fix(android): repair immutable release dispatch

release(android): android-v1.5.0

.github/workflows/approve-release-android.yml

@@ -89,7 +89,7 @@ jobs:
           VERSION: ${{ steps.metadata.outputs.version }}
         run: |
           gh workflow run release-android.yml \
-            --ref="android-v${VERSION}" \
+            --ref=main \
             -f version="$VERSION"
 
       - name: Approval summary
@@ -97,4 +97,4 @@ jobs:
           echo "## Android release approved" >> "$GITHUB_STEP_SUMMARY"
           echo "" >> "$GITHUB_STEP_SUMMARY"
           echo "Created \`android-v${{ steps.metadata.outputs.version }}\` from main at \`$GITHUB_SHA\`." >> "$GITHUB_STEP_SUMMARY"
-          echo "The release workflow was dispatched at that tag. It will submit the preflighted Play draft before creating the public GitHub Release." >> "$GITHUB_STEP_SUMMARY"
+          echo "The current release workflow was dispatched from main and will check out that immutable tag. It will submit the preflighted Play draft before creating the public GitHub Release." >> "$GITHUB_STEP_SUMMARY"

.github/workflows/release-android.yml

@@ -12,8 +12,9 @@ on:
     tags:
       - "android-v*"
   # Approve Android Release creates its tag with GITHUB_TOKEN, whose tag event
-  # does not recursively start workflows. It explicitly dispatches this file
-  # at that tag instead. Manual tag pushes continue to use the push trigger.
+  # does not recursively start workflows. It dispatches the current workflow
+  # definition from main, while every job checks out the immutable tag. Manual
+  # tag pushes continue to use the push trigger.
   workflow_dispatch:
     inputs:
       version:
@@ -37,19 +38,22 @@ jobs:
       - uses: actions/checkout@v7
         with:
           fetch-depth: 0
+          ref: ${{ github.event_name == 'workflow_dispatch' && format('android-v{0}', inputs.version) || github.ref }}
 
       - name: Extract version from tag
         id: version
         env:
           DISPATCHED_VERSION: ${{ inputs.version }}
         run: |
-          REF_VERSION="${GITHUB_REF#refs/tags/android-v}"
-          if [ "$GITHUB_REF" = "$REF_VERSION" ]; then
+          if [ -n "$DISPATCHED_VERSION" ]; then
             REF_VERSION="$DISPATCHED_VERSION"
-          fi
-          if [ -n "$DISPATCHED_VERSION" ] && [ "$DISPATCHED_VERSION" != "$REF_VERSION" ]; then
-            echo "::error::Dispatched version $DISPATCHED_VERSION does not match ref version $REF_VERSION"
-            exit 1
+            TAG_COMMIT=$(git rev-list -n 1 "android-v${REF_VERSION}")
+            if [ -z "$TAG_COMMIT" ] || [ "$TAG_COMMIT" != "$(git rev-parse HEAD)" ]; then
+              echo "::error::Checked-out commit does not match immutable tag android-v${REF_VERSION}"
+              exit 1
+            fi
+          else
+            REF_VERSION="${GITHUB_REF#refs/tags/android-v}"
           fi
           VERSION_CODE=$(grep -oP 'appVersionCode\s*=\s*"\K[^"]+' gradle/libs.versions.toml)
           echo "version=$REF_VERSION" >> "$GITHUB_OUTPUT"
@@ -67,8 +71,8 @@ jobs:
             echo "::error::Tag version ($TAG_VERSION) does not match appVersionName ($TOML_VERSION) in gradle/libs.versions.toml"
             exit 1
           fi
-          if ! grep -Fq "## [$TAG_VERSION]" CHANGELOG.md; then
-            echo "::error::CHANGELOG.md has no release heading for $TAG_VERSION"
+          if ! grep -Eq "^## \\[(Android )?${TAG_VERSION}\\]" CHANGELOG.md; then
+            echo "::error::CHANGELOG.md has no Android release heading for $TAG_VERSION"
             exit 1
           fi
 
@@ -111,6 +115,8 @@ jobs:
     timeout-minutes: 30
     steps:
       - uses: actions/checkout@v7
+        with:
+          ref: ${{ github.event_name == 'workflow_dispatch' && format('android-v{0}', inputs.version) || github.ref }}
 
       - name: Set up JDK 17
         uses: actions/setup-java@v5
@@ -147,6 +153,8 @@ jobs:
     timeout-minutes: 30
     steps:
       - uses: actions/checkout@v7
+        with:
+          ref: ${{ github.event_name == 'workflow_dispatch' && format('android-v{0}', inputs.version) || github.ref }}
 
       - name: Set up JDK 17
         uses: actions/setup-java@v5

CHANGELOG.md

@@ -6,18 +6,8 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/), and this
 
 ## [Unreleased]
 
-### Added
-
-- **Android onboarding finishes with a permission setup step.** After connecting, users can enable background chat alerts with one deliberate Android prompt, review optional feature permissions individually, or continue immediately without granting phone access.
-- **Image generation stays visible when upstream tool progress is hidden.** A paired Relay can expose read-only image-tool activity from Hermes session state so Android shows and completes its existing generation animation during Standard Gateway turns; the image canvas replaces generic streaming progress and crossfades into the result within one stable assistant bubble. Native Gateway lifecycle events remain authoritative and Relay remains optional.
-
 ### Fixed
 
-- **Background chats stay reachable without an always-on connection.** Android now protects user-started work until every concurrent Gateway session settles, shows active and waiting counts in its ongoing notification, and gives each privacy-safe interaction alert expanded session context plus a direct review, answer, or secure-response action.
-- **Android alerts when a background Gateway turn needs input.** Approval, clarification, elevated-permission, and secret requests post privacy-safe notifications that reopen the correct conversation, survive reconnect replay without duplicates, and clear when the request is answered or expires.
-- **Promoted voice tasks keep their Chat row through background delivery.** Completing the provider's initial spoken handoff no longer removes an otherwise empty assistant bubble that still owns a running background task.
-- **Android accepts deliberately installed private certificate authorities.** Google Play and sideload builds now use Android's user CA store alongside system roots for self-hosted HTTPS/WSS connections while preserving certificate-chain, hostname, and Relay pin verification.
-- **Malformed code blocks no longer crash Android Markdown rendering.** Syntax highlighting now bounds dependency-provided spans before applying them, preserving valid highlighting while safely ignoring reversed or out-of-bounds ranges.
 - **Windows-trusted certificates work in the desktop CLI.** The packaged Windows binary and newer Node runtimes add the Windows certificate store without dropping bundled or operator-supplied roots, while TLS verification and Relay certificate pinning remain enforced.
 
 ## [Server 1.4.3] - 2026-07-22
@@ -32,14 +22,18 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/), and this
 - **Plugin bootstrap work no longer blocks the Gateway event loop.** Database initialization and compatibility-state inspection run off the async request path while preserving older upstream bootstrap behavior.
 - **Starting Relay no longer terminates a running Hermes gateway on Windows.** Profile discovery now checks gateway PIDs through non-signalling process APIs, including during periodic rescans.
 
-## [Android 1.5.0] - 2026-07-22
+## [Android 1.5.0] - 2026-07-25
 
 ### Added
 
 - **Voice settings are organized around Standard and Realtime paths.** Provider, model, and voice choices use a cleaner card layout with upstream-aware discovery, useful descriptions, inline previews, waveform feedback, loading skeletons, and an expandable scrolling voice browser.
 - **Standard Hermes speech streams while replies are generated.** Android plays completed speech segments as they arrive, interrupts prior playback before starting another preview or reply, and stops audio when leaving voice mode.
 - **Manage and diagnostics expose more upstream Gateway controls.** Android consumes health hints, follows canonical redirects, compresses larger RPC payloads, scopes diagnostics by profile, and surfaces compatibility information without requiring Relay-only behavior.
-- **Chat shows richer upstream state.** One-turn model selection, queued-recovery and project labels, interim Gateway events, and a theme-aware image-generation animation make active work easier to follow.
+- **Chat shows richer upstream state and media.** One-turn model selection, approval policies, advisor progress, queued-recovery and project labels, collapsible attachments, persisted images, interim Gateway events, and a theme-aware image-generation animation make active work easier to follow.
+- **The Agent Passport makes the active agent controllable.** The chat drawer now combines live connection and session context with profile switching, personality, model, reasoning, approval, and speed controls in one focused surface.
+- **Android onboarding finishes with a permission setup step.** After connecting, users can enable background chat alerts with one deliberate Android prompt, review optional feature permissions individually, or continue immediately without granting phone access.
+- **Image generation stays visible when upstream tool progress is hidden.** A paired Relay can expose read-only image-tool activity from Hermes session state so Android shows and completes its existing generation animation during Standard Gateway turns; native Gateway lifecycle events remain authoritative and Relay remains optional.
+- **Background work stays actionable.** User-started turns remain protected until every active session settles, while privacy-safe notifications reopen the correct conversation for approvals, questions, elevated permissions, and secure responses.
 
 ### Fixed
 
@@ -48,6 +42,10 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/), and this
 - **Relay pairing preserves Tailscale and other fallback routes.** Adding Relay to an existing Standard connection now keeps every signed QR route, restores older per-device endpoints hidden by the connection upgrade, and gives remote Dashboard routes their API fallback. When a host-scoped Dashboard sign-in is still required, Chat shows the route-specific sign-in action instead of loading indefinitely.
 - **Remote routes move every Hermes surface together.** Android uses `GET /health` instead of misclassifying the API server's `405 Method Not Allowed` response to `HEAD`, and the selected Tailscale route now carries Dashboard/Gateway, sessions, Manage, and Standard Voice with API and Relay instead of leaving them pinned to the saved LAN host. Manage also distinguishes host-side Nous provider authentication from Dashboard sign-in.
 - **Hosted Manage and direct-chat compatibility stay bounded and secure.** OAuth state remains tied to the selected dashboard, inline image memory is capped, and session reset and queued-recovery boundaries follow upstream contracts.
+- **Dashboard sign-in is secure and route-aware.** Browser-based authorization is scoped and serialized to the selected host, while cold start no longer activates a temporary localhost API fallback or reports a missing key before stored connection state is ready.
+- **Background and promoted voice work retain their owning chat rows.** Completing an initial spoken handoff no longer removes an otherwise empty assistant bubble that still owns a running task, and concurrent turns remain reachable without requiring an always-on idle connection.
+- **Self-hosted rendering is safer.** Android accepts deliberately installed user certificate authorities without bypassing chain, hostname, or Relay-pin verification, and malformed syntax-highlighting ranges no longer crash Markdown rendering.
+- **Developer Options reflect current product behavior.** The obsolete Relay feature toggle is removed, version-tap unlock and explicit relock persist correctly, and backup, import, reset, and completion messages now report their actual results.
 
 ## [1.4.9] - 2026-07-19
 

DEVLOG.md

@@ -1,5 +1,32 @@
 # Hermes-Relay — Dev Log
 
+## 2026-07-25 — Immutable Android release dispatch repair
+
+Android approval now dispatches the current release workflow definition from
+`main`, while every release job explicitly checks out the immutable
+`android-v*` tag. Validation confirms the dispatched version resolves to that
+checked-out commit and accepts the repository's surface-qualified
+`[Android x.y.z]` changelog heading. Existing tags remain unchanged, and a
+workflow-only correction can resume a failed publication without rebuilding
+from a different application tree.
+
+Audited `.github/workflows/approve-release-android.yml`,
+`.github/workflows/release-android.yml`, `RELEASE.md`, and `DEVLOG.md`.
+
+## 2026-07-25 — Android 1.5.0 final release reconciliation
+
+The final Android 1.5.0 release tree reconciles the accumulated Dashboard-first
+connection, Gateway recovery, background delivery, Agent Passport, onboarding,
+voice, attachment, image-generation, security, localization, and Developer
+Options work into one public release narrative. Android remains version 1.5.0
+with monotonic versionCode 33 because that prepared version was not previously
+tagged or uploaded to production.
+
+Release notes, the in-app What's New assets, localized Play release notes, and
+the Play listing reference now describe the final tree rather than the earlier
+voice-focused candidate. The release train is gated by the exact-tree private
+Play preflight before the `dev` to `main` release merge and public tag.
+
 ## 2026-07-25 — Active-turn retention and actionable interaction alerts
 
 Android now promotes user-started chat work to foreground execution until every

RELEASE.md

@@ -610,8 +610,12 @@ git push origin dev
 Then open **Actions → Approve Android Release**, choose **Run workflow**, select
 `main`, and enter the version. Starting the workflow is the release approval. It
 verifies that `main` has the exact preflighted tree and creates the
-`android-v<version>` tag. Manual stable tags are still guarded by the same
-preflight proof in the tag workflow.
+`android-v<version>` tag. Because tags created with `GITHUB_TOKEN` do not trigger
+another workflow, approval dispatches the current release workflow definition
+from `main`; every release job explicitly checks out and verifies the immutable
+`android-v<version>` tag. This lets release-workflow fixes apply without moving
+an existing tag or changing its artifact tree. Manual stable tags are still
+guarded by the same preflight proof in the tag workflow.
 
 The tag-triggered `.github/workflows/release-android.yml` rebuilds and scans the
 artifacts, changes the existing Play Production draft to `completed` (submitting

RELEASE_NOTES.md

@@ -1,6 +1,6 @@
 # Hermes-Relay-Android v1.5.0
 
-**Release Date:** July 22, 2026
+**Release Date:** July 25, 2026
 
 ## Download
 
@@ -12,22 +12,26 @@ Verify the download against `SHA256SUMS.txt`. See the [sideload guide](https://h
 
 ## Summary
 
-This feature release overhauls voice setup and playback, expands upstream Gateway-aware controls, and makes active Hermes work easier to understand.
+This release makes the Hermes Dashboard and Gateway the clear standard connection, keeps active work reachable across the app and Android backgrounding, and gives profiles, voice, attachments, image generation, and approvals a more coherent native interface.
 
 ## Added
 
-- Standard and Realtime voice settings now have distinct, organized cards for provider, model, and voice selection, with upstream-aware discovery, descriptions, inline previews, waveform feedback, loading skeletons, and an expandable scrolling voice browser.
-- Standard Hermes speech now streams completed reply segments as they arrive. Starting another preview or reply stops the prior audio, and leaving voice mode stops playback.
-- Manage and diagnostics consume upstream health hints and compatibility details, follow canonical Gateway redirects, compress larger RPC payloads, and preserve profile-scoped behavior.
-- Chat surfaces one-turn model selection, queued recovery, project labels, interim Gateway events, and image-generation progress.
+- The Agent Passport drawer combines live route and session context with explicit profile switching, personality, model, reasoning, approval-policy, chat-override, and processing-tier controls.
+- Secure browser-based Dashboard sign-in is scoped to the selected host. Chat, sessions, Manage, and Standard Voice share the same authenticated Gateway route while the API server remains an automatic fallback.
+- Standard and Realtime voice settings use focused provider, model, and voice cards with upstream-aware discovery, descriptions, inline previews, waveforms, and a browsable catalog. Standard replies can begin speaking completed segments before generation finishes.
+- User-started turns stay protected until every concurrent session settles. Privacy-safe notifications reopen the correct chat for approvals, questions, elevated permissions, or secure responses.
+- Onboarding finishes with a layered permission review: notifications are recommended deliberately, optional capabilities remain separate, and users can continue without granting phone access.
+- Chat surfaces one-turn model choices, approval modes, advisor progress, queued recovery, project labels, collapsible attachments, persisted images, interim Gateway events, and image-generation activity.
 
 ## Fixed
 
-- Voice settings and active-turn correction copy remain complete across supported languages.
-- Chat reactivates the original live Gateway session after a connection loss, avoids duplicate prompt submission when an acknowledgement is lost, and prevents duplicate session rows from crashing the drawer.
-- Relay pairing retains Tailscale and other QR fallback routes when added to an existing Standard connection, recovers older stored routes, and shows a route-specific Dashboard sign-in action instead of leaving remote Chat loading.
-- Remote route checks use the API server's supported `GET /health` contract. Selecting Tailscale now moves Dashboard/Gateway, sessions, Manage, Standard Voice, API, and Relay together instead of leaving dashboard-backed features on the saved LAN host; Manage also labels host-side Nous provider authentication separately from Dashboard sign-in.
-- Hosted Manage OAuth remains bound to the selected dashboard, direct-chat image memory is bounded, and session reset and recovery behavior follow upstream contracts.
+- Gateway reconnects reactivate the original live session without resubmitting acknowledged prompts or duplicating session rows.
+- Tailscale, QR, and other remote routes move Dashboard, Gateway, sessions, Manage, Standard Voice, API fallback, and optional Relay together.
+- Dashboard authentication, model routing, recovery, and profile state stay scoped to the selected connection and session, including during cold start and rapid switching.
+- Promoted voice and background tasks keep their owning Chat row until the work settles.
+- User-installed certificate authorities work for self-hosted HTTPS/WSS while normal chain, hostname, and Relay-pin verification remain enforced.
+- Malformed syntax-highlighting ranges no longer crash Markdown rendering.
+- Developer Options no longer exposes the obsolete Relay feature flag; version-tap unlock, relock, backup, import, and reset actions now persist and report accurately.
 
 ## Install / Verify
 

app/src/googlePlay/play/release-notes/en-US/default.txt

@@ -1 +1 @@
-Browse Standard and Realtime voice providers, models, and voices in a cleaner layout with inline previews. Standard Hermes replies now speak completed segments while the answer is generated, and new audio stops prior playback. This release also expands Gateway-aware Manage, diagnostics, model selection, recovery, and generation status.
+Connect through secure Dashboard sign-in, switch profiles from the new Agent Passport, and keep multiple background chats active with actionable approval and question alerts. Image generation, attachments, model routing, voice, and Gateway recovery are clearer and more reliable. Setup now guides optional notification, camera, microphone, and companion permissions without blocking chat.

app/src/googlePlay/play/release-notes/zh-CN/default.txt

@@ -1 +1 @@
-现在可在更清晰的界面中浏览标准和实时语音的提供商、模型与声音，并直接试听。标准 Hermes 回复会在生成过程中分段朗读；开始新的音频时会停止之前的播放。本次更新还增强了与 Gateway 兼容的管理、诊断、模型选择、恢复及生成状态。
+通过安全的 Dashboard 登录连接，并在新的智能体护照中切换配置文件。多个后台对话可保持运行，审批或提问通知可直接返回正确会话。图像生成、附件、模型路由、语音和 Gateway 恢复更加清晰可靠。设置流程会说明可选的通知、相机、麦克风和通知伴侣权限，且不会阻止聊天。

app/src/main/assets/changelog.json

@@ -2,28 +2,35 @@
  "versions": [
   {
    "version": "1.5.0",
-   "title": "Voice that keeps pace",
-   "date": "2026-07-22",
+   "title": "Hermes, always in reach",
+   "date": "2026-07-25",
    "sections": [
     {
-     "header": "A clearer voice studio",
+     "header": "One secure Hermes connection",
      "bullets": [
-      "Standard and Realtime paths now organize provider, model, and voice choices in focused cards with upstream-aware discovery and descriptions.",
-      "Preview voices inline with loading feedback and a lighter waveform, then expand and scroll the voice browser without leaving the page."
+      "Connect through secure Dashboard sign-in while Chat, sessions, Manage, and Standard Voice follow the same active route.",
+      "Switch profiles and control personality, model, reasoning, approvals, and processing speed from the new Agent Passport."
      ]
     },
     {
-     "header": "Natural streaming speech",
+     "header": "Active work stays reachable",
      "bullets": [
-      "Standard Hermes replies begin speaking completed segments while the rest of the answer is still being generated.",
-      "Starting new audio stops the prior preview or reply, and leaving voice mode stops playback."
+      "Multiple user-started chats remain active in the background until every session settles.",
+      "Approval, question, elevated-permission, and secure-response alerts reopen the correct conversation."
      ]
     },
     {
-     "header": "More upstream-aware controls",
+     "header": "Richer chat and voice",
      "bullets": [
-      "Manage and diagnostics consume Gateway health and compatibility details while keeping Standard Hermes usable without Relay.",
-      "Chat now shows one-turn model choices, queued recovery, project labels, interim events, and image-generation progress."
+      "Attachments, image generation, model routing, recovery, advisor progress, and upstream events are clearer and more reliable.",
+      "Browse and preview Standard and Realtime voices, and hear Standard replies begin speaking as completed segments arrive."
+     ]
+    },
+    {
+     "header": "Setup without surprises",
+     "bullets": [
+      "Onboarding explains optional notification, camera, microphone, companion, and device permissions without blocking standard chat.",
+      "Tailscale, QR, and remote routes now move all Hermes surfaces together and recover the original session after connection loss."
      ]
     }
    ]

app/src/main/assets/whats_new.txt

@@ -1,5 +1,6 @@
-v1.5.0 - Voice that keeps pace
+v1.5.0 - Hermes, always in reach
 
-* Browse Standard and Realtime providers, models, and voices in a cleaner layout with inline previews.
-* Hear Standard Hermes replies as completed speech segments arrive; starting new audio stops the prior playback.
-* Use richer Gateway-aware Manage, diagnostics, model selection, recovery, and generation status.
+* Connect through secure Dashboard sign-in and switch profiles from the new Agent Passport.
+* Keep multiple background chats active and reopen the right session from approval or question alerts.
+* Follow richer attachments, image generation, model routing, Gateway recovery, and streaming voice.
+* Finish setup with clear, optional permission guidance that never blocks standard chat.

app/src/main/kotlin/com/hermesandroid/relay/data/DataManager.kt

@@ -255,9 +255,11 @@ class DataManager(
     suspend fun writeBackupToUri(uri: Uri, backup: String): Boolean {
         return withContext(Dispatchers.IO) {
             try {
-                context.contentResolver.openOutputStream(uri)?.use { outputStream ->
-                    outputStream.write(backup.toByteArray(Charsets.UTF_8))
-                    outputStream.flush()
+                val outputStream = context.contentResolver.openOutputStream(uri)
+                    ?: return@withContext false
+                outputStream.use {
+                    it.write(backup.toByteArray(Charsets.UTF_8))
+                    it.flush()
                 }
                 true
             } catch (e: Exception) {
@@ -288,9 +290,10 @@ class DataManager(
      * - Clear DataStore preferences
      * - Clear EncryptedSharedPreferences (auth tokens)
      * - Clear any cached data
-     * Does NOT clear the onboarding flag (that's separate via [resetOnboarding]).
+     * Preserves the onboarding flag. Use [resetOnboarding] when the next launch
+     * should show onboarding again.
      */
-    suspend fun resetAppData() {
+    suspend fun resetAppData(): Boolean =
         try {
             // Preserve onboarding state before clearing
             val onboarding = isOnboardingCompleted()
@@ -320,10 +323,11 @@ class DataManager(
             }
 
             Log.d(TAG, "App data reset complete")
+            true
         } catch (e: Exception) {
             Log.e(TAG, "Failed to reset app data", e)
+            false
         }
-    }
 
     private suspend fun deleteSensitivePreferenceFiles() {
         withContext(Dispatchers.IO) {
@@ -384,16 +388,17 @@ class DataManager(
      * Reset only the onboarding completion flag.
      * Next app launch will show onboarding again.
      */
-    suspend fun resetOnboarding() {
+    suspend fun resetOnboarding(): Boolean =
         try {
             context.relayDataStore.edit { preferences ->
                 preferences.remove(KEY_ONBOARDING_COMPLETED)
             }
             Log.d(TAG, "Onboarding flag reset")
+            true
         } catch (e: Exception) {
             Log.e(TAG, "Failed to reset onboarding flag", e)
+            false
         }
-    }
 
     /**
      * Check if onboarding has been completed.
@@ -412,13 +417,14 @@ class DataManager(
     /**
      * Mark onboarding as completed.
      */
-    suspend fun setOnboardingCompleted(completed: Boolean) {
+    suspend fun setOnboardingCompleted(completed: Boolean): Boolean =
         try {
             context.relayDataStore.edit { preferences ->
                 preferences[KEY_ONBOARDING_COMPLETED] = completed
             }
+            true
         } catch (e: Exception) {
             Log.e(TAG, "Failed to set onboarding completed", e)
+            false
         }
-    }
 }

app/src/main/kotlin/com/hermesandroid/relay/data/FeatureFlags.kt

@@ -10,7 +10,8 @@ import kotlinx.coroutines.flow.map
 /**
  * Feature flags with compile-time defaults and runtime overrides.
  *
- * In debug builds, all features are unlocked by default.
+ * In debug builds, Developer Options are unlocked by default until the user
+ * explicitly locks them.
  * In release builds, experimental features are hidden unless the user
  * enables Developer Options (tap version 7 times in Settings > About).
  *
@@ -21,7 +22,6 @@ object FeatureFlags {
 
     // DataStore keys
     private val KEY_DEV_OPTIONS_UNLOCKED = booleanPreferencesKey("dev_options_unlocked")
-    private val KEY_RELAY_ENABLED = booleanPreferencesKey("feature_relay_enabled")
 
     /** Whether the app is running a debug build. */
     val isDevBuild: Boolean get() = BuildConfig.DEV_MODE
@@ -29,13 +29,7 @@ object FeatureFlags {
     /** Observe whether Developer Options have been unlocked. */
     fun devOptionsUnlocked(context: Context): Flow<Boolean> =
         context.relayDataStore.data.map { prefs ->
-            if (isDevBuild) true else prefs[KEY_DEV_OPTIONS_UNLOCKED] ?: false
-        }
-
-    /** Observe whether relay features (settings, pairing, onboarding pages) are enabled. */
-    fun relayEnabled(context: Context): Flow<Boolean> =
-        context.relayDataStore.data.map { prefs ->
-            if (isDevBuild) true else prefs[KEY_RELAY_ENABLED] ?: false
+            prefs[KEY_DEV_OPTIONS_UNLOCKED] ?: isDevBuild
         }
 
     /** Unlock Developer Options. */
@@ -45,18 +39,10 @@ object FeatureFlags {
         }
     }
 
-    /** Lock Developer Options and disable all experimental features. */
+    /** Lock Developer Options, including in debug builds. */
     suspend fun lockDevOptions(context: Context) {
         context.relayDataStore.edit { prefs ->
             prefs[KEY_DEV_OPTIONS_UNLOCKED] = false
-            prefs[KEY_RELAY_ENABLED] = false
-        }
-    }
-
-    /** Toggle relay features (terminal/bridge settings, pairing, onboarding relay page). */
-    suspend fun setRelayEnabled(context: Context, enabled: Boolean) {
-        context.relayDataStore.edit { prefs ->
-            prefs[KEY_RELAY_ENABLED] = enabled
         }
     }
 

app/src/main/kotlin/com/hermesandroid/relay/ui/components/ActiveConnectionSections.kt

@@ -268,7 +268,6 @@ fun ActiveCardRelayStatusSection(
 @Composable
 fun ActiveCardFeaturesSection(
     connectionViewModel: ConnectionViewModel,
-    relayEnabled: Boolean,
     onOpenApiInfo: () -> Unit,
     onOpenDashboard: () -> Unit,
     onOpenRelayInfo: () -> Unit,
@@ -349,21 +348,19 @@ fun ActiveCardFeaturesSection(
     }
 
     val relayValue = when {
-        !relayEnabled -> stringResource(R.string.active_section_disabled)
         !relayConfigured -> stringResource(R.string.active_section_optional)
         relayReady -> stringResource(R.string.active_section_ready)
         relayUiState == RelayUiState.Stale -> stringResource(R.string.active_section_reconnect)
         else -> stringResource(R.string.active_section_configured)
     }
     val relayTone = when {
-        !relayEnabled || !relayConfigured -> CapabilityTone.Neutral
+        !relayConfigured -> CapabilityTone.Neutral
         relayReady -> CapabilityTone.Good
         relayUiState == RelayUiState.Stale -> CapabilityTone.Warning
         else -> CapabilityTone.Info
     }
 
     val terminalValue = when {
-        !relayEnabled -> stringResource(R.string.active_section_disabled)
         authState is AuthState.Paired -> stringResource(R.string.active_section_ready)
         relayConfigured -> stringResource(R.string.active_section_pair_relay)
         else -> stringResource(R.string.active_section_optional)
@@ -614,7 +611,6 @@ private fun CapabilityRow(
 @Composable
 fun ActiveCardAdvancedSection(
     connectionViewModel: ConnectionViewModel,
-    relayEnabled: Boolean,
     @Suppress("UNUSED_PARAMETER") isDarkTheme: Boolean,
     onPairRelay: () -> Unit,
     onInsecureAckRequested: () -> Unit,
@@ -654,7 +650,7 @@ fun ActiveCardAdvancedSection(
                             Text(stringResource(R.string.active_section_done))
                         }
                     }
-                    ManualUrlSubsection(connectionViewModel, relayEnabled, showApi = true, showRelay = false)
+                    ManualUrlSubsection(connectionViewModel, showApi = true, showRelay = false)
                 }
             }
         } else {
@@ -731,7 +727,7 @@ fun ActiveCardAdvancedSection(
         TextButton(onClick = { relayEditorOpen = !relayEditorOpen }) {
             Text(stringResource(R.string.active_section_other_relay_methods))
         }
-        if (relayEnabled && relayEditorOpen) {
+        if (relayEditorOpen) {
             Surface(
                 color = Color.Transparent,
                 shape = RoundedCornerShape(12.dp),
@@ -746,7 +742,7 @@ fun ActiveCardAdvancedSection(
                             Text(stringResource(R.string.active_section_done))
                         }
                     }
-                    ManualUrlSubsection(connectionViewModel, relayEnabled = true, showApi = false, showRelay = true)
+                    ManualUrlSubsection(connectionViewModel, showApi = false, showRelay = true)
                 }
             }
         }
@@ -798,7 +794,6 @@ fun ActiveCardAdvancedSection(
 @Composable
 private fun ManualUrlSubsection(
     connectionViewModel: ConnectionViewModel,
-    relayEnabled: Boolean,
     showApi: Boolean,
     showRelay: Boolean,
 ) {
@@ -960,7 +955,7 @@ private fun ManualUrlSubsection(
         }
     }
 
-    if (relayEnabled && showRelay) {
+    if (showRelay) {
         HorizontalDivider()
 
         Column(verticalArrangement = Arrangement.spacedBy(6.dp)) {

app/src/main/kotlin/com/hermesandroid/relay/ui/components/ConnectionWizard.kt

@@ -100,7 +100,6 @@ import com.hermesandroid.relay.auth.AuthState
 import com.hermesandroid.relay.data.Connection
 import com.hermesandroid.relay.data.ConnectionValidation
 import com.hermesandroid.relay.data.EndpointCandidate
-import com.hermesandroid.relay.data.FeatureFlags
 import com.hermesandroid.relay.data.displayLabel
 import com.hermesandroid.relay.data.primaryRouteUrl
 import com.hermesandroid.relay.network.shared.HermesLanDiscovery
@@ -197,8 +196,6 @@ fun ConnectionWizard(
 
     val isTailscaleDetected by connectionViewModel.isTailscaleDetected.collectAsState()
     val authState by connectionViewModel.authState.collectAsState()
-    val relayEnabled by FeatureFlags.relayEnabled(context)
-        .collectAsState(initial = FeatureFlags.isDevBuild)
     val pairingCode by connectionViewModel.pairingCode.collectAsState()
     val currentApiUrl by connectionViewModel.apiServerUrl.collectAsState()
     val currentRelayUrl by connectionViewModel.relayUrl.collectAsState()
@@ -621,7 +618,6 @@ fun ConnectionWizard(
                 WizardStep.RelayChoice -> RelayChoiceStep(
                     connectionLabel = activeConnection?.label.orEmpty(),
                     dashboardUrl = currentDashboardUrl,
-                    relayEnabled = relayEnabled,
                     onPickScan = {
                         chosenMethod = PairMethod.Scan
                         cameraPermissionLauncher.launch(Manifest.permission.CAMERA)
@@ -638,7 +634,6 @@ fun ConnectionWizard(
                 )
 
                 WizardStep.Method -> MethodStep(
-                    relayEnabled = relayEnabled,
                     onPickStandard = {
                         chosenMethod = PairMethod.Standard
                         standardError = null
@@ -1701,7 +1696,6 @@ private fun FoundCapabilityLine(label: String, value: String, ready: Boolean) {
 private fun RelayChoiceStep(
     connectionLabel: String,
     dashboardUrl: String,
-    relayEnabled: Boolean,
     onPickScan: () -> Unit,
     onPickEnterCode: () -> Unit,
     onPickShowCode: () -> Unit,
@@ -1769,14 +1763,12 @@ private fun RelayChoiceStep(
             subtitle = stringResource(R.string.cw_method_pair_code_subtitle),
             onClick = onPickEnterCode,
         )
-        if (relayEnabled) {
-            MethodTile(
-                icon = Icons.Filled.PhonelinkLock,
-                title = stringResource(R.string.cw_method_show_code_title),
-                subtitle = stringResource(R.string.cw_method_show_code_subtitle),
-                onClick = onPickShowCode,
-            )
-        }
+        MethodTile(
+            icon = Icons.Filled.PhonelinkLock,
+            title = stringResource(R.string.cw_method_show_code_title),
+            subtitle = stringResource(R.string.cw_method_show_code_subtitle),
+            onClick = onPickShowCode,
+        )
         TextButton(
             onClick = { openExternalUrl(context, RelaySetupDocsUrl) },
             modifier = Modifier.fillMaxWidth(),
@@ -1794,7 +1786,6 @@ private fun RelayChoiceStep(
 
 @Composable
 private fun MethodStep(
-    relayEnabled: Boolean,
     onPickStandard: () -> Unit,
     onPickScan: () -> Unit,
     onPickEnterCode: () -> Unit,
@@ -1931,14 +1922,12 @@ private fun MethodStep(
             onClick = onPickEnterCode,
         )
 
-        if (relayEnabled) {
-            MethodTile(
-                icon = Icons.Filled.PhonelinkLock,
-                title = stringResource(R.string.cw_method_show_code_title),
-                subtitle = stringResource(R.string.cw_method_show_code_subtitle),
-                onClick = onPickShowCode,
-            )
-        }
+        MethodTile(
+            icon = Icons.Filled.PhonelinkLock,
+            title = stringResource(R.string.cw_method_show_code_title),
+            subtitle = stringResource(R.string.cw_method_show_code_subtitle),
+            onClick = onPickShowCode,
+        )
 
         if (onSkip != null) {
             TextButton(

app/src/main/kotlin/com/hermesandroid/relay/ui/screens/AboutScreen.kt

@@ -206,10 +206,16 @@ fun AboutScreen(
                                 val remaining = 7 - versionTapCount
                                 when {
                                     remaining <= 0 -> {
-                                        scope.launch { FeatureFlags.unlockDevOptions(context) }
-                                        Toast.makeText(context, devUnlockedMsg, Toast.LENGTH_SHORT).show()
                                         versionTapCount = 0
-                                        onUnlockDeveloperOptions()
+                                        scope.launch {
+                                            FeatureFlags.unlockDevOptions(context)
+                                            Toast.makeText(
+                                                context,
+                                                devUnlockedMsg,
+                                                Toast.LENGTH_SHORT,
+                                            ).show()
+                                            onUnlockDeveloperOptions()
+                                        }
                                     }
                                     remaining <= 3 -> {
                                         val tapsMsg = context.getString(R.string.about_taps_to_unlock, remaining)

app/src/main/kotlin/com/hermesandroid/relay/ui/screens/ConnectionDetailScreen.kt

@@ -54,7 +54,6 @@ import androidx.compose.ui.unit.dp
 import com.hermesandroid.relay.R
 import com.hermesandroid.relay.data.Connection
 import com.hermesandroid.relay.data.capabilities
-import com.hermesandroid.relay.data.FeatureFlags
 import com.hermesandroid.relay.ui.components.ActiveCardAdvancedSection
 import com.hermesandroid.relay.ui.components.ActiveCardFeaturesSection
 import com.hermesandroid.relay.ui.components.ActiveCardRoutesSection
@@ -110,9 +109,6 @@ fun ConnectionDetailScreen(
     val connections by connectionViewModel.connections.collectAsState()
     val activeConnectionId by connectionViewModel.activeConnectionId.collectAsState()
     val relayUiState by connectionViewModel.relayUiState.collectAsState()
-    val relayEnabled by FeatureFlags.relayEnabled(context)
-        .collectAsState(initial = FeatureFlags.isDevBuild)
-
     val connection = connections.firstOrNull { it.id == connectionId }
     // Connection was removed (e.g. via the overflow menu) — leave the screen.
     LaunchedEffect(connection == null) {
@@ -275,7 +271,6 @@ fun ConnectionDetailScreen(
                                 connectionViewModel = connectionViewModel,
                                 connection = connection,
                                 relayUiState = relayUiState,
-                                relayEnabled = relayEnabled,
                                 onReconnect = onReconnect,
                                 onRepair = { onRepair(connectionId) },
                                 onOpenApiInfo = { showApiInfoSheet = true },
@@ -303,7 +298,6 @@ fun ConnectionDetailScreen(
 
                     DetailTab.Advanced -> ActiveCardAdvancedSection(
                         connectionViewModel = connectionViewModel,
-                        relayEnabled = relayEnabled,
                         isDarkTheme = isDarkTheme,
                         onPairRelay = { onRepair(connectionId) },
                         onInsecureAckRequested = { showInsecureAckDialog = true },
@@ -423,7 +417,6 @@ private fun ActiveOverview(
     connectionViewModel: ConnectionViewModel,
     connection: Connection,
     relayUiState: RelayUiState,
-    relayEnabled: Boolean,
     onReconnect: () -> Unit,
     onRepair: () -> Unit,
     onOpenApiInfo: () -> Unit,
@@ -498,7 +491,6 @@ private fun ActiveOverview(
 
     ActiveCardFeaturesSection(
         connectionViewModel = connectionViewModel,
-        relayEnabled = relayEnabled,
         onOpenApiInfo = onOpenApiInfo,
         onOpenDashboard = onOpenDashboard,
         onOpenRelayInfo = onOpenRelayInfo,

app/src/main/kotlin/com/hermesandroid/relay/ui/screens/DeveloperSettingsScreen.kt

@@ -34,13 +34,11 @@ import androidx.compose.material3.Icon
 import androidx.compose.material3.IconButton
 import androidx.compose.material3.MaterialTheme
 import androidx.compose.material3.Scaffold
-import androidx.compose.material3.Switch
 import androidx.compose.material3.Text
 import androidx.compose.material3.TextButton
 import androidx.compose.material3.TopAppBar
 import androidx.compose.material3.TopAppBarDefaults
 import androidx.compose.runtime.Composable
-import androidx.compose.runtime.collectAsState
 import androidx.compose.runtime.getValue
 import androidx.compose.runtime.mutableStateOf
 import androidx.compose.runtime.remember
@@ -64,8 +62,7 @@ import kotlinx.coroutines.launch
 
 /**
  * Dedicated Developer Options screen. Gated behind the tap-version-7x
- * unlock. Hosts feature flags (voice/terminal/bridge/etc.), data management
- * (clear session / wipe caches), and any experimental toggles.
+ * unlock. Hosts experimental labs, test tools, and data-management utilities.
  */
 @OptIn(ExperimentalMaterial3Api::class)
 @Composable
@@ -79,8 +76,6 @@ fun DeveloperSettingsScreen(
     val scope = rememberCoroutineScope()
     val isDarkTheme = LocalBrand.current.isDark
 
-    val relayEnabled by FeatureFlags.relayEnabled(context).collectAsState(initial = FeatureFlags.isDevBuild)
-
     // Data management local state — unfolded from the private
     // DataManagementSection helper in the old SettingsScreen.
     var showResetDialog by remember { mutableStateOf(false) }
@@ -185,8 +180,17 @@ fun DeveloperSettingsScreen(
                             )
                         }
                         IconButton(onClick = {
-                            connectionViewModel.resetOnboarding()
-                            Toast.makeText(context, context.getString(R.string.dev_settings_onboarding_reset_toast), Toast.LENGTH_SHORT).show()
+                            connectionViewModel.resetOnboarding { success ->
+                                Toast.makeText(
+                                    context,
+                                    if (success) {
+                                        context.getString(R.string.dev_settings_onboarding_reset_toast)
+                                    } else {
+                                        context.getString(R.string.dev_settings_reset_failed)
+                                    },
+                                    Toast.LENGTH_SHORT,
+                                ).show()
+                            }
                         }) {
                             Icon(
                                 imageVector = Icons.Filled.RestartAlt,
@@ -300,42 +304,6 @@ fun DeveloperSettingsScreen(
                     modifier = Modifier.padding(16.dp),
                     verticalArrangement = Arrangement.spacedBy(12.dp)
                 ) {
-                    // Relay features toggle
-                    Row(
-                        modifier = Modifier.fillMaxWidth(),
-                        horizontalArrangement = Arrangement.SpaceBetween,
-                        verticalAlignment = Alignment.CenterVertically
-                    ) {
-                        Column(modifier = Modifier.weight(1f)) {
-                            Row(
-                                verticalAlignment = Alignment.CenterVertically,
-                                horizontalArrangement = Arrangement.spacedBy(6.dp)
-                            ) {
-                                Icon(
-                                    imageVector = Icons.Filled.Science,
-                                    contentDescription = null,
-                                    modifier = Modifier.size(16.dp),
-                                    tint = MaterialTheme.colorScheme.tertiary
-                                )
-                                Text(
-                                    text = stringResource(R.string.dev_settings_relay_features),
-                                    style = MaterialTheme.typography.bodyMedium
-                                )
-                            }
-                            Text(
-                                text = stringResource(R.string.dev_settings_relay_features_desc),
-                                style = MaterialTheme.typography.bodySmall,
-                                color = MaterialTheme.colorScheme.onSurfaceVariant
-                            )
-                        }
-                        Switch(
-                            checked = relayEnabled,
-                            onCheckedChange = { scope.launch { FeatureFlags.setRelayEnabled(context, it) } }
-                        )
-                    }
-
-                    HorizontalDivider()
-
                     Row(
                         modifier = Modifier.fillMaxWidth(),
                         horizontalArrangement = Arrangement.SpaceBetween,
@@ -432,9 +400,15 @@ fun DeveloperSettingsScreen(
                             )
                         }
                         IconButton(onClick = {
-                            scope.launch { FeatureFlags.lockDevOptions(context) }
-                            Toast.makeText(context, context.getString(R.string.dev_settings_locked_toast), Toast.LENGTH_SHORT).show()
-                            onBack()
+                            scope.launch {
+                                FeatureFlags.lockDevOptions(context)
+                                Toast.makeText(
+                                    context,
+                                    context.getString(R.string.dev_settings_locked_toast),
+                                    Toast.LENGTH_SHORT,
+                                ).show()
+                                onBack()
+                            }
                         }) {
                             Icon(
                                 imageVector = Icons.Filled.Lock,
@@ -562,8 +536,16 @@ fun DeveloperSettingsScreen(
                     onClick = {
                         showExportDialog = false
                         connectionViewModel.exportSettings { json ->
-                            backupJson = json
-                            exportLauncher.launch("hermes-relay-sensitive-backup.json")
+                            if (json == null) {
+                                Toast.makeText(
+                                    context,
+                                    context.getString(R.string.dev_settings_export_failed),
+                                    Toast.LENGTH_SHORT,
+                                ).show()
+                            } else {
+                                backupJson = json
+                                exportLauncher.launch("hermes-relay-sensitive-backup.json")
+                            }
                         }
                     }
                 ) {
@@ -619,8 +601,17 @@ fun DeveloperSettingsScreen(
                 TextButton(
                     onClick = {
                         showResetDialog = false
-                        connectionViewModel.resetAppData()
-                        Toast.makeText(context, context.getString(R.string.dev_settings_app_data_reset_toast), Toast.LENGTH_SHORT).show()
+                        connectionViewModel.resetAppData { success ->
+                            Toast.makeText(
+                                context,
+                                if (success) {
+                                    context.getString(R.string.dev_settings_app_data_reset_toast)
+                                } else {
+                                    context.getString(R.string.dev_settings_reset_failed)
+                                },
+                                Toast.LENGTH_SHORT,
+                            ).show()
+                        }
                     }
                 ) {
                     Text(stringResource(R.string.dev_settings_reset_action), color = MaterialTheme.colorScheme.error)

app/src/main/kotlin/com/hermesandroid/relay/viewmodel/ConnectionViewModel.kt

@@ -6371,50 +6371,62 @@ class ConnectionViewModel(application: Application) : AndroidViewModel(applicati
         }
     }
 
-    fun resetOnboarding() {
+    fun resetOnboarding(onResult: (Boolean) -> Unit = {}) {
         viewModelScope.launch {
-            dataManager.resetOnboarding()
-            _onboardingCompleted.value = false
+            val success = dataManager.resetOnboarding()
+            if (success) {
+                _onboardingCompleted.value = false
+            }
+            onResult(success)
         }
     }
 
-    fun resetAppData() {
+    fun resetAppData(onResult: (Boolean) -> Unit = {}) {
         viewModelScope.launch {
-            disconnectRelay()
-            authManager.clearSession()
-            authManager.clearApiKey()
-            dataManager.resetAppData()
-            profileController.profileSelectionStore.clearAll()
-            profileController.profileLockStore.clearAll()
-            profileController.profilePresentationStore.clearAll()
-            profileController.profileSessionStore.clearAll()
-            _apiServerUrl.value = ""
-            _relayUrl.value = ""
-            rebuildApiClient()
-            shutdownClientOffMain(profileChatApiClient)
-            profileChatApiClient = null
-            profileChatApiClientUrl = null
-            profileChatApiClientKey = null
-            profileController.clearSelectionState()
-            _lastSessionId.value = null
+            val success = runCatching {
+                disconnectRelay()
+                authManager.clearSession()
+                authManager.clearApiKey()
+                check(dataManager.resetAppData()) { "App data store reset failed" }
+                profileController.profileSelectionStore.clearAll()
+                profileController.profileLockStore.clearAll()
+                profileController.profilePresentationStore.clearAll()
+                profileController.profileSessionStore.clearAll()
+                _apiServerUrl.value = ""
+                _relayUrl.value = ""
+                rebuildApiClient()
+                shutdownClientOffMain(profileChatApiClient)
+                profileChatApiClient = null
+                profileChatApiClientUrl = null
+                profileChatApiClientKey = null
+                profileController.clearSelectionState()
+                _lastSessionId.value = null
+            }.onFailure {
+                android.util.Log.e("ConnectionVM", "Failed to reset app data", it)
+            }.isSuccess
+            onResult(success)
         }
     }
 
-    fun exportSettings(onResult: (String) -> Unit) {
+    fun exportSettings(onResult: (String?) -> Unit) {
         viewModelScope.launch {
-            val json = dataManager.exportSettings(
-                serverUrl = _relayUrl.value,
-                theme = theme.value,
-                onboardingCompleted = _onboardingCompleted.value,
-                // Pass 2: AuthManager.sessionLabels is gone — replaced by
-                // `agentProfiles: StateFlow<List<Profile>>`. The DataManager
-                // param is marked @Suppress("UNUSED_PARAMETER") and isn't
-                // written to the backup anyway, so an empty list keeps the
-                // signature stable until the param is removed in a later pass.
-                sessionLabels = emptyList(),
-                apiServerUrl = _apiServerUrl.value,
-                relayUrl = _relayUrl.value
-            )
+            val json = runCatching {
+                dataManager.exportSettings(
+                    serverUrl = _relayUrl.value,
+                    theme = theme.value,
+                    onboardingCompleted = _onboardingCompleted.value,
+                    // Pass 2: AuthManager.sessionLabels is gone — replaced by
+                    // `agentProfiles: StateFlow<List<Profile>>`. The DataManager
+                    // param is marked @Suppress("UNUSED_PARAMETER") and isn't
+                    // written to the backup anyway, so an empty list keeps the
+                    // signature stable until the param is removed in a later pass.
+                    sessionLabels = emptyList(),
+                    apiServerUrl = _apiServerUrl.value,
+                    relayUrl = _relayUrl.value
+                )
+            }.onFailure {
+                android.util.Log.e("ConnectionVM", "Failed to prepare settings backup", it)
+            }.getOrNull()
             onResult(json)
         }
     }
@@ -6436,24 +6448,39 @@ class ConnectionViewModel(application: Application) : AndroidViewModel(applicati
                 onResult(false)
                 return@launch
             }
-            // Apply imported settings
-            if (backup.connections.isNotEmpty()) {
+            val success = runCatching {
+                val importedRelayUrl = if (backup.connections.isEmpty()) {
+                    backup.relayUrl ?: backup.serverUrl
+                } else {
+                    null
+                }
+                // A backup is a replacement snapshot, including when it
+                // intentionally contains zero connections.
                 dataManager.restoreConnectionBackup(backup)
+                getApplication<Application>().relayDataStore.edit { preferences ->
+                    preferences[KEY_THEME] = backup.theme
+                    importedRelayUrl?.let { preferences[KEY_RELAY_URL] = it }
+                    backup.apiServerUrl
+                        ?.takeIf { backup.connections.isEmpty() }
+                        ?.let { preferences[KEY_API_SERVER_URL] = it }
+                }
                 connectionStore.activeConnection.value?.let { restored ->
                     restorePersistedActiveConnectionContext(restored)
                 }
-            } else {
-                // Prefer v2 fields, fall back to v1 serverUrl for relay
-                val importedRelayUrl = backup.relayUrl ?: backup.serverUrl
-                importedRelayUrl?.let { updateRelayUrl(it) }
-                backup.apiServerUrl?.let { updateApiServerUrl(it) }
-            }
-            setTheme(backup.theme)
-            if (backup.onboardingCompleted) {
-                dataManager.setOnboardingCompleted(true)
-                _onboardingCompleted.value = true
-            }
-            onResult(true)
+                if (backup.connections.isEmpty()) {
+                    // Preserve v1/v2 compatibility after clearing the current
+                    // multi-connection snapshot.
+                    importedRelayUrl?.let { updateRelayUrl(it) }
+                    backup.apiServerUrl?.let { updateApiServerUrl(it) }
+                }
+                check(dataManager.setOnboardingCompleted(backup.onboardingCompleted)) {
+                    "Failed to restore onboarding state"
+                }
+                _onboardingCompleted.value = backup.onboardingCompleted
+            }.onFailure {
+                android.util.Log.e("ConnectionVM", "Failed to import settings backup", it)
+            }.isSuccess
+            onResult(success)
         }
     }
 

app/src/main/res/values-b+pt+BR/strings.xml

@@ -1130,7 +1130,7 @@
     <string name="dev_settings_relay_features">Recursos do Relay</string>
     <string name="dev_settings_relay_features_desc">Mostrar configurações do Servidor Relay e de pareamento para desenvolvimento do Bridge/Terminal</string>
     <string name="dev_settings_realtime_voice_lab">Laboratório de voz em tempo real</string>
-    <string name="dev_settings_realtime_voice_lab_desc">Abrir a bancada de testes do WebSocket do provedor em versões de desenvolvimento</string>
+    <string name="dev_settings_realtime_voice_lab_desc">Verifique a configuração de voz em tempo real e execute um teste de microfone</string>
     <string name="dev_settings_open_realtime_voice_lab_cd">Abrir laboratório de voz em tempo real</string>
     <string name="dev_settings_lock_dev_options">Bloquear opções do desenvolvedor</string>
     <string name="dev_settings_lock_dev_options_desc">Ocultar esta seção e desativar recursos experimentais</string>
@@ -1161,6 +1161,7 @@
     <string name="dev_settings_export_failed">Falha na exportação</string>
     <string name="dev_settings_imported">Configurações importadas</string>
     <string name="dev_settings_import_failed">Falha na importação — arquivo inválido</string>
+    <string name="dev_settings_reset_failed">Falha ao redefinir</string>
     <string name="dev_settings_export_sensitive_backup_title">Exportar backup sensível?</string>
     <string name="dev_settings_export_sensitive_backup_body">Este backup inclui conexões salvas, chaves da API, tokens de sessão do relay, IDs de dispositivos e cookies do painel. Qualquer pessoa com o arquivo poderá acessar seu servidor Hermes.</string>
     <string name="dev_settings_export_action">Exportar</string>
@@ -2138,6 +2139,19 @@
     <string name="conn_info_confirms_on_next_message">Confirma na próxima mensagem</string>
     <string name="conn_info_connect">Conectar</string>
     <string name="conn_info_connected">Conectado</string>
+    <string name="conn_info_active_configuration">Configuração ativa</string>
+    <string name="conn_info_inherited">Herdado</string>
+    <string name="conn_info_bypassed">Ignorado</string>
+    <string name="conn_info_customize_identity">Personalizar identidade</string>
+    <string name="conn_info_agent_passport">Passaporte do agente</string>
+    <string name="conn_info_chat_override">Substituição do chat</string>
+    <string name="conn_info_fast_tier">Nível rápido</string>
+    <string name="conn_info_fast">Rápido</string>
+    <string name="conn_info_context">Contexto</string>
+    <string name="conn_info_profile_already_bypasses">As aprovações já são ignoradas pelo perfil.</string>
+    <string name="conn_info_start_new_chat">Iniciar novo chat</string>
+    <string name="conn_info_approval_mode_short_desc">Escolha como as aprovações são aplicadas.</string>
+    <string name="conn_info_approval_policy">Política de aprovação</string>
     <string name="conn_info_connecting">Conectando…</string>
     <string name="conn_info_connection">Conexão</string>
     <string name="conn_info_connection_state">Estado da conexão</string>

app/src/main/res/values-b+zh+Hans/strings.xml

@@ -1185,7 +1185,7 @@
     <string name="dev_settings_relay_features">Relay 功能</string>
     <string name="dev_settings_relay_features_desc">显示 Relay 服务器和配对设置，用于 Bridge/Terminal 开发</string>
     <string name="dev_settings_realtime_voice_lab">实时语音实验室</string>
-    <string name="dev_settings_realtime_voice_lab_desc">为开发构建打开 provider websocket 测试台</string>
+    <string name="dev_settings_realtime_voice_lab_desc">检查实时语音设置并运行专项麦克风测试</string>
     <string name="dev_settings_open_realtime_voice_lab_cd">打开实时语音实验室</string>
     <string name="dev_settings_lock_dev_options">锁定开发者选项</string>
     <string name="dev_settings_lock_dev_options_desc">隐藏此分区并禁用实验性功能</string>
@@ -1216,6 +1216,7 @@
     <string name="dev_settings_export_failed">导出失败</string>
     <string name="dev_settings_imported">设置已导入</string>
     <string name="dev_settings_import_failed">导入失败——文件无效</string>
+    <string name="dev_settings_reset_failed">重置失败</string>
     <string name="dev_settings_export_sensitive_backup_title">导出敏感备份？</string>
     <string name="dev_settings_export_sensitive_backup_body">此备份包含已保存的连接、API 密钥、Relay 会话令牌、设备 ID 和仪表盘 Cookie。任何持有该文件的人都可能访问您的 Hermes 服务器。</string>
     <string name="dev_settings_export_action">导出</string>
@@ -2232,6 +2233,19 @@
     <string name="conn_info_confirms_on_next_message">下条消息确认</string>
     <string name="conn_info_connect">连接</string>
     <string name="conn_info_connected">已连接</string>
+    <string name="conn_info_active_configuration">当前配置</string>
+    <string name="conn_info_inherited">继承</string>
+    <string name="conn_info_bypassed">已绕过</string>
+    <string name="conn_info_customize_identity">自定义身份</string>
+    <string name="conn_info_agent_passport">智能体档案</string>
+    <string name="conn_info_chat_override">对话覆盖</string>
+    <string name="conn_info_fast_tier">快速层级</string>
+    <string name="conn_info_fast">快速</string>
+    <string name="conn_info_context">上下文</string>
+    <string name="conn_info_profile_already_bypasses">此配置已绕过审批。</string>
+    <string name="conn_info_start_new_chat">开始新对话</string>
+    <string name="conn_info_approval_mode_short_desc">选择如何执行审批。</string>
+    <string name="conn_info_approval_policy">审批策略</string>
     <string name="conn_info_connecting">连接中…</string>
     <string name="conn_info_connection">连接</string>
     <string name="conn_info_connection_state">连接状态</string>

app/src/main/res/values-de/strings.xml

@@ -1188,7 +1188,7 @@
     <string name="dev_settings_relay_features">Relay-Funktionen</string>
     <string name="dev_settings_relay_features_desc">Relay-Server- und Kopplungseinstellungen für Bridge-/Terminal-Entwicklung anzeigen</string>
     <string name="dev_settings_realtime_voice_lab">Echtzeit-Sprachlabor</string>
-    <string name="dev_settings_realtime_voice_lab_desc">WebSocket-Testumgebung des Anbieters für Entwicklungs-Builds öffnen</string>
+    <string name="dev_settings_realtime_voice_lab_desc">Echtzeit-Sprachkonfiguration prüfen und einen gezielten Mikrofontest ausführen</string>
     <string name="dev_settings_open_realtime_voice_lab_cd">Echtzeit-Sprachlabor öffnen</string>
     <string name="dev_settings_lock_dev_options">Entwickleroptionen sperren</string>
     <string name="dev_settings_lock_dev_options_desc">Diesen Abschnitt ausblenden und experimentelle Funktionen deaktivieren</string>
@@ -1219,6 +1219,7 @@
     <string name="dev_settings_export_failed">Export fehlgeschlagen</string>
     <string name="dev_settings_imported">Einstellungen importiert</string>
     <string name="dev_settings_import_failed">Import fehlgeschlagen — ungültige Datei</string>
+    <string name="dev_settings_reset_failed">Zurücksetzen fehlgeschlagen</string>
     <string name="dev_settings_export_sensitive_backup_title">Vertrauliche Sicherung exportieren?</string>
     <string name="dev_settings_export_sensitive_backup_body">Diese Sicherung enthält gespeicherte Verbindungen, API-Schlüssel, Relay-Sitzungstoken, Geräte-IDs und Dashboard-Cookies. Jede Person mit dieser Datei kann möglicherweise auf deinen Hermes-Server zugreifen.</string>
     <string name="dev_settings_export_action">Exportieren</string>
@@ -2237,6 +2238,19 @@
     <string name="conn_info_confirms_on_next_message">Bei nächster Nachricht bestätigen</string>
     <string name="conn_info_connect">Verbinden</string>
     <string name="conn_info_connected">Verbunden</string>
+    <string name="conn_info_active_configuration">Aktive Konfiguration</string>
+    <string name="conn_info_inherited">Geerbt</string>
+    <string name="conn_info_bypassed">Umgangen</string>
+    <string name="conn_info_customize_identity">Identität anpassen</string>
+    <string name="conn_info_agent_passport">Agentenpass</string>
+    <string name="conn_info_chat_override">Chat-Überschreibung</string>
+    <string name="conn_info_fast_tier">Schnellstufe</string>
+    <string name="conn_info_fast">Schnell</string>
+    <string name="conn_info_context">Kontext</string>
+    <string name="conn_info_profile_already_bypasses">Genehmigungen werden bereits vom Profil umgangen.</string>
+    <string name="conn_info_start_new_chat">Neuen Chat starten</string>
+    <string name="conn_info_approval_mode_short_desc">Wähle, wie Genehmigungen erzwungen werden.</string>
+    <string name="conn_info_approval_policy">Genehmigungsrichtlinie</string>
     <string name="conn_info_connecting">Verbindung wird hergestellt…</string>
     <string name="conn_info_connection">Verbindung</string>
     <string name="conn_info_connection_state">Verbindungsstatus</string>

app/src/main/res/values-es/strings.xml

@@ -1076,7 +1076,7 @@
     <string name="dev_settings_relay_features">Características de Relay</string>
     <string name="dev_settings_relay_features_desc">Mostrar el servidor Relay y la configuración de emparejamiento para el desarrollo de Bridge/Terminal</string>
     <string name="dev_settings_realtime_voice_lab">Laboratorio de voz en tiempo real</string>
-    <string name="dev_settings_realtime_voice_lab_desc">Abra el banco de pruebas del proveedor websocket para compilaciones de desarrollo.</string>
+    <string name="dev_settings_realtime_voice_lab_desc">Revisa la configuración de voz en tiempo real y ejecuta una prueba de micrófono</string>
     <string name="dev_settings_open_realtime_voice_lab_cd">Abrir laboratorio de voz en tiempo real</string>
     <string name="dev_settings_lock_dev_options">Bloquear opciones de desarrollador</string>
     <string name="dev_settings_lock_dev_options_desc">Ocultar esta sección y desactivar las funciones experimentales</string>
@@ -1107,6 +1107,7 @@
     <string name="dev_settings_export_failed">Exportación fallida</string>
     <string name="dev_settings_imported">Configuraciones importadas</string>
     <string name="dev_settings_import_failed">Error al importar: archivo no válido</string>
+    <string name="dev_settings_reset_failed">Error al restablecer</string>
     <string name="dev_settings_export_sensitive_backup_title">¿Exportar copia de seguridad confidencial?</string>
     <string name="dev_settings_export_sensitive_backup_body">Esta copia de seguridad incluye conexiones guardadas, claves API, tokens de sesión relay, ID de dispositivos y cookies del panel. Cualquier persona que tenga el archivo podrá acceder a su servidor Hermes.</string>
     <string name="dev_settings_export_action">Exportar</string>
@@ -2043,6 +2044,19 @@
     <string name="conn_info_confirms_on_next_message">Confirma en el siguiente mensaje</string>
     <string name="conn_info_connect">Conectar</string>
     <string name="conn_info_connected">Conectado</string>
+    <string name="conn_info_active_configuration">Configuración activa</string>
+    <string name="conn_info_inherited">Heredado</string>
+    <string name="conn_info_bypassed">Omitido</string>
+    <string name="conn_info_customize_identity">Personalizar identidad</string>
+    <string name="conn_info_agent_passport">Pasaporte del agente</string>
+    <string name="conn_info_chat_override">Anulación del chat</string>
+    <string name="conn_info_fast_tier">Nivel rápido</string>
+    <string name="conn_info_fast">Rápido</string>
+    <string name="conn_info_context">Contexto</string>
+    <string name="conn_info_profile_already_bypasses">El perfil ya omite las aprobaciones.</string>
+    <string name="conn_info_start_new_chat">Iniciar nuevo chat</string>
+    <string name="conn_info_approval_mode_short_desc">Elige cómo se aplican las aprobaciones.</string>
+    <string name="conn_info_approval_policy">Política de aprobación</string>
     <string name="conn_info_connecting">Conectando…</string>
     <string name="conn_info_connection">Conexión</string>
     <string name="conn_info_connection_state">Estado de conexión</string>

app/src/main/res/values-ja/strings.xml

@@ -1201,7 +1201,7 @@
     <string name="dev_settings_relay_features">Relay の特徴</string>
     <string name="dev_settings_relay_features_desc">Relay サーバーと Bridge/ターミナル開発用のペアリング設定を表示</string>
     <string name="dev_settings_realtime_voice_lab">リアルタイム音声ラボ</string>
-    <string name="dev_settings_realtime_voice_lab_desc">開発ビルド用のプロバイダー WebSocket テストベンチを開きます</string>
+    <string name="dev_settings_realtime_voice_lab_desc">リアルタイム音声の設定を確認し、マイクの集中テストを実行します</string>
     <string name="dev_settings_open_realtime_voice_lab_cd">リアルタイム音声ラボを開く</string>
     <string name="dev_settings_lock_dev_options">開発者向けオプションをロックする</string>
     <string name="dev_settings_lock_dev_options_desc">このセクションを非表示にし、実験的な機能を無効にします</string>
@@ -1232,6 +1232,7 @@
     <string name="dev_settings_export_failed">エクスポートに失敗しました</string>
     <string name="dev_settings_imported">インポートされた設定</string>
     <string name="dev_settings_import_failed">インポートに失敗しました - 無効なファイル</string>
+    <string name="dev_settings_reset_failed">リセットに失敗しました</string>
     <string name="dev_settings_export_sensitive_backup_title">機密性の高いバックアップをエクスポートしますか?</string>
     <string name="dev_settings_export_sensitive_backup_body">このバックアップには、保存された接続、API キー、Relay セッション トークン、デバイス ID、およびダッシュボード Cookie が含まれます。ファイルを持っている人は誰でも、Hermes サーバーにアクセスできる可能性があります。</string>
     <string name="dev_settings_export_action">輸出</string>
@@ -2248,6 +2249,19 @@
     <string name="conn_info_confirms_on_next_message">次のメッセージで確認します</string>
     <string name="conn_info_connect">接続する</string>
     <string name="conn_info_connected">接続済み</string>
+    <string name="conn_info_active_configuration">有効な構成</string>
+    <string name="conn_info_inherited">継承</string>
+    <string name="conn_info_bypassed">バイパス</string>
+    <string name="conn_info_customize_identity">アイデンティティをカスタマイズ</string>
+    <string name="conn_info_agent_passport">エージェントパスポート</string>
+    <string name="conn_info_chat_override">チャットの上書き</string>
+    <string name="conn_info_fast_tier">高速ティア</string>
+    <string name="conn_info_fast">高速</string>
+    <string name="conn_info_context">コンテキスト</string>
+    <string name="conn_info_profile_already_bypasses">承認はプロファイルですでにバイパスされています。</string>
+    <string name="conn_info_start_new_chat">新しいチャットを開始</string>
+    <string name="conn_info_approval_mode_short_desc">承認を適用する方法を選択します。</string>
+    <string name="conn_info_approval_policy">承認ポリシー</string>
     <string name="conn_info_connecting">接続中…</string>
     <string name="conn_info_connection">繋がり</string>
     <string name="conn_info_connection_state">接続状態</string>

app/src/main/res/values/strings.xml

@@ -1290,7 +1290,7 @@
     <string name="dev_settings_relay_features">Relay features</string>
     <string name="dev_settings_relay_features_desc">Show Relay Server and Pairing settings for Bridge/Terminal development</string>
     <string name="dev_settings_realtime_voice_lab">Realtime voice lab</string>
-    <string name="dev_settings_realtime_voice_lab_desc">Open the provider websocket testbench for dev builds</string>
+    <string name="dev_settings_realtime_voice_lab_desc">Inspect realtime voice setup and run a focused microphone test</string>
     <string name="dev_settings_open_realtime_voice_lab_cd">Open realtime voice lab</string>
     <string name="dev_settings_image_generation_lab">Image generation lab</string>
     <string name="dev_settings_image_generation_lab_desc">Preview generation loops and the final image reveal</string>
@@ -1324,6 +1324,7 @@
     <string name="dev_settings_export_failed">Export failed</string>
     <string name="dev_settings_imported">Settings imported</string>
     <string name="dev_settings_import_failed">Import failed — invalid file</string>
+    <string name="dev_settings_reset_failed">Reset failed</string>
     <string name="dev_settings_export_sensitive_backup_title">Export sensitive backup?</string>
     <string name="dev_settings_export_sensitive_backup_body">This backup includes saved connections, API keys, relay session tokens, device IDs, and dashboard cookies. Anyone with the file may be able to access your Hermes server.</string>
     <string name="dev_settings_export_action">Export</string>
@@ -2357,6 +2358,19 @@
     <string name="conn_info_confirms_on_next_message">Confirms on next message</string>
     <string name="conn_info_connect">Connect</string>
     <string name="conn_info_connected">Connected</string>
+    <string name="conn_info_active_configuration">Active configuration</string>
+    <string name="conn_info_inherited">Inherited</string>
+    <string name="conn_info_bypassed">Bypassed</string>
+    <string name="conn_info_customize_identity">Customize identity</string>
+    <string name="conn_info_agent_passport">Agent Passport</string>
+    <string name="conn_info_chat_override">Chat override</string>
+    <string name="conn_info_fast_tier">Fast tier</string>
+    <string name="conn_info_fast">Fast</string>
+    <string name="conn_info_context">Context</string>
+    <string name="conn_info_profile_already_bypasses">Approvals already bypassed by profile.</string>
+    <string name="conn_info_start_new_chat">Start new chat</string>
+    <string name="conn_info_approval_mode_short_desc">Choose how approvals are enforced.</string>
+    <string name="conn_info_approval_policy">Approval policy</string>
     <string name="conn_info_connecting">Connecting…</string>
     <string name="conn_info_connection">Connection</string>
     <string name="conn_info_connection_state">Connection state</string>

app/src/test/kotlin/com/hermesandroid/relay/data/DataManagerIoTest.kt

@@ -0,0 +1,52 @@
+package com.hermesandroid.relay.data
+
+import android.content.ContentResolver
+import android.content.Context
+import android.net.Uri
+import io.mockk.every
+import io.mockk.mockk
+import io.mockk.coJustRun
+import io.mockk.coVerify
+import kotlinx.coroutines.test.runTest
+import org.junit.Assert.assertFalse
+import org.junit.Test
+import java.io.File
+
+class DataManagerIoTest {
+    @Test
+    fun writeBackupFailsWhenProviderReturnsNoOutputStream() = runTest {
+        val uri = mockk<Uri>()
+        val resolver = mockk<ContentResolver>()
+        val context = mockk<Context>()
+        every { context.contentResolver } returns resolver
+        every { resolver.openOutputStream(uri) } returns null
+
+        val success = DataManager(context).writeBackupToUri(uri, "{}")
+
+        assertFalse(success)
+    }
+
+    @Test
+    fun restoreTreatsEmptyConnectionsAsReplacementSnapshot() = runTest {
+        val context = mockk<Context>()
+        val store = mockk<ConnectionStore>()
+        every { context.filesDir } returns File("build/tmp/data-manager-test/files")
+        coJustRun {
+            store.replaceConnections(
+                connections = emptyList(),
+                activeConnectionId = null,
+                startupConnectionId = null,
+            )
+        }
+
+        DataManager(context, store).restoreConnectionBackup(DataManager.AppBackup())
+
+        coVerify(exactly = 1) {
+            store.replaceConnections(
+                connections = emptyList(),
+                activeConnectionId = null,
+                startupConnectionId = null,
+            )
+        }
+    }
+}

app/src/test/kotlin/com/hermesandroid/relay/data/FeatureFlagsTest.kt

@@ -0,0 +1,51 @@
+package com.hermesandroid.relay.data
+
+import android.content.Context
+import androidx.datastore.preferences.core.edit
+import androidx.test.core.app.ApplicationProvider
+import kotlinx.coroutines.flow.first
+import kotlinx.coroutines.test.runTest
+import org.junit.After
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertFalse
+import org.junit.Assert.assertTrue
+import org.junit.Before
+import org.junit.Test
+import org.junit.runner.RunWith
+import org.robolectric.RobolectricTestRunner
+
+@RunWith(RobolectricTestRunner::class)
+class FeatureFlagsTest {
+    private lateinit var context: Context
+
+    @Before
+    fun setUp() = runTest {
+        context = ApplicationProvider.getApplicationContext()
+        context.relayDataStore.edit { it.clear() }
+    }
+
+    @After
+    fun tearDown() = runTest {
+        context.relayDataStore.edit { it.clear() }
+    }
+
+    @Test
+    fun missingPreferenceUsesBuildDefault() = runTest {
+        assertEquals(FeatureFlags.isDevBuild, FeatureFlags.devOptionsUnlocked(context).first())
+    }
+
+    @Test
+    fun explicitLockOverridesDebugBuildDefault() = runTest {
+        FeatureFlags.lockDevOptions(context)
+
+        assertFalse(FeatureFlags.devOptionsUnlocked(context).first())
+    }
+
+    @Test
+    fun unlockPersistsAfterExplicitLock() = runTest {
+        FeatureFlags.lockDevOptions(context)
+        FeatureFlags.unlockDevOptions(context)
+
+        assertTrue(FeatureFlags.devOptionsUnlocked(context).first())
+    }
+}

app/src/test/kotlin/com/hermesandroid/relay/network/upstream/GatewayChatClientTest.kt

@@ -295,6 +295,10 @@ class GatewayClientHarness(
                         put("key", "fast")
                         put("value", (params["value"] as? JsonPrimitive)?.contentOrNull ?: "normal")
                     }
+                    "yolo" -> buildJsonObject {
+                        put("key", "yolo")
+                        put("value", (params["value"] as? JsonPrimitive)?.contentOrNull ?: "0")
+                    }
                     "approvals.mode" -> {
                         approvalMode =
                             (params["value"] as? JsonPrimitive)?.contentOrNull ?: approvalMode
@@ -1892,6 +1896,25 @@ class GatewayChatClientTest {
         assertFalse(rpc.containsKey("scope"))
     }
 
+    @Test
+    fun `yolo update targets live session with ephemeral session scope`() {
+        val r = Recorder()
+        client.sendTurn("stored-1", "hi", null, r.callbacks) { r.preflightFailures += it }
+        harness.awaitServerSocket()
+        harness.awaitRpc("session.resume")
+        harness.awaitRpc("prompt.submit")
+
+        val result = runBlocking { client.setYolo(true) }
+
+        assertTrue(result.isSuccess)
+        assertTrue(result.getOrThrow())
+        val rpc = harness.awaitRpc("config.set")
+        assertEquals("yolo", (rpc["key"] as? JsonPrimitive)?.contentOrNull)
+        assertEquals("1", (rpc["value"] as? JsonPrimitive)?.contentOrNull)
+        assertEquals("session", (rpc["scope"] as? JsonPrimitive)?.contentOrNull)
+        assertEquals("live-resumed", (rpc["session_id"] as? JsonPrimitive)?.contentOrNull)
+    }
+
     // --- Edit & regenerate ---
 
     @Test

design-qa.md

@@ -1,27 +1,30 @@
-# Voice Settings design QA
+# Agent Passport design QA
 
 Status: **passed**
 
 ## Compared
 
-- Source: `voice-audit/mockup-04-recommended-hybrid.png`
-- Implementation: `voice-audit/implementation-03-provider-preview-refined.png`
-- Viewport: Android `Medium_Phone`, 1080 x 2400 px (about 390 dp wide), font scale 1.0
-- State: Output tab, xAI Grok TTS, Eve selected and actively previewing
+- Source: `C:\Users\Bailey\.codex\generated_images\019f6640-e6dc-7c33-8aca-a1610e2a19f0\call_JzVlJKlG8KWTJRo2xup7oTlq.png`
+- Implementation: `C:\Users\Bailey\.codex\visualizations\2026\07\25\agent-drawer-audit\passport-qa-final.png`
+- Source size: 852 x 1846 px
+- Device viewport: Android, 1080 x 2340 px, font scale 1.0
+- State: Agent tab, Victor pinned profile, disconnected gateway
 
 ## Resolved findings
 
-- **P2 - Group boundaries were too weak.** Provider, model/voice, and language/quality surfaces now use the product's rounded Material cards with outline-token borders and a subtle surface-variant fill.
-- **P2 - Preview state was too tall.** The existing voice waveform now accepts a caller-provided height; inline preview uses a compact 28 dp waveform while the full voice overlay keeps its 56 dp default.
-- **P2 - Long catalogs displaced the core controls.** The selected/recommended voices remain inline, while the full catalog opens from a compact `View all voices` action.
-- **P2 - Secondary controls competed with selection.** Latency, fallback, expressive tags, and manual IDs now stay inside the collapsed Language & quality section.
-- **P3 - Active tab lacked the target emphasis.** The selected segment now uses the theme primary/on-primary colors.
+- **P2 - Header hierarchy and identity treatment differed from the selected concept.** The sheet now uses the Agent Passport title, large profile card, circular avatar, pin-style profile chip, status line, and four-column metrics strip.
+- **P2 - Configuration controls lacked the concept's card hierarchy.** Personality, model, and reasoning are grouped into one outlined Active configuration card with matching icon medallions and row affordances.
+- **P2 - Safety controls did not match the selected inline treatment.** Approval status, chat override, and fast tier now share one outlined Safety & speed card with compact segmented controls.
+- **P2 - Primary action looked detached and visually unfinished.** Start new chat now uses the selected full-width purple-to-relay gradient, white outlined chat icon, and a single clean label.
+- **P2 - Nested sheet and content gestures caused visible vertical bounce.** Sheet drag gestures are disabled for this scrollable detail surface and overscroll is suppressed; repeated device swipes keep the sheet anchored while the content scrolls.
 
 ## Final review
 
-- Layout and hierarchy match the selected hybrid: summary, Output/Listening/Advanced tabs, grouped provider, grouped model/voice, inline play/stop, active waveform, and collapsed language/quality.
-- Interactions are wired: tabs switch sections, provider/model/voice selections update the draft, only one preview can play, the active play button becomes Stop, and full catalogs remain accessible.
-- Accessibility: native Material controls retain semantics and practical tap targets; the active preview has explicit play/stop descriptions; the screen remains vertically scrollable for large text and long provider catalogs.
-- Accepted native adaptation: Android exposed dropdowns and dynamic account-backed catalogs use more vertical space than the static concept. The hierarchy and core actions remain intact without clipping or overlap.
+- Layout and hierarchy match the selected Agent Passport direction: profile identity, metrics, Agent/Session tabs, active configuration, safety and speed, primary chat action, and identity customization.
+- Interactions remain wired: profile selection, configuration rows, Agent/Session tabs, approval and fast controls, new chat, and identity customization.
+- Runtime values remain live rather than copied from the static concept; connection state, message count, route label, provider, and model can therefore differ from the reference.
+- Native Android adaptation preserves system insets and scrollability on the taller 1080 x 2340 device viewport.
 
 No open P0, P1, or P2 findings.
+
+final result: passed

docs/localization-status.json

@@ -13,7 +13,7 @@
       "verification": "ai-translated",
       "review_refs": [],
       "source_sha256": {
-        "main": "0c143c2f1440b5b4f5684d3a5db7481d304f61e93654aad5ff140b191dd8a82d",
+        "main": "535984df5230a1120622c384f76056611c4edc73599b6e7f2311827c776eedd7",
         "sideload": "4abff4f1069091ec2de735c3037a7ec7d77699cb4321e8511a622437bceaf7c2"
       },
       "surfaces": {
@@ -48,7 +48,7 @@
       "verification": "ai-translated",
       "review_refs": [],
       "source_sha256": {
-        "main": "0c143c2f1440b5b4f5684d3a5db7481d304f61e93654aad5ff140b191dd8a82d",
+        "main": "535984df5230a1120622c384f76056611c4edc73599b6e7f2311827c776eedd7",
         "sideload": "4abff4f1069091ec2de735c3037a7ec7d77699cb4321e8511a622437bceaf7c2"
       },
       "surfaces": {
@@ -72,7 +72,7 @@
       "verification": "ai-translated",
       "review_refs": [],
       "source_sha256": {
-        "main": "0c143c2f1440b5b4f5684d3a5db7481d304f61e93654aad5ff140b191dd8a82d",
+        "main": "535984df5230a1120622c384f76056611c4edc73599b6e7f2311827c776eedd7",
         "sideload": "4abff4f1069091ec2de735c3037a7ec7d77699cb4321e8511a622437bceaf7c2"
       },
       "surfaces": {
@@ -96,7 +96,7 @@
       "verification": "ai-translated",
       "review_refs": [],
       "source_sha256": {
-        "main": "0c143c2f1440b5b4f5684d3a5db7481d304f61e93654aad5ff140b191dd8a82d",
+        "main": "535984df5230a1120622c384f76056611c4edc73599b6e7f2311827c776eedd7",
         "sideload": "4abff4f1069091ec2de735c3037a7ec7d77699cb4321e8511a622437bceaf7c2"
       },
       "surfaces": {
@@ -120,7 +120,7 @@
       "verification": "ai-translated",
       "review_refs": [],
       "source_sha256": {
-        "main": "0c143c2f1440b5b4f5684d3a5db7481d304f61e93654aad5ff140b191dd8a82d",
+        "main": "535984df5230a1120622c384f76056611c4edc73599b6e7f2311827c776eedd7",
         "sideload": "4abff4f1069091ec2de735c3037a7ec7d77699cb4321e8511a622437bceaf7c2"
       },
       "surfaces": {

docs/play-store-listing.md

@@ -14,9 +14,9 @@ It's not a hosted AI service. It's a companion app for the Hermes agent you run,
 
 QUICK START
 
-1. Run hermes-agent with its API server enabled on your computer or home server.
-2. Install Hermes-Relay and enter your server's address (for example [http://192.168.1.100:8642](http://192.168.1.100:8642)).
-3. The setup wizard checks what your server supports and shows a readiness card — then you're talking.
+1. Run hermes-agent with its Dashboard/Gateway enabled on your computer or home server.
+2. Install Hermes-Relay and select the nearby Dashboard, or enter its address and custom port.
+3. Sign in through the Dashboard when prompted. The setup wizard verifies Chat, sessions, Manage, and voice before finishing.
 
 No server yet? Tap "Try the demo" on the setup screen to explore the app offline — a sample conversation, no login or server required.
 
@@ -24,7 +24,7 @@ A plain Hermes install is enough. Chat, management, and voice all work with no p
 
 HOW IT WORKS
 
-Chat streams directly from your Hermes API Server in real time. Manage and voice use your Hermes dashboard with one sign-in. Run the optional relay service and the app can pair by QR code to add power tools: remote terminal, notification companion, media handoff, relay-session management, and more voice engines.
+Chat, sessions, Manage, and voice use the Hermes Dashboard/Gateway with one sign-in. A headless API server remains an automatic compatibility fallback. Run the optional relay service and the app can pair by QR code to add power tools: remote terminal, notification companion, media handoff, relay-session management, and more voice engines.
 
 GOOGLE PLAY BUILD
 
@@ -85,11 +85,12 @@ This app is a community project and is not affiliated with or endorsed by NousRe
 Paste into Play Console → **What's new** (≤500 characters):
 
 ```
-v1.4.9 - Clearer Hermes connections
+v1.5.0 - Hermes, always in reach
 
-* Connect through the Hermes dashboard with one sign-in.
-* Setup now explains nearby, remote, Tailscale, custom-port, and optional Relay paths.
-* Server default consistently displays Hermes' pinned active profile.
+* Secure Dashboard sign-in and a clearer Agent Passport.
+* Active background chats with actionable approval and question alerts.
+* Better attachments, image generation, voice, routing, and recovery.
+* Optional permission guidance that never blocks chat.
 ```
 
 ## Category