slot, when recorded by the receiving build. */
+    val notificationId: Int? = null,
 )

 private val Context.proactiveInboxStore: DataStore<Preferences> by
@@ -58,15 +60,19 @@ private const val MAX_ENTRIES = 100
 * bounded store also backs the provisional Thread until the user's first reply
 * promotes it to a real `source=phone` session.
 */
-class ProactiveInboxRepository(private val context: Context) {
+class ProactiveInboxRepository internal constructor(
+    private val store: DataStore<Preferences>,
+) {
+
+    constructor(context: Context) : this(context.proactiveInboxStore)

    private val json = Json { ignoreUnknownKeys = true }

    val entries: Flow<List<ProactiveInboxEntry>> =
-        context.proactiveInboxStore.data.map { prefs -> decode(prefs[INBOX_JSON]) }
+        store.data.map { prefs -> decode(prefs[INBOX_JSON]) }

    suspend fun add(entry: ProactiveInboxEntry) {
-        context.proactiveInboxStore.edit { prefs ->
+        store.edit { prefs ->
            val current = decode(prefs[INBOX_JSON]).toMutableList()
            current.removeAll { it.id == entry.id }
            current.add(0, entry)
@@ -76,7 +82,40 @@ class ProactiveInboxRepository(private val context: Context) {
    }

    suspend fun clear() {
-        context.proactiveInboxStore.edit { it.remove(INBOX_JSON) }
+        store.edit { it.remove(INBOX_JSON) }
+    }
+
+    /**
+     * Remove one provisional Thread owned by one saved connection.
+     *
+     * This only edits the bounded local inbox. A promoted Thread is server
+     * history and is deliberately outside this repository, so this operation
+     * can never delete it. Legacy entries without a connection owner are
+     * removed with the active row because they are rendered in that row; rows
+     * explicitly owned by another connection remain isolated.
+     */
+    suspend fun removeThread(
+        chatId: String,
+        connectionId: String,
+    ): List<ProactiveInboxEntry> {
+        val normalizedChatId = chatId.ifBlank { "phone" }
+        var removed = emptyList<ProactiveInboxEntry>()
+        store.edit { prefs ->
+            val current = decode(prefs[INBOX_JSON])
+            removed = current.filter {
+                (it.connectionId == null || it.connectionId == connectionId) &&
+                    (it.chatId ?: "phone") == normalizedChatId
+            }
+            if (removed.isNotEmpty()) {
+                val retained = current.filterNot { it in removed }
+                if (retained.isEmpty()) {
+                    prefs.remove(INBOX_JSON)
+                } else {
+                    prefs[INBOX_JSON] = json.encodeToString(retained)
+                }
+            }
+        }
+        return removed
    }

    private fun decode(raw: String?): List<ProactiveInboxEntry> {
@@ -111,6 +111,8 @@ data class Profile(
    val hasAvatar: Boolean = false,
    @SerialName("ui_meta")
    val uiMeta: JsonObject = JsonObject(emptyMap()),
+    @SerialName("display_name")
+    val displayName: String = "",
 ) {
    val hasIsolatedApi: Boolean
        get() = !apiServerUrl.isNullOrBlank()
@@ -27,7 +27,7 @@ data class ProviderUsagePreferences(
    val visibleProviders: Set<String> = DEFAULT_VISIBLE_PROVIDERS,
 ) {
    companion object {
-        val DEFAULT_VISIBLE_PROVIDERS = setOf("openai-codex", "nous", "opencode-go")
+        val DEFAULT_VISIBLE_PROVIDERS = setOf("openai-codex", "nous", "opencode-go", "supergrok")
    }
 }

@@ -11,6 +11,29 @@ data class RelayEndpoints(
    val healthUrl: String,
 )

+/** Dashboard plugin namespace used when Relay rides the Dashboard origin. */
+const val DASHBOARD_RELAY_INGRESS_PATH: String =
+    "/api/plugins/hermes-relay/transport"
+
+/**
+ * True when [raw] points at the Dashboard-mounted Relay transport rather than
+ * a directly exposed Relay listener. The distinction is authentication
+ * relevant: the outer Dashboard request keeps its cookie/bearer credential,
+ * while Relay's independently scoped session travels in
+ * `X-Hermes-Relay-Session`.
+ */
+fun isDashboardRelayIngressUrl(raw: String?): Boolean {
+    val endpoints = RelayEndpointContract.parseOrNull(raw) ?: return false
+    val path = runCatching { URI(endpoints.httpBaseUrl).rawPath.orEmpty() }
+        .getOrDefault("")
+        .trimEnd('/')
+    val marker = path.indexOf(DASHBOARD_RELAY_INGRESS_PATH)
+    if (marker < 0) return false
+    val markerEndsAt = marker + DASHBOARD_RELAY_INGRESS_PATH.length
+    val suffixBoundary = markerEndsAt == path.length || path[markerEndsAt] == '/'
+    return suffixBoundary
+}
+
 /**
 * Parses the accepted Relay URL forms and derives every route from one base.
 *
@@ -90,10 +90,10 @@ data class SessionActivityRecord(
        }
    }

-    /** Presentation projection that never labels uncertain or background activity as Working. */
+    /** Presentation projection that never labels missing optional runtime data as session state. */
    fun presentationState(nowMillis: Long = Long.MIN_VALUE): SessionActivityState? = when (freshness) {
-        SessionActivityFreshness.Revalidating -> SessionActivityState.Checking
-        SessionActivityFreshness.Unavailable -> SessionActivityState.Unavailable
+        SessionActivityFreshness.Revalidating -> null
+        SessionActivityFreshness.Unavailable -> null
        SessionActivityFreshness.Confirmed -> when (phase(nowMillis)) {
            SessionActivityPhase.Starting -> SessionActivityState.Starting
            SessionActivityPhase.Working -> SessionActivityState.Working
@@ -294,7 +294,9 @@ data class SessionActivityRegistry(

    private fun observeOwner(update: SessionActivityUpdate.ObserveOwner): SessionActivityRegistry {
        val existing = records[update.owner]
-        if (existing?.freshness == SessionActivityFreshness.Confirmed) return this
+        // Directory rows establish ownership only. They are not live evidence and must not
+        // turn an unsupported/failed active-list probe back into a permanent Checking row.
+        if (existing != null) return this
        val observed = SessionActivityRecord(
            owner = update.owner,
            turnPhase = SessionActivityPhase.Idle,
@@ -81,6 +81,24 @@ class SupervisedModeStore private constructor(
        dataStore.edit { preferences -> preferences.remove(KEY_POLICIES) }
    }

+    /** Disable every policy while preserving its configured controls and remove the parent credential atomically. */
+    internal suspend fun disableAllAndRemoveCredential(
+        parentCredentialKey: Preferences.Key<String>,
+    ) {
+        dataStore.edit { preferences ->
+            val decoded = decode(preferences[KEY_POLICIES])
+            if (decoded.corrupt || decoded.policies.isEmpty()) {
+                preferences.remove(KEY_POLICIES)
+            } else {
+                val disabled = decoded.policies.mapValues { (_, policy) ->
+                    policy.copy(enabled = false).normalized()
+                }
+                preferences[KEY_POLICIES] = json.encodeToString(serializer, disabled)
+            }
+            preferences.remove(parentCredentialKey)
+        }
+    }
+
    private fun decode(raw: String?): DecodeResult {
        if (raw.isNullOrBlank()) return DecodeResult(emptyMap(), corrupt = false)
        return try {
@@ -0,0 +1,461 @@
+package com.hermesandroid.relay.data
+
+import android.content.Context
+import android.util.Log
+import androidx.datastore.core.DataStore
+import androidx.datastore.preferences.core.Preferences
+import androidx.datastore.preferences.core.edit
+import androidx.datastore.preferences.core.stringPreferencesKey
+import java.security.MessageDigest
+import java.security.SecureRandom
+import java.util.Base64
+import javax.crypto.SecretKeyFactory
+import javax.crypto.spec.PBEKeySpec
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.flow.Flow
+import kotlinx.coroutines.flow.first
+import kotlinx.coroutines.flow.map
+import kotlinx.coroutines.sync.Mutex
+import kotlinx.coroutines.sync.withLock
+import kotlinx.coroutines.withContext
+import kotlinx.serialization.Serializable
+import kotlinx.serialization.json.Json
+
+/** Availability of the app-specific parent credential. */
+enum class SupervisedParentAuthStatus {
+    Missing,
+    Configured,
+    Corrupt,
+}
+
+/** Input method selected for the app-specific parent credential. */
+@Serializable
+enum class SupervisedParentCredentialType {
+    Legacy,
+    Pin,
+    Password,
+}
+
+@Serializable
+private enum class SupervisedRecoveryFormat {
+    LegacyCode,
+    WordPhrase,
+}
+
+/** Result of a parent-secret or recovery-phrase verification attempt. */
+sealed interface SupervisedParentAuthResult {
+    data object Success : SupervisedParentAuthResult
+    data class Invalid(val attemptsBeforeDelay: Int) : SupervisedParentAuthResult
+    data class Throttled(val retryAfterMillis: Long) : SupervisedParentAuthResult
+    data object Missing : SupervisedParentAuthResult
+    data object Corrupt : SupervisedParentAuthResult
+}
+
+/** Successful enrollment returns a recovery phrase which is shown once and never persisted. */
+data class SupervisedParentEnrollment(val recoveryPhrase: String)
+
+/** Validation result for a new parent PIN or password. */
+data class SupervisedParentSecretValidation(
+    val valid: Boolean,
+    val message: String? = null,
+)
+
+/** Narrow authentication surface consumed by Compose dialogs and test fakes. */
+interface SupervisedParentAuthenticator {
+    val credentialTypeFlow: Flow<SupervisedParentCredentialType?>
+    suspend fun enroll(
+        newSecret: CharArray,
+        credentialType: SupervisedParentCredentialType,
+    ): Result<SupervisedParentEnrollment>
+    suspend fun verify(secret: CharArray): SupervisedParentAuthResult
+    suspend fun change(
+        currentSecret: CharArray,
+        newSecret: CharArray,
+        credentialType: SupervisedParentCredentialType,
+    ): Result<SupervisedParentEnrollment>
+    suspend fun resetWithRecoveryPhrase(
+        recoveryPhrase: CharArray,
+        newSecret: CharArray,
+        credentialType: SupervisedParentCredentialType,
+    ): Result<SupervisedParentEnrollment>
+}
+
+/**
+ * App-specific parent authentication for Supervised Mode.
+ *
+ * This store deliberately does not delegate to Android's device credential: a
+ * child can legitimately own the PIN or biometrics on their Android profile.
+ * Only salted PBKDF2 verifiers and bounded failure state are stored. The parent
+ * secret and recovery phrase are never persisted.
+ */
+class SupervisedParentAuthStore private constructor(
+    private val dataStore: DataStore<Preferences>,
+    private val iterations: Int,
+    private val minimumAcceptedIterations: Int,
+    private val random: SecureRandom,
+    private val nowMillis: () -> Long,
+) : SupervisedParentAuthenticator {
+    constructor(context: Context) : this(
+        dataStore = context.applicationContext.relayDataStore,
+        iterations = DEFAULT_PBKDF2_ITERATIONS,
+        minimumAcceptedIterations = MIN_ACCEPTED_ITERATIONS,
+        random = SecureRandom(),
+        nowMillis = System::currentTimeMillis,
+    )
+
+    private val json = Json { encodeDefaults = true; ignoreUnknownKeys = false }
+    val statusFlow: Flow<SupervisedParentAuthStatus> = dataStore.data.map { preferences ->
+        decode(preferences[KEY_RECORD]).status
+    }
+    override val credentialTypeFlow: Flow<SupervisedParentCredentialType?> = dataStore.data.map { preferences ->
+        decode(preferences[KEY_RECORD]).record?.credentialType
+    }
+
+    override suspend fun enroll(
+        newSecret: CharArray,
+        credentialType: SupervisedParentCredentialType,
+    ): Result<SupervisedParentEnrollment> = processMutex.withLock {
+        val validation = validateNewSecret(newSecret, credentialType)
+        if (!validation.valid) {
+            return Result.failure(IllegalArgumentException(validation.message))
+        }
+        if (decode(dataStore.data.first()[KEY_RECORD]).status != SupervisedParentAuthStatus.Missing) {
+            return Result.failure(IllegalStateException("Parent access is already configured or unavailable."))
+        }
+        runCatching { enrollLocked(newSecret, credentialType) }
+    }
+
+    override suspend fun verify(secret: CharArray): SupervisedParentAuthResult = processMutex.withLock {
+        verifyLocked(secret, AuthTarget.ParentSecret)
+    }
+
+    override suspend fun change(
+        currentSecret: CharArray,
+        newSecret: CharArray,
+        credentialType: SupervisedParentCredentialType,
+    ): Result<SupervisedParentEnrollment> = processMutex.withLock {
+        val validation = validateNewSecret(newSecret, credentialType)
+        if (!validation.valid) {
+            return Result.failure(IllegalArgumentException(validation.message))
+        }
+        when (val verified = verifyLocked(currentSecret, AuthTarget.ParentSecret)) {
+            SupervisedParentAuthResult.Success -> runCatching { enrollLocked(newSecret, credentialType) }
+            else -> Result.failure(ParentAuthenticationException(verified))
+        }
+    }
+
+    override suspend fun resetWithRecoveryPhrase(
+        recoveryPhrase: CharArray,
+        newSecret: CharArray,
+        credentialType: SupervisedParentCredentialType,
+    ): Result<SupervisedParentEnrollment> = processMutex.withLock {
+        val validation = validateNewSecret(newSecret, credentialType)
+        if (!validation.valid) {
+            return Result.failure(IllegalArgumentException(validation.message))
+        }
+        val record = decode(dataStore.data.first()[KEY_RECORD]).record
+            ?: return Result.failure(ParentAuthenticationException(SupervisedParentAuthResult.Missing))
+        val normalizedRecovery = normalizeRecoveryPhrase(recoveryPhrase, record.recoveryFormat)
+        try {
+            when (val verified = verifyLocked(normalizedRecovery, AuthTarget.RecoveryCode)) {
+                SupervisedParentAuthResult.Success -> runCatching { enrollLocked(newSecret, credentialType) }
+                else -> Result.failure(ParentAuthenticationException(verified))
+            }
+        } finally {
+            normalizedRecovery.fill('\u0000')
+        }
+    }
+
+    /**
+     * Authenticated escape hatch used by the parent controls.
+     *
+     * The app-global credential cannot be removed while leaving any supervised
+     * policy enabled. Every policy is disabled, but its configuration is retained,
+     * in the same transaction that removes the credential.
+     */
+    suspend fun clearCredentialAndDisablePolicies(): Result<Unit> = processMutex.withLock {
+        runCatching {
+            SupervisedModeStore.forTesting(dataStore).disableAllAndRemoveCredential(KEY_RECORD)
+            Unit
+        }
+    }
+
+    private suspend fun enrollLocked(
+        secret: CharArray,
+        credentialType: SupervisedParentCredentialType,
+    ): SupervisedParentEnrollment {
+        require(credentialType != SupervisedParentCredentialType.Legacy)
+        val recoveryChars = generateRecoveryPhrase().toCharArray()
+        val parentSalt = ByteArray(SALT_BYTES).also(random::nextBytes)
+        val recoverySalt = ByteArray(SALT_BYTES).also(random::nextBytes)
+        var parentVerifier = ByteArray(0)
+        var recoveryVerifier = ByteArray(0)
+        try {
+            parentVerifier = derive(secret, parentSalt, iterations)
+            recoveryVerifier = derive(recoveryChars, recoverySalt, iterations)
+            val record = PersistedParentAuth(
+                iterations = iterations,
+                parentSalt = encode(parentSalt),
+                parentVerifier = encode(parentVerifier),
+                recoverySalt = encode(recoverySalt),
+                recoveryVerifier = encode(recoveryVerifier),
+                credentialType = credentialType,
+                recoveryFormat = SupervisedRecoveryFormat.WordPhrase,
+            )
+            dataStore.edit { it[KEY_RECORD] = json.encodeToString(record) }
+            return SupervisedParentEnrollment(recoveryChars.concatToString())
+        } finally {
+            recoveryChars.fill('\u0000')
+            parentSalt.fill(0)
+            recoverySalt.fill(0)
+            parentVerifier.fill(0)
+            recoveryVerifier.fill(0)
+        }
+    }
+
+    private suspend fun verifyLocked(
+        candidate: CharArray,
+        target: AuthTarget,
+    ): SupervisedParentAuthResult {
+        val decoded = decode(dataStore.data.first()[KEY_RECORD])
+        val record = decoded.record ?: return when (decoded.status) {
+            SupervisedParentAuthStatus.Missing -> SupervisedParentAuthResult.Missing
+            else -> SupervisedParentAuthResult.Corrupt
+        }
+        val now = nowMillis()
+        if (record.blockedUntilEpochMillis > now) {
+            return SupervisedParentAuthResult.Throttled(record.blockedUntilEpochMillis - now)
+        }
+
+        val saltText = when (target) {
+            AuthTarget.ParentSecret -> record.parentSalt
+            AuthTarget.RecoveryCode -> record.recoverySalt
+        }
+        val verifierText = when (target) {
+            AuthTarget.ParentSecret -> record.parentVerifier
+            AuthTarget.RecoveryCode -> record.recoveryVerifier
+        }
+        val salt = decodeBytes(saltText) ?: return SupervisedParentAuthResult.Corrupt
+        val expected = decodeBytes(verifierText) ?: return SupervisedParentAuthResult.Corrupt
+        val actual = try {
+            derive(candidate, salt, record.iterations)
+        } catch (error: Exception) {
+            Log.w(TAG, "Unable to derive supervised parent verifier", error)
+            return SupervisedParentAuthResult.Corrupt
+        } finally {
+            salt.fill(0)
+        }
+        val matches = try {
+            MessageDigest.isEqual(expected, actual)
+        } finally {
+            expected.fill(0)
+            actual.fill(0)
+        }
+
+        if (matches) {
+            if (record.failedAttempts != 0 || record.blockedUntilEpochMillis != 0L) {
+                save(record.copy(failedAttempts = 0, blockedUntilEpochMillis = 0L))
+            }
+            return SupervisedParentAuthResult.Success
+        }
+
+        val failures = (record.failedAttempts + 1).coerceAtMost(MAX_TRACKED_FAILURES)
+        val delayMillis = backoffMillis(failures)
+        save(
+            record.copy(
+                failedAttempts = failures,
+                blockedUntilEpochMillis = if (delayMillis == 0L) 0L else now + delayMillis,
+            ),
+        )
+        return if (delayMillis == 0L) {
+            SupervisedParentAuthResult.Invalid(
+                attemptsBeforeDelay = (FAILURES_BEFORE_BACKOFF - failures).coerceAtLeast(0),
+            )
+        } else {
+            SupervisedParentAuthResult.Throttled(delayMillis)
+        }
+    }
+
+    private suspend fun save(record: PersistedParentAuth) {
+        dataStore.edit { it[KEY_RECORD] = json.encodeToString(record) }
+    }
+
+    private suspend fun derive(secret: CharArray, salt: ByteArray, rounds: Int): ByteArray =
+        withContext(Dispatchers.Default) {
+            val spec = PBEKeySpec(secret, salt, rounds, KEY_BITS)
+            try {
+                SecretKeyFactory.getInstance(KDF_ALGORITHM).generateSecret(spec).encoded
+            } finally {
+                spec.clearPassword()
+            }
+        }
+
+    private fun decode(raw: String?): DecodedRecord {
+        if (raw.isNullOrBlank()) {
+            return DecodedRecord(SupervisedParentAuthStatus.Missing, null)
+        }
+        val record = runCatching { json.decodeFromString<PersistedParentAuth>(raw) }
+            .getOrElse {
+                Log.w(TAG, "Unable to decode supervised parent authentication; failing closed", it)
+                return DecodedRecord(SupervisedParentAuthStatus.Corrupt, null)
+            }
+        val valid = record.version == RECORD_VERSION &&
+            record.algorithm == KDF_ALGORITHM &&
+            record.iterations in minimumAcceptedIterations..MAX_ACCEPTED_ITERATIONS &&
+            decodeBytes(record.parentSalt)?.size == SALT_BYTES &&
+            decodeBytes(record.parentVerifier)?.size == KEY_BITS / 8 &&
+            decodeBytes(record.recoverySalt)?.size == SALT_BYTES &&
+            decodeBytes(record.recoveryVerifier)?.size == KEY_BITS / 8 &&
+            record.failedAttempts in 0..MAX_TRACKED_FAILURES &&
+            record.blockedUntilEpochMillis >= 0
+        return if (valid) {
+            DecodedRecord(SupervisedParentAuthStatus.Configured, record)
+        } else {
+            DecodedRecord(SupervisedParentAuthStatus.Corrupt, null)
+        }
+    }
+
+    private fun generateRecoveryPhrase(): String {
+        val available = RECOVERY_WORDS.toMutableList()
+        val selected = buildList(RECOVERY_WORD_COUNT) {
+            repeat(RECOVERY_WORD_COUNT) {
+                add(available.removeAt(random.nextInt(available.size)))
+            }
+        }
+        return selected.joinToString("-")
+    }
+
+    private fun encode(bytes: ByteArray): String = Base64.getUrlEncoder().withoutPadding().encodeToString(bytes)
+
+    private fun decodeBytes(value: String): ByteArray? =
+        runCatching { Base64.getUrlDecoder().decode(value) }.getOrNull()
+
+    private fun backoffMillis(failures: Int): Long = when (failures) {
+        in 0 until FAILURES_BEFORE_BACKOFF -> 0L
+        FAILURES_BEFORE_BACKOFF -> 30_000L
+        FAILURES_BEFORE_BACKOFF + 1 -> 60_000L
+        FAILURES_BEFORE_BACKOFF + 2 -> 120_000L
+        FAILURES_BEFORE_BACKOFF + 3 -> 300_000L
+        else -> MAX_BACKOFF_MILLIS
+    }
+
+    @Serializable
+    private data class PersistedParentAuth(
+        val version: Int = RECORD_VERSION,
+        val algorithm: String = KDF_ALGORITHM,
+        val iterations: Int,
+        val parentSalt: String,
+        val parentVerifier: String,
+        val recoverySalt: String,
+        val recoveryVerifier: String,
+        val credentialType: SupervisedParentCredentialType = SupervisedParentCredentialType.Legacy,
+        val recoveryFormat: SupervisedRecoveryFormat = SupervisedRecoveryFormat.LegacyCode,
+        val failedAttempts: Int = 0,
+        val blockedUntilEpochMillis: Long = 0L,
+    )
+
+    private data class DecodedRecord(
+        val status: SupervisedParentAuthStatus,
+        val record: PersistedParentAuth?,
+    )
+
+    private enum class AuthTarget { ParentSecret, RecoveryCode }
+
+    class ParentAuthenticationException(
+        val authResult: SupervisedParentAuthResult,
+    ) : IllegalStateException("Parent authentication failed: $authResult")
+
+    companion object {
+        private const val TAG = "SupervisedParentAuth"
+        private const val RECORD_VERSION = 1
+        private const val KDF_ALGORITHM = "PBKDF2WithHmacSHA256"
+        private const val DEFAULT_PBKDF2_ITERATIONS = 310_000
+        private const val MIN_ACCEPTED_ITERATIONS = 100_000
+        private const val MAX_ACCEPTED_ITERATIONS = 1_000_000
+        private const val SALT_BYTES = 16
+        private const val KEY_BITS = 256
+        private const val FAILURES_BEFORE_BACKOFF = 5
+        private const val MAX_TRACKED_FAILURES = 9
+        private const val MAX_BACKOFF_MILLIS = 15 * 60_000L
+        private const val RECOVERY_WORD_COUNT = 6
+        private val KEY_RECORD = stringPreferencesKey("supervised_parent_auth_v1")
+        private val processMutex = Mutex()
+
+        fun validateNewSecret(
+            secret: CharArray,
+            credentialType: SupervisedParentCredentialType,
+        ): SupervisedParentSecretValidation {
+            if (secret.size > 64) {
+                return SupervisedParentSecretValidation(false, "Use at most 64 characters.")
+            }
+            if (credentialType == SupervisedParentCredentialType.Pin) {
+                return if (secret.size == 6 && secret.all(Char::isDigit)) {
+                    SupervisedParentSecretValidation(true)
+                } else {
+                    SupervisedParentSecretValidation(false, "Use exactly 6 digits.")
+                }
+            }
+            return if (
+                credentialType == SupervisedParentCredentialType.Password &&
+                secret.size >= 8 && secret.any { !it.isWhitespace() }
+            ) {
+                SupervisedParentSecretValidation(true)
+            } else {
+                SupervisedParentSecretValidation(false, "Use a password with at least 8 characters.")
+            }
+        }
+
+        private fun normalizeRecoveryPhrase(
+            value: CharArray,
+            format: SupervisedRecoveryFormat,
+        ): CharArray = when (format) {
+            SupervisedRecoveryFormat.LegacyCode -> value
+                .filterNot { it == '-' || it.isWhitespace() }
+                .joinToString("")
+                .uppercase()
+                .toCharArray()
+            SupervisedRecoveryFormat.WordPhrase -> value.concatToString()
+                .trim()
+                .lowercase()
+                .split(Regex("[-\\s]+"))
+                .filter(String::isNotBlank)
+                .joinToString("-")
+                .toCharArray()
+        }
+
+        private val RECOVERY_WORDS = listOf(
+            "acorn", "amber", "apple", "april", "arrow", "beach", "berry", "birch",
+            "blue", "breeze", "brook", "button", "cabin", "cactus", "candle", "cedar",
+            "cherry", "cloud", "clover", "cobalt", "comet", "coral", "cotton", "cove",
+            "daisy", "dawn", "delta", "drift", "eagle", "earth", "ember", "fern",
+            "field", "finch", "forest", "frost", "garden", "ginger", "glade", "gold",
+            "grape", "green", "harbor", "hazel", "heron", "honey", "island", "ivory",
+            "jade", "juniper", "kite", "lagoon", "lake", "lantern", "lark", "leaf",
+            "lemon", "lilac", "lotus", "maple", "meadow", "mint", "moon", "morning",
+            "moss", "oasis", "ocean", "olive", "orchid", "otter", "peach", "pearl",
+            "pebble", "pine", "plum", "pond", "poppy", "quartz", "rain", "reed",
+            "river", "robin", "rose", "saffron", "sage", "sand", "shell", "silver",
+            "sky", "snow", "sparrow", "spring", "spruce", "star", "stone", "summer",
+            "sun", "sunset", "teal", "thistle", "tide", "tulip", "valley", "violet",
+            "willow", "wind", "winter", "wood", "wren", "yellow", "zephyr", "zinnia",
+            "anchor", "bamboo", "copper", "cricket", "feather", "harvest", "marble", "ribbon",
+            "rocket", "shadow", "timber", "whistle", "yarrow", "almond", "badger", "canvas",
+        )
+
+        internal fun forTesting(
+            dataStore: DataStore<Preferences>,
+            iterations: Int = MIN_ACCEPTED_ITERATIONS,
+            minimumAcceptedIterations: Int = MIN_ACCEPTED_ITERATIONS,
+            random: SecureRandom = SecureRandom(),
+            nowMillis: () -> Long = System::currentTimeMillis,
+        ): SupervisedParentAuthStore = SupervisedParentAuthStore(
+            dataStore = dataStore,
+            iterations = iterations,
+            minimumAcceptedIterations = minimumAcceptedIterations,
+            random = random,
+            nowMillis = nowMillis,
+        )
+
+        internal val recordKeyForTesting: Preferences.Key<String> = KEY_RECORD
+    }
+}
@@ -344,6 +344,46 @@ class VoicePreferencesRepository(private val dataStore: DataStore<Preferences>)
        dataStore.edit { it[key] = route.storageValue }
    }

+    /**
+     * Clear Relay-only selections after Relay has been explicitly removed from
+     * the active connection. A temporarily unreachable configured Relay must
+     * not call this: preserving the selection lets the richer route resume
+     * when connectivity returns.
+     *
+     * [expectedScope] fences profile/connection changes that can race the
+     * DataStore edit. Values are re-read inside the transaction instead of
+     * trusting an earlier settings snapshot, so a newer user choice wins.
+     * The legacy default-profile keys are global (their storage names predate
+     * connection scoping), so they are never rewritten here: runtime fallback
+     * handles an unpaired default profile without changing another
+     * connection's selection.
+     */
+    suspend fun reconcileRelayRemoval(expectedScope: VoiceProfileScope): Boolean {
+        if (_scope.value != expectedScope || expectedScope.profileName == null) return false
+        var changed = false
+        dataStore.edit { prefs ->
+            if (_scope.value != expectedScope) return@edit
+
+            val engine = VoiceEngineMode.fromStorage(
+                resolveString(prefs, KEY_ENGINE_MODE, expectedScope, DEFAULT_ENGINE_MODE),
+            )
+            val route = VoiceAudioRoute.fromStorage(
+                resolveString(prefs, KEY_AUDIO_ROUTE, expectedScope, DEFAULT_AUDIO_ROUTE),
+            )
+            if (engine == VoiceEngineMode.RealtimeAgent) {
+                prefs[stringPreferencesKey(scopedName(KEY_ENGINE_MODE, expectedScope))] =
+                    VoiceEngineMode.HermesVoiceOutput.storageValue
+                changed = true
+            }
+            if (route == VoiceAudioRoute.Relay) {
+                prefs[stringPreferencesKey(scopedName(KEY_AUDIO_ROUTE, expectedScope))] =
+                    VoiceAudioRoute.Auto.storageValue
+                changed = true
+            }
+        }
+        return changed
+    }
+
    /** "" clears the override (relay falls back to the server's saved voice). */
    suspend fun setEnhancedVoice(voice: String) {
        val key = stringPreferencesKey(scopedName(KEY_ENH_VOICE, _scope.value))
@@ -5,6 +5,7 @@ import kotlinx.coroutines.flow.StateFlow
 import kotlinx.coroutines.flow.asStateFlow
 import com.hermesandroid.relay.reliability.ReliabilityCenter
 import com.hermesandroid.relay.reliability.ReliabilityRedactor
+import java.time.Instant

 enum class DiagnosticCategory(val label: String) {
    Api("API"),
@@ -83,6 +84,8 @@ data class StatusCheck(
 object DiagnosticsLog {
    private const val MAX_ENTRIES = 200
    private const val MAX_TEXT_LENGTH = 180
+    const val SUPPORT_ENTRY_LIMIT = 80
+    private const val MAX_SUPPORT_TEXT_LENGTH = 32_000

    /** Cap for the full stacktrace kept on an error entry — a few KB is plenty. */
    private const val MAX_TRACE_LENGTH = 8000
@@ -204,6 +207,46 @@ object DiagnosticsLog {
        }
    }

+    /**
+     * Exact, bounded diagnostics section used by the review-before-sharing
+     * support export. Entries were already sanitized at record time; the final
+     * redaction pass protects legacy entries and keeps this safe to compose with
+     * persistent reliability reports.
+     */
+    fun supportText(entries: List<DiagnosticLogEntry>): String {
+        val selected = entries.takeLast(SUPPORT_ENTRY_LIMIT)
+        if (selected.isEmpty()) return ""
+        return ReliabilityRedactor.redact(
+            buildString {
+                appendLine("Recent in-app diagnostics")
+                appendLine("Diagnostics: ${selected.size}")
+                selected.forEachIndexed { index, entry ->
+                    appendLine()
+                    appendLine("===== Diagnostic ${index + 1} =====")
+                    appendLine("Time:     ${Instant.ofEpochMilli(entry.timestampMs)}")
+                    appendLine("Category: ${entry.category.label}")
+                    appendLine("Severity: ${entry.severity.name}")
+                    appendLine("Title:    ${entry.title}")
+                    entry.operation?.let { appendLine("Operation: $it") }
+                    entry.endpointRole?.let { appendLine("Route:    $it") }
+                    entry.configuredUrl?.let { appendLine("Configured URL: $it") }
+                    entry.requestUrl?.let { appendLine("Request:  $it") }
+                    if (entry.configuredUrl == null && entry.requestUrl == null) {
+                        entry.url?.let { appendLine("URL:      $it") }
+                    }
+                    entry.elapsedMs?.let { appendLine("Elapsed:  ${it}ms") }
+                    entry.detail?.let { appendLine("Detail:   $it") }
+                    entry.suggestion?.let { appendLine("Next:     $it") }
+                    entry.stacktrace?.let {
+                        appendLine("Technical detail (redacted)")
+                        appendLine(it)
+                    }
+                }
+            },
+            MAX_SUPPORT_TEXT_LENGTH,
+        )
+    }
+
    fun sanitizeUrl(value: String?): String? {
        val trimmed = value?.trim()?.takeIf { it.isNotBlank() } ?: return null
        val noQuery = trimmed.substringBefore('?').substringBefore('#')
@@ -348,7 +348,7 @@ class BridgeCommandHandler(
     * the multiplexer. The two paths are fully independent.
     *
     * Caught by Bailey's on-device test 2026-04-14 — see the v0.4.1
-     * "voice intent local dispatch loop" entry in ROADMAP.md.
+     * "voice intent local dispatch loop" entry in docs/project/ROADMAP.md.
     */
    suspend fun handleLocalCommand(envelope: Envelope): LocalDispatchResult {
        if (envelope.type != "bridge.command") {
@@ -11,6 +11,7 @@ import com.hermesandroid.relay.R
 import com.hermesandroid.relay.auth.CertPinStore
 import com.hermesandroid.relay.data.EndpointCandidate
 import com.hermesandroid.relay.data.RelayEndpointContract
+import com.hermesandroid.relay.data.isDashboardRelayIngressUrl
 import com.hermesandroid.relay.data.primaryRouteUrl
 import com.hermesandroid.relay.data.PairingPreferences
 import com.hermesandroid.relay.network.shared.pluginProxyRoutesOrNull
@@ -43,6 +44,7 @@ import okhttp3.Response
 import okhttp3.WebSocket
 import okhttp3.WebSocketListener
 import java.util.concurrent.TimeUnit
+import java.util.concurrent.atomic.AtomicLong

 enum class ConnectionState {
    Disconnected,
@@ -138,6 +140,12 @@ class ConnectionManager(
     * back to the legacy per-device PairingPreferences source below.
     */
    private val endpointCandidatesProvider: (suspend () -> List<EndpointCandidate>)? = null,
+    /**
+     * Dynamic ownership fence for Relay-only resolution. Production uses it
+     * to keep Dashboard ingress on the exact origin that owns Dashboard auth,
+     * while direct Relay and proxy routes remain independently eligible.
+     */
+    private val relayCandidateEligibility: (EndpointCandidate) -> Boolean = { true },
    /**
     * Suspending supplier for the active device id. Used to key into
     * [PairingPreferences.getDeviceEndpoints] during resolution. `null`
@@ -151,6 +159,14 @@ class ConnectionManager(
    private val proxyClientProvider: ((String) -> OkHttpClient?)? = null,
    /** Test seam for observing lifecycle teardown without opening a socket. */
    private val okHttpClientFactory: (() -> OkHttpClient)? = null,
+    /**
+     * Builds a Dashboard-authorized WebSocket request for plugin ingress.
+     * Implementations mint a fresh single-use Dashboard WS ticket on every
+     * invocation. Direct Relay listeners never call this provider.
+     */
+    private val dashboardRelayRequestProvider: (suspend (String) -> Request?)? = null,
+    /** Deterministic race seam immediately before an ingress failure may poison route state. */
+    private val beforeIngressFailureCommit: suspend () -> Unit = {},
 ) {
    private val supervisorJob = SupervisorJob()
    private val scope = CoroutineScope(supervisorJob + Dispatchers.IO)
@@ -191,6 +207,9 @@ class ConnectionManager(

    @Volatile
    private var webSocket: WebSocket? = null
+    private val socketGeneration = AtomicLong(0L)
+    @Volatile
+    private var activeSocketGeneration: Long = 0L

    @Volatile
    private var serverUrl: String? = null
@@ -273,6 +292,11 @@ class ConnectionManager(
    @Volatile
    private var networkResolveJob: kotlinx.coroutines.Job? = null

+    /** Optional API discovery is never part of Dashboard/Gateway readiness. */
+    @Volatile
+    private var apiResolveJob: Job? = null
+    private var apiResolveRevision: Long = 0L
+
    /** Deferred reaction to a network loss — cancelled if a network returns within the grace. */
    private var networkLossJob: kotlinx.coroutines.Job? = null

@@ -363,13 +387,12 @@ class ConnectionManager(
        // the synthesized list just collapses to the same URL anyway.
        scope.launch {
            val resolved = resolveBestEndpointSafe(EndpointSurface.Dashboard)
-                ?: resolveBestEndpointSafe(EndpointSurface.Standard)
-            val apiResolved = resolveBestEndpointSafe(EndpointSurface.Api)
-            val relayResolved = resolveBestEndpointSafe(EndpointSurface.Relay)
+                ?: resolveLegacyStandardFallbackSafe()
+            scheduleApiResolution()
+            val relayResolved = resolveBestRelayEndpointSafe()
            val resolvedRelayUrl = relayResolved?.relayWebSocketUrl()?.takeIf { it.isNotBlank() }
            val targetUrl = resolvedRelayUrl ?: url.takeIf { it.isNotBlank() }
            _activeRelayEndpoint.value = relayResolved
-            _activeApiEndpoint.value = apiResolved
            if (resolved != null) {
                _activeEndpoint.value = resolved
                Log.i(TAG, "connect: standard resolver picked role=${resolved.role} " +
@@ -407,6 +430,18 @@ class ConnectionManager(
        }
    }

+    /**
+     * Open the exact QR-advertised socket for a fresh pair. Relay health probes
+     * require an established Relay session, so running the normal resolver
+     * before `auth.ok` is circular and can consume the entire pairing window.
+     * Post-pair reconnects continue to use [connect] and full route resolution.
+     */
+    fun connectPairing(url: String) {
+        ensureNetworkCallbackRegistered()
+        _activeRelayEndpoint.value = null
+        connectToUrlOnMainPath(url, replaceReason = "Fresh Relay pairing")
+    }
+
    /**
     * Replace an ordinary scheduled reconnect with an immediate attempt.
     *
@@ -577,10 +612,17 @@ class ConnectionManager(
     */
    suspend fun resolveBestEndpoint(): EndpointCandidate? =
        resolveBestEndpointSafe(EndpointSurface.Dashboard)
-            ?: resolveBestEndpointSafe(EndpointSurface.Standard)
+            ?: resolveLegacyStandardFallbackSafe()
+
+    private suspend fun resolveLegacyStandardFallbackSafe(): EndpointCandidate? =
+        resolveBestEndpointSafe(EndpointSurface.Standard) { candidate ->
+            candidate.dashboard?.url.isNullOrBlank() &&
+                candidate.pluginProxyRoutesOrNull()?.dashboardBaseUrl == null
+        }

    private suspend fun resolveBestEndpointSafe(
        surface: EndpointSurface,
+        candidateFilter: (EndpointCandidate) -> Boolean = { true },
    ): EndpointCandidate? {
        val resolver = endpointResolver ?: return null
        val ctx = context ?: return null
@@ -609,13 +651,14 @@ class ConnectionManager(
            } ?: emptyList()
        }

-        if (endpoints.isEmpty()) return null
+        val eligibleEndpoints = endpoints.filter(candidateFilter)
+        if (eligibleEndpoints.isEmpty()) return null

        // Manual override: if the user pinned a role in the Endpoints card,
        // try that one first; fall through to the strict-priority algorithm
        // if it isn't reachable.
        _manualRoleOverride.value?.let { preferredRole ->
-            val preferred = endpoints.firstOrNull {
+            val preferred = eligibleEndpoints.firstOrNull {
                it.role.equals(preferredRole, ignoreCase = true)
            }
            if (preferred != null) {
@@ -627,7 +670,54 @@ class ConnectionManager(
            }
        }

-        return resolver.resolve(endpoints, surface)
+        return resolver.resolve(eligibleEndpoints, surface)
+    }
+
+    /** Every Relay selection path must apply the same live ownership fence. */
+    private suspend fun resolveBestRelayEndpointSafe(): EndpointCandidate? =
+        resolveBestEndpointSafe(
+            surface = EndpointSurface.Relay,
+            candidateFilter = relayCandidateEligibility,
+        )
+
+    /**
+     * Discover the optional API fallback without holding up the standard
+     * Dashboard/Gateway route. A single manager-level job coalesces lifecycle
+     * callers; [EndpointResolver] additionally shares an in-flight request per
+     * route/surface. The negative cache keeps ordinary profile changes cheap,
+     * while network callbacks and explicit probes still invalidate it.
+     */
+    private fun scheduleApiResolution() {
+        synchronized(this) {
+            apiResolveRevision += 1L
+            if (apiResolveJob?.isActive != true) {
+                startApiResolutionLocked(apiResolveRevision)
+            }
+        }
+    }
+
+    /** Caller must hold this manager's monitor. */
+    private fun startApiResolutionLocked(revision: Long) {
+        apiResolveJob = scope.launch {
+            try {
+                val resolved = resolveBestEndpointSafe(EndpointSurface.Api)
+                synchronized(this@ConnectionManager) {
+                    // A route/connection refresh may have arrived while this
+                    // optional probe was waiting. Never publish its stale
+                    // winner over the newer connection's API ownership.
+                    if (revision == apiResolveRevision) {
+                        _activeApiEndpoint.value = resolved
+                    }
+                }
+            } finally {
+                synchronized(this@ConnectionManager) {
+                    apiResolveJob = null
+                    if (revision != apiResolveRevision && supervisorJob.isActive) {
+                        startApiResolutionLocked(apiResolveRevision)
+                    }
+                }
+            }
+        }
    }

    /**
@@ -656,9 +746,9 @@ class ConnectionManager(
        endpointResolver?.clearCache()
        val current = serverUrl
        val resolved = resolveBestEndpointSafe(EndpointSurface.Dashboard)
-            ?: resolveBestEndpointSafe(EndpointSurface.Standard)
-        val apiResolved = resolveBestEndpointSafe(EndpointSurface.Api)
-        val relayResolved = resolveBestEndpointSafe(EndpointSurface.Relay)
+            ?: resolveLegacyStandardFallbackSafe()
+        scheduleApiResolution()
+        val relayResolved = resolveBestRelayEndpointSafe()
        if (resolved == null && _connectionState.value == ConnectionState.Connected) {
            // Transient probe miss while the relay socket is demonstrably up
            // — keep the live route published rather than downgrading every
@@ -666,7 +756,6 @@ class ConnectionManager(
            return _activeEndpoint.value
        }
        _activeEndpoint.value = resolved
-        _activeApiEndpoint.value = apiResolved
        if (relayResolved != null) _activeRelayEndpoint.value = relayResolved
        val targetUrl = relayResolved?.relayWebSocketUrl() ?: current ?: return resolved
        val normalizedTarget = normalizeRelayUrl(targetUrl)
@@ -706,8 +795,8 @@ class ConnectionManager(
    suspend fun refreshActiveEndpoint(clearProbeCache: Boolean = false): EndpointCandidate? {
        if (clearProbeCache) endpointResolver?.clearCache()
        val resolved = resolveBestEndpointSafe(EndpointSurface.Dashboard)
-            ?: resolveBestEndpointSafe(EndpointSurface.Standard)
-        val apiResolved = resolveBestEndpointSafe(EndpointSurface.Api)
+            ?: resolveLegacyStandardFallbackSafe()
+        scheduleApiResolution()
        if (resolved == null && _connectionState.value == ConnectionState.Connected) {
            // Transient probe miss while the relay socket is demonstrably up
            // (slow resume, mid-handoff blip) — keep publishing the live
@@ -716,7 +805,6 @@ class ConnectionManager(
            return _activeEndpoint.value
        }
        _activeEndpoint.value = resolved
-        _activeApiEndpoint.value = apiResolved
        return resolved
    }

@@ -738,6 +826,46 @@ class ConnectionManager(
        Log.i(TAG, "marked endpoint role=${active.role} unreachable ($reason)")
    }

+    /** Admission is stronger evidence than `/transport/health`: reject this ingress and retain direct fallback. */
+    private suspend fun fallbackFromBrokenDashboardIngress(
+        url: String,
+        reason: String,
+        failingSocket: WebSocket? = null,
+        failingGeneration: Long? = null,
+    ): Boolean {
+        if (!isDashboardRelayIngressUrl(url)) return false
+        if (failingGeneration != null) {
+            beforeIngressFailureCommit()
+            if (activeSocketGeneration != failingGeneration || webSocket !== failingSocket) {
+                Log.i(TAG, "Ignoring stale Dashboard ingress failure ($reason)")
+                return false
+            }
+        }
+        val failed = _activeRelayEndpoint.value ?: return false
+        val failedUrl = failed.relayWebSocketUrl()?.let(::normalizeRelayUrl)
+        if (failedUrl != normalizeRelayUrl(url)) return false
+        endpointResolver?.markUnreachable(failed, EndpointSurface.Relay) ?: return false
+        val replacement = resolveBestRelayEndpointSafe() ?: return false
+        val replacementUrl = replacement.relayWebSocketUrl()?.takeIf(String::isNotBlank) ?: return false
+        if (normalizeRelayUrl(replacementUrl) == normalizeRelayUrl(url)) return false
+        _activeRelayEndpoint.value = replacement
+        Log.i(TAG, "Dashboard Relay ingress rejected; switching to ${replacement.role} ($reason)")
+        DiagnosticsLog.record(
+            category = DiagnosticCategory.Relay,
+            severity = DiagnosticSeverity.Warning,
+            title = "Relay ingress unavailable",
+            detail = "Dashboard admission failed; using retained direct Relay route.",
+            operation = "Select Relay transport after admission failure",
+            endpointRole = failed.role,
+            requestUrl = url,
+        )
+        connectToUrlOnMainPath(
+            replacementUrl,
+            replaceReason = "Dashboard Relay ingress admission failed",
+        )
+        return true
+    }
+
    /**
     * Debounced network-change re-resolution, shared by both NetworkCallback
     * events. Re-runs the resolver and publishes the winner to
@@ -760,8 +888,8 @@ class ConnectionManager(
            if (wipeCache) endpointResolver.clearCache()
            val current = serverUrl
            val resolved = resolveBestEndpointSafe(EndpointSurface.Dashboard)
-                ?: resolveBestEndpointSafe(EndpointSurface.Standard)
-            val apiResolved = resolveBestEndpointSafe(EndpointSurface.Api)
+                ?: resolveLegacyStandardFallbackSafe()
+            scheduleApiResolution()
            if (resolved == null) {
                // Hysteresis for the AUTOMATIC (network-callback) path. A
                // transient cold-route probe miss must NOT null the published
@@ -798,7 +926,6 @@ class ConnectionManager(
            }
            sustainedLossDeclared = false
            _activeEndpoint.value = resolved
-            _activeApiEndpoint.value = apiResolved
            if (current == null) return@launch
            // After an explicit disconnect() the route still publishes above
            // (HTTP surfaces keep roaming), but no socket action: without
@@ -807,7 +934,7 @@ class ConnectionManager(
            // (connectToUrlOnMainPath force-sets shouldReconnect = true, so
            // the swap path never re-checked it.)
            if (!shouldReconnect) return@launch
-            val relayResolved = resolveBestEndpointSafe(EndpointSurface.Relay)
+            val relayResolved = resolveBestRelayEndpointSafe()
            if (relayResolved != null) _activeRelayEndpoint.value = relayResolved
            val relayUrl = relayResolved?.relayWebSocketUrl()?.takeIf { it.isNotBlank() }
                ?: return@launch
@@ -974,7 +1101,8 @@ class ConnectionManager(
        webSocket?.send(text)
    }

-    private fun isActiveSocket(socket: WebSocket): Boolean = webSocket === socket
+    private fun isActiveSocket(socket: WebSocket, generation: Long): Boolean =
+        webSocket === socket && activeSocketGeneration == generation

    private fun doConnect(
        url: String,
@@ -1010,7 +1138,7 @@ class ConnectionManager(
        scope.launch { doConnectInternal(url, previousSocketToClose, replaceReason) }
    }

-    private fun doConnectInternal(
+    private suspend fun doConnectInternal(
        url: String,
        previousSocketToClose: WebSocket? = null,
        replaceReason: String = "Relay socket replaced",
@@ -1035,22 +1163,49 @@ class ConnectionManager(
            buildClient(url)
        }

-        val request = buildRelayRequestOrNull(url)
+        val request = if (isDashboardRelayIngressUrl(url)) {
+            dashboardRelayRequestProvider?.invoke(url)
+        } else {
+            buildRelayRequestOrNull(url)
+        }
        if (request == null) {
            // A malformed relay URL (an invalid/empty host from a corrupt or
            // hand-edited pairing payload) can't be built into a request. This
            // runs on a background coroutine, so letting OkHttp's url() throw
            // would crash the app — the #131 "Invalid URL host" class, relay-
            // socket half. Route it through the same path onFailure uses.
-            Log.e(TAG, "doConnect: malformed relay URL '$url' — not connecting")
+            Log.e(
+                TAG,
+                if (isDashboardRelayIngressUrl(url)) {
+                    "doConnect: Dashboard Relay ticket/request unavailable for '$url'"
+                } else {
+                    "doConnect: malformed relay URL '$url' — not connecting"
+                },
+            )
            DiagnosticsLog.record(
                category = DiagnosticCategory.Relay,
                severity = DiagnosticSeverity.Error,
-                title = "Invalid relay URL",
-                detail = "The relay address could not be parsed; re-pair to refresh it.",
-                operation = "Build Relay WebSocket request",
+                title = if (isDashboardRelayIngressUrl(url)) {
+                    "Dashboard Relay authorization unavailable"
+                } else {
+                    "Invalid relay URL"
+                },
+                detail = if (isDashboardRelayIngressUrl(url)) {
+                    "Dashboard authorization could not prepare the Relay WebSocket request."
+                } else {
+                    "The relay address could not be parsed; re-pair to refresh it."
+                },
+                operation = if (isDashboardRelayIngressUrl(url)) {
+                    "Mint Dashboard Relay WebSocket ticket"
+                } else {
+                    "Build Relay WebSocket request"
+                },
                configuredUrl = url,
-                suggestion = "Edit or re-pair the Relay route to replace the invalid address.",
+                suggestion = if (isDashboardRelayIngressUrl(url)) {
+                    "Sign in to the matching Dashboard route, then recheck Relay routes."
+                } else {
+                    "Edit or re-pair the Relay route to replace the invalid address."
+                },
            )
            authenticated = false
            _connectionState.value = ConnectionState.Disconnected
@@ -1058,14 +1213,18 @@ class ConnectionManager(
                runCatching { stale.close(1000, replaceReason) }
                stale.cancel()
            }
-            scheduleReconnect()
+            if (!fallbackFromBrokenDashboardIngress(url, "request provider or ticket unavailable")) {
+                scheduleReconnect()
+            }
            return
        }

        Log.i(TAG, "doConnect: opening WSS to $url")
+        val generation = socketGeneration.incrementAndGet()
+        activeSocketGeneration = generation
        val newSocket = client.newWebSocket(request, object : WebSocketListener() {
            override fun onOpen(webSocket: WebSocket, response: Response) {
-                if (!isActiveSocket(webSocket)) {
+                if (!isActiveSocket(webSocket, generation)) {
                    Log.i(TAG, "onOpen: stale WSS handshake ignored ($url)")
                    runCatching { webSocket.close(1000, "Stale relay socket") }
                    webSocket.cancel()
@@ -1108,7 +1267,7 @@ class ConnectionManager(
            }

            override fun onMessage(webSocket: WebSocket, text: String) {
-                if (!isActiveSocket(webSocket)) {
+                if (!isActiveSocket(webSocket, generation)) {
                    Log.i(TAG, "onMessage: stale WSS envelope ignored ($url)")
                    return
                }
@@ -1135,7 +1294,7 @@ class ConnectionManager(
            }

            override fun onClosed(webSocket: WebSocket, code: Int, reason: String) {
-                if (!isActiveSocket(webSocket)) {
+                if (!isActiveSocket(webSocket, generation)) {
                    Log.i(TAG, "onClosed: stale WSS close ignored ($url code=$code reason=$reason)")
                    return
                }
@@ -1149,13 +1308,28 @@ class ConnectionManager(
                    requestUrl = url,
                    suggestion = if (code == 1000) null else "Check the Relay server logs for the matching close code and reason.",
                )
+                val admitted = authenticated
                authenticated = false
                _connectionState.value = ConnectionState.Disconnected
-                scheduleReconnect()
+                if (isDashboardRelayIngressUrl(url) && !admitted && code != 1000) {
+                    scope.launch {
+                        if (!fallbackFromBrokenDashboardIngress(
+                                url,
+                                "pre-auth close $code",
+                                webSocket,
+                                generation,
+                            ) && activeSocketGeneration == generation
+                        ) {
+                            scheduleReconnect()
+                        }
+                    }
+                } else {
+                    scheduleReconnect()
+                }
            }

            override fun onFailure(webSocket: WebSocket, t: Throwable, response: Response?) {
-                if (!isActiveSocket(webSocket)) {
+                if (!isActiveSocket(webSocket, generation)) {
                    Log.i(TAG, "onFailure: stale WSS failure ignored ($url ${t.javaClass.simpleName}: ${t.message})")
                    return
                }
@@ -1177,6 +1351,22 @@ class ConnectionManager(
                    } ?: NetworkDiagnosticGuidance.forThrowable(t, "Relay"),
                )
                lastUpgradeResponseCode = code
+                if (isDashboardRelayIngressUrl(url) && response != null) {
+                    authenticated = false
+                    _connectionState.value = ConnectionState.Disconnected
+                    scope.launch {
+                        if (!fallbackFromBrokenDashboardIngress(
+                                url,
+                                "HTTP admission ${response.code}",
+                                webSocket,
+                                generation,
+                            ) && activeSocketGeneration == generation
+                        ) {
+                            scheduleReconnect()
+                        }
+                    }
+                    return
+                }
                if (response == null) {
                    // Transport-level failure (no HTTP upgrade response): on a
                    // remote (Tailscale) link the first handshake can fail cold.
@@ -1290,7 +1480,7 @@ class ConnectionManager(
            // expires, auth state may have changed (e.g., user hit Revoke
            // during the retry window).
            if (shouldReconnect && reconnectGate()) {
-                val resolved = resolveBestEndpointSafe(EndpointSurface.Relay)
+                val resolved = resolveBestRelayEndpointSafe()
                val targetUrl = resolved?.relayWebSocketUrl()
                if (resolved != null) {
                    // Mirror scheduleNetworkReResolve: clear the sustained-loss
@@ -102,22 +102,18 @@ class ProactiveMessageHandler(
    /** Route a parsed message: into the open Thread if it belongs there, else
     *  the durable inbox log + the surface its hint selects. */
    private fun dispatch(msg: ProactiveMessage) {
-        // Persist first even when the currently open Thread consumes the live
-        // message. Agent-initiated outbound sends do not create a gateway
-        // session until the phone replies, so this cache is the provisional
-        // Thread transcript during that gap.
-        toInbox?.invoke(msg)
        // The surfacing hint selects the additional surface. Thread injection
        // is best-effort presentation of the persisted row, not itself a reason
        // to suppress an explicitly requested notification.
-        when (msg.surfacing?.lowercase()) {
+        val notificationId = when (msg.surfacing?.lowercase()) {
            "inbox" -> {
                injectIntoThread?.invoke(msg)
+                null
            }
            "session" -> {
                val delivered = injectIntoThread?.invoke(msg) == true ||
                    toSession?.invoke(msg) == true
-                if (!delivered) notify(msg)
+                if (delivered) null else notify(msg)
            }
            // null / "default" / "notification" / anything unrecognized.
            else -> {
@@ -125,17 +121,20 @@ class ProactiveMessageHandler(
                notify(msg)
            }
        }
+        // Every message remains in the bounded local cache. Persist the exact
+        // posted notification slot as part of that row so a later local Thread
+        // removal can cancel only its own notification.
+        toInbox?.invoke(msg.copy(notificationId = notificationId))
    }

-    private fun notify(msg: ProactiveMessage) {
+    private fun notify(msg: ProactiveMessage): Int? =
        ProactiveMessageNotifier.notify(
            context = context,
            title = msg.title,
-            text = msg.text,
+            text = mediaFreeProactivePreview(msg.text),
            messageId = msg.messageId,
            chatId = msg.chatId,
        )
-    }

    private fun parse(payload: JsonObject): ProactiveMessage? {
        val text = payload["text"]?.jsonPrimitive?.contentOrNull
@@ -157,6 +156,30 @@ class ProactiveMessageHandler(
    }
 }

+/** Notification text is a preview; the Thread owns attachment rendering. */
+internal fun mediaFreeProactivePreview(text: String): String {
+    var fence: String? = null
+    val lines = mutableListOf<String>()
+    for (line in text.lines()) {
+        val trimmed = line.trim()
+        val delimiter = when {
+            trimmed.startsWith("```") -> "```"
+            trimmed.startsWith("~~~") -> "~~~"
+            else -> null
+        }
+        if (delimiter != null) {
+            fence = if (fence == delimiter) null else if (fence == null) delimiter else fence
+        }
+        val markerOnly = fence == null && (
+            trimmed.startsWith("MEDIA:hermes-relay://") ||
+                trimmed.startsWith("MEDIA:/") ||
+                Regex("^MEDIA:[A-Za-z]:\\\\").containsMatchIn(trimmed)
+            )
+        if (!markerOnly && trimmed.isNotEmpty()) lines += trimmed
+    }
+    return lines.joinToString(" ").ifBlank { "Attachment" }
+}
+
 /**
 * A parsed agent-initiated message. `surfacing` is the optional route hint
 * (null = app default); Phase 2 keys inbox/session delivery off it.
@@ -172,4 +195,6 @@ data class ProactiveMessage(
    val replyTo: String? = null,
    /** True only when Relay explicitly marked this as a reconnect queue flush. */
    val arrivedWhileAway: Boolean = false,
+    /** Exact Android notification slot when this delivery posted one. */
+    val notificationId: Int? = null,
 )
@@ -5,6 +5,7 @@ import android.util.Log
 import com.hermesandroid.relay.R
 import com.hermesandroid.relay.auth.PairedDeviceInfo
 import com.hermesandroid.relay.data.RelayEndpointContract
+import com.hermesandroid.relay.data.isDashboardRelayIngressUrl
 import com.hermesandroid.relay.diagnostics.DiagnosticCategory
 import com.hermesandroid.relay.diagnostics.DiagnosticSeverity
 import com.hermesandroid.relay.diagnostics.DiagnosticsLog
@@ -27,6 +28,19 @@ import okhttp3.OkHttpClient
 import okhttp3.Request
 import okhttp3.RequestBody.Companion.toRequestBody
 import java.io.IOException
+import java.io.ByteArrayOutputStream
+
+internal const val RELAY_SESSION_HEADER: String = "X-Hermes-Relay-Session"
+
+/** Keep Dashboard outer auth and Relay capability auth in separate headers. */
+internal fun Request.Builder.relaySessionCredential(
+    token: String,
+    dashboardIngress: Boolean,
+): Request.Builder = if (dashboardIngress) {
+    header(RELAY_SESSION_HEADER, token)
+} else {
+    header("Authorization", "Bearer $token")
+}

 /**
 * HTTP client for the Hermes relay media endpoint.
@@ -59,13 +73,32 @@ class RelayHttpClient(
    /** Application context for localized string resources. Nullable for
     *  backwards-compat with call sites that don't need localization. */
    private val context: Context? = null,
+    /** Dashboard-authenticated client for same-origin plugin ingress calls. */
+    private val dashboardHttpClientProvider: ((String) -> OkHttpClient?)? = null,
+    /**
+     * Pinned-TLS client for Hermes Secure Link (`plugin_proxy`) relay URLs.
+     * Without this, HTTPS probes against the self-signed Secure Link cert fail
+     * with "Trust anchor for certification path not found" while the WSS path
+     * (which already uses buildPluginProxyClient) stays healthy — the UI then
+     * reports dashboard/relay surfaces offline despite an Active connection.
+     */
+    private val pluginProxyHttpClientProvider: ((String) -> OkHttpClient?)? = null,
 ) {

    private fun relayHttpBaseOrNull(url: String): String? =
        RelayEndpointContract.parseOrNull(url)?.httpBaseUrl

+    private fun callClient(relayUrl: String): OkHttpClient =
+        when {
+            isDashboardRelayIngressUrl(relayUrl) ->
+                dashboardHttpClientProvider?.invoke(relayUrl) ?: okHttpClient
+            else ->
+                pluginProxyHttpClientProvider?.invoke(relayUrl) ?: okHttpClient
+        }
+
    companion object {
        private const val TAG = "RelayHttpClient"
+        private const val DEFAULT_MEDIA_DOWNLOAD_LIMIT_BYTES = 100L * 1024L * 1024L
        const val MAX_MODEL_CAPABILITY_ROWS = 64
        private const val MAX_MODEL_CAPABILITY_PROVIDER_CHARS = 128
        private const val MAX_MODEL_CAPABILITY_MODEL_CHARS = 512
@@ -199,10 +232,10 @@ class RelayHttpClient(
        val request = Request.Builder()
            .url(url)
            .get()
-            .header("Authorization", "Bearer $sessionToken")
+            .relaySessionCredential(sessionToken, isDashboardRelayIngressUrl(relayUrl))
            .header("Accept", "application/json")
            .build()
-        val activityClient = okHttpClient.newBuilder()
+        val activityClient = callClient(relayUrl).newBuilder()
            .callTimeout(3, java.util.concurrent.TimeUnit.SECONDS)
            .build()

@@ -235,7 +268,10 @@ class RelayHttpClient(
     * underlying exception with a human-readable message suitable for
     * surfacing in the attachment's `errorMessage` field.
     */
-    suspend fun fetchMedia(token: String): Result<FetchedMedia> = withContext(Dispatchers.IO) {
+    suspend fun fetchMedia(
+        token: String,
+        maxBytes: Long = DEFAULT_MEDIA_DOWNLOAD_LIMIT_BYTES,
+    ): Result<FetchedMedia> = withContext(Dispatchers.IO) {
        val relayUrl = relayUrlProvider()?.trim().orEmpty()
        if (relayUrl.isEmpty()) {
            return@withContext Result.failure(
@@ -261,12 +297,12 @@ class RelayHttpClient(
        val request = Request.Builder()
            .url(url)
            .get()
-            .header("Authorization", "Bearer $sessionToken")
+            .relaySessionCredential(sessionToken, isDashboardRelayIngressUrl(relayUrl))
            .header("Accept", "*/*")
            .build()

        try {
-            okHttpClient.newCall(request).execute().use { response ->
+            callClient(relayUrl).newCall(request).execute().use { response ->
                if (!response.isSuccessful) {
                    val reason = when (response.code) {
                        401, 403 -> "Unauthorized — re-pair with the relay"
@@ -296,15 +332,15 @@ class RelayHttpClient(
                if (body == null) {
                    return@withContext Result.failure(IOException("Empty response body"))
                }
-                val bytes = body.bytes()
+                val bytes = body.readBytesBounded(maxBytes)
                Result.success(FetchedMedia(contentType, bytes, fileName, sensitive))
            }
        } catch (e: IOException) {
-            Log.w(TAG, "fetchMedia failed: ${e.message}")
-            Result.failure(e)
+            Log.w(TAG, "fetchMedia failed")
+            Result.failure(if (e is RelayMediaLimitException) e else IOException("Relay media request failed"))
        } catch (e: Exception) {
-            Log.w(TAG, "fetchMedia unexpected error: ${e.message}")
-            Result.failure(e)
+            Log.w(TAG, "fetchMedia unexpected error")
+            Result.failure(IOException("Relay media request failed"))
        }
    }

@@ -330,6 +366,7 @@ class RelayHttpClient(
    suspend fun fetchMediaByPath(
        path: String,
        contentTypeHint: String? = null,
+        maxBytes: Long = DEFAULT_MEDIA_DOWNLOAD_LIMIT_BYTES,
    ): Result<FetchedMedia> = withContext(Dispatchers.IO) {
        val relayUrl = relayUrlProvider()?.trim().orEmpty()
        if (relayUrl.isEmpty()) {
@@ -369,17 +406,17 @@ class RelayHttpClient(
        val request = Request.Builder()
            .url(url)
            .get()
-            .header("Authorization", "Bearer $sessionToken")
+            .relaySessionCredential(sessionToken, isDashboardRelayIngressUrl(relayUrl))
            .header("Accept", "*/*")
            .build()

        try {
-            okHttpClient.newCall(request).execute().use { response ->
+            callClient(relayUrl).newCall(request).execute().use { response ->
                if (!response.isSuccessful) {
                    val reason = when (response.code) {
                        401 -> "Unauthorized — re-pair with the relay"
                        403 -> "Path not allowed by relay sandbox"
-                        404 -> "File not found on relay: $path"
+                        404 -> "File not found on relay"
                        400 -> "Bad request — missing path"
                        in 500..599 -> "Relay error (HTTP ${response.code})"
                        else -> "HTTP ${response.code}: ${response.message.ifBlank { "request failed" }}"
@@ -405,15 +442,19 @@ class RelayHttpClient(
                if (body == null) {
                    return@withContext Result.failure(IOException("Empty response body"))
                }
-                val bytes = body.bytes()
+                val bytes = body.readBytesBounded(maxBytes)
                Result.success(FetchedMedia(contentType, bytes, fileName, sensitive))
            }
        } catch (e: IOException) {
-            Log.w(TAG, "fetchMediaByPath failed for $path: ${e.message}")
-            Result.failure(IOException("Relay unreachable: ${e.message ?: "IO error"}"))
+            Log.w(TAG, "fetchMediaByPath failed")
+            if (e is RelayMediaLimitException) {
+                Result.failure(e)
+            } else {
+                Result.failure(IOException("Relay media request failed"))
+            }
        } catch (e: Exception) {
-            Log.w(TAG, "fetchMediaByPath unexpected error for $path: ${e.message}")
-            Result.failure(e)
+            Log.w(TAG, "fetchMediaByPath unexpected error")
+            Result.failure(IOException("Relay media request failed"))
        }
    }

@@ -456,12 +497,12 @@ class RelayHttpClient(
            val request = Request.Builder()
                .url(url)
                .get()
-                .header("Authorization", "Bearer $sessionToken")
+                .relaySessionCredential(sessionToken, isDashboardRelayIngressUrl(relayUrl))
                .header("Accept", "image/*")
                .build()

            try {
-                okHttpClient.newCall(request).execute().use { response ->
+                callClient(relayUrl).newCall(request).execute().use { response ->
                    if (!response.isSuccessful) {
                        val errorCode = runCatching {
                            sessionsJson.parseToJsonElement(response.body.string())
@@ -554,11 +595,11 @@ class RelayHttpClient(
        val request = Request.Builder()
            .url(url)
            .get()
-            .header("Authorization", "Bearer $sessionToken")
+            .relaySessionCredential(sessionToken, isDashboardRelayIngressUrl(relayUrl))
            .header("Accept", "application/json")
            .build()

-        val auditClient = okHttpClient.newBuilder()
+        val auditClient = callClient(relayUrl).newBuilder()
            .callTimeout(3, java.util.concurrent.TimeUnit.SECONDS)
            .build()

@@ -640,10 +681,10 @@ class RelayHttpClient(
        val request = Request.Builder()
            .url(url)
            .get()
-            .header("Authorization", "Bearer $sessionToken")
+            .relaySessionCredential(sessionToken, isDashboardRelayIngressUrl(relayUrl))
            .header("Accept", "application/json")
            .build()
-        val client = okHttpClient.newBuilder()
+        val client = callClient(relayUrl).newBuilder()
            .callTimeout(3, java.util.concurrent.TimeUnit.SECONDS)
            .build()
        try {
@@ -753,10 +794,10 @@ class RelayHttpClient(
            return@withContext Result.failure(IOException("Invalid relay URL: ${e.message}"))
        }
        val request = Request.Builder().url(url).get()
-            .header("Authorization", "Bearer $token")
+            .relaySessionCredential(token, isDashboardRelayIngressUrl(relayUrl))
            .header("Accept", "application/json").build()
        try {
-            okHttpClient.newBuilder().callTimeout(4, java.util.concurrent.TimeUnit.SECONDS).build()
+            callClient(relayUrl).newBuilder().callTimeout(4, java.util.concurrent.TimeUnit.SECONDS).build()
                .newCall(request).execute().use { response ->
                    if (response.code == 404) return@withContext Result.success(null)
                    if (!response.isSuccessful) return@withContext Result.failure(IOException("HTTP ${response.code}"))
@@ -807,11 +848,11 @@ class RelayHttpClient(
        val request = Request.Builder()
            .url(url)
            .post(sessionsJson.encodeToString(payload).toRequestBody("application/json".toMediaType()))
-            .header("Authorization", "Bearer $token")
+            .relaySessionCredential(token, isDashboardRelayIngressUrl(relayUrl))
            .header("Accept", "application/json")
            .build()
        try {
-            okHttpClient.newBuilder().callTimeout(4, java.util.concurrent.TimeUnit.SECONDS).build()
+            callClient(relayUrl).newBuilder().callTimeout(4, java.util.concurrent.TimeUnit.SECONDS).build()
                .newCall(request).execute().use { response ->
                    if (response.code == 404) return@withContext Result.success(null)
                    if (!response.isSuccessful) return@withContext Result.failure(IOException("HTTP ${response.code}"))
@@ -857,12 +898,12 @@ class RelayHttpClient(
        val request = Request.Builder()
            .url(url)
            .get()
-            .header("Authorization", "Bearer $sessionToken")
+            .relaySessionCredential(sessionToken, isDashboardRelayIngressUrl(relayUrl))
            .header("Accept", "application/json")
            .build()
        // Slightly longer than the other reads — a cache-miss on the relay does a
        // GitHub round-trip in an executor before responding.
-        val client = okHttpClient.newBuilder()
+        val client = callClient(relayUrl).newBuilder()
            .callTimeout(8, java.util.concurrent.TimeUnit.SECONDS)
            .build()
        try {
@@ -941,12 +982,12 @@ class RelayHttpClient(
        val request = Request.Builder()
            .url(url)
            .get()
-            .header("Authorization", "Bearer $sessionToken")
+            .relaySessionCredential(sessionToken, isDashboardRelayIngressUrl(relayUrl))
            .header("Accept", "application/json")
            .build()

        try {
-            okHttpClient.newCall(request).execute().use { response ->
+            callClient(relayUrl).newCall(request).execute().use { response ->
                if (response.code == 404) {
                    // Server hasn't shipped the endpoint yet — degrade to
                    // empty list so the UI can render "No paired devices"
@@ -1028,12 +1069,12 @@ class RelayHttpClient(
        val request = Request.Builder()
            .url(url)
            .delete()
-            .header("Authorization", "Bearer $sessionToken")
+            .relaySessionCredential(sessionToken, isDashboardRelayIngressUrl(relayUrl))
            .header("Accept", "application/json")
            .build()

        try {
-            okHttpClient.newCall(request).execute().use { response ->
+            callClient(relayUrl).newCall(request).execute().use { response ->
                if (response.code == 404) {
                    // Already gone — treat as success so the UI can just
                    // drop the row on the next refresh.
@@ -1145,12 +1186,12 @@ class RelayHttpClient(
        val request = Request.Builder()
            .url(url)
            .patch(bodyJson.toRequestBody("application/json".toMediaType()))
-            .header("Authorization", "Bearer $sessionToken")
+            .relaySessionCredential(sessionToken, isDashboardRelayIngressUrl(relayUrl))
            .header("Accept", "application/json")
            .build()

        try {
-            okHttpClient.newCall(request).execute().use { response ->
+            callClient(relayUrl).newCall(request).execute().use { response ->
                if (!response.isSuccessful) {
                    val reason = when (response.code) {
                        400 -> "Invalid extend request (check TTL/grants)"
@@ -1242,7 +1283,7 @@ class RelayHttpClient(

        // Fast-timeout client — we don't want Save & Test to hang the UI
        // for 10 seconds on a dead URL.
-        val fastClient = okHttpClient.newBuilder()
+        val fastClient = callClient(relayUrl).newBuilder()
            .connectTimeout(3, java.util.concurrent.TimeUnit.SECONDS)
            .readTimeout(3, java.util.concurrent.TimeUnit.SECONDS)
            .writeTimeout(3, java.util.concurrent.TimeUnit.SECONDS)
@@ -1328,7 +1369,16 @@ class RelayHttpClient(
                        IOException("Relay reports status=${status ?: "missing"} (expected 'ok')")
                    )
                }
-                val version = (parsed["version"] as? kotlinx.serialization.json.JsonPrimitive)?.content
+                val surface = (parsed["surface"] as? kotlinx.serialization.json.JsonPrimitive)?.content
+                val versionRaw = (parsed["version"] as? kotlinx.serialization.json.JsonPrimitive)?.content
+                // Secure Link /relay/health historically returned status=ok without
+                // version (surface=hermes_secure_proxy). Treat that as healthy so
+                // route probes don't spam "Missing version field".
+                val version = when {
+                    !versionRaw.isNullOrBlank() -> versionRaw
+                    surface.equals("hermes_secure_proxy", ignoreCase = true) -> "secure-link"
+                    else -> null
+                }
                if (version.isNullOrBlank()) {
                    DiagnosticsLog.record(
                        category = DiagnosticCategory.Relay,
@@ -1434,6 +1484,33 @@ class RelayHttpClient(
        return match?.groupValues?.get(1)?.trim()?.ifBlank { null }
    }

+    private fun okhttp3.ResponseBody.readBytesBounded(maxBytes: Long): ByteArray {
+        if (maxBytes <= 0L) throw RelayMediaLimitException()
+        val declared = contentLength().takeIf { it >= 0L }
+        if (declared != null && declared > maxBytes) throw RelayMediaLimitException()
+        val output = ByteArrayOutputStream(
+            declared?.coerceAtMost(Int.MAX_VALUE.toLong())?.toInt() ?: DEFAULT_BUFFER_SIZE,
+        )
+        byteStream().use { input ->
+            val buffer = ByteArray(DEFAULT_BUFFER_SIZE)
+            var total = 0L
+            while (true) {
+                val count = input.read(buffer)
+                if (count < 0) break
+                total += count
+                if (total > maxBytes) throw RelayMediaLimitException()
+                output.write(buffer, 0, count)
+            }
+            if (declared != null && total != declared) {
+                throw IOException("Media file changed while it was being downloaded")
+            }
+        }
+        return output.toByteArray()
+    }
+
+    private class RelayMediaLimitException :
+        IOException("File exceeds the configured download limit")
+
    /**
     * Parse the relay's `X-Media-Sensitive` response header into a bool.
     *
@@ -1446,7 +1523,7 @@ class RelayHttpClient(
        return value == "1" || value == "true"
    }

-    /** Provider-neutral compatibility fetch for gateways without `account.usage`. */
+    /** Provider-neutral enhancement for pools and providers upstream does not expose. */
    suspend fun fetchProviderUsage(
        profile: String? = null,
        sessionId: String? = null,
@@ -1484,12 +1561,12 @@ class RelayHttpClient(
            val request = Request.Builder()
                .url(url)
                .get()
-                .header("Authorization", "Bearer $sessionToken")
+                .relaySessionCredential(sessionToken, isDashboardRelayIngressUrl(relayUrl))
                .header("Accept", "application/json")
                .build()

            try {
-                okHttpClient.newCall(request).execute().use { response ->
+                callClient(relayUrl).newCall(request).execute().use { response ->
                    if (response.code == 404) {
                        // Older or operator-disabled hosts simply do not expose
                        // account usage. This is capability absence, not an error.
@@ -10,6 +10,7 @@ import com.hermesandroid.relay.data.ProfileMemoryUpdateResponse
 import com.hermesandroid.relay.data.LegacyProfileInspectorClient
 import com.hermesandroid.relay.data.RelaySkillToggleResult
 import com.hermesandroid.relay.data.RelayEndpointContract
+import com.hermesandroid.relay.data.isDashboardRelayIngressUrl
 import kotlinx.coroutines.Dispatchers
 import kotlinx.coroutines.withContext
 import kotlinx.serialization.SerializationException
@@ -51,11 +52,19 @@ class RelayProfileInspectorClient(
    private val okHttpClient: OkHttpClient,
    private val relayUrlProvider: () -> String?,
    private val sessionTokenProvider: suspend () -> String?,
+    private val dashboardHttpClientProvider: ((String) -> OkHttpClient?)? = null,
 ) : LegacyProfileInspectorClient {

    private fun relayHttpBaseOrNull(url: String): String? =
        RelayEndpointContract.parseOrNull(url)?.httpBaseUrl

+    private fun callClient(relayUrl: String): OkHttpClient =
+        if (isDashboardRelayIngressUrl(relayUrl)) {
+            dashboardHttpClientProvider?.invoke(relayUrl) ?: okHttpClient
+        } else {
+            okHttpClient
+        }
+
    companion object {
        private const val TAG = "RelayProfileInspector"

@@ -211,12 +220,12 @@ class RelayProfileInspectorClient(
        val request = Request.Builder()
            .url(url)
            .put(body.toRequestBody(JSON_MEDIA_TYPE))
-            .header("Authorization", "Bearer $sessionToken")
+            .relaySessionCredential(sessionToken, isDashboardRelayIngressUrl(relayUrl))
            .header("Accept", "application/json")
            .build()

        try {
-            okHttpClient.newCall(request).execute().use { response ->
+            callClient(relayUrl).newCall(request).execute().use { response ->
                if (!response.isSuccessful) {
                    val reason = when (response.code) {
                        400 -> {
@@ -314,12 +323,12 @@ class RelayProfileInspectorClient(
        val request = Request.Builder()
            .url(url)
            .put(bodyJson.toRequestBody(JSON_MEDIA_TYPE))
-            .header("Authorization", "Bearer $sessionToken")
+            .relaySessionCredential(sessionToken, isDashboardRelayIngressUrl(relayUrl))
            .header("Accept", "application/json")
            .build()

        try {
-            okHttpClient.newCall(request).execute().use { response ->
+            callClient(relayUrl).newCall(request).execute().use { response ->
                when (response.code) {
                    in 200..299 -> Result.success(RelaySkillToggleResult.Ok)
                    501 -> Result.success(RelaySkillToggleResult.NotImplemented)
@@ -374,11 +383,11 @@ class RelayProfileInspectorClient(
        val request = Request.Builder()
            .url(url)
            .method("OPTIONS", null)
-            .header("Authorization", "Bearer $sessionToken")
+            .relaySessionCredential(sessionToken, isDashboardRelayIngressUrl(relayUrl))
            .build()

        try {
-            okHttpClient.newCall(request).execute().use { response ->
+            callClient(relayUrl).newCall(request).execute().use { response ->
                when (response.code) {
                    501 -> false
                    404, 405 -> false
@@ -464,12 +473,12 @@ class RelayProfileInspectorClient(
        val request = Request.Builder()
            .url(url)
            .get()
-            .header("Authorization", "Bearer $sessionToken")
+            .relaySessionCredential(sessionToken, isDashboardRelayIngressUrl(relayUrl))
            .header("Accept", "application/json")
            .build()

        try {
-            okHttpClient.newCall(request).execute().use { response ->
+            callClient(relayUrl).newCall(request).execute().use { response ->
                if (!response.isSuccessful) {
                    val reason = when (response.code) {
                        401, 403 -> "Unauthorized — re-pair with the relay"
@@ -7,6 +7,7 @@ import com.hermesandroid.relay.data.EnhancedVoiceOverrides
 import com.hermesandroid.relay.data.MessageRole
 import com.hermesandroid.relay.data.RealtimeConversationContextMessage
 import com.hermesandroid.relay.data.RelayEndpointContract
+import com.hermesandroid.relay.data.isDashboardRelayIngressUrl
 import kotlinx.coroutines.CompletableDeferred
 import kotlinx.coroutines.CoroutineScope
 import kotlinx.coroutines.Dispatchers
@@ -89,7 +90,7 @@ import java.util.concurrent.atomic.AtomicReference
 */
 class RelayVoiceClient(
    private val context: Context,
-    private val okHttpClient: OkHttpClient,
+    okHttpClient: OkHttpClient,
    private val relayUrlProvider: () -> String?,
    private val sessionTokenProvider: suspend () -> String?,
    private val profileNameProvider: () -> String? = { null },
@@ -100,8 +101,24 @@ class RelayVoiceClient(
    private val realtimeResumeRetryIntervalMs: Long = REALTIME_RESUME_RETRY_INTERVAL_MS,
    private val realtimeResumeRetryWindowMs: Long = REALTIME_RESUME_RETRY_WINDOW_MS,
    private val voiceOutputFirstAudioTimeoutMs: Long = VOICE_OUTPUT_FIRST_AUDIO_TIMEOUT_MS,
+    /** Dashboard-authenticated transport for same-origin plugin ingress. */
+    private val dashboardHttpClientProvider: ((String) -> OkHttpClient?)? = null,
+    /** Pinned-TLS client for Hermes Secure Link relay URLs (self-signed leaf). */
+    private val pluginProxyHttpClientProvider: ((String) -> OkHttpClient?)? = null,
+    /** Fresh Dashboard ticket request for every ingress voice socket dial. */
+    private val dashboardIngressWebSocketRequestProvider:
+        (suspend (String) -> Request?)? = null,
 ) {

+    private val directOkHttpClient: OkHttpClient = okHttpClient
+
+    /** Resolve lazily so a Dashboard route/client handoff is observed. */
+    private val okHttpClient: OkHttpClient
+        get() {
+            val relayUrl = relayUrlProvider()?.trim().orEmpty()
+            return resolveClient(relayUrl)
+        }
+
    companion object {
        private const val TAG = "RelayVoiceClient"
        private val json = Json { ignoreUnknownKeys = true; isLenient = true }
@@ -144,13 +161,39 @@ class RelayVoiceClient(
        }
    }

+    private fun resolveClient(url: String): OkHttpClient =
+        when {
+            isDashboardRelayIngressUrl(url) ->
+                dashboardHttpClientProvider?.invoke(url) ?: directOkHttpClient
+            else ->
+                pluginProxyHttpClientProvider?.invoke(url) ?: directOkHttpClient
+        }
+
+    private fun callClient(url: String): OkHttpClient = resolveClient(url)
+
    private fun sessionClient(): OkHttpClient =
        okHttpClient.newBuilder()
            .callTimeout(SESSION_CALL_TIMEOUT_SECONDS, TimeUnit.SECONDS)
            .build()

    private fun openWebSocket(request: Request, listener: WebSocketListener): WebSocket =
-        webSocketFactory?.invoke(request, listener) ?: okHttpClient.newWebSocket(request, listener)
+        webSocketFactory?.invoke(request, listener)
+            ?: callClient(request.url.toString()).newWebSocket(request, listener)
+
+    private suspend fun voiceWebSocketRequest(url: String, relayToken: String): Request {
+        val dashboardIngress = isDashboardRelayIngressUrl(url)
+        val outerRequest = if (dashboardIngress) {
+            val provider = dashboardIngressWebSocketRequestProvider
+                ?: throw IOException("Dashboard Relay voice authorization is unavailable")
+            provider(url)
+                ?: throw IOException("Dashboard Relay voice ticket could not be minted")
+        } else {
+            Request.Builder().url(url).build()
+        }
+        return outerRequest.newBuilder()
+            .relaySessionCredential(relayToken, dashboardIngress)
+            .build()
+    }

    private fun requestRouteProbeOnce(
        surface: String,
@@ -196,7 +239,7 @@ class RelayVoiceClient(
        val request = Request.Builder()
            .url(urlWithProfile("$httpBase/voice/transcribe"))
            .post(body)
-            .header("Authorization", "Bearer $token")
+            .relaySessionCredential(token, isDashboardRelayIngressUrl(httpBase))
            .header("Accept", "application/json")
            .build()

@@ -278,7 +321,7 @@ class RelayVoiceClient(
        val request = Request.Builder()
            .url("$httpBase/voice/synthesize")
            .post(bodyJson.toRequestBody(JSON_MEDIA_TYPE))
-            .header("Authorization", "Bearer $token")
+            .relaySessionCredential(token, isDashboardRelayIngressUrl(httpBase))
            .header("Accept", "audio/mpeg")
            .build()

@@ -333,7 +376,7 @@ class RelayVoiceClient(
        val request = Request.Builder()
            .url(urlWithProfile("$httpBase/voice/config"))
            .get()
-            .header("Authorization", "Bearer $token")
+            .relaySessionCredential(token, isDashboardRelayIngressUrl(httpBase))
            .header("Accept", "application/json")
            .build()

@@ -375,7 +418,7 @@ class RelayVoiceClient(
        val request = Request.Builder()
            .url(urlWithProfile("$httpBase/voice/realtime/config"))
            .get()
-            .header("Authorization", "Bearer $token")
+            .relaySessionCredential(token, isDashboardRelayIngressUrl(httpBase))
            .header("Accept", "application/json")
            .build()

@@ -414,7 +457,7 @@ class RelayVoiceClient(
        val request = Request.Builder()
            .url(urlWithProfile("$httpBase/voice/realtime/providers/${pathSegment(provider)}/options"))
            .get()
-            .header("Authorization", "Bearer $token")
+            .relaySessionCredential(token, isDashboardRelayIngressUrl(httpBase))
            .header("Accept", "application/json")
            .build()

@@ -462,7 +505,7 @@ class RelayVoiceClient(
        val request = Request.Builder()
            .url(urlWithProfile("$httpBase/voice/realtime/providers/${pathSegment(provider)}/validate"))
            .post(payload.toString().toRequestBody(JSON_MEDIA_TYPE))
-            .header("Authorization", "Bearer $token")
+            .relaySessionCredential(token, isDashboardRelayIngressUrl(httpBase))
            .header("Accept", "application/json")
            .build()

@@ -515,7 +558,7 @@ class RelayVoiceClient(
        val request = Request.Builder()
            .url(urlWithProfile("$httpBase/voice/realtime/config"))
            .patch(payload.toString().toRequestBody(JSON_MEDIA_TYPE))
-            .header("Authorization", "Bearer $token")
+            .relaySessionCredential(token, isDashboardRelayIngressUrl(httpBase))
            .header("Accept", "application/json")
            .build()

@@ -618,7 +661,7 @@ class RelayVoiceClient(
        val request = Request.Builder()
            .url(urlWithProfile("$httpBase/voice/realtime-agent/config"))
            .patch(payload.toString().toRequestBody(JSON_MEDIA_TYPE))
-            .header("Authorization", "Bearer $token")
+            .relaySessionCredential(token, isDashboardRelayIngressUrl(httpBase))
            .header("Accept", "application/json")
            .build()
        try {
@@ -650,7 +693,7 @@ class RelayVoiceClient(
        val request = Request.Builder()
            .url(urlWithProfile("$httpBase/voice/output/config"))
            .get()
-            .header("Authorization", "Bearer $token")
+            .relaySessionCredential(token, isDashboardRelayIngressUrl(httpBase))
            .header("Accept", "application/json")
            .build()

@@ -689,7 +732,7 @@ class RelayVoiceClient(
        val request = Request.Builder()
            .url(urlWithProfile("$httpBase/voice/output/providers/${pathSegment(provider)}/options"))
            .get()
-            .header("Authorization", "Bearer $token")
+            .relaySessionCredential(token, isDashboardRelayIngressUrl(httpBase))
            .header("Accept", "application/json")
            .build()

@@ -741,7 +784,7 @@ class RelayVoiceClient(
        val request = Request.Builder()
            .url(urlWithProfile("$httpBase/voice/output/providers/${pathSegment(provider)}/validate"))
            .post(payload.toString().toRequestBody(JSON_MEDIA_TYPE))
-            .header("Authorization", "Bearer $token")
+            .relaySessionCredential(token, isDashboardRelayIngressUrl(httpBase))
            .header("Accept", "application/json")
            .build()

@@ -812,7 +855,7 @@ class RelayVoiceClient(
        val request = Request.Builder()
            .url(urlWithProfile("$httpBase/voice/output/config"))
            .patch(payload.toString().toRequestBody(JSON_MEDIA_TYPE))
-            .header("Authorization", "Bearer $token")
+            .relaySessionCredential(token, isDashboardRelayIngressUrl(httpBase))
            .header("Accept", "application/json")
            .build()

@@ -845,6 +888,7 @@ class RelayVoiceClient(
        onHandoff: (VoiceHandoffEvent) -> Unit = {},
        onEvent: (RealtimeVoiceEvent) -> Unit,
    ): Result<VoiceOutputSummary> = withContext(Dispatchers.IO) {
+        val owningScope = this
        val httpBase = resolveHttpBase()
            ?: return@withContext Result.failure(IllegalStateException("Relay URL not configured"))
        val token = resolveBearerToken()
@@ -869,6 +913,7 @@ class RelayVoiceClient(
        val completed = AtomicBoolean(false)
        val resumeAttempted = AtomicBoolean(false)
        val routeProbeRequested = AtomicBoolean(false)
+        val resumeDialPending = AtomicBoolean(false)
        val currentSocket = AtomicReference<WebSocket?>()
        val firstAudioSeen = AtomicBoolean(false)
        val socketGeneration = AtomicLong(0L)
@@ -907,14 +952,14 @@ class RelayVoiceClient(
            }
        }

-        fun openSocket(resume: Boolean, overrideWsBase: String? = null): WebSocket {
+        suspend fun openSocket(resume: Boolean, overrideWsBase: String? = null): WebSocket {
            val generation = socketGeneration.incrementAndGet()
            val currentWsBase = overrideWsBase ?: resolveWebSocketBase()
                ?: throw IOException("Relay URL not configured")
-            val request = Request.Builder()
-                .url("$currentWsBase${session.websocketPath}")
-                .header("Authorization", "Bearer $token")
-                .build()
+            val request = voiceWebSocketRequest(
+                "$currentWsBase${session.websocketPath}",
+                token,
+            )
            Log.i(
                TAG,
                "Voice output websocket opening resume=$resume url=${request.url}",
@@ -1044,23 +1089,28 @@ class RelayVoiceClient(
                        return
                    }
                    if (session.resumeSupported && !session.resumeToken.isNullOrBlank() && resumeAttempted.compareAndSet(false, true)) {
-                        try {
-                            Log.i(TAG, "Voice output websocket failed; attempting resume: ${t.message}")
-                            requestRouteProbeOnce("Voice output", t.message, routeProbeRequested)
-                            onHandoff(
-                                VoiceHandoffEvent(
-                                    label = context.getString(R.string.voice_diag_connection_changed),
-                                    detail = t.message,
-                                    route = routeLabel(webSocket.request().url.toString()),
-                                    active = true,
-                                )
+                        Log.i(TAG, "Voice output websocket failed; scheduling resume: ${t.message}")
+                        requestRouteProbeOnce("Voice output", t.message, routeProbeRequested)
+                        onHandoff(
+                            VoiceHandoffEvent(
+                                label = context.getString(R.string.voice_diag_connection_changed),
+                                detail = t.message,
+                                route = routeLabel(webSocket.request().url.toString()),
+                                active = true,
                            )
-                            openSocket(resume = true)
-                            return
-                        } catch (e: Exception) {
-                            completeFailure("Voice output resume failed: ${e.message ?: "network error"}", e)
-                            return
+                        )
+                        if (resumeDialPending.compareAndSet(false, true)) {
+                            owningScope.launch {
+                                try {
+                                    openSocket(resume = true)
+                                } catch (e: Exception) {
+                                    completeFailure("Voice output resume failed: ${e.message ?: "network error"}", e)
+                                } finally {
+                                    resumeDialPending.set(false)
+                                }
+                            }
                        }
+                        return
                    }
                    completeFailure("Voice output websocket failed: ${t.message}", t)
                }
@@ -1090,23 +1140,28 @@ class RelayVoiceClient(
                        return
                    }
                    if (session.resumeSupported && !session.resumeToken.isNullOrBlank() && resumeAttempted.compareAndSet(false, true)) {
-                        try {
-                            Log.i(TAG, "Voice output websocket closed code=$code; attempting resume")
-                            requestRouteProbeOnce("Voice output", "Closed $code $reason", routeProbeRequested)
-                            onHandoff(
-                                VoiceHandoffEvent(
-                                    label = context.getString(R.string.voice_diag_connection_changed),
-                                    detail = "Closed $code $reason",
-                                    route = routeLabel(webSocket.request().url.toString()),
-                                    active = true,
-                                )
+                        Log.i(TAG, "Voice output websocket closed code=$code; scheduling resume")
+                        requestRouteProbeOnce("Voice output", "Closed $code $reason", routeProbeRequested)
+                        onHandoff(
+                            VoiceHandoffEvent(
+                                label = context.getString(R.string.voice_diag_connection_changed),
+                                detail = "Closed $code $reason",
+                                route = routeLabel(webSocket.request().url.toString()),
+                                active = true,
                            )
-                            openSocket(resume = true)
-                            return
-                        } catch (e: Exception) {
-                            completeFailure("Voice output resume failed: ${e.message ?: "network error"}", e)
-                            return
+                        )
+                        if (resumeDialPending.compareAndSet(false, true)) {
+                            owningScope.launch {
+                                try {
+                                    openSocket(resume = true)
+                                } catch (e: Exception) {
+                                    completeFailure("Voice output resume failed: ${e.message ?: "network error"}", e)
+                                } finally {
+                                    resumeDialPending.set(false)
+                                }
+                            }
                        }
+                        return
                    }
                    completeFailure("Voice output websocket closed before completion: $code $reason")
                }
@@ -1178,10 +1233,7 @@ class RelayVoiceClient(
        var audioChunks = 0
        var audioBytes = 0

-        val request = Request.Builder()
-            .url("$wsBase${session.websocketPath}")
-            .header("Authorization", "Bearer $token")
-            .build()
+        val request = voiceWebSocketRequest("$wsBase${session.websocketPath}", token)

        val listener = object : WebSocketListener() {
            override fun onOpen(webSocket: WebSocket, response: Response) {
@@ -1306,6 +1358,7 @@ class RelayVoiceClient(
        prewarm: Boolean = false,
        onEvent: (RealtimeVoiceEvent, RealtimeAgentSessionControl) -> Unit,
    ): Result<RealtimeVoiceSummary> = withContext(Dispatchers.IO) {
+        val owningScope = this
        val persistent = turnInputs != null
        val httpBase = resolveHttpBase()
            ?: return@withContext Result.failure(IllegalStateException("Relay URL not configured"))
@@ -1649,7 +1702,7 @@ class RelayVoiceClient(
            }
        }

-        fun openSocket(
+        suspend fun openSocket(
            resume: Boolean,
            overrideWsBase: String? = null,
            expectedResumeEpisode: Long? = null,
@@ -1673,10 +1726,10 @@ class RelayVoiceClient(
            val (currentWsBase, request) = try {
                val base = overrideWsBase ?: resolveWebSocketBase()
                    ?: throw IOException("Relay URL not configured")
-                val socketRequest = Request.Builder()
-                    .url("$base${session.websocketPath}")
-                    .header("Authorization", "Bearer $token")
-                    .build()
+                val socketRequest = voiceWebSocketRequest(
+                    "$base${session.websocketPath}",
+                    token,
+                )
                Log.i(
                    TAG,
                    "Realtime agent websocket opening resume=$resume url=${socketRequest.url}",
@@ -1765,12 +1818,20 @@ class RelayVoiceClient(
                                // A synchronous failure callback can replace this
                                // socket while setup sends are still unwinding. A
                                // stale attempt must not terminate the newer route.
-                                if (currentSocket.get() !== webSocket || completed.get()) return
+                                if (
+                                    terminalCallbackSeen.get() ||
+                                    currentSocket.get() !== webSocket ||
+                                    completed.get()
+                                ) return
                                completeFailure("Realtime agent websocket rejected session setup")
                                webSocket.close(1011, "session setup failed")
                                return
                            }
-                            if (currentSocket.get() !== webSocket || completed.get()) return
+                            if (
+                                terminalCallbackSeen.get() ||
+                                currentSocket.get() !== webSocket ||
+                                completed.get()
+                            ) return
                            if (resume) {
                                Log.i(TAG, "Realtime agent resume sent; awaiting relay confirmation")
                            } else {
@@ -1984,16 +2045,17 @@ class RelayVoiceClient(
                            )
                        )
                        if (!claim.openImmediately) return
-                        try {
-                            openSocket(
-                                resume = true,
-                                expectedResumeEpisode = claim.waiting.episode,
-                            )
-                            return
-                        } catch (e: Exception) {
-                            completeFailure("Realtime agent resume failed: ${e.message ?: "network error"}", e)
-                            return
+                        owningScope.launch {
+                            try {
+                                openSocket(
+                                    resume = true,
+                                    expectedResumeEpisode = claim.waiting.episode,
+                                )
+                            } catch (e: Exception) {
+                                completeFailure("Realtime agent resume failed: ${e.message ?: "network error"}", e)
+                            }
                        }
+                        return
                    }
                    val transitionRevision = claimTerminalSocket(
                        webSocket,
@@ -2097,16 +2159,17 @@ class RelayVoiceClient(
                            )
                        )
                        if (!claim.openImmediately) return
-                        try {
-                            openSocket(
-                                resume = true,
-                                expectedResumeEpisode = claim.waiting.episode,
-                            )
-                            return
-                        } catch (e: Exception) {
-                            completeFailure("Realtime agent resume failed: ${e.message ?: "network error"}", e)
-                            return
+                        owningScope.launch {
+                            try {
+                                openSocket(
+                                    resume = true,
+                                    expectedResumeEpisode = claim.waiting.episode,
+                                )
+                            } catch (e: Exception) {
+                                completeFailure("Realtime agent resume failed: ${e.message ?: "network error"}", e)
+                            }
                        }
+                        return
                    }
                    val transitionRevision = claimTerminalSocket(
                        webSocket,
@@ -2294,9 +2357,7 @@ class RelayVoiceClient(
            null
        }

-        val socket = openSocket(resume = false)
-            ?: currentSocket.get()
-            ?: throw IOException("Realtime agent websocket handshake was already pending")
+        val initialSocket = openSocket(resume = false) ?: currentSocket.get()
        val routeWatcherResumeEpisode = AtomicLong(0L)
        val routeWatcher = startRouteResumeWatcher(
            surface = "Realtime agent",
@@ -2378,7 +2439,7 @@ class RelayVoiceClient(
            awaitRealtimeAgentCompletion()
        } catch (e: Exception) {
            currentSocket.get()?.close(1001, "timeout")
-            socket.close(1001, "timeout")
+            initialSocket?.close(1001, "timeout")
            Result.failure(IOException(e.message ?: "Realtime agent timed out", e))
        } finally {
            routeWatcher?.cancel()
@@ -2394,7 +2455,7 @@ class RelayVoiceClient(
        resumeSupported: Boolean,
        resumeToken: String?,
        currentSocket: AtomicReference<WebSocket?>,
-        openResumeSocket: (String?) -> WebSocket?,
+        openResumeSocket: suspend (String?) -> WebSocket?,
        onHandoff: (VoiceHandoffEvent) -> Unit,
        completeFailure: (String, Throwable?) -> Unit,
    ): Job? {
@@ -2454,7 +2515,7 @@ class RelayVoiceClient(
        val request = Request.Builder()
            .url(urlWithProfile("$httpBase$path"))
            .get()
-            .header("Authorization", "Bearer $token")
+            .relaySessionCredential(token, isDashboardRelayIngressUrl(httpBase))
            .header("Accept", "application/json")
            .build()
        try {
@@ -2493,7 +2554,7 @@ class RelayVoiceClient(
        val request = Request.Builder()
            .url(urlWithProfile("$httpBase$pathPrefix/${pathSegment(provider)}/options"))
            .get()
-            .header("Authorization", "Bearer $token")
+            .relaySessionCredential(token, isDashboardRelayIngressUrl(httpBase))
            .header("Accept", "application/json")
            .build()
        try {
@@ -2541,7 +2602,7 @@ class RelayVoiceClient(
        val request = Request.Builder()
            .url(urlWithProfile("$httpBase$pathPrefix/${pathSegment(provider)}/validate"))
            .post(payload.toString().toRequestBody(JSON_MEDIA_TYPE))
-            .header("Authorization", "Bearer $token")
+            .relaySessionCredential(token, isDashboardRelayIngressUrl(httpBase))
            .header("Accept", "application/json")
            .build()
        try {
@@ -2593,7 +2654,7 @@ class RelayVoiceClient(
        val request = Request.Builder()
            .url(urlWithProfile("$httpBase$path"))
            .patch(payload.toString().toRequestBody(JSON_MEDIA_TYPE))
-            .header("Authorization", "Bearer $token")
+            .relaySessionCredential(token, isDashboardRelayIngressUrl(httpBase))
            .header("Accept", "application/json")
            .build()
        try {
@@ -2678,7 +2739,7 @@ class RelayVoiceClient(
        val request = Request.Builder()
            .url("$httpBase/voice/realtime/session")
            .post(body.toRequestBody(JSON_MEDIA_TYPE))
-            .header("Authorization", "Bearer $token")
+            .relaySessionCredential(token, isDashboardRelayIngressUrl(httpBase))
            .header("Accept", "application/json")
            .build()
        return try {
@@ -2763,7 +2824,7 @@ class RelayVoiceClient(
        val request = Request.Builder()
            .url("$httpBase/voice/realtime-agent/session")
            .post(body.toRequestBody(JSON_MEDIA_TYPE))
-            .header("Authorization", "Bearer $token")
+            .relaySessionCredential(token, isDashboardRelayIngressUrl(httpBase))
            .header("Accept", "application/json")
            .build()
        return try {
@@ -2804,7 +2865,7 @@ class RelayVoiceClient(
        val request = Request.Builder()
            .url("$httpBase/voice/output/session")
            .post(body.toRequestBody(JSON_MEDIA_TYPE))
-            .header("Authorization", "Bearer $token")
+            .relaySessionCredential(token, isDashboardRelayIngressUrl(httpBase))
            .header("Accept", "application/json")
            .build()
        return try {
@@ -5,6 +5,7 @@ import android.util.Log
 import com.hermesandroid.relay.R
 import com.hermesandroid.relay.data.EndpointCandidate
 import com.hermesandroid.relay.data.RelayEndpointContract
+import com.hermesandroid.relay.data.isDashboardRelayIngressUrl
 import com.hermesandroid.relay.data.primaryRouteUrl
 import com.hermesandroid.relay.data.routeAuthority
 import com.hermesandroid.relay.diagnostics.DiagnosticCategory
@@ -12,16 +13,24 @@ import com.hermesandroid.relay.diagnostics.DiagnosticSeverity
 import com.hermesandroid.relay.diagnostics.DiagnosticsLog
 import com.hermesandroid.relay.diagnostics.NetworkDiagnosticGuidance
 import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.CoroutineScope
+import kotlinx.coroutines.CoroutineStart
+import kotlinx.coroutines.CancellationException
+import kotlinx.coroutines.Deferred
+import kotlinx.coroutines.SupervisorJob
 import kotlinx.coroutines.TimeoutCancellationException
 import kotlinx.coroutines.async
-import kotlinx.coroutines.awaitAll
 import kotlinx.coroutines.coroutineScope
+import kotlinx.coroutines.channels.Channel
 import kotlinx.coroutines.flow.MutableStateFlow
 import kotlinx.coroutines.flow.StateFlow
 import kotlinx.coroutines.flow.asStateFlow
 import kotlinx.coroutines.flow.update
+import kotlinx.coroutines.currentCoroutineContext
+import kotlinx.coroutines.ensureActive
 import kotlinx.coroutines.withContext
 import kotlinx.coroutines.withTimeoutOrNull
+import kotlinx.coroutines.launch
 import okhttp3.HttpUrl.Companion.toHttpUrlOrNull
 import okhttp3.OkHttpClient
 import okhttp3.Request
@@ -43,7 +52,7 @@ import javax.net.ssl.SSLException
 */
 data class RouteProbeOutcome(
    val reachable: Boolean,
-    /** Short human-readable failure reason; null when [reachable]. */
+    /** Short result detail; protected ingress may be reachable but require authorization. */
    val detail: String? = null,
    /** Resolver-clock timestamp of when the probe finished. */
    val atMillis: Long,
@@ -68,12 +77,15 @@ enum class EndpointSurface {
 *
 * ### Semantics (locked by ADR 24)
 *
- *  * **Strict priority.** `priority = 0` is highest. If a priority-0
- *    candidate is reachable we use it; reachability never promotes a lower
- *    priority over a higher one. Reachability is **only** the tiebreaker
- *    among candidates that share the same priority.
- *  * **Reachability probe.** Dashboard-first routes use `GET
- *    ${dashboard.url}/api/status`; legacy API routes use `GET
+ *  * **Strict selection priority with speculative probes.** `priority = 0`
+ *    is highest. All supported priority groups start probing together so one
+ *    dead route cannot add its full timeout before the fallback even starts,
+ *    but a lower-priority result is considered only after every higher group
+ *    has failed. Reachability is **only** the tiebreaker among candidates that
+ *    share the same priority.
+ *  * **Reachability probe.** Dashboard-first routes use lightweight `GET
+ *    ${dashboard.url}/api/health` and fall back to `/api/status` only for a
+ *    confirmed legacy host without the health route. Legacy API routes use `GET
 *    ${api.url}/health`. Relay-only routes use `GET ${relay.httpUrl}/health`.
 *    Each request has a 4-second
 *    per-candidate timeout. Positive results are cached longer than negative
@@ -112,8 +124,15 @@ class EndpointResolver(
     * expected path for plain JVM tests.
     */
    private val context: Context? = null,
-    /** Route-aware client for pinned plugin proxy probes. */
-    private val clientForCandidate: ((EndpointCandidate) -> OkHttpClient?)? = null,
+    /**
+     * Route-aware client for pinned plugin proxy probes.
+     * Second arg is the concrete probe request URL when known — callers must
+     * pin only when *this* request targets the Secure Link authority. Using a
+     * pin client for every surface on a LAN candidate that merely *stores* a
+     * Secure Link relay URL breaks plain :9119/:8642 probes (authority guard
+     * throws IOException → "Unreachable - IOException").
+     */
+    private val clientForCandidate: ((EndpointCandidate, probeRequestUrl: String?) -> OkHttpClient?)? = null,
 ) {

    /**
@@ -126,9 +145,24 @@ class EndpointResolver(
        val baseUrl: String,
        val requestUrl: String,
        val path: String,
+        val legacyFallbackRequestUrl: String? = null,
+        val legacyFallbackPath: String? = null,
+    )
+
+    private data class ProbeHttpResult(
+        val code: Int,
+        val successful: Boolean,
+        val bodyPreview: String,
    )

    private val probeCache = ConcurrentHashMap<String, CacheEntry>()
+    // Every access is owned by [probeStateLock]. This must not be a
+    // concurrently-mutated collection: clearCache() takes a stable snapshot
+    // while completion callbacks remove finished probes.
+    private val inFlightProbes = mutableMapOf<String, Deferred<Boolean>>()
+    private val probeScope = CoroutineScope(SupervisorJob() + Dispatchers.IO)
+    private val probeStateLock = Any()
+    private var probeGeneration = 0L

    private val _probeOutcomes = MutableStateFlow<Map<String, RouteProbeOutcome>>(emptyMap())

@@ -140,6 +174,12 @@ class EndpointResolver(
     */
    val probeOutcomes: StateFlow<Map<String, RouteProbeOutcome>> = _probeOutcomes.asStateFlow()

+    /** Last independently observed verdict for one configured route surface. */
+    fun outcomeFor(
+        candidate: EndpointCandidate,
+        surface: EndpointSurface,
+    ): RouteProbeOutcome? = probeOutcomes.value[outcomeKey(candidate, surface)]
+
    private fun recordOutcome(
        candidate: EndpointCandidate,
        surface: EndpointSurface,
@@ -177,41 +217,48 @@ class EndpointResolver(
        const val CACHE_TTL_MS = 60_000L

        /**
-         * Failed probe-result cache TTL. Keep this intentionally short:
+         * Failed probe-result cache TTL. Keep this bounded but long enough
+         * that ordinary screen/profile lifecycle work cannot repeatedly pay
+         * the full probe timeout:
         * Android may report a new cellular/VPN network before Tailscale has
         * finished routing, so a single early ConnectException must not keep a
-         * viable fallback route suppressed through the voice resume window.
+         * viable fallback route suppressed for long. Network-change and
+         * explicit-probe paths invalidate the cache immediately.
         */
-        const val NEGATIVE_CACHE_TTL_MS = 2_000L
+        const val NEGATIVE_CACHE_TTL_MS = 15_000L

        /** Shared timeout wording so HEAD-timeout and socket-timeout read the same. */
        private const val PROBE_TIMEOUT_DETAIL = "No answer (timed out)"

        /**
-         * Stable cache key for one candidate surface:
-         * `"<surface>|<role>|<surface host>:<port>"`.
+         * Stable outcome/cache key for one candidate surface:
+         * `"<surface>|<role>|<normalized service base>"`.
         * Roles are preserved case-verbatim (HMAC canonicalization contract)
         * but hostnames are lowercased — two roles pointing at the same
         * host:port share reachability state.
         */
-        internal fun cacheKey(
+        fun outcomeKey(
            candidate: EndpointCandidate,
            surface: EndpointSurface = EndpointSurface.Standard,
        ): String {
-            val authority = when (surface) {
+            val serviceIdentity = when (surface) {
                EndpointSurface.Standard ->
                    candidate.routeAuthority() ?: candidate.primaryRouteUrl().orEmpty().lowercase()
                EndpointSurface.Dashboard ->
-                    routeAuthority(candidate.pluginProxyRoutesOrNull()?.dashboardBaseUrl ?: candidate.dashboard?.url).orEmpty()
+                    routeIdentity(candidate.pluginProxyRoutesOrNull()?.dashboardBaseUrl ?: candidate.dashboard?.url)
                EndpointSurface.Api ->
-                    routeAuthority(candidate.pluginProxyRoutesOrNull()?.apiBaseUrl ?: candidate.api?.url).orEmpty()
+                    routeIdentity(candidate.pluginProxyRoutesOrNull()?.apiBaseUrl ?: candidate.api?.url)
                EndpointSurface.Relay ->
-                    candidate.pluginProxyRoutesOrNull()?.authority
-                        ?: routeAuthority(candidate.relay?.url).orEmpty()
+                    routeIdentity(candidate.pluginProxyRoutesOrNull()?.relayHttpUrl ?: candidate.relay?.url)
            }
-            return "${surface.name.lowercase()}|${candidate.role}|$authority"
+            return "${surface.name.lowercase()}|${candidate.role}|$serviceIdentity"
        }

+        internal fun cacheKey(
+            candidate: EndpointCandidate,
+            surface: EndpointSurface = EndpointSurface.Standard,
+        ): String = outcomeKey(candidate, surface)
+
        private fun routeAuthority(rawUrl: String?): String? {
            val candidate = rawUrl?.trim()?.takeIf { it.isNotBlank() } ?: return null
            val httpUrl = when {
@@ -223,17 +270,31 @@ class EndpointResolver(
            }
            return httpUrl.toHttpUrlOrNull()?.let { url -> "${url.host}:${url.port}" }
        }
+
+        private fun routeIdentity(rawUrl: String?): String {
+            val candidate = rawUrl?.trim()?.takeIf { it.isNotBlank() } ?: return ""
+            val httpCandidate = when {
+                candidate.startsWith("ws://", ignoreCase = true) ->
+                    "http://${candidate.substringAfter("://")}"
+                candidate.startsWith("wss://", ignoreCase = true) ->
+                    "https://${candidate.substringAfter("://")}"
+                else -> candidate
+            }
+            return httpCandidate.toHttpUrlOrNull()?.let { url ->
+                val path = url.encodedPath.trimEnd('/').takeIf { it.isNotEmpty() }.orEmpty()
+                "${url.scheme}://${url.host}:${url.port}$path"
+            } ?: candidate.lowercase().trimEnd('/')
+        }
    }

    /**
     * Run the resolver against [candidates].
     *
-     *  1. Group by `priority` ascending.
-     *  2. For each priority group, race the selected surface's health probe
-     *     against every candidate in the group. First 2xx wins; ties
-     *     broken by whichever response lands first.
-     *  3. If the entire group is unreachable, fall through to the next
-     *     priority group.
+     *  1. Group by `priority` ascending and by supported/experimental tier.
+     *  2. Start every supported priority group speculatively, while awaiting
+     *     their results in strict priority order. Within a group, first 2xx
+     *     wins. If higher groups fail, a completed fallback is ready at once.
+     *  3. Probe the experimental tier only when every supported group fails.
     *  4. If no candidate is reachable, return `null` — the caller falls back
     *     to its legacy single-URL path.
     *
@@ -254,14 +315,15 @@ class EndpointResolver(
        // last-resort fallback without displacing Tailscale or direct TLS.
        val supported = eligible.filterNot { it.experimental || it.role.equals("outbound_broker", ignoreCase = true) }
        val experimental = eligible.filter { it.experimental || it.role.equals("outbound_broker", ignoreCase = true) }
-        val groups = (supported.groupBy { it.priority }.toSortedMap().values +
-            experimental.groupBy { it.priority }.toSortedMap().values)
+        val tiers = listOf(
+            supported.groupBy { it.priority }.toSortedMap().values.toList(),
+            experimental.groupBy { it.priority }.toSortedMap().values.toList(),
+        )

-        for (group in groups) {
-            val priority = group.first().priority
-            Log.d(TAG, "probing priority=$priority group (size=${group.size})")
-            val winner = raceGroup(group, surface)
+        for (groups in tiers) {
+            val winner = racePriorityGroups(groups, surface)
            if (winner != null) {
+                val priority = winner.priority
                val winnerUrl = probeTarget(winner, surface)?.baseUrl
                Log.i(TAG, "resolve winner: role=${winner.role} " +
                    "surface=$surface route=$winnerUrl priority=$priority")
@@ -287,6 +349,76 @@ class EndpointResolver(
        return null
    }

+    /**
+     * Start all groups in one stability tier together, but consume them in
+     * strict priority order. Cancelling losing waiters never cancels the shared
+     * physical probes, so their cache/outcome records still warm later calls.
+     */
+    private suspend fun racePriorityGroups(
+        groups: List<List<EndpointCandidate>>,
+        surface: EndpointSurface,
+    ): EndpointCandidate? = coroutineScope {
+        if (groups.isEmpty()) return@coroutineScope null
+        val races = groups.map { group ->
+            val priority = group.first().priority
+            Log.d(TAG, "probing priority=$priority group (size=${group.size})")
+            group to async(Dispatchers.IO) { raceGroup(group, surface) }
+        }
+        for ((_, race) in races) {
+            val winner = race.await()
+            if (winner != null) {
+                races.forEach { (_, other) -> if (other !== race) other.cancel() }
+                return@coroutineScope winner
+            }
+        }
+        null
+    }
+
+    /**
+     * Probe every independently configured route surface in parallel.
+     *
+     * Dashboard/Gateway, optional API fallback, and Relay do not vouch for one
+     * another even when they share a hostname. Unconfigured surfaces are
+     * omitted. Invalidated probes publish no result, preserving the prior
+     * outcome until a fresh physical probe completes.
+     */
+    suspend fun probeSurfaces(
+        candidate: EndpointCandidate,
+    ): Map<EndpointSurface, RouteProbeOutcome> = coroutineScope {
+        val configuredSurfaces = listOf(
+            EndpointSurface.Dashboard,
+            EndpointSurface.Api,
+            EndpointSurface.Relay,
+        ).filter { probeTarget(candidate, it) != null }
+
+        configuredSurfaces
+            .map { surface ->
+                async {
+                    isReachable(candidate, surface)
+                    surface to currentCachedOutcomeFor(candidate, surface)
+                }
+            }
+            .mapNotNull { deferred ->
+                val (surface, outcome) = deferred.await()
+                outcome?.let { surface to it }
+            }
+            .toMap()
+    }
+
+    /** Return only an outcome still backed by this generation's probe cache. */
+    private fun currentCachedOutcomeFor(
+        candidate: EndpointCandidate,
+        surface: EndpointSurface,
+    ): RouteProbeOutcome? = synchronized(probeStateLock) {
+        val key = cacheKey(candidate, surface)
+        val cached = probeCache[key]
+        if (cached != null && cached.expiresAt > clock()) {
+            probeOutcomes.value[key]
+        } else {
+            null
+        }
+    }
+
    /**
     * Race all candidates in [group] (same priority tier) in parallel. First
     * candidate that reports reachable — whether from cache or a fresh probe
@@ -316,20 +448,23 @@ class EndpointResolver(
        }

        return coroutineScope {
-            val deferred = group.map { candidate ->
-                async(Dispatchers.IO) {
-                    if (isReachable(candidate, surface)) candidate else null
+            val completions = Channel<EndpointCandidate?>(group.size)
+            val waiters = group.map { candidate ->
+                launch(Dispatchers.IO) {
+                    completions.send(if (isReachable(candidate, surface)) candidate else null)
                }
            }
-            // Collect results in arrival order: iterate through awaitAll +
-            // pick the first non-null. awaitAll preserves input order, which
-            // means a slow-but-reachable priority-0 candidate would block a
-            // fast-and-reachable sibling. But HEAD /health against a healthy
-            // API route replies in <100ms and the timeout caps stragglers at 2s,
-            // so this is acceptable in practice. A true "first to arrive"
-            // would need kotlinx.coroutines Channel plumbing that's not
-            // worth the weight here.
-            deferred.awaitAll().firstOrNull { it != null }
+            repeat(group.size) {
+                val completed = completions.receive()
+                if (completed != null) {
+                    // Cancelling these waiters does not cancel the shared
+                    // physical probes below; their outcomes still populate
+                    // the cache for the next resolution.
+                    waiters.forEach { it.cancel() }
+                    return@coroutineScope completed
+                }
+            }
+            null
        }
    }

@@ -350,10 +485,39 @@ class EndpointResolver(
            return cached.reachable
        }

-        val reachable = probe(candidate, surface)
-        val ttl = if (reachable) CACHE_TTL_MS else NEGATIVE_CACHE_TTL_MS
-        probeCache[key] = CacheEntry(expiresAt = now + ttl, reachable = reachable)
-        return reachable
+        // Resolution is triggered from several independent lifecycle paths
+        // (connection hydration, profile restoration, network callbacks, and
+        // explicit probes). Share one physical request per route/surface so a
+        // slow optional endpoint cannot accumulate duplicate 4-second probes.
+        val shared = synchronized(probeStateLock) {
+            inFlightProbes[key] ?: run {
+                val generation = probeGeneration
+                probeScope.async(start = CoroutineStart.LAZY) {
+                    probe(candidate, surface, generation)
+                }.also { deferred ->
+                    inFlightProbes[key] = deferred
+                    deferred.invokeOnCompletion {
+                        synchronized(probeStateLock) {
+                            // Identity-aware removal prevents an invalidated
+                            // probe from removing its fresh replacement.
+                            inFlightProbes.remove(key, deferred)
+                        }
+                    }
+                    deferred.start()
+                }
+            }
+        }
+        return try {
+            shared.await()
+        } catch (_: CancellationException) {
+            // clearCache() owns cancellation of the shared physical probe. A
+            // still-active waiter treats that invalidated result as unknown so
+            // same-priority races can publish their non-winning completion.
+            // Genuine caller cancellation still propagates from ensureActive.
+            currentCoroutineContext().ensureActive()
+            Log.d(TAG, "probe invalidated for $key")
+            false
+        }
    }

    /**
@@ -367,6 +531,7 @@ class EndpointResolver(
    private suspend fun probe(
        candidate: EndpointCandidate,
        surface: EndpointSurface,
+        generation: Long,
    ): Boolean {
        val startedAtMs = clock()
        val operation = when (surface) {
@@ -378,69 +543,124 @@ class EndpointResolver(
        val target = probeTarget(candidate, surface)
        val url = target?.requestUrl?.toHttpUrlOrNull()
            ?: run {
-                Log.w(TAG, "probe: invalid url for role=${candidate.role}")
-                DiagnosticsLog.record(
-                    category = DiagnosticCategory.Endpoint,
-                    severity = DiagnosticSeverity.Error,
-                    title = context?.getString(R.string.endpoint_diag_probe_invalid) ?: "Endpoint probe invalid",
-                    detail = "No valid Dashboard, API, or Relay URL",
-                    operation = operation,
-                    endpointRole = candidate.role,
-                    configuredUrl = candidate.primaryRouteUrl(),
-                    suggestion = "Edit or re-pair this route so it contains a valid service URL.",
-                )
-                recordOutcome(candidate, surface, reachable = false, detail = "Invalid route URL")
-                return false
+                return completeProbe(
+                    candidate = candidate,
+                    surface = surface,
+                    generation = generation,
+                    reachable = false,
+                    detail = "Invalid route URL",
+                ) {
+                    Log.w(TAG, "probe: invalid url for role=${candidate.role}")
+                    DiagnosticsLog.record(
+                        category = DiagnosticCategory.Endpoint,
+                        severity = DiagnosticSeverity.Error,
+                        title = context?.getString(R.string.endpoint_diag_probe_invalid) ?: "Endpoint probe invalid",
+                        detail = "No valid Dashboard, API, or Relay URL",
+                        operation = operation,
+                        endpointRole = candidate.role,
+                        configuredUrl = candidate.primaryRouteUrl(),
+                        suggestion = "Edit or re-pair this route so it contains a valid service URL.",
+                    )
+                }
            }
-        val fastClient = (clientForCandidate?.invoke(candidate) ?: httpClient).newBuilder()
+        val fastClient = (
+            clientForCandidate?.invoke(candidate, target.requestUrl) ?: httpClient
+            ).newBuilder()
            .connectTimeout(PROBE_TIMEOUT_MS, TimeUnit.MILLISECONDS)
            .readTimeout(PROBE_TIMEOUT_MS, TimeUnit.MILLISECONDS)
            .writeTimeout(PROBE_TIMEOUT_MS, TimeUnit.MILLISECONDS)
            .callTimeout(PROBE_TIMEOUT_MS, TimeUnit.MILLISECONDS)
            .build()
-        val requestBuilder = Request.Builder()
-            .url(url)
-            .header("Accept", "*/*")
-        // Hermes API's aiohttp health route accepts GET but returns 405 to
-        // HEAD. That response proves connectivity while the old probe marked
-        // the route unreachable. Health payloads are tiny, so follow the
-        // endpoint's actual public contract on every surface.
-        val request = requestBuilder.get().build()
        return withContext(Dispatchers.IO) {
            try {
                withTimeoutOrNull(PROBE_TIMEOUT_MS + 200L) {
-                    fastClient.newCall(request).execute().use { resp ->
-                        val ok = resp.isSuccessful
-                        val probeTitle = if (ok) {
+                    val primary = executeProbeHttp(fastClient, url)
+                    val fallbackUrl = target.legacyFallbackRequestUrl
+                        ?.takeIf { dashboardHealthNeedsLegacyFallback(primary) }
+                        ?.toHttpUrlOrNull()
+                    val result = fallbackUrl?.let { executeProbeHttp(fastClient, it) } ?: primary
+                    val resultPath = if (fallbackUrl != null) {
+                        target.legacyFallbackPath ?: target.path
+                    } else {
+                        target.path
+                    }
+                    val resultUrl = fallbackUrl?.toString() ?: target.requestUrl
+                    result.let { response ->
+                        val authRequired = surface == EndpointSurface.Relay &&
+                            isDashboardRelayIngressUrl(candidate.relay?.url) &&
+                            response.code in setOf(401, 403)
+                        val reachable = response.successful || authRequired
+                        val probeTitle = if (reachable) {
                            context?.getString(R.string.endpoint_diag_probe_ok) ?: "Endpoint probe ok"
                        } else {
                            context?.getString(R.string.endpoint_diag_probe_failed) ?: "Endpoint probe failed"
                        }
+                        completeProbe(
+                            candidate = candidate,
+                            surface = surface,
+                            generation = generation,
+                            reachable = reachable,
+                            detail = when {
+                                authRequired -> "HTTP ${response.code} · Dashboard authorization required"
+                                reachable -> null
+                                else -> "HTTP ${response.code} from $resultPath"
+                            },
+                        ) {
+                            DiagnosticsLog.record(
+                                category = DiagnosticCategory.Endpoint,
+                                severity = if (reachable) DiagnosticSeverity.Info else DiagnosticSeverity.Warning,
+                                title = probeTitle,
+                                detail = when {
+                                    authRequired -> "HTTP ${response.code} · Dashboard authorization required"
+                                    reachable -> null
+                                    else -> "HTTP ${response.code}"
+                                },
+                                operation = operation,
+                                endpointRole = candidate.role,
+                                configuredUrl = target.baseUrl,
+                                requestUrl = resultUrl,
+                                elapsedMs = clock() - startedAtMs,
+                                suggestion = if (reachable) {
+                                    null
+                                } else {
+                                    NetworkDiagnosticGuidance.forHttpStatus(
+                                        response.code,
+                                        surface.diagnosticTarget(),
+                                    )
+                                },
+                            )
+                        }
+                    }
+                } ?: run {
+                    completeProbe(
+                        candidate = candidate,
+                        surface = surface,
+                        generation = generation,
+                        reachable = false,
+                        detail = PROBE_TIMEOUT_DETAIL,
+                    ) {
                        DiagnosticsLog.record(
                            category = DiagnosticCategory.Endpoint,
-                            severity = if (ok) DiagnosticSeverity.Info else DiagnosticSeverity.Warning,
-                            title = probeTitle,
-                            detail = if (ok) null else "HTTP ${resp.code}",
+                            severity = DiagnosticSeverity.Warning,
+                            title = context?.getString(R.string.endpoint_diag_probe_timeout) ?: "Endpoint probe timeout",
+                            detail = "No ${target.path} response in ${PROBE_TIMEOUT_MS}ms",
                            operation = operation,
                            endpointRole = candidate.role,
                            configuredUrl = target.baseUrl,
                            requestUrl = target.requestUrl,
                            elapsedMs = clock() - startedAtMs,
-                            suggestion = if (ok) {
-                                null
-                            } else {
-                                NetworkDiagnosticGuidance.forHttpStatus(resp.code, surface.diagnosticTarget())
-                            },
+                            suggestion = "Check network routing or firewall rules between this device and ${surface.diagnosticTarget()}.",
                        )
-                        recordOutcome(
-                            candidate,
-                            surface,
-                            reachable = ok,
-                            detail = if (ok) null else "HTTP ${resp.code} from ${target.path}",
-                        )
-                        ok
                    }
-                } ?: run {
+                }
+            } catch (_: TimeoutCancellationException) {
+                completeProbe(
+                    candidate = candidate,
+                    surface = surface,
+                    generation = generation,
+                    reachable = false,
+                    detail = PROBE_TIMEOUT_DETAIL,
+                ) {
                    DiagnosticsLog.record(
                        category = DiagnosticCategory.Endpoint,
                        severity = DiagnosticSeverity.Warning,
@@ -453,45 +673,81 @@ class EndpointResolver(
                        elapsedMs = clock() - startedAtMs,
                        suggestion = "Check network routing or firewall rules between this device and ${surface.diagnosticTarget()}.",
                    )
-                    recordOutcome(candidate, surface, reachable = false, detail = PROBE_TIMEOUT_DETAIL)
-                    false
                }
-            } catch (_: TimeoutCancellationException) {
-                DiagnosticsLog.record(
-                    category = DiagnosticCategory.Endpoint,
-                    severity = DiagnosticSeverity.Warning,
-                    title = context?.getString(R.string.endpoint_diag_probe_timeout) ?: "Endpoint probe timeout",
-                    detail = "No ${target.path} response in ${PROBE_TIMEOUT_MS}ms",
-                    operation = operation,
-                    endpointRole = candidate.role,
-                    configuredUrl = target.baseUrl,
-                    requestUrl = target.requestUrl,
-                    elapsedMs = clock() - startedAtMs,
-                    suggestion = "Check network routing or firewall rules between this device and ${surface.diagnosticTarget()}.",
-                )
-                recordOutcome(candidate, surface, reachable = false, detail = PROBE_TIMEOUT_DETAIL)
-                false
+            } catch (e: CancellationException) {
+                throw e
            } catch (e: Exception) {
-                Log.d(TAG, "probe failed role=${candidate.role} " +
-                    "route=${target.baseUrl}: ${e.javaClass.simpleName}")
-                DiagnosticsLog.record(
-                    category = DiagnosticCategory.Endpoint,
-                    severity = DiagnosticSeverity.Warning,
-                    title = context?.getString(R.string.endpoint_diag_probe_failed) ?: "Endpoint probe failed",
+                completeProbe(
+                    candidate = candidate,
+                    surface = surface,
+                    generation = generation,
+                    reachable = false,
                    detail = humanProbeFailure(e),
-                    operation = operation,
-                    endpointRole = candidate.role,
-                    configuredUrl = target.baseUrl,
-                    requestUrl = target.requestUrl,
-                    elapsedMs = clock() - startedAtMs,
-                    suggestion = NetworkDiagnosticGuidance.forThrowable(e, surface.diagnosticTarget()),
-                )
-                recordOutcome(candidate, surface, reachable = false, detail = humanProbeFailure(e))
-                false
+                ) {
+                    Log.d(TAG, "probe failed role=${candidate.role} " +
+                        "route=${target.baseUrl}: ${e.javaClass.simpleName}")
+                    DiagnosticsLog.record(
+                        category = DiagnosticCategory.Endpoint,
+                        severity = DiagnosticSeverity.Warning,
+                        title = context?.getString(R.string.endpoint_diag_probe_failed) ?: "Endpoint probe failed",
+                        detail = humanProbeFailure(e),
+                        operation = operation,
+                        endpointRole = candidate.role,
+                        configuredUrl = target.baseUrl,
+                        requestUrl = target.requestUrl,
+                        elapsedMs = clock() - startedAtMs,
+                        suggestion = NetworkDiagnosticGuidance.forThrowable(e, surface.diagnosticTarget()),
+                    )
+                }
            }
        }
    }

+    private fun executeProbeHttp(client: OkHttpClient, url: okhttp3.HttpUrl): ProbeHttpResult {
+        val request = Request.Builder()
+            .url(url)
+            .header("Accept", "application/json")
+            .get()
+            .build()
+        return client.newCall(request).execute().use { response ->
+            ProbeHttpResult(
+                code = response.code,
+                successful = response.isSuccessful,
+                bodyPreview = response.peekBody(4_096L).string(),
+            )
+        }
+    }
+
+    /** Official Desktop compatibility for Hermes versions predating `/api/health`. */
+    private fun dashboardHealthNeedsLegacyFallback(result: ProbeHttpResult): Boolean =
+        result.code == 404 ||
+            (result.code == 401 && result.bodyPreview.contains("no_cookie", ignoreCase = true))
+
+    /** Commit one physical probe only if it still belongs to the active cache generation. */
+    private suspend fun completeProbe(
+        candidate: EndpointCandidate,
+        surface: EndpointSurface,
+        generation: Long,
+        reachable: Boolean,
+        detail: String?,
+        recordDiagnostic: () -> Unit,
+    ): Boolean {
+        currentCoroutineContext().ensureActive()
+        synchronized(probeStateLock) {
+            if (generation != probeGeneration) {
+                throw CancellationException("Endpoint probe invalidated")
+            }
+            recordDiagnostic()
+            recordOutcome(candidate, surface, reachable, detail)
+            val ttl = if (reachable) CACHE_TTL_MS else NEGATIVE_CACHE_TTL_MS
+            probeCache[cacheKey(candidate, surface)] = CacheEntry(
+                expiresAt = clock() + ttl,
+                reachable = reachable,
+            )
+        }
+        return reachable
+    }
+
    /** Choose the standard Dashboard/Gateway surface first when advertised. */
    private fun probeTarget(
        candidate: EndpointCandidate,
@@ -499,10 +755,22 @@ class EndpointResolver(
    ): ProbeTarget? {
        if (surface == EndpointSurface.Dashboard) {
            candidate.pluginProxyRoutesOrNull()?.dashboardBaseUrl?.let { base ->
-                return ProbeTarget(base, "$base/api/status", "/dashboard/api/status")
+                return ProbeTarget(
+                    baseUrl = base,
+                    requestUrl = "$base/api/health",
+                    path = "/dashboard/api/health",
+                    legacyFallbackRequestUrl = "$base/api/status",
+                    legacyFallbackPath = "/dashboard/api/status",
+                )
            }
            candidate.dashboard?.url?.trim()?.trimEnd('/')?.takeIf { it.isNotBlank() }?.let { base ->
-                return ProbeTarget(base, "$base/api/status", "/api/status")
+                return ProbeTarget(
+                    baseUrl = base,
+                    requestUrl = "$base/api/health",
+                    path = "/api/health",
+                    legacyFallbackRequestUrl = "$base/api/status",
+                    legacyFallbackPath = "/api/status",
+                )
            }
            return null
        }
@@ -530,8 +798,10 @@ class EndpointResolver(
            ?.let { base ->
                return ProbeTarget(
                    baseUrl = base,
-                    requestUrl = "$base/api/status",
-                    path = "/api/status",
+                    requestUrl = "$base/api/health",
+                    path = "/api/health",
+                    legacyFallbackRequestUrl = "$base/api/status",
+                    legacyFallbackPath = "/api/status",
                )
            }

@@ -602,17 +872,19 @@ class EndpointResolver(
        candidate: EndpointCandidate,
        surface: EndpointSurface = EndpointSurface.Standard,
    ) {
-        val key = cacheKey(candidate, surface)
-        probeCache[key] = CacheEntry(
-            expiresAt = clock() + NEGATIVE_CACHE_TTL_MS,
-            reachable = false,
-        )
-        recordOutcome(
-            candidate,
-            surface,
-            reachable = false,
-            detail = "Network changed — assumed offline",
-        )
+        synchronized(probeStateLock) {
+            val key = cacheKey(candidate, surface)
+            probeCache[key] = CacheEntry(
+                expiresAt = clock() + NEGATIVE_CACHE_TTL_MS,
+                reachable = false,
+            )
+            recordOutcome(
+                candidate,
+                surface,
+                reachable = false,
+                detail = "Network changed — assumed offline",
+            )
+        }
    }

    /**
@@ -623,7 +895,17 @@ class EndpointResolver(
     * just-died route must not outlive the handoff.
     */
    internal fun clearCache() {
-        probeCache.clear()
+        val staleProbes = synchronized(probeStateLock) {
+            probeGeneration += 1L
+            probeCache.clear()
+            inFlightProbes.values.toList().also { inFlightProbes.clear() }
+        }
+        // An explicit re-probe must not join a request that began before the
+        // invalidation signal. Cancellation is resolver-owned (not waiter-
+        // owned), so ordinary lifecycle cancellation still leaves shared
+        // probes alive for other callers. The generation check prevents a
+        // late InterruptedIOException/response from publishing stale state.
+        staleProbes.forEach { it.cancel() }
    }

    /** Test-only: snapshot the current cache for assertion purposes. */
@@ -43,15 +43,16 @@ object HermesLanDiscovery {
    private const val TAG = "HermesLanDiscovery"
    private const val MAX_HOSTS = 254
    private const val MAX_CONCURRENT_PROBES = 32
-    private const val PROBE_TIMEOUT_MS = 650L
+    private const val PROBE_TIMEOUT_MS = 750L
    private const val IPV4_MASK = 0xFFFF_FFFFL

    suspend fun scan(
        context: Context,
        apiPort: Int = 8642,
        dashboardPort: Int = 9119,
+        dashboardOnly: Boolean = false,
    ): List<HermesLanDiscoveryResult> = withContext(Dispatchers.IO) {
-        val hosts = localLanHosts(context.applicationContext)
+        val hosts = prioritizeHostSweep(localLanHosts(context.applicationContext))
        if (hosts.isEmpty()) return@withContext emptyList()

        val client = OkHttpClient.Builder()
@@ -66,7 +67,13 @@ object HermesLanDiscovery {
            hosts.map { host ->
                async {
                    semaphore.withPermit {
-                        probeHost(client, host, apiPort, dashboardPort)?.let { result ->
+                        probeHost(
+                            client,
+                            host,
+                            apiPort,
+                            dashboardPort,
+                            dashboardOnly,
+                        )?.let { result ->
                            result.copy(hostname = resolveHostname(host))
                        }
                    }
@@ -88,6 +95,7 @@ object HermesLanDiscovery {
        host: String,
        apiPort: Int,
        dashboardPort: Int,
+        dashboardOnly: Boolean,
    ): HermesLanDiscoveryResult? {
        val apiUrl = "http://$host:$apiPort"
        val dashboardUrl = "http://$host:$dashboardPort"
@@ -95,12 +103,18 @@ object HermesLanDiscovery {
            client = client,
            url = "$dashboardUrl/api/status",
            expectedBody = ::looksLikeDashboardStatus,
+            attempts = 2,
        )
-        val apiReachable = probe(
-            client = client,
-            url = "$apiUrl/health",
-            expectedBody = ::looksLikeApiHealth,
-        )
+        if (dashboardOnly && !dashboardReachable) return null
+        val apiReachable = if (dashboardOnly) {
+            false
+        } else {
+            probe(
+                client = client,
+                url = "$apiUrl/health",
+                expectedBody = ::looksLikeApiHealth,
+            )
+        }
        if (!dashboardReachable && !apiReachable) return null
        return HermesLanDiscoveryResult(
            host = host,
@@ -115,6 +129,7 @@ object HermesLanDiscovery {
        client: OkHttpClient,
        url: String,
        expectedBody: (String, String) -> Boolean,
+        attempts: Int = 1,
    ): Boolean {
        val httpUrl = url.toHttpUrlOrNull() ?: return false
        val request = Request.Builder()
@@ -123,21 +138,25 @@ object HermesLanDiscovery {
            .header("Accept", "application/json, text/plain, */*")
            .build()

-        return try {
-            client.newCall(request).execute().use { response ->
-                if (response.code == 401 || response.code == 403) {
-                    return true
+        repeat(attempts.coerceAtLeast(1)) { attempt ->
+            try {
+                client.newCall(request).execute().use { response ->
+                    if (response.code == 401 || response.code == 403) {
+                        return true
+                    }
+                    if (!response.isSuccessful) {
+                        if (response.code >= 500 && attempt + 1 < attempts) return@use
+                        return false
+                    }
+                    val contentType = response.header("Content-Type").orEmpty()
+                    val body = response.body.string().take(2_048)
+                    if (expectedBody(body, contentType)) return true
                }
-                if (!response.isSuccessful) {
-                    return false
-                }
-                val contentType = response.header("Content-Type").orEmpty()
-                val body = response.body.string().take(2_048)
-                expectedBody(body, contentType)
+            } catch (_: Exception) {
+                if (attempt + 1 >= attempts) return false
            }
-        } catch (_: Exception) {
-            false
        }
+        return false
    }

    private suspend fun resolveHostname(address: String): String? =
@@ -158,6 +177,23 @@ object HermesLanDiscovery {
        return normalized
    }

+    /** Interleave low/high host suffixes so `.1` and `.250` are both early. */
+    internal fun prioritizeHostSweep(hosts: List<String>): List<String> {
+        val sorted = hosts.distinct().sortedBy { address ->
+            address.split('.').fold(0L) { acc, part ->
+                (acc shl 8) + (part.toLongOrNull() ?: 0L)
+            }
+        }
+        val prioritized = ArrayList<String>(sorted.size)
+        var low = 0
+        var high = sorted.lastIndex
+        while (low <= high) {
+            prioritized += sorted[low++]
+            if (low <= high) prioritized += sorted[high--]
+        }
+        return prioritized
+    }
+
    private fun looksLikeDashboardStatus(body: String, contentType: String): Boolean {
        val lower = body.lowercase()
        return contentType.contains("json", ignoreCase = true) && (
@@ -3,7 +3,6 @@ package com.hermesandroid.relay.network.shared
 import com.hermesandroid.relay.data.EndpointCandidate
 import com.hermesandroid.relay.data.ProxyEndpoint
 import com.hermesandroid.relay.data.isValidPinnedProxy
-import okhttp3.CertificatePinner
 import okhttp3.Interceptor
 import okhttp3.OkHttpClient
 import java.net.URI
@@ -66,9 +65,10 @@ fun EndpointCandidate.pluginProxyRoutesOrNull(): PluginProxyRoutes? =
 private fun formatHost(host: String): String = if (':' in host) "[$host]" else host

 /**
- * Build a client that trusts the system normally, plus exactly the
- * pairing-advertised SPKI for this proxy. The authority guard keeps a pin
- * scoped to host *and port*; OkHttp's CertificatePinner alone is host-only.
+ * Require the paired leaf SPKI for both system-trusted and self-signed chains.
+ * Validate it in the trust manager, before OkHttp's chain cleaning, so a
+ * self-signed paired leaf does not depend on a platform-supplied cleaned chain.
+ * The authority guard applies to HTTP calls and WebSocket upgrades alike.
 */
 fun buildPluginProxyClient(
    baseBuilder: OkHttpClient.Builder,
@@ -88,12 +88,12 @@ fun buildPluginProxyClient(
    if (rawSocketFactory != null) baseBuilder.socketFactory(rawSocketFactory)
    return baseBuilder
        .sslSocketFactory(sslContext.socketFactory, pinnedTrust)
-        .certificatePinner(
-            CertificatePinner.Builder().add(expectedHost, routes.pinSha256).build(),
-        )
-        .addNetworkInterceptor(Interceptor { chain ->
+        .followRedirects(false)
+        .followSslRedirects(false)
+        .addInterceptor(Interceptor { chain ->
            val requestUrl = chain.request().url
-            if (!requestUrl.host.equals(expectedHost, ignoreCase = true) ||
+            if (!requestUrl.isHttps ||
+                !requestUrl.host.equals(expectedHost, ignoreCase = true) ||
                requestUrl.port != expectedPort
            ) {
                throw java.io.IOException("Pinned proxy redirect left its paired authority")
@@ -122,7 +122,7 @@ private fun systemTrustManager(): X509TrustManager {
    return factory.trustManagers.filterIsInstance<X509TrustManager>().single()
 }

-private class PinnedOrSystemTrustManager(
+internal class PinnedOrSystemTrustManager(
    private val system: X509TrustManager,
    private val expectedPin: String,
 ) : X509TrustManager {
@@ -133,10 +133,8 @@ private class PinnedOrSystemTrustManager(
        val certificates = chain?.takeIf { it.isNotEmpty() }
            ?: throw CertificateException("Proxy supplied no certificate chain")
        val systemAccepted = runCatching { system.checkServerTrusted(chain, authType) }.isSuccess
-        if (systemAccepted) return
-
        val leaf = certificates.first()
-        leaf.checkValidity()
+        if (!systemAccepted) leaf.checkValidity()
        val actual = "sha256/" + java.util.Base64.getEncoder().encodeToString(
            MessageDigest.getInstance("SHA-256").digest(leaf.publicKey.encoded),
        )
@@ -13,6 +13,7 @@ import com.hermesandroid.relay.data.MessageRole
 import com.hermesandroid.relay.data.MoaReference
 import com.hermesandroid.relay.data.RealtimeTurnTrace
 import com.hermesandroid.relay.data.ToolCall
+import com.hermesandroid.relay.data.isImageGenerationToolName
 import com.hermesandroid.relay.data.VoiceIntentTrace
 import com.hermesandroid.relay.network.shared.LocalDispatchResult
 import com.hermesandroid.relay.network.upstream.models.MessageItem
@@ -478,12 +479,15 @@ class ChatHandler {
        arrivedWhileAway: Boolean = false,
    ) {
        val id = messageId?.let { "proactive-$it" } ?: "proactive-${java.util.UUID.randomUUID()}"
+        val mediaHits = mutableListOf<Pair<String, MediaMarkerHit>>()
+        val cleanedText = extractMediaMarkersFromContent(id, text, mediaHits)
+        val visibleText = if (mediaHits.isEmpty()) text else cleanedText
        _messages.update { list ->
            if (messageId != null && list.any { it.id == id }) return@update list
            val msg = ChatMessage(
                id = id,
                role = MessageRole.ASSISTANT,
-                content = text,
+                content = visibleText,
                timestamp = System.currentTimeMillis(),
                agentName = agentName,
                badges = if (arrivedWhileAway) listOf("While away") else emptyList(),
@@ -491,6 +495,8 @@ class ChatHandler {
            )
            (list + msg).let { if (it.size > MAX_MESSAGES) it.drop(it.size - MAX_MESSAGES) else it }
        }
+        // The row must exist before the ViewModel attaches a loading card.
+        mediaHits.forEach { (_, hit) -> dispatchMediaHit(id, hit) }
    }

    /**
@@ -517,6 +523,16 @@ class ChatHandler {
        }
    }

+    /** Refresh only an existing local ask, preserving its dispatches and transcript position. */
+    fun updateAskCardMessage(messageId: String, card: HermesCard) {
+        _messages.update { list ->
+            list.map { message ->
+                if (message.clientOnly && message.matchesIdentity(messageId)) message.copy(cards = listOf(card))
+                else message
+            }
+        }
+    }
+
    /**
     * Edit-and-regenerate local truncation: drop [messageId] and everything
     * after it. The gateway performs the authoritative truncation via
@@ -1006,6 +1022,56 @@ class ChatHandler {
        }
    }

+    /**
+     * Bound the ephemeral, read-only child-watch projection. This is stricter
+     * than the main transcript: system rows and tool results are not part of
+     * the preview contract, and one live child must not retain unbounded text.
+     */
+    internal fun boundReadOnlyPreview(
+        maxMessages: Int = 100,
+        maxTotalChars: Int = 32_000,
+        maxFieldChars: Int = 8_000,
+        maxToolChars: Int = 1_000,
+    ): Boolean {
+        var truncated = false
+        _messages.update { current ->
+            val visible = current.filterNot { it.role == MessageRole.SYSTEM }
+            if (visible.size != current.size || visible.size > maxMessages) truncated = true
+            var remaining = maxTotalChars
+            val kept = mutableListOf<ChatMessage>()
+            visible.takeLast(maxMessages).asReversed().forEach { message ->
+                if (remaining <= 0) {
+                    truncated = true
+                    return@forEach
+                }
+                fun bounded(value: String, limit: Int): String {
+                    val allowed = minOf(limit, remaining)
+                    val next = value.takeLast(allowed)
+                    if (next.length != value.length) truncated = true
+                    remaining -= next.length
+                    return next
+                }
+                val content = bounded(message.content, maxFieldChars)
+                val thinking = bounded(message.thinkingContent, maxFieldChars)
+                val tools = message.toolCalls.takeLast(50).map { tool ->
+                    if (message.toolCalls.size > 50) truncated = true
+                    tool.copy(
+                        args = tool.args?.let { bounded(it, maxToolChars) },
+                        result = null,
+                        error = tool.error?.let { bounded(it, maxToolChars) },
+                    )
+                }
+                kept += message.copy(
+                    content = content,
+                    thinkingContent = thinking,
+                    toolCalls = tools,
+                )
+            }
+            kept.asReversed()
+        }
+        return truncated
+    }
+
    /**
     * Rehydrate the last client-owned state of an unfinished turn.
     *
@@ -1400,6 +1466,12 @@ class ChatHandler {
        val loaded = renderedItems.mapNotNull { item ->
            val displayKind = item.displayKind?.trim()?.lowercase()
            if (displayKind == "hidden") return@mapNotNull null
+            val activitySourceId = if (displayKind == "async_delegation_complete") {
+                item.displayMetadata.stringField("delegation_id")?.let { "delegation:$it" }
+                    ?: "unavailable:${item.id}"
+            } else null
+            val activityTaskCount = if (activitySourceId != null) item.displayMetadata.intField("task_count") else null
+            val activityFailedCount = if (activitySourceId != null) item.displayMetadata.intField("failed_count") else null
            val role = when {
                displayKind == "model_switch" ||
                    displayKind == "async_delegation_complete" ||
@@ -1449,11 +1521,13 @@ class ChatHandler {

            // Run the media marker parser on assistant content; strip matched
            // lines and queue hits for post-assignment dispatch.
+            val messageMediaHits = mutableListOf<Pair<String, MediaMarkerHit>>()
            val afterMedia = if (role == MessageRole.ASSISTANT && persistedImages.cleanedText.isNotEmpty()) {
-                extractMediaMarkersFromContent(messageId, persistedImages.cleanedText, pendingMediaHits)
+                extractMediaMarkersFromContent(messageId, persistedImages.cleanedText, messageMediaHits)
            } else {
                persistedImages.cleanedText
            }
+            pendingMediaHits += messageMediaHits

            // Cards are synchronous (no async fetch) so we attach them
            // straight onto the reconstructed ChatMessage and strip their
@@ -1487,15 +1561,34 @@ class ChatHandler {
            val prior = priorById[messageId]
            // Outbound attachments: prefer an id-match (covers any future
            // user-message id reconciliation), else fall back to the
-            // content-keyed queue. Inbound attachments are intentionally
-            // excluded — they come back via the marker re-dispatch.
+            // content-keyed queue. Exact inbound marker attachments are also
+            // carried by id: a history refresh must not replace a successfully
+            // loaded image/file with a fresh LOADING placeholder. A process
+            // restart has no prior attachment, so the marker still dispatches
+            // normally and rehydrates it. One additional narrow exception
+            // retains a completed image_generate result when the immediate
+            // post-turn history read still lacks its MEDIA marker.
            val carriedAttachments = run {
                val persistedImagePaths = persistedImages.paths.toHashSet()
+                val persistedMediaKeys = messageMediaHits.mapTo(HashSet()) { (_, hit) ->
+                    when (hit) {
+                        is MediaMarkerHit.RelayToken -> hit.token
+                        is MediaMarkerHit.BarePath -> hit.path
+                    }
+                }
+                val priorGeneratedImage = prior?.toolCalls.orEmpty().any { tool ->
+                    isImageGenerationToolName(tool.name) &&
+                        tool.isComplete && tool.success != false
+                }
                val byId = prior?.attachments.orEmpty().filter { attachment ->
                    attachment.relayToken == null ||
+                        attachment.relayToken in persistedMediaKeys ||
+                        (role == MessageRole.USER && attachment.relayToken in persistedImagePaths) ||
                        (
-                            role == MessageRole.USER &&
-                                attachment.relayToken in persistedImagePaths
+                            role == MessageRole.ASSISTANT &&
+                                priorGeneratedImage &&
+                                attachment.isImage &&
+                                messageMediaHits.isEmpty()
                            )
                }
                when {
@@ -1539,6 +1632,9 @@ class ChatHandler {
                // this as the same visible row across the post-turn reload.
                prior.copy(
                    id = messageId,
+                    activitySourceId = activitySourceId,
+                    activityTaskCount = activityTaskCount,
+                    activityFailedCount = activityFailedCount,
                    rowId = item.resolvedRowId,
                    reactions = item.reactions,
                    role = role,
@@ -1571,6 +1667,9 @@ class ChatHandler {
                // nothing local to carry).
                ChatMessage(
                    id = messageId,
+                    activitySourceId = activitySourceId,
+                    activityTaskCount = activityTaskCount,
+                    activityFailedCount = activityFailedCount,
                    rowId = item.resolvedRowId,
                    reactions = item.reactions,
                    role = role,
@@ -1641,22 +1740,7 @@ class ChatHandler {
        // Now that the reloaded messages are in state, fire callbacks so the
        // ViewModel can insert LOADING/FAILED attachments via mutateMessage.
        for ((messageId, hit) in pendingMediaHits) {
-            when (hit) {
-                is MediaMarkerHit.RelayToken -> {
-                    val dedupeKey = "$messageId:relay:${hit.token}"
-                    if (dispatchedMediaMarkers.add(dedupeKey)) {
-                        Log.d(TAG, "Media marker accepted from reloaded Relay history")
-                        onMediaAttachmentRequested(messageId, hit.token)
-                    }
-                }
-                is MediaMarkerHit.BarePath -> {
-                    val dedupeKey = "$messageId:bare:${hit.path}"
-                    if (dispatchedMediaMarkers.add(dedupeKey)) {
-                        Log.d(TAG, "Media marker (bare-path, reload): ${hit.path}")
-                        onMediaBarePathRequested(messageId, hit.path)
-                    }
-                }
-            }
+            dispatchMediaHit(messageId, hit)
        }
        for ((messageId, path) in pendingPersistedUserImages) {
            onPersistedUserImageRequested(messageId, path)
@@ -1890,29 +1974,33 @@ class ChatHandler {
        content: String,
        out: MutableList<Pair<String, MediaMarkerHit>>,
    ): String {
-        var cleaned = content
+        val visibleLines = mutableListOf<String>()
        var openFence: String? = null
        for (rawLine in content.lines()) {
            val trimmed = rawLine.trim()
-            if (trimmed.isEmpty()) continue
+            if (trimmed.isEmpty()) {
+                visibleLines += rawLine
+                continue
+            }
            val delimiter = fenceDelimiter(rawLine)
            if (delimiter != null) {
                openFence = if (openFence == delimiter) null else if (openFence == null) delimiter else openFence
+                visibleLines += rawLine
+                continue
+            }
+            if (openFence != null) {
+                visibleLines += rawLine
                continue
            }
-            if (openFence != null) continue

            val hits = parseMediaMarkerLine(trimmed)
            if (hits.isNotEmpty()) {
                hits.forEach { out.add(messageId to it) }
-                cleaned = cleaned
-                    .replace("\n$rawLine\n", "\n")
-                    .replace("\n$rawLine", "")
-                    .replace("$rawLine\n", "")
-                    .replace(rawLine, "")
+            } else {
+                visibleLines += rawLine
            }
        }
-        return cleaned.trim()
+        return visibleLines.joinToString("\n").trim()
    }

    /**
@@ -2036,7 +2124,7 @@ class ChatHandler {
    /**
     * Update sessions list from API response.
     */
-    fun updateSessions(items: List<SessionItem>) {
+    fun updateSessions(items: List<SessionItem>, append: Boolean = false) {
        // Index the current rows so a server row that arrives without a title
        // can inherit a title we already know locally. Auto-titling is a
        // fire-and-forget background job on the server (upstream
@@ -2109,9 +2197,22 @@ class ChatHandler {
        } else {
            null
        }
-        _sessions.value = if (pending != null) listOf(pending) + mapped else mapped
+        val resolved = if (append) {
+            (_sessions.value + mapped)
+                .distinctBy { it.sessionId }
+                .sortedByDescending { it.activityTimestamp }
+        } else {
+            mapped
+        }
+        _sessions.value = if (pending != null && resolved.none { it.sessionId == pending.sessionId }) {
+            listOf(pending) + resolved
+        } else {
+            resolved
+        }
    }

+    fun appendSessions(items: List<SessionItem>) = updateSessions(items, append = true)
+
    fun clearSessions() {
        _sessions.value = emptyList()
    }
@@ -2506,27 +2607,28 @@ class ChatHandler {
     */
    private fun tryDispatchMediaMarker(messageId: String, line: String): Boolean {
        val hits = parseMediaMarkerLine(line)
-        for (hit in hits) {
-            when (hit) {
-                is MediaMarkerHit.RelayToken -> {
-                    val dedupeKey = "$messageId:relay:${hit.token}"
-                    if (dispatchedMediaMarkers.add(dedupeKey)) {
-                        Log.d(TAG, "Media marker accepted from Relay stream")
-                        onMediaAttachmentRequested(messageId, hit.token)
-                    }
-                }
-                is MediaMarkerHit.BarePath -> {
-                    val dedupeKey = "$messageId:bare:${hit.path}"
-                    if (dispatchedMediaMarkers.add(dedupeKey)) {
-                        Log.d(TAG, "Media marker (bare-path): ${hit.path}")
-                        onMediaBarePathRequested(messageId, hit.path)
-                    }
-                }
-            }
-        }
+        hits.forEach { dispatchMediaHit(messageId, it) }
        return hits.isNotEmpty()
    }

+    private fun dispatchMediaHit(messageId: String, hit: MediaMarkerHit) {
+        val (key, reference) = when (hit) {
+            is MediaMarkerHit.RelayToken -> "$messageId:relay:${hit.token}" to hit.token
+            is MediaMarkerHit.BarePath -> "$messageId:bare:${hit.path}" to hit.path
+        }
+        if (!dispatchedMediaMarkers.add(key)) return
+        val alreadyHydrated = _messages.value
+            .firstOrNull { it.matchesIdentity(messageId) }
+            ?.attachments
+            ?.any { it.relayToken == reference } == true
+        if (alreadyHydrated) return
+        Log.d(TAG, "Media marker accepted")
+        when (hit) {
+            is MediaMarkerHit.RelayToken -> onMediaAttachmentRequested(messageId, hit.token)
+            is MediaMarkerHit.BarePath -> onMediaBarePathRequested(messageId, hit.path)
+        }
+    }
+
    /**
     * Remove a matched annotation line from the message's displayed content.
     * This prevents the raw annotation text (e.g., `💻 terminal`) from showing
@@ -3030,7 +3132,9 @@ class ChatHandler {
    fun onSubagentEvent(messageId: String, event: GatewaySubagentEvent) {
        val label = event.goal.trim().take(60).ifBlank { null }
        when (event.phase) {
-            GatewaySubagentEvent.Phase.START -> {
+            GatewaySubagentEvent.Phase.SPAWN_REQUESTED,
+            GatewaySubagentEvent.Phase.START,
+            -> {
                if (label != null) subagentLabels[event.taskIndex] = label
                event.subagentId?.takeIf(String::isNotBlank)?.let {
                    subagentIds[event.taskIndex] = it
@@ -18,6 +18,8 @@ import com.hermesandroid.relay.auth.SecureStoreCache
 import com.hermesandroid.relay.auth.SessionTokenStore
 import com.hermesandroid.relay.auth.buildRawTokenStore
 import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.suspendCancellableCoroutine
+import kotlinx.coroutines.withTimeoutOrNull
 import kotlinx.coroutines.withContext
 import kotlinx.serialization.Serializable
 import kotlinx.serialization.SerialName
@@ -27,6 +29,7 @@ import kotlinx.serialization.json.Json
 import kotlinx.serialization.json.JsonArray
 import kotlinx.serialization.json.JsonElement
 import kotlinx.serialization.json.JsonObject
+import kotlinx.serialization.json.JsonNull
 import kotlinx.serialization.json.JsonPrimitive
 import kotlinx.serialization.json.booleanOrNull
 import kotlinx.serialization.json.buildJsonObject
@@ -34,6 +37,8 @@ import kotlinx.serialization.json.contentOrNull
 import kotlinx.serialization.json.jsonObject
 import kotlinx.serialization.json.jsonPrimitive
 import kotlinx.serialization.json.put
+import okhttp3.Call
+import okhttp3.Callback
 import okhttp3.Cookie
 import okhttp3.CookieJar
 import okhttp3.HttpUrl
@@ -45,11 +50,13 @@ import okhttp3.Request
 import okhttp3.RequestBody
 import okhttp3.RequestBody.Companion.toRequestBody
 import okhttp3.Response
+import java.io.ByteArrayOutputStream
 import java.io.IOException
 import java.io.InputStream
 import java.io.OutputStream
 import java.net.URLEncoder
 import java.util.concurrent.TimeUnit
+import kotlin.coroutines.resume
 import okio.BufferedSink

 // Status/session/provider snapshots are @Serializable so the Manage tab's
@@ -288,6 +295,34 @@ internal fun copyBounded(
    return written
 }

+internal fun copyMediaBounded(
+    input: InputStream,
+    output: OutputStream,
+    declaredLength: Long?,
+    limitBytes: Long,
+): Long {
+    require(limitBytes > 0)
+    require(declaredLength == null || declaredLength >= 0)
+    if (declaredLength != null && declaredLength > limitBytes) {
+        throw IOException("File exceeds the configured download limit")
+    }
+    val buffer = ByteArray(DEFAULT_BUFFER_SIZE)
+    var written = 0L
+    while (true) {
+        val read = input.read(buffer)
+        if (read < 0) break
+        written += read
+        if (written > limitBytes) {
+            throw IOException("File exceeds the configured download limit")
+        }
+        output.write(buffer, 0, read)
+    }
+    if (declaredLength != null && written != declaredLength) {
+        throw IOException("Media file changed while it was being downloaded")
+    }
+    return written
+}
+
 /** One entry from `GET /api/audio/elevenlabs/voices` — non-secret voice metadata. */
 data class ElevenLabsVoice(
    val voiceId: String,
@@ -305,6 +340,19 @@ data class ElevenLabsVoices(
    val voices: List<ElevenLabsVoice>,
 )

+/**
+ * Metadata for a file streamed from upstream's authenticated managed-files surface.
+ *
+ * The Dashboard applies its own managed-root, sensitive-file, and maximum-size
+ * policy before the file leaves the Hermes host. Android applies the user's
+ * stricter inbound-media cap while reading the response as a second boundary.
+ */
+data class DashboardFetchedFile(
+    val sizeBytes: Long,
+    val contentType: String,
+    val fileName: String?,
+)
+
 /**
 * Native client for the Hermes dashboard/admin server (:9119).
 *
@@ -315,13 +363,17 @@ data class ElevenLabsVoices(
 */
 class DashboardApiClient(
    baseUrl: String,
-    private val okHttpClient: OkHttpClient = defaultClient(),
+    internal val okHttpClient: OkHttpClient = defaultClient(),
+    private val ownsHttpClient: Boolean = true,
    private val json: Json = Json {
        ignoreUnknownKeys = true
        isLenient = true
        coerceInputValues = true
    },
    private val nowMillis: () -> Long = System::currentTimeMillis,
+    private val sessionReadTimeoutMillis: Long = SESSION_READ_TIMEOUT_MILLIS,
+    private val controlReadTimeoutMillis: Long = CONTROL_READ_TIMEOUT_MILLIS,
+    private val sessionEnrichmentBudgetMillis: Long = SESSION_ENRICHMENT_BUDGET_MILLIS,
 ) {
    private val baseUrl: String = baseUrl.trim().trimEnd('/')
    private val sessionPrScanLock = Any()
@@ -372,6 +424,58 @@ class DashboardApiClient(
        executeJsonElement(request, normalized)
    }

+    /**
+     * Download a server-local artifact through current upstream Hermes.
+     *
+     * This is the same authenticated `/api/files/download` route official
+     * Desktop uses for remote gateway files. The caller supplies its display
+     * cap so a malicious or stale Content-Length cannot cause an unbounded
+     * allocation. The supplied output is normally Android's on-disk media cache;
+     * local playback supplies seeking, so `/api/files/stream` is unnecessary
+     * on this path.
+     */
+    suspend fun downloadManagedFile(
+        serverPath: String,
+        maxBytes: Long,
+        output: OutputStream,
+    ): Result<DashboardFetchedFile> = withContext(Dispatchers.IO) {
+        if (serverPath.isBlank()) {
+            return@withContext Result.failure(IOException("Media path is empty"))
+        }
+        if (maxBytes <= 0L) {
+            return@withContext Result.failure(IOException("Media download limit is invalid"))
+        }
+        val httpUrl = resolveUrl("/api/files/download")
+            ?.newBuilder()
+            ?.addQueryParameter("path", serverPath)
+            ?.build()
+            ?: return@withContext Result.failure(invalidUrlException())
+        val request = Request.Builder().url(httpUrl).get().build()
+
+        executeCancellable(request, "Dashboard media download") { response ->
+            val body = response.body
+            val declaredLength = body.contentLength().takeIf { it >= 0L }
+            if (declaredLength != null && declaredLength > maxBytes) {
+                throw IOException("File exceeds the configured download limit")
+            }
+            val readTotal = body.byteStream().use { input ->
+                copyMediaBounded(input, output, declaredLength, maxBytes)
+            }
+            DashboardFetchedFile(
+                sizeBytes = readTotal,
+                contentType = response.header("Content-Type")
+                    ?.substringBefore(';')
+                    ?.trim()
+                    ?.takeIf(String::isNotEmpty)
+                    ?: "application/octet-stream",
+                fileName = response.header("Content-Disposition")
+                    ?.let(::contentDispositionFileName)
+                    ?: serverPath.substringAfterLast('/').substringAfterLast('\\')
+                        .takeIf(String::isNotBlank),
+            )
+        }
+    }
+
    suspend fun postJsonObject(
        path: String,
        payload: JsonObject = JsonObject(emptyMap()),
@@ -1027,16 +1131,20 @@ class DashboardApiClient(
    suspend fun listSessions(
        profile: String? = null,
        limit: Int = SESSION_LIST_WINDOW_LIMIT,
+        offset: Int = 0,
        archived: String? = null,
+        excludeSources: Collection<String> = emptyList(),
    ): Result<List<SessionItem>> =
        withContext(Dispatchers.IO) {
+            val readDeadlineNanos = System.nanoTime() +
+                TimeUnit.MILLISECONDS.toNanos(sessionReadTimeoutMillis.coerceAtLeast(1L))
            val sessions = linkedMapOf<String, SessionItem>()
            for (page in sessionListPages(limit)) {
                val query = buildList {
                    // Upstream dashboard GET /api/sessions rejects pages over 100.
                    // Keep Android's 200-row drawer window via two bounded pages.
                    add("limit=${page.limit}")
-                    add("offset=${page.offset}")
+                    add("offset=${offset.coerceAtLeast(0) + page.offset}")
                    add("order=recent")
                    add("min_messages=1")
                    val name = profile?.trim().orEmpty()
@@ -1045,8 +1153,33 @@ class DashboardApiClient(
                    // Omitted unless requested so older hosts see an unchanged request.
                    val archivedMode = archived?.trim().orEmpty()
                    if (archivedMode.isNotBlank()) add("archived=${pathSegment(archivedMode)}")
+                    val excluded = excludeSources
+                        .asSequence()
+                        .map(String::trim)
+                        .filter(String::isNotBlank)
+                        .map(String::lowercase)
+                        .distinct()
+                        .sorted()
+                        .toList()
+                    if (excluded.isNotEmpty()) {
+                        add("exclude_sources=${queryValue(excluded.joinToString(","))}")
+                    }
                }.joinToString(prefix = "?", separator = "&")
-                val pageResult = getJson("/api/sessions$query").mapCatching { root ->
+                val remainingReadMillis = TimeUnit.NANOSECONDS.toMillis(
+                    readDeadlineNanos - System.nanoTime(),
+                )
+                if (remainingReadMillis <= 0L) {
+                    return@withContext Result.failure(
+                        IOException("Dashboard session list exceeded its bounded read window"),
+                    )
+                }
+                val pageResult = getJson(
+                    "/api/sessions$query",
+                    // One budget covers the complete 200-row operation. A slow
+                    // first page cannot silently turn the nominal 8s bound into
+                    // 16s when the second page is needed.
+                    callTimeoutMillis = remainingReadMillis,
+                ).mapCatching { root ->
                    val parsed = json.decodeFromJsonElement(SessionListResponse.serializer(), root)
                    parsed.sessions ?: parsed.items ?: parsed.data ?: emptyList()
                }
@@ -1055,13 +1188,20 @@ class DashboardApiClient(
                pageSessions.forEach { sessions.putIfAbsent(it.id, it) }
                if (pageSessions.size < page.limit) break
            }
-            Result.success(
+            val listed = sessions.values.take(limit.coerceIn(1, SESSION_LIST_WINDOW_LIMIT))
+            // Repository/PR decoration is useful drawer metadata, but it is not
+            // authoritative session data. Keep it off the critical path when an
+            // older host or an unavailable GitHub helper stalls: return the exact
+            // profile-scoped rows within a small budget and retry decoration on a
+            // later refresh. Cancellation also cancels the active OkHttp call.
+            val enriched = withTimeoutOrNull(sessionEnrichmentBudgetMillis) {
                enrichSessionWorkState(
-                    sessions.values.take(limit.coerceIn(1, SESSION_LIST_WINDOW_LIMIT)),
+                    listed,
                    fixedProfile = profile?.trim()?.takeIf { it.isNotBlank() }
                        ?: DEFAULT_SESSION_PROFILE_SCOPE,
-                ),
-            )
+                )
+            } ?: listed
+            Result.success(enriched)
        }

    /**
@@ -1217,7 +1357,7 @@ class DashboardApiClient(
    suspend fun getSessionMessages(
        sessionId: String,
        profile: String? = null,
-        mode: SessionMessageLoadMode = SessionMessageLoadMode.COMPLETE,
+        mode: SessionMessageLoadMode = SessionMessageLoadMode.LATEST,
    ): Result<List<MessageItem>> = withContext(Dispatchers.IO) {
        val name = profile?.trim().orEmpty()
        loadSessionMessages(mode) { page ->
@@ -1227,7 +1367,10 @@ class DashboardApiClient(
                add("order=${page.order}")
                if (name.isNotBlank()) add("profile=${pathSegment(name)}")
            }.joinToString(prefix = "?", separator = "&")
-            getJson("/api/sessions/${pathSegment(sessionId)}/messages$query").mapCatching { root ->
+            getJson(
+                "/api/sessions/${pathSegment(sessionId)}/messages$query",
+                callTimeoutMillis = sessionReadTimeoutMillis,
+            ).mapCatching { root ->
                val parsed = json.decodeFromJsonElement(MessageListResponse.serializer(), root)
                SessionMessagePage(
                    messages = parsed.messages ?: parsed.data ?: parsed.items ?: emptyList(),
@@ -1364,7 +1507,7 @@ class DashboardApiClient(
            val patched = buildJsonObject {
                obj.forEach { (k, v) -> put(k, v) }
                if (obj["name"] == null && !nameOverride.isNullOrBlank()) put("name", nameOverride)
-                if (obj["model"] == null) put("model", "")
+                if (obj["model"] == null || obj["model"] == JsonNull) put("model", "")
            }
            json.decodeFromJsonElement(Profile.serializer(), patched)
        }.getOrNull()
@@ -1383,10 +1526,14 @@ class DashboardApiClient(
        password: String,
        next: String = "/",
    ): Result<DashboardLoginResponse> = withContext(Dispatchers.IO) {
+        // Match the Dashboard's single-line HTML username/password controls:
+        // remove only forbidden line breaks and preserve every other code point.
+        val normalizedUsername = username.replace("\r", "").replace("\n", "")
+        val normalizedPassword = password.replace("\r", "").replace("\n", "")
        val payload = buildJsonObject {
            put("provider", provider)
-            put("username", username)
-            put("password", password)
+            put("username", normalizedUsername)
+            put("password", normalizedPassword)
            put("next", next)
        }
        val httpUrl = resolveUrl("/auth/password-login")
@@ -1471,10 +1618,14 @@ class DashboardApiClient(
            .post(ByteArray(0).toRequestBody(null))
            .build()

-        executeJson(request, "Dashboard websocket ticket").mapCatching { root ->
+        executeJson(
+            request,
+            "Dashboard websocket ticket",
+            callTimeoutMillis = controlReadTimeoutMillis,
+        ).mapCatching { root ->
            val ticket = root.stringField("ticket")
                ?: root.stringField("ws_ticket")
-                ?: throw IOException("Dashboard websocket ticket response missing ticket")
+                ?: throw IllegalStateException("Dashboard websocket ticket response missing ticket")
            DashboardWsTicket(
                ticket = ticket,
                ttlSeconds = root.intField("ttl_seconds") ?: root.intField("ttl"),
@@ -1496,44 +1647,77 @@ class DashboardApiClient(
        profile = profile,
    )

-    fun shutdown() = shutdownOffMainThread("DashboardApiClient-shutdown") {
-        okHttpClient.dispatcher.executorService.shutdown()
-        okHttpClient.connectionPool.evictAll()
+    fun shutdown() {
+        if (!ownsHttpClient) return
+        shutdownOffMainThread("DashboardApiClient-shutdown") {
+            okHttpClient.dispatcher.executorService.shutdown()
+            okHttpClient.connectionPool.evictAll()
+        }
    }

-    private suspend fun getJson(path: String): Result<JsonObject> = withContext(Dispatchers.IO) {
+    private suspend fun getJson(
+        path: String,
+        callTimeoutMillis: Long? = null,
+    ): Result<JsonObject> = withContext(Dispatchers.IO) {
        val httpUrl = resolveUrl(path) ?: return@withContext Result.failure(invalidUrlException())
        val request = Request.Builder()
            .url(httpUrl)
            .get()
            .build()
-        executeJson(request, path)
+        executeJson(request, path, callTimeoutMillis)
    }

-    private fun executeJson(request: Request, operation: String): Result<JsonObject> {
-        return try {
-            okHttpClient.newCall(request).execute().use { response ->
-                if (!response.isSuccessful) {
-                    return Result.failure(apiFailure(response, operation))
-                }
-                Result.success(response.readJsonObject(json))
-            }
-        } catch (e: Exception) {
-            Result.failure(e)
-        }
+    private suspend fun executeJson(
+        request: Request,
+        operation: String,
+        callTimeoutMillis: Long? = null,
+    ): Result<JsonObject> = executeCancellable(request, operation, callTimeoutMillis) { response ->
+        response.readJsonObject(json)
    }

-    private fun executeJsonElement(request: Request, operation: String): Result<JsonElement> {
-        return try {
-            okHttpClient.newCall(request).execute().use { response ->
-                if (!response.isSuccessful) {
-                    return Result.failure(apiFailure(response, operation))
-                }
-                Result.success(response.readJsonElement(json))
-            }
-        } catch (e: Exception) {
-            Result.failure(e)
+    private suspend fun executeJsonElement(
+        request: Request,
+        operation: String,
+    ): Result<JsonElement> = executeCancellable(request, operation) { response ->
+        response.readJsonElement(json)
+    }
+
+    /** Bridge OkHttp cancellation to the owning coroutine so superseded profile reads do not linger. */
+    private suspend fun <T> executeCancellable(
+        request: Request,
+        operation: String,
+        callTimeoutMillis: Long? = null,
+        decode: (Response) -> T,
+    ): Result<T> = suspendCancellableCoroutine { continuation ->
+        val call = okHttpClient.newCall(request)
+        callTimeoutMillis?.takeIf { it > 0L }?.let {
+            call.timeout().timeout(it, TimeUnit.MILLISECONDS)
        }
+        continuation.invokeOnCancellation { call.cancel() }
+        call.enqueue(object : Callback {
+            override fun onFailure(call: Call, e: IOException) {
+                runCatching {
+                    if (continuation.isActive) continuation.resume(Result.failure(e))
+                }
+            }
+
+            override fun onResponse(call: Call, response: Response) {
+                val result = response.use {
+                    try {
+                        if (!it.isSuccessful) {
+                            Result.failure(apiFailure(it, operation))
+                        } else {
+                            Result.success(decode(it))
+                        }
+                    } catch (error: Exception) {
+                        Result.failure(error)
+                    }
+                }
+                runCatching {
+                    if (continuation.isActive) continuation.resume(result)
+                }
+            }
+        })
    }

    private suspend fun download(
@@ -1570,10 +1754,18 @@ class DashboardApiClient(
    companion object {
        private val JSON_MEDIA = "application/json; charset=utf-8".toMediaType()
        private const val DEFAULT_SESSION_PROFILE_SCOPE = "__dashboard_default__"
+        // Desktop allows 60s for its 40-row recents request. Android uses a
+        // similarly small initial window and a bounded 20s mobile budget;
+        // the old 8s deadline repeatedly cancelled valid first-load reads on
+        // large profile databases before any row could be shown.
+        private const val SESSION_READ_TIMEOUT_MILLIS = 20_000L
+        private const val CONTROL_READ_TIMEOUT_MILLIS = 8_000L
+        private const val SESSION_ENRICHMENT_BUDGET_MILLIS = 1_500L
        internal const val ACTIVE_SESSION_PR_MISS_TTL_MILLIS = 60_000L
        // Mirrors current upstream `_MANAGED_FILE_MAX_BYTES`; enforcing it
        // client-side avoids uploading a body the Dashboard will reject.
        internal const val MAX_BACKUP_TRANSFER_BYTES = 100L * 1024L * 1024L
+        internal const val MAX_JSON_RESPONSE_BYTES = 8L * 1024L * 1024L

        fun pathSegment(value: String): String =
            URLEncoder.encode(value, "UTF-8").replace("+", "%20")
@@ -1712,8 +1904,9 @@ class DashboardApiClient(
            cookieStore: DashboardCookieStore = InMemoryDashboardCookieStore(),
            bearerAuth: DashboardBearerAuth? = null,
        ): OkHttpClient {
+            val cookieJar = DashboardCookieJar(cookieStore)
            val builder = OkHttpClient.Builder()
-                .cookieJar(DashboardCookieJar(cookieStore))
+                .cookieJar(cookieJar)
                .connectTimeout(10, TimeUnit.SECONDS)
                // Skills-hub search fans out server-side with a 30s overall
                // timeout; keep the read window above it so a slow-but-successful
@@ -1721,6 +1914,7 @@ class DashboardApiClient(
                .readTimeout(45, TimeUnit.SECONDS)
                .writeTimeout(30, TimeUnit.SECONDS)
            bearerAuth?.let {
+                it.preferCookiesWhen(cookieJar::hasCookiesFor)
                builder.addInterceptor(it)
                builder.authenticator(it)
            }
@@ -1963,9 +2157,10 @@ fun sameDashboardBase(candidate: String, trusted: String): Boolean {
 fun trustedDashboardBearerAuthOrNull(
    candidate: String,
    trusted: String,
+    httpConsentOrigins: Set<String> = emptySet(),
    tokenStoreProvider: () -> NativeDashboardTokenStore,
 ): DashboardBearerAuth? =
-    if (isNativeDashboardTransportEligible(candidate) &&
+    if (isNativeDashboardTransportEligible(candidate, httpConsentOrigins) &&
        sameDashboardBase(candidate, trusted)
    ) {
        DashboardBearerAuth(candidate, tokenStoreProvider())
@@ -2080,14 +2275,20 @@ class DashboardCookieJar(
    private val store: DashboardCookieStore,
    private val clockMillis: () -> Long = { System.currentTimeMillis() },
 ) : CookieJar {
+    fun hasCookiesFor(url: HttpUrl): Boolean = loadForRequest(url).isNotEmpty()
+
    override fun saveFromResponse(url: HttpUrl, cookies: List<Cookie>) {
        val now = clockMillis()
        val incoming = cookies.map { StoredDashboardCookie.fromCookie(it) }
            .filterNot { it.isExpired(now) }
+        val incomingSessionFamilies = incoming.mapNotNullTo(mutableSetOf()) {
+            it.sessionFamilyKey()
+        }
        val retained = store.load()
            .filterNot { it.isExpired(now) }
            .filterNot { old -> incoming.any { it.key == old.key } }
-        store.save(retained + incoming)
+            .filterNot { old -> old.sessionFamilyKey() in incomingSessionFamilies }
+        store.save(collapseDashboardSessionCookieVariants(retained + incoming))
    }

    override fun loadForRequest(url: HttpUrl): List<Cookie> {
@@ -2095,7 +2296,9 @@ class DashboardCookieJar(
        // Load once (each load() is a decrypt + JSON decode); prune expired
        // entries back to disk only when something actually expired.
        val all = store.load()
-        val stored = all.filterNot { it.isExpired(now) }
+        val stored = collapseDashboardSessionCookieVariants(
+            all.filterNot { it.isExpired(now) },
+        )
        if (stored.size != all.size) {
            store.save(stored)
        }
@@ -2104,61 +2307,6 @@ class DashboardCookieJar(
    }
 }

-/**
- * Copy only Hermes' authenticated dashboard session cookies to another host
- * that belongs to the same saved Connection. Dashboard cookies are host-only
- * by design, while a Connection may reach one server through LAN and
- * Tailscale hostnames/IPs. The encrypted store remains the source of truth and
- * explicit sign-out clears every mirrored host together.
- *
- * PKCE, SSO-attempt, and unrelated application cookies are intentionally not
- * copied. Secure cookies also remain Secure; this helper never downgrades them
- * for an HTTP route.
- */
-fun mirrorDashboardSessionCookies(
-    store: DashboardCookieStore,
-    targetUrl: String,
-    trustedHosts: Set<String>,
-    clockMillis: () -> Long = { System.currentTimeMillis() },
-): Int {
-    val targetHost = targetUrl.toHttpUrlOrNull()?.host?.lowercase() ?: return 0
-    val allowedHosts = trustedHosts.mapTo(mutableSetOf()) { it.lowercase() }
-    if (targetHost !in allowedHosts) return 0
-
-    val now = clockMillis()
-    val all = store.load()
-    val live = all.filterNot { it.isExpired(now) }
-    val existingTargetKeys = live.asSequence()
-        .filter { it.domain.equals(targetHost, ignoreCase = true) }
-        .map { "${it.name.lowercase()}|$targetHost|${it.path}" }
-        .toSet()
-    val mirrored = live.asSequence()
-        .filter { it.isDashboardSessionCookie() }
-        .filter { it.domain.lowercase() in allowedHosts }
-        .filterNot { it.domain.equals(targetHost, ignoreCase = true) }
-        .groupBy { "${it.name.lowercase()}|${it.path}" }
-        .values
-        .mapNotNull { candidates -> candidates.maxByOrNull { it.expiresAt } }
-        .map { it.copy(domain = targetHost, hostOnly = true) }
-        .filterNot { it.key in existingTargetKeys }
-        .toList()
-
-    if (mirrored.isNotEmpty() || live.size != all.size) {
-        store.save(live + mirrored)
-    }
-    return mirrored.size
-}
-
-private fun StoredDashboardCookie.isDashboardSessionCookie(): Boolean {
-    val bareName = name
-        .removePrefix("__Host-")
-        .removePrefix("__Secure-")
-    return bareName == "hermes_session" ||
-        bareName == "hermes_session_at" ||
-        bareName == "hermes_session_rt" ||
-        bareName == "hermes_session_provider"
-}
-
 /**
 * Cookie jar that resolves the backing per-connection store at request time.
 *
@@ -2220,13 +2368,78 @@ fun importDashboardCookieHeader(
        .filterNot { it.isExpired(now) }
    if (imported.isEmpty()) return 0

+    val importedSessionFamilies = imported.mapNotNullTo(mutableSetOf()) {
+        it.sessionFamilyKey()
+    }
    val retained = store.load()
        .filterNot { it.isExpired(now) }
        .filterNot { old -> imported.any { it.key == old.key } }
-    store.save(retained + imported)
+        .filterNot { old -> old.sessionFamilyKey() in importedSessionFamilies }
+    store.save(collapseDashboardSessionCookieVariants(retained + imported))
    return imported.size
 }

+private val DASHBOARD_SESSION_COOKIE_FAMILIES = setOf(
+    "hermes_session",
+    "hermes_session_at",
+    "hermes_session_rt",
+    "hermes_session_provider",
+)
+
+internal val DASHBOARD_SESSION_COOKIE_VARIANT_NAMES: List<String> =
+    DASHBOARD_SESSION_COOKIE_FAMILIES.flatMap { name ->
+        listOf(name, "__Host-$name", "__Secure-$name")
+    }
+
+private fun isDashboardSessionCookieName(name: String): Boolean =
+    name.lowercase()
+        .removePrefix("__host-")
+        .removePrefix("__secure-") in DASHBOARD_SESSION_COOKIE_FAMILIES
+
+/**
+ * Clear only Hermes session cookies that would be attached to [requestUrl].
+ * Called solely after an explicit provider selection; background 503 probes
+ * never mutate auth state.
+ */
+internal fun clearDashboardSessionCookiesForRequest(
+    store: DashboardCookieStore,
+    requestUrl: String,
+): Int {
+    val url = requestUrl.toHttpUrlOrNull() ?: return 0
+    val current = store.load()
+    val retained = current.filterNot { stored ->
+        isDashboardSessionCookieName(stored.name) && stored.toCookie()?.matches(url) == true
+    }
+    if (retained.size != current.size) store.save(retained)
+    return current.size - retained.size
+}
+
+private fun StoredDashboardCookie.sessionFamilyKey(): String? {
+    val normalized = name.lowercase()
+        .removePrefix("__host-")
+        .removePrefix("__secure-")
+    if (normalized !in DASHBOARD_SESSION_COOKIE_FAMILIES) return null
+    return "$normalized|${domain.lowercase()}|$path"
+}
+
+/**
+ * HTTPS/proxy changes can leave bare, `__Host-`, and `__Secure-` variants in
+ * Android's imported WebView store. Hermes treats those names as one logical
+ * session family and prefers the strict prefix, so coexistence can revive an
+ * older provider session. Preserve list order and keep only the newest variant.
+ */
+private fun collapseDashboardSessionCookieVariants(
+    cookies: List<StoredDashboardCookie>,
+): List<StoredDashboardCookie> {
+    val lastIndexByFamily = mutableMapOf<String, Int>()
+    cookies.forEachIndexed { index, cookie ->
+        cookie.sessionFamilyKey()?.let { lastIndexByFamily[it] = index }
+    }
+    return cookies.filterIndexed { index, cookie ->
+        cookie.sessionFamilyKey()?.let { lastIndexByFamily[it] == index } ?: true
+    }
+}
+
@Serializable
 data class StoredDashboardCookie(
    val name: String,
@@ -2282,21 +2495,142 @@ data class StoredDashboardCookie(
 }

 private fun Response.readJsonObject(json: Json): JsonObject {
-    val raw = body.string()
+    val raw = body.readUtf8Bounded(DashboardApiClient.MAX_JSON_RESPONSE_BYTES)
    if (raw.isBlank()) return JsonObject(emptyMap())
    return json.parseToJsonElement(raw).jsonObject
 }

 private fun Response.readJsonElement(json: Json): JsonElement {
-    val raw = body.string()
+    val raw = body.readUtf8Bounded(DashboardApiClient.MAX_JSON_RESPONSE_BYTES)
    if (raw.isBlank()) return JsonObject(emptyMap())
    return json.parseToJsonElement(raw)
 }

+internal fun okhttp3.ResponseBody.readUtf8Bounded(maxBytes: Long): String {
+    require(maxBytes in 1..Int.MAX_VALUE.toLong()) { "Invalid response byte limit" }
+    val declaredLength = contentLength()
+    if (declaredLength > maxBytes) {
+        throw IOException("Dashboard response exceeds Android's bounded JSON limit")
+    }
+    val initialSize = when {
+        declaredLength in 1..maxBytes -> declaredLength.toInt()
+        else -> minOf(maxBytes, DEFAULT_BUFFER_SIZE.toLong()).toInt()
+    }
+    val output = ByteArrayOutputStream(initialSize)
+    byteStream().use { input ->
+        val buffer = ByteArray(DEFAULT_BUFFER_SIZE)
+        var total = 0L
+        while (true) {
+            val read = input.read(buffer)
+            if (read < 0) break
+            total += read
+            if (total > maxBytes) {
+                throw IOException("Dashboard response exceeds Android's bounded JSON limit")
+            }
+            output.write(buffer, 0, read)
+        }
+    }
+    return output.toString(Charsets.UTF_8.name())
+}
+
+private fun contentDispositionFileName(header: String): String? {
+    val encoded = Regex("""filename\*=UTF-8''([^;]+)""", RegexOption.IGNORE_CASE)
+        .find(header)
+        ?.groupValues
+        ?.getOrNull(1)
+        ?.let { runCatching { java.net.URLDecoder.decode(it, "UTF-8") }.getOrNull() }
+    val plain = Regex("""filename=\"([^\"]+)\"|filename=([^;]+)""", RegexOption.IGNORE_CASE)
+        .find(header)
+        ?.let { it.groupValues[1].ifBlank { it.groupValues[2] } }
+        ?.trim()
+        ?.trim('"')
+    return (encoded ?: plain)
+        ?.substringAfterLast('/')
+        ?.substringAfterLast('\\')
+        ?.takeIf(String::isNotBlank)
+}
+
+internal class DashboardHttpException(
+    val statusCode: Int,
+    message: String,
+) : IOException(message)
+
+internal fun Throwable.isDashboardAuthProviderUnavailable(): Boolean {
+    var current: Throwable? = this
+    val seen = java.util.Collections.newSetFromMap(
+        java.util.IdentityHashMap<Throwable, Boolean>(),
+    )
+    while (current != null && seen.add(current)) {
+        if (
+            current is DashboardHttpException &&
+            current.statusCode == 503 &&
+            current.message.orEmpty().contains("Auth provider", ignoreCase = true) &&
+            current.message.orEmpty().contains("unreachable", ignoreCase = true)
+        ) {
+            return true
+        }
+        current = current.cause
+    }
+    return false
+}
+
+internal fun Throwable.isDashboardSignInRequiredFailure(): Boolean {
+    if (isDashboardAuthProviderUnavailable()) return true
+    var current: Throwable? = this
+    val seen = java.util.Collections.newSetFromMap(
+        java.util.IdentityHashMap<Throwable, Boolean>(),
+    )
+    while (current != null && seen.add(current)) {
+        // Every 401 from an authenticated Dashboard route means the saved
+        // browser/native session can no longer authorize this request. Older
+        // gateways used `no_cookie`/`unauthenticated`; current builds may return
+        // reason codes such as `session_expired`, or no structured body at all.
+        if (current is DashboardHttpException && current.statusCode == 401) {
+            return true
+        }
+        current = current.cause
+    }
+    return false
+}
+
+/** True only when the managed-file route itself is absent on this Hermes build. */
+internal fun Throwable.isDashboardManagedFilesUnsupported(): Boolean {
+    var current: Throwable? = this
+    val seen = java.util.Collections.newSetFromMap(
+        java.util.IdentityHashMap<Throwable, Boolean>(),
+    )
+    while (current != null && seen.add(current)) {
+        if (current is DashboardHttpException) {
+            if (current.statusCode in setOf(405, 501)) return true
+            if (current.statusCode == 404) {
+                val detail = current.message.orEmpty()
+                // FastAPI's missing-route response is the generic "Not Found".
+                // A real managed-file miss says "File not found" and must not
+                // silently escape to Relay's broader path policy.
+                val isManagedFileMiss = detail.contains("File not found", ignoreCase = true) ||
+                    detail.contains("Path not found", ignoreCase = true)
+                val isGenericRouteMiss = detail.trim().endsWith(": not found", ignoreCase = true) ||
+                    detail.contains("\"detail\":\"Not Found\"", ignoreCase = true) ||
+                    detail.contains("\"detail\": \"Not Found\"", ignoreCase = true)
+                if (!isManagedFileMiss && isGenericRouteMiss) return true
+            }
+        }
+        current = current.cause
+    }
+    return false
+}
+
 private fun apiFailure(response: Response, operation: String): IOException {
-    val bodyDetail = runCatching { response.body.string() }.getOrDefault("")
+    val bodyDetail = try {
+        response.body.readUtf8Bounded(4L * 1024L)
+    } catch (_: Exception) {
+        ""
+    }
    val detail = bodyDetail.take(240).ifBlank { response.message }
-    return IOException("$operation failed - HTTP ${response.code}: $detail")
+    return DashboardHttpException(
+        statusCode = response.code,
+        message = "$operation failed - HTTP ${response.code}: $detail",
+    )
 }

 private fun JsonObject?.stringField(name: String): String? =
@@ -0,0 +1,38 @@
+package com.hermesandroid.relay.network.upstream
+
+import java.io.IOException
+
+data class DashboardSetupVerification(
+    val status: DashboardStatus,
+    val session: DashboardAuthSession,
+    val ticketAvailable: Boolean,
+) {
+    val authenticated: Boolean get() = session.authenticated && ticketAvailable
+}
+
+/** Public status is discovery, not proof that a phone can use protected Dashboard routes. */
+suspend fun DashboardApiClient.verifySetup(): DashboardSetupVerification {
+    val status = getStatus().getOrThrow()
+    var session = currentSession().getOrThrow()
+    val ticketAvailable = if (session.authenticated) {
+        val ticket = requestWsTicket()
+        val failure = ticket.exceptionOrNull()
+        if (failure?.isDashboardSignInRequiredFailure() == true) {
+            session = session.copy(authenticated = false)
+            false
+        } else {
+            ticket.getOrThrow()
+            true
+        }
+    } else false
+    if (!status.authRequired && !session.authenticated) {
+        throw DashboardLocalAuthenticationRequiredException()
+    }
+    return DashboardSetupVerification(status, session, ticketAvailable)
+}
+
+class DashboardLocalAuthenticationRequiredException : IOException(
+    "Hermes is reachable, but protected requests are not authorized. If the Dashboard is forwarded " +
+        "from loopback, check its bind address, authentication provider, and dashboard.public_url " +
+        "on the host. A 401 alone does not identify the cause.",
+)
@@ -7,6 +7,7 @@ import kotlinx.serialization.json.JsonPrimitive
 import kotlinx.serialization.json.contentOrNull
 import kotlinx.serialization.json.doubleOrNull
 import kotlinx.serialization.json.intOrNull
+import kotlinx.serialization.json.longOrNull
 import kotlinx.serialization.json.booleanOrNull

 /**
@@ -31,19 +32,66 @@ class GatewayEventMapper(
    var turnEnded: Boolean = false
        private set

+    @get:Synchronized
    internal val currentInteraction: GatewayAsk?
        get() = pendingInteraction
+    @Volatile internal var interactionGeneration: Long = 0
+        private set

-    internal fun restoreInteraction(ask: GatewayAsk) {
-        val duplicate = pendingInteraction?.sameRequestAs(ask) == true
-        pendingInteraction = ask
-        if (!duplicate) callbacks.onInteractionRequest(ask)
+    @Synchronized internal fun restoreInteraction(ask: GatewayAsk) {
+        val previous = pendingInteraction
+        val duplicate = previous?.sameRequestAs(ask) == true
+        if (!duplicate) interactionGeneration++
+        val merged = if (duplicate && ask.questions.isNotEmpty()) {
+            ask.withAnswers(previous.answers + ask.answers, previous)
+        } else if (ask.questions.isNotEmpty()) ask.withAnswers(emptyMap()) else ask
+        if (merged.ownershipToken.retired.get() && !merged.clarifyComplete) {
+            if (duplicate) pendingInteraction = null
+            callbacks.onInteractionExpired(GatewayAskExpiry(merged.kind, merged.requestId))
+            if (pendingInteraction == null) drainDeferredTerminalEvent()
+            return
+        }
+        pendingInteraction = merged
+        if (!duplicate || previous != merged) callbacks.onInteractionRequest(merged)
+        if (merged.clarifyComplete) {
+            pendingInteraction = null
+            drainDeferredTerminalEvent()
+        }
+    }
+
+    @Synchronized internal fun acknowledgeClarify(
+        requestId: String,
+        questionId: String?,
+        answer: String,
+        expired: Boolean,
+        generation: Long = interactionGeneration,
+    ) {
+        if (generation != interactionGeneration) return
+        val pending = pendingInteraction ?: return
+        if (pending.kind != GatewayAsk.Kind.CLARIFY || pending.requestId != requestId) return
+        if (!expired && questionId != null && pending.questions.none { it.qid == questionId }) return
+        if (!expired && questionId != null && pending.questions.any { it.qid == questionId }) {
+            val updated = pending.withAnswers(pending.answers + (questionId to answer))
+            if (updated.questions.any { it.qid !in updated.answers }) {
+                pendingInteraction = updated
+                return
+            }
+        }
+        acknowledgeInteraction(GatewayAskExpiry(GatewayAsk.Kind.CLARIFY, requestId))
+    }
+
+    @Synchronized internal fun acknowledgeClarifyOwner(
+        requestId: String, questionId: String?, answer: String, expired: Boolean, owner: GatewayAskOwnership,
+    ) {
+        if (pendingInteraction?.ownershipToken !== owner) return
+        acknowledgeClarify(requestId, questionId, answer, expired)
    }

    /** Retire only the ask whose explicit respond RPC reached server truth. */
-    internal fun acknowledgeInteraction(expiry: GatewayAskExpiry) {
+    @Synchronized internal fun acknowledgeInteraction(expiry: GatewayAskExpiry) {
        val pending = pendingInteraction ?: return
        if (pending.matches(expiry)) {
+            pending.ownershipToken.retired.set(true)
            pendingInteraction = null
            drainDeferredTerminalEvent()
        }
@@ -76,7 +124,7 @@ class GatewayEventMapper(
     */
    private val generatingIdsByName = mutableMapOf<String, ArrayDeque<String>>()

-    fun onEvent(type: String, payload: JsonObject?) {
+    @Synchronized fun onEvent(type: String, payload: JsonObject?) {
        if (turnEnded) return

        interactionRequest(type, payload)?.let { ask ->
@@ -87,6 +135,7 @@ class GatewayEventMapper(
        interactionExpiry(type, payload)?.let { expiry ->
            val pending = pendingInteraction
            if (pending != null && pending.matches(expiry)) {
+                pending.ownershipToken.retired.set(true)
                pendingInteraction = null
            }
            callbacks.onInteractionExpired(expiry)
@@ -195,7 +244,8 @@ class GatewayEventMapper(

            "tool.start" -> {
                clearActivityStatuses()
-                val name = payload.string("name") ?: "unknown"
+                val identity = payload.effectiveToolIdentity()
+                val name = identity.name
                // A pending generating placeholder for this name is adopted
                // (consumed FIFO) whether or not the server sent a real id.
                val adopted = generatingIdsByName[name]?.removeFirstOrNull()
@@ -207,7 +257,7 @@ class GatewayEventMapper(
                    }
                    else -> syntheticToolId(name)
                }
-                val argsPreview = payload?.get("args")
+                val argsPreview = identity.argsPreview ?: payload?.get("args")
                    ?.takeUnless { it is JsonPrimitive && it.contentOrNull.isNullOrBlank() }
                    ?.toString()
                    ?.takeIf { it.isNotBlank() && it != "null" }
@@ -219,7 +269,7 @@ class GatewayEventMapper(

            "tool.complete" -> {
                clearActivityStatuses()
-                val name = payload.string("name") ?: "unknown"
+                val name = payload.effectiveToolIdentity().name
                val toolId = payload.string("tool_id")
                    ?: openSyntheticIdsByName[name]?.removeFirstOrNull()
                    ?: return
@@ -278,36 +328,19 @@ class GatewayEventMapper(

            "error" -> {
                turnEnded = true
-                callbacks.onError(payload.string("message") ?: "Gateway error")
+                val message = payload.string("message") ?: "Gateway error"
+                if (isSessionOwnershipRejection(message)) {
+                    callbacks.onSubmitRejected(message)
+                } else {
+                    callbacks.onError(message)
+                }
            }

-            "subagent.start", "subagent.thinking", "subagent.tool",
+            "subagent.spawn_requested", "subagent.start", "subagent.thinking", "subagent.tool",
            "subagent.progress", "subagent.complete",
            -> {
                clearActivityStatuses()
-                val phase = when (type) {
-                    "subagent.start" -> GatewaySubagentEvent.Phase.START
-                    "subagent.thinking" -> GatewaySubagentEvent.Phase.THINKING
-                    "subagent.tool" -> GatewaySubagentEvent.Phase.TOOL
-                    "subagent.progress" -> GatewaySubagentEvent.Phase.PROGRESS
-                    else -> GatewaySubagentEvent.Phase.COMPLETE
-                }
-                callbacks.onSubagentEvent(
-                    GatewaySubagentEvent(
-                        phase = phase,
-                        taskIndex = payload.int("task_index") ?: 0,
-                        taskCount = payload.int("task_count") ?: 1,
-                        goal = payload.string("goal") ?: "",
-                        status = payload.string("status"),
-                        summary = payload.string("summary"),
-                        toolName = payload.string("tool_name"),
-                        // subagent.tool sets tool_preview AND mirrors it into
-                        // text; thinking/progress carry text only.
-                        preview = payload.string("tool_preview") ?: payload.string("text"),
-                        durationSeconds = payload.double("duration_seconds"),
-                        subagentId = payload.string("subagent_id"),
-                    ),
-                )
+                parseSubagentEvent(type, payload)?.let(callbacks.onSubagentEvent)
            }

            "tool.output_risk" -> {
@@ -392,8 +425,26 @@ class GatewayEventMapper(
                }
            }

-            // Known-but-unrendered (notification.show, …) and unknown types
-            // alike: ignore.
+            "notification.show" -> {
+                val text = payload.string("text")?.trim().orEmpty()
+                if (text.isNotEmpty()) {
+                    callbacks.onNoticeShow(
+                        GatewayAgentNotice(
+                            text = text,
+                            level = payload.string("level"),
+                            kind = payload.string("kind"),
+                            ttlMs = payload.long("ttl_ms"),
+                            key = payload.string("key"),
+                            id = payload.string("id"),
+                        ),
+                    )
+                }
+            }
+
+            "notification.clear" ->
+                payload.string("key")?.trim()?.takeIf(String::isNotEmpty)?.let(callbacks.onNoticeClear)
+
+            // Unknown event types remain forward-compatible no-ops.
            else -> Unit
        }
        previousEventType = type
@@ -437,6 +488,42 @@ class GatewayEventMapper(
    }

    companion object {
+        /** Shared by turn transcripts and the session-owned activity stream. */
+        fun parseSubagentEvent(type: String, payload: JsonObject?): GatewaySubagentEvent? {
+            if (type !in setOf(
+                    "subagent.spawn_requested", "subagent.start", "subagent.thinking",
+                    "subagent.tool", "subagent.progress", "subagent.complete",
+                )) return null
+            val phase = when (type) {
+                "subagent.spawn_requested" -> GatewaySubagentEvent.Phase.SPAWN_REQUESTED
+                "subagent.start" -> GatewaySubagentEvent.Phase.START
+                "subagent.thinking" -> GatewaySubagentEvent.Phase.THINKING
+                "subagent.tool" -> GatewaySubagentEvent.Phase.TOOL
+                "subagent.progress" -> GatewaySubagentEvent.Phase.PROGRESS
+                else -> GatewaySubagentEvent.Phase.COMPLETE
+            }
+
+            return GatewaySubagentEvent(
+                phase = phase,
+                taskIndex = payload.int("task_index") ?: 0,
+                taskCount = payload.int("task_count") ?: 1,
+                goal = payload.string("goal") ?: "",
+                status = payload.string("status"),
+                summary = payload.string("summary"),
+                toolName = payload.string("tool_name"),
+                // subagent.tool sets tool_preview AND mirrors it into
+                // text; thinking/progress carry text only.
+                preview = payload.string("tool_preview") ?: payload.string("text"),
+                durationSeconds = payload.double("duration_seconds"),
+                subagentId = payload.string("subagent_id"),
+                childSessionId = payload.string("child_session_id"),
+                parentId = payload.string("parent_id"),
+                depth = payload.int("depth"),
+                model = payload.string("model"),
+                delegationId = payload.string("delegation_id"),
+            )
+        }
+
        const val PROVIDER_WAIT_STATUS_KIND = "provider_wait"
        const val COMPACTION_STATUS_KIND = "compacting"
        const val ERROR_STATUS_KIND = "error"
@@ -445,32 +532,26 @@ class GatewayEventMapper(
        private const val MAX_MOA_REFERENCE_CHARS = 16_000
        private val OUTPUT_RISK_LEVELS = setOf("low", "medium", "high", "critical")
        private val TERMINAL_EVENTS = setOf("message.complete", "error")
+
+        /**
+         * Isolated-turn paths can acknowledge `prompt.submit` and then emit
+         * the ownership refusal as a plain terminal `error` event. That event
+         * has no JSON-RPC code or structured reason, so match both stable
+         * clauses from upstream's canonical message.
+         */
+        internal fun isSessionOwnershipRejection(message: String): Boolean {
+            val normalized = message.lowercase()
+            return "already has a live owner (" in normalized &&
+                "only one surface at a time may run a session" in normalized
+        }
+
        internal fun isFailedMoaReference(text: String): Boolean {
            val normalized = text.trimStart().lowercase()
            return normalized.startsWith("[failed:") || normalized.startsWith("[skipped:")
        }

        fun interactionRequest(type: String, payload: JsonObject?): GatewayAsk? = when (type) {
-            "clarify.request" -> {
-                val choices = (payload?.get("choices") as? JsonArray)
-                    ?.mapNotNull { (it as? JsonPrimitive)?.contentOrNull?.trim() }
-                    ?.filter { it.isNotEmpty() }
-                    ?.distinct()
-                    ?.take(MAX_CLARIFY_CHOICES)
-                    ?.takeIf { it.isNotEmpty() }
-                GatewayAsk(
-                    kind = GatewayAsk.Kind.CLARIFY,
-                    requestId = payload.string("request_id"),
-                    text = payload.string("question") ?: "The agent needs clarification",
-                    choices = choices,
-                    multiSelect = payload.boolean("multi_select") == true && choices != null,
-                    // Current upstream owns expiry through clarify.expire and
-                    // does not advertise its configurable deadline. Never
-                    // invent a local deadline; consume future additive
-                    // metadata only when it is present and positive.
-                    timeoutSeconds = payload.int("timeout_seconds")?.coerceAtLeast(0) ?: 0,
-                )
-            }
+            "clarify.request" -> clarifyRequest(payload)

            "approval.request" -> GatewayAsk(
                kind = GatewayAsk.Kind.APPROVAL,
@@ -503,6 +584,41 @@ class GatewayEventMapper(
            else -> null
        }

+        private fun clarifyRequest(payload: JsonObject?): GatewayAsk? {
+            val rawQuestions = payload?.get("questions")
+            if (rawQuestions != null && rawQuestions !is JsonArray) return null
+            val questions = rawQuestions?.map { value ->
+                val row = value as? JsonObject ?: return null
+                val qid = (row["qid"] as? JsonPrimitive)?.takeIf { it.isString }
+                    ?.contentOrNull?.takeIf(String::isNotBlank) ?: return null
+                val text = row.string("question")?.takeIf(String::isNotBlank) ?: return null
+                val choices = (row["choices"] as? JsonArray)?.mapNotNull {
+                    (it as? JsonPrimitive)?.takeIf { option -> option.isString }
+                        ?.contentOrNull?.takeIf(String::isNotBlank)
+                }.orEmpty().take(MAX_CLARIFY_CHOICES)
+                GatewayClarifyQuestion(qid, text, choices, row.boolean("multi_select") == true && choices.isNotEmpty())
+            }.orEmpty()
+            if (questions.size > MAX_CLARIFY_QUESTIONS || questions.map { it.qid }.distinct().size != questions.size) return null
+            val choices = (payload?.get("choices") as? JsonArray)
+                ?.mapNotNull { (it as? JsonPrimitive)?.contentOrNull?.trim() }
+                ?.filter(String::isNotEmpty)?.distinct()?.take(MAX_CLARIFY_CHOICES)
+                ?.takeIf { it.isNotEmpty() }
+            return GatewayAsk(
+                kind = GatewayAsk.Kind.CLARIFY,
+                requestId = payload.string("request_id"),
+                text = payload.string("question") ?: "The agent needs clarification",
+                choices = choices,
+                multiSelect = payload.boolean("multi_select") == true && choices != null,
+                // Upstream owns its configurable deadline; only consume advertised metadata.
+                timeoutSeconds = payload.int("timeout_seconds")?.coerceAtLeast(0) ?: 0,
+                questions = questions,
+                answers = (payload?.get("answers") as? JsonObject)?.mapNotNull { (qid, value) ->
+                    (value as? JsonPrimitive)?.takeIf { it.isString }?.contentOrNull
+                        ?.takeIf { questions.any { q -> q.qid == qid } }?.let { qid to it }
+                }?.toMap().orEmpty(),
+            )
+        }
+
        fun interactionExpiry(type: String, payload: JsonObject?): GatewayAskExpiry? = when (type) {
            "clarify.expire" -> GatewayAskExpiry(
                kind = GatewayAsk.Kind.CLARIFY,
@@ -582,15 +698,47 @@ class GatewayEventMapper(
 // Upstream clarify tool accepts at most four choices. Sudo/secret retain fixed
 // `_block()` timeouts; clarify is configurable and expires authoritatively.
 private const val MAX_CLARIFY_CHOICES = 4
+private const val MAX_CLARIFY_QUESTIONS = 5
 private const val SUDO_TIMEOUT_SECONDS = 120
 private const val SECRET_TIMEOUT_SECONDS = 300

+private data class GatewayToolIdentity(
+    val name: String,
+    val argsPreview: String?,
+)
+
+/**
+ * Older Tool Search gateways can expose the model-visible `tool_call` bridge
+ * instead of the effective tool identity that current upstream callbacks use.
+ * Unwrap only the bridge's explicit structured `{name, arguments}` envelope;
+ * never infer a tool from prompt text or result content.
+ */
+private fun JsonObject?.effectiveToolIdentity(): GatewayToolIdentity {
+    val outerName = string("name") ?: "unknown"
+    val outerArgs = this?.get("args") as? JsonObject
+    if (outerName != "tool_call" || outerArgs == null) {
+        return GatewayToolIdentity(outerName, null)
+    }
+    val effectiveName = outerArgs.string("name")
+        ?.trim()
+        ?.takeIf { it.isNotEmpty() }
+        ?: return GatewayToolIdentity(outerName, null)
+    val effectiveArgs = outerArgs["arguments"]
+        ?.takeUnless { it is JsonPrimitive && it.contentOrNull.isNullOrBlank() }
+        ?.toString()
+        ?.takeIf { it.isNotBlank() && it != "null" }
+    return GatewayToolIdentity(effectiveName, effectiveArgs)
+}
+
 private fun JsonObject?.string(key: String): String? =
    (this?.get(key) as? JsonPrimitive)?.contentOrNull

 private fun JsonObject?.int(key: String): Int? =
    (this?.get(key) as? JsonPrimitive)?.intOrNull

+private fun JsonObject?.long(key: String): Long? =
+    (this?.get(key) as? JsonPrimitive)?.longOrNull
+
 private fun JsonObject?.double(key: String): Double? =
    (this?.get(key) as? JsonPrimitive)?.doubleOrNull

@@ -9,18 +9,23 @@ import android.content.Context
 import android.content.Intent
 import android.content.pm.ServiceInfo
 import android.content.res.Configuration
+import android.net.Uri
 import android.os.Build
 import android.os.IBinder
+import android.os.Looper
 import android.util.Log
+import androidx.annotation.MainThread
 import androidx.core.app.NotificationCompat
+import androidx.datastore.preferences.core.edit
 import com.hermesandroid.relay.MainActivity
 import com.hermesandroid.relay.R
-import com.hermesandroid.relay.data.setGatewayKeepAlive
+import com.hermesandroid.relay.data.KEY_GATEWAY_KEEP_ALIVE
+import com.hermesandroid.relay.data.relayDataStore
 import kotlinx.coroutines.CoroutineScope
 import kotlinx.coroutines.Dispatchers
 import kotlinx.coroutines.SupervisorJob
-import kotlinx.coroutines.cancel
 import kotlinx.coroutines.launch
+import java.util.UUID

 /**
 * Foreground service that holds the app process up so work the user already
@@ -48,16 +53,16 @@ import kotlinx.coroutines.launch
 *
 * The service's only job is to hold the process in the foreground. The socket
 * stays open because [GatewayChatClient.setKeepAliveInBackground] stops its
- * idle-close timer while retention is required. On task removal (user swipes the app
- * away) the ViewModel + socket die with the process, so the service stops
- * itself rather than leave a notification that lies about being connected.
+ * idle-close timer while retention is required. Task removal releases local
+ * foreground protection; it does not terminate server-owned work or assume
+ * that removing a task kills the application process.
 *
- * # Android 15 watchdog
+ * # Foreground-start obligation (Android 8+)
 *
- * On target SDK 35 any intent to a service that declares a foregroundServiceType
- * must call `startForeground` within 5s — so [onStartCommand] always does that
- * first, before branching on the action. Shutdown goes through [stop]
- * (`stopService`) to bypass [onStartCommand] entirely.
+ * An accepted startForegroundService must promote promptly, even if demand
+ * disappears before delivery. Never stopService a pending start: Android 12
+ * also treats teardown before promotion as a foreground-start failure.
+ * Main-thread demand is coalesced until onStartCommand acknowledges the start.
 */
 class GatewayKeepAliveService : Service() {
    companion object {
@@ -67,47 +72,76 @@ class GatewayKeepAliveService : Service() {
        const val NOTIFICATION_ID = 4713
        const val ACTION_STOP = "com.hermesandroid.relay.gateway.KEEPALIVE_STOP"
        private const val ACTION_REFRESH = "com.hermesandroid.relay.gateway.KEEPALIVE_REFRESH"
-        private const val EXTRA_PERSISTENT = "persistent"
-        private const val EXTRA_ACTIVE_TURNS = "active_turns"
-        private const val EXTRA_WAITING_SESSIONS = "waiting_sessions"
-        @Volatile private var runningInstance: GatewayKeepAliveService? = null
+        private const val EXTRA_START_TOKEN = "start_token"
+        private var runningInstance: GatewayKeepAliveService? = null
+        private var pendingStart: String? = null
+        private var desiredPersistent = false
+        private var desiredTurns = ActiveTurnKeepAliveRegistry.Snapshot()
+        private var wasForeground = false
+        private var taskRemoved = false
+        @Volatile private var persistentToken: String? = null
+        // Preference writes must survive service teardown, but never process death.
+        private val preferenceScope = CoroutineScope(SupervisorJob() + Dispatchers.Main.immediate)

+        @MainThread
        fun update(
            context: Context,
            persistent: Boolean,
            activeTurns: ActiveTurnKeepAliveRegistry.Snapshot,
+            appForeground: Boolean = true,
        ) {
-            if (!persistent && !activeTurns.required) {
-                stop(context)
-                return
+            checkMainThread()
+            if (appForeground && !wasForeground) taskRemoved = false
+            wasForeground = appForeground
+            if (persistent != desiredPersistent) {
+                persistentToken = if (persistent) UUID.randomUUID().toString() else null
            }
-            runningInstance?.let { service ->
-                service.applyState(persistent, activeTurns)
-                service.startForegroundNotification()
+            desiredPersistent = persistent
+            desiredTurns = activeTurns
+            // Keep the accepted start alive until Android delivers its command.
+            if (pendingStart != null) return
+            runningInstance?.let {
+                it.reconcile()
                return
            }
+            if (taskRemoved || !appForeground || (!persistent && !activeTurns.required)) return
+            val token = UUID.randomUUID().toString()
+            pendingStart = token
            val intent = Intent(context.applicationContext, GatewayKeepAliveService::class.java)
                .setAction(ACTION_REFRESH)
-                .putExtra(EXTRA_PERSISTENT, persistent)
-                .putExtra(EXTRA_ACTIVE_TURNS, activeTurns.activeTurnCount)
-                .putExtra(EXTRA_WAITING_SESSIONS, activeTurns.waitingSessionCount)
-            if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.O) {
-                context.applicationContext.startForegroundService(intent)
-            } else {
-                context.applicationContext.startService(intent)
+                .putExtra(EXTRA_START_TOKEN, token)
+            try {
+                if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.O) {
+                    context.applicationContext.startForegroundService(intent)
+                } else {
+                    context.applicationContext.startService(intent)
+                }
+            } catch (e: Exception) {
+                pendingStart = null
+                Log.w(TAG, "Foreground service launch rejected; retaining server-owned work", e)
            }
        }

+        @MainThread
        fun stop(context: Context) {
-            // stopService() bypasses onStartCommand, so a "please shut down"
-            // never trips the Android 15 foreground-start watchdog.
-            context.applicationContext.stopService(
-                Intent(context.applicationContext, GatewayKeepAliveService::class.java),
-            )
+            update(context, false, ActiveTurnKeepAliveRegistry.Snapshot(), wasForeground)
+        }
+
+        private fun checkMainThread() {
+            check(Looper.myLooper() == Looper.getMainLooper())
+        }
+
+        internal fun resetForTest() {
+            runningInstance = null
+            pendingStart = null
+            desiredPersistent = false
+            desiredTurns = ActiveTurnKeepAliveRegistry.Snapshot()
+            persistentToken = null
+            wasForeground = false
+            taskRemoved = false
        }
    }

-    private val scope = CoroutineScope(SupervisorJob() + Dispatchers.IO)
    private var persistent = false
    private var activeTurns = 0
    private var waitingSessions = 0
@@ -116,45 +150,63 @@ class GatewayKeepAliveService : Service() {

    override fun onCreate() {
        super.onCreate()
-        runningInstance = this
+        // No datastore, socket, coroutine or other owner work ahead of promotion.
+        // A cold stale notification action has no accepted foreground start.
+        if (pendingStart != null) {
+            applyState(desiredPersistent, desiredTurns)
+            startForegroundNotification()
+        }
    }

    override fun onStartCommand(intent: Intent?, flags: Int, startId: Int): Int {
+        val token = intent?.getStringExtra(EXTRA_START_TOKEN)
        if (intent?.action == ACTION_REFRESH) {
-            persistent = intent.getBooleanExtra(EXTRA_PERSISTENT, false)
-            activeTurns = intent.getIntExtra(EXTRA_ACTIVE_TURNS, 0).coerceAtLeast(0)
-            waitingSessions = intent.getIntExtra(EXTRA_WAITING_SESSIONS, 0)
-                .coerceIn(0, activeTurns)
-        }
-        startForegroundNotification()
-        if (intent?.action == ACTION_STOP) {
-            Log.i(TAG, "ACTION_STOP → user disabled continuous background connection")
-            scope.launch { runCatching { applicationContext.setGatewayKeepAlive(false) } }
-            persistent = false
-            if (activeTurns == 0) {
-                stopForeground(STOP_FOREGROUND_REMOVE)
-                stopSelf()
-            } else {
-                startForegroundNotification()
+            applyState(desiredPersistent, desiredTurns)
+            // Also promote reused service instances before acknowledging the start.
+            // A delivered start still owes promotion if process-local demand
+            // was lost or its token is stale. Never replay its old demand.
+            if (startForegroundNotification()) {
+                if (token == pendingStart) pendingStart = null
+                if (pendingStart == null) {
+                    runningInstance = this
+                    reconcile()
+                }
            }
-            return START_NOT_STICKY
+        } else if (intent?.action == ACTION_STOP &&
+            intent.data?.lastPathSegment == persistentToken && persistentToken != null
+        ) {
+            val actionToken = persistentToken
+            val context = applicationContext
+            preferenceScope.launch {
+                try {
+                    context.relayDataStore.edit { preferences ->
+                        // Recheck inside the serialized edit; an old action must
+                        // not undo a subsequent disable/re-enable cycle.
+                        if (persistentToken == actionToken) preferences[KEY_GATEWAY_KEEP_ALIVE] = false
+                    }
+                } catch (e: Exception) {
+                    Log.w(TAG, "Could not disable persistent connection", e)
+                }
+            }
+            // The preference collector reconciles current active-turn demand
+            // after persistence. Never stop from the notification's old snapshot.
        }
+        if (runningInstance !== this && pendingStart == null) stopSelfResult(startId)
        return START_NOT_STICKY
    }

    override fun onTaskRemoved(rootIntent: Intent?) {
        super.onTaskRemoved(rootIntent)
-        // The socket lives in the ViewModel, which dies when the task is
-        // removed — keeping the notification would be a lie. Stop cleanly.
        Log.i(TAG, "onTaskRemoved → app swiped away; stopping keep-alive")
-        ActiveTurnKeepAliveRegistry.releaseAll()
-        stopForeground(STOP_FOREGROUND_REMOVE)
-        stopSelf()
+        taskRemoved = true
+        // Leases belong to chat owners. Keep them intact so a surviving
+        // process can protect unfinished turns again when the user returns.
+        // A queued new start still owes Android promotion before retirement.
+        if (pendingStart == null) retire()
    }

    override fun onDestroy() {
        if (runningInstance === this) runningInstance = null
-        scope.cancel()
        super.onDestroy()
    }

@@ -164,7 +216,23 @@ class GatewayKeepAliveService : Service() {
        // this foreground service (and its Gateway socket) alive. Re-post the
        // existing notification so its localized title/body follow the new
        // application resources without restarting either owner.
-        startForegroundNotification()
+        if (runningInstance === this) reconcile()
+    }
+
+    private fun reconcile() {
+        if (taskRemoved || (!desiredPersistent && !desiredTurns.required)) {
+            retire()
+        } else {
+            applyState(desiredPersistent, desiredTurns)
+            startForegroundNotification()
+        }
+    }
+
+    private fun retire() {
+        if (runningInstance === this) runningInstance = null
+        // Let Android remove the foreground notification with service teardown.
+        // Do not demote an instance while another start may be queued for it.
+        stopSelf()
    }

    private fun applyState(
@@ -181,10 +249,10 @@ class GatewayKeepAliveService : Service() {
    // satisfied. Suppress retained defensively — lint's ForegroundServiceType
    // check is finicky about correlating the runtime type arg with the manifest.
    @SuppressLint("ForegroundServiceType")
-    private fun startForegroundNotification() {
-        ensureChannel()
-        val notification = buildNotification()
+    private fun startForegroundNotification(): Boolean {
        try {
+            ensureChannel()
+            val notification = buildNotification()
            if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.UPSIDE_DOWN_CAKE) {
                startForeground(
                    NOTIFICATION_ID,
@@ -194,9 +262,12 @@ class GatewayKeepAliveService : Service() {
            } else {
                startForeground(NOTIFICATION_ID, notification)
            }
-        } catch (t: Throwable) {
-            Log.w(TAG, "startForeground failed — stopping keep-alive", t)
-            stopSelf()
+            return true
+        } catch (e: Exception) {
+            Log.w(TAG, "Foreground notification failed; retaining server-owned work", e)
+            pendingStart = null
+            retire()
+            return false
        }
    }

@@ -208,6 +279,7 @@ class GatewayKeepAliveService : Service() {
        val tapPending = PendingIntent.getActivity(this, 0, tapIntent, pendingFlags)

        val stopIntent = Intent(this, GatewayKeepAliveService::class.java).setAction(ACTION_STOP)
+            .setData(Uri.parse("hermes-relay://keep-alive/$persistentToken"))
        val stopPending = PendingIntent.getService(this, 1, stopIntent, pendingFlags)

        val (title, body) = when {
--- a/Show More
+++ b/Show More