Merge remote-tracking branch 'origin/dev' into fix/android-basic-auth-paste

# Conflicts:
#	CHANGELOG.md

.github/scripts/classify-ci-paths.cjs

@@ -4,6 +4,7 @@ function classifyCiPaths(paths) {
   const forceAll = paths.some((path) => [
     '.github/workflows/ci-required.yml',
     '.github/workflows/release-backmerge.yml',
+    '.github/workflows/approve-release-train.yml',
     '.github/scripts/classify-ci-paths.cjs',
     '.github/scripts/classify-ci-paths.test.cjs',
     'scripts/plan_release_backmerge.py',
@@ -13,15 +14,17 @@ function classifyCiPaths(paths) {
   const under = (prefixes) => paths.some((path) => prefixes.some((prefix) => path.startsWith(prefix)));
 
   return {
-    android: forceAll || under(['app/', 'relay-core/', 'relay-ui/', 'ui-preview/', 'quest/', 'gradle/']) || exact([
+    android: forceAll || under(['app/', 'gradle/']) || exact([
       'build.gradle.kts', 'settings.gradle.kts', 'gradle.properties', 'gradlew', 'gradlew.bat',
       'scripts/check-android-locales.py', 'scripts/android-locale-harness.py',
       'scripts/check-android-collection-apis.py', 'scripts/check-android-native-compat.py',
       'scripts/check-android-release-notes.py',
+      'scripts/android_release_artifacts.py',
       'scripts/android-lane.ps1', 'scripts/android-prepush.py', 'scripts/dev.bat', 'scripts/dev.sh',
       'scripts/tests/android_prepush_test.py',
       'scripts/tests/check_android_native_compat_test.py',
       'scripts/tests/check_android_release_notes_test.py',
+      'scripts/tests/android_release_artifacts_test.py',
       '.github/workflows/android-on-demand.yml', '.github/workflows/ci-android.yml',
       '.github/workflows/play-preflight-android.yml',
       '.github/workflows/approve-release-android.yml',

.github/scripts/classify-ci-paths.test.cjs

@@ -16,9 +16,11 @@ const none = {
 
 assert.deepEqual(classifyCiPaths(['README.md']), none);
 assert.deepEqual(classifyCiPaths(['desktop/src/cli.ts']), { ...none, desktop: true });
-assert.deepEqual(classifyCiPaths(['relay-core/src/main/kotlin/Wire.kt']), { ...none, android: true });
+assert.deepEqual(classifyCiPaths(['experiments/quest/src/main/kotlin/Quest.kt']), none);
 assert.deepEqual(classifyCiPaths(['scripts/check-android-release-notes.py']), { ...none, android: true });
 assert.deepEqual(classifyCiPaths(['scripts/check-android-native-compat.py']), { ...none, android: true });
+assert.deepEqual(classifyCiPaths(['scripts/android_release_artifacts.py']), { ...none, android: true });
+assert.deepEqual(classifyCiPaths(['scripts/tests/android_release_artifacts_test.py']), { ...none, android: true });
 assert.deepEqual(classifyCiPaths(['scripts/tests/check_android_native_compat_test.py']), { ...none, android: true });
 assert.deepEqual(classifyCiPaths(['scripts/android-lane.ps1']), { ...none, android: true });
 assert.deepEqual(classifyCiPaths(['scripts/android-prepush.py']), { ...none, android: true });
@@ -56,6 +58,14 @@ assert.deepEqual(classifyCiPaths(['.github/workflows/release-backmerge.yml']), {
   contract: true,
   docs: true,
 });
+assert.deepEqual(classifyCiPaths(['.github/workflows/approve-release-train.yml']), {
+  android: true,
+  desktop: true,
+  plugin: true,
+  dashboard: true,
+  contract: true,
+  docs: true,
+});
 
 const repoRoot = join(__dirname, '..', '..');
 const approvalWorkflow = readFileSync(
@@ -70,6 +80,30 @@ const pluginReleaseWorkflow = readFileSync(
   join(repoRoot, '.github', 'workflows', 'release-plugin.yml'),
   'utf8',
 );
+const desktopCiWorkflow = readFileSync(
+  join(repoRoot, '.github', 'workflows', 'ci-desktop.yml'),
+  'utf8',
+);
+const androidPreflightWorkflow = readFileSync(
+  join(repoRoot, '.github', 'workflows', 'play-preflight-android.yml'),
+  'utf8',
+);
+const androidApprovalWorkflow = readFileSync(
+  join(repoRoot, '.github', 'workflows', 'approve-release-android.yml'),
+  'utf8',
+);
+const androidReleaseWorkflow = readFileSync(
+  join(repoRoot, '.github', 'workflows', 'release-android.yml'),
+  'utf8',
+);
+const requiredChecksWorkflow = readFileSync(
+  join(repoRoot, '.github', 'workflows', 'ci-required.yml'),
+  'utf8',
+);
+const releaseTrainWorkflow = readFileSync(
+  join(repoRoot, '.github', 'workflows', 'approve-release-train.yml'),
+  'utf8',
+);
 
 assert.match(approvalWorkflow, /permissions:\r?\n  contents: read/);
 assert.match(
@@ -81,6 +115,16 @@ assert.match(
   /ref: \$\{\{ contains\(inputs\.version, '-'\) && 'dev' \|\| 'main' \}\}/,
 );
 assert.match(cliReleaseWorkflow, /workflow_dispatch:[\s\S]*?Approved CLI\+UI version/);
+assert.match(cliReleaseWorkflow, /name: Restore exact-source tray build cache[\s\S]*?actions\/cache@v6/);
+assert.match(desktopCiWorkflow, /name: Restore exact-source tray build cache[\s\S]*?actions\/cache@v6/);
 assert.match(pluginReleaseWorkflow, /workflow_dispatch:[\s\S]*?Approved Plugin version/);
+assert.match(androidPreflightWorkflow, /Package immutable preflight artifacts/);
+assert.match(androidApprovalWorkflow, /Android public approval accepts stable SemVer only/);
+assert.match(androidReleaseWorkflow, /Download exact stable preflight artifacts/);
+assert.match(androidReleaseWorkflow, /artifact-ids: \$\{\{ needs\.validate\.outputs\.preflight_artifact_id \}\}/);
+assert.match(requiredChecksWorkflow, /name: Reuse exact-tree required checks/);
+assert.match(requiredChecksWorkflow, /name: required-checks-\$\{\{ needs\.changes\.outputs\.tree \}\}/);
+assert.match(releaseTrainWorkflow, /name: Hermes-Relay Coordinated Release Approval/);
+assert.match(releaseTrainWorkflow, /Coordinated Android approval is stable-only/);
 
 console.log('CI path classification tests passed.');

.github/workflows/approve-release-android.yml

@@ -40,6 +40,10 @@ jobs:
             echo "::error::Hermes-Relay Android Release Approval must run from main, not $GITHUB_REF"
             exit 1
           fi
+          if [[ ! "$REQUESTED_VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+            echo "::error::Android public approval accepts stable SemVer only: $REQUESTED_VERSION"
+            exit 1
+          fi
           TOML_VERSION=$(grep -oP 'appVersionName\s*=\s*"\K[^"]+' gradle/libs.versions.toml)
           if [ "$REQUESTED_VERSION" != "$TOML_VERSION" ]; then
             echo "::error::Requested version $REQUESTED_VERSION does not match appVersionName $TOML_VERSION"
@@ -56,13 +60,21 @@ jobs:
           RELEASE_TREE: ${{ steps.metadata.outputs.tree }}
         run: |
           ARTIFACT_NAME="play-preflight-${VERSION}-${RELEASE_TREE}"
-          COUNT=$(gh api "/repos/${GITHUB_REPOSITORY}/actions/artifacts?name=${ARTIFACT_NAME}" \
-            --jq '[.artifacts[] | select(.expired == false)] | length')
-          if [ "$COUNT" -lt 1 ]; then
+          ARTIFACT=$(gh api "/repos/${GITHUB_REPOSITORY}/actions/artifacts?name=${ARTIFACT_NAME}" \
+            --jq '[.artifacts[] | select(.expired == false)] | sort_by(.created_at) | last')
+          RUN_ID=$(jq -r '.workflow_run.id // empty' <<<"$ARTIFACT")
+          if [ -z "$RUN_ID" ]; then
             echo "::error::No successful Play preflight found for version $VERSION with tree $RELEASE_TREE"
             exit 1
           fi
-          echo "Verified Play preflight proof: $ARTIFACT_NAME"
+          RUN=$(gh api "/repos/${GITHUB_REPOSITORY}/actions/runs/${RUN_ID}")
+          CONCLUSION=$(jq -r '.conclusion' <<<"$RUN")
+          WORKFLOW_PATH=$(jq -r '.path' <<<"$RUN")
+          if [ "$WORKFLOW_PATH" != ".github/workflows/play-preflight-android.yml" ] || [ "$CONCLUSION" != "success" ]; then
+            echo "::error::Preflight artifact came from ${WORKFLOW_PATH} with conclusion ${CONCLUSION}"
+            exit 1
+          fi
+          echo "Verified immutable Play preflight artifacts: $ARTIFACT_NAME (run $RUN_ID)"
 
       - name: Ensure release tag does not already exist
         env:

.github/workflows/approve-release-train.yml

@@ -0,0 +1,120 @@
+name: Hermes-Relay Coordinated Release Approval
+
+on:
+  workflow_dispatch:
+    inputs:
+      android:
+        description: "Approve Hermes-Relay Android"
+        required: true
+        default: false
+        type: boolean
+      android_version:
+        description: "Android version when selected"
+        required: false
+        type: string
+      plugin:
+        description: "Approve Hermes-Relay Plugin"
+        required: true
+        default: false
+        type: boolean
+      plugin_version:
+        description: "Plugin version when selected"
+        required: false
+        type: string
+      desktop:
+        description: "Approve Hermes-Relay CLI+UI"
+        required: true
+        default: false
+        type: boolean
+      desktop_version:
+        description: "CLI+UI version when selected"
+        required: false
+        type: string
+
+permissions:
+  actions: write
+  contents: read
+
+concurrency:
+  group: approve-coordinated-release
+  cancel-in-progress: false
+
+jobs:
+  validate:
+    name: Validate selected release surfaces
+    runs-on: ubuntu-latest
+    steps:
+      - name: Require versions for every selected surface
+        env:
+          ANDROID: ${{ inputs.android }}
+          ANDROID_VERSION: ${{ inputs.android_version }}
+          PLUGIN: ${{ inputs.plugin }}
+          PLUGIN_VERSION: ${{ inputs.plugin_version }}
+          DESKTOP: ${{ inputs.desktop }}
+          DESKTOP_VERSION: ${{ inputs.desktop_version }}
+        run: |
+          set -euo pipefail
+          if [ "$ANDROID" != "true" ] && [ "$PLUGIN" != "true" ] && [ "$DESKTOP" != "true" ]; then
+            echo "::error::Select at least one release surface"
+            exit 1
+          fi
+          for pair in \
+            "$ANDROID:$ANDROID_VERSION:Android" \
+            "$PLUGIN:$PLUGIN_VERSION:Plugin" \
+            "$DESKTOP:$DESKTOP_VERSION:CLI+UI"; do
+            IFS=: read -r selected version label <<<"$pair"
+            if [ "$selected" = "true" ] && [[ ! "$version" =~ ^[0-9]+\.[0-9]+\.[0-9]+(-[0-9A-Za-z.-]+)?$ ]]; then
+              echo "::error::$label requires a valid SemVer version"
+              exit 1
+            fi
+          done
+          if [ "$ANDROID" = "true" ] && [[ "$ANDROID_VERSION" == *-* ]]; then
+            echo "::error::Coordinated Android approval is stable-only; use a dev candidate tag for prereleases"
+            exit 1
+          fi
+
+  android:
+    name: Approve Hermes-Relay Android
+    needs: validate
+    if: inputs.android
+    runs-on: ubuntu-latest
+    steps:
+      - name: Dispatch Android approval
+        env:
+          GH_TOKEN: ${{ github.token }}
+          VERSION: ${{ inputs.android_version }}
+        run: gh workflow run approve-release-android.yml --repo "$GITHUB_REPOSITORY" --ref main -f version="$VERSION"
+
+  plugin:
+    name: Approve Hermes-Relay Plugin
+    needs: validate
+    if: inputs.plugin
+    runs-on: ubuntu-latest
+    steps:
+      - name: Dispatch Plugin approval
+        env:
+          GH_TOKEN: ${{ github.token }}
+          VERSION: ${{ inputs.plugin_version }}
+        run: |
+          gh workflow run approve-release-extensions.yml \
+            --repo "$GITHUB_REPOSITORY" \
+            --ref main \
+            -f surface=plugin \
+            -f version="$VERSION"
+
+  desktop:
+    name: Approve Hermes-Relay CLI+UI
+    needs: validate
+    if: inputs.desktop
+    runs-on: ubuntu-latest
+    steps:
+      - name: Dispatch CLI+UI approval
+        env:
+          GH_TOKEN: ${{ github.token }}
+          VERSION: ${{ inputs.desktop_version }}
+        run: |
+          gh workflow run approve-release-extensions.yml \
+            --repo "$GITHUB_REPOSITORY" \
+            --ref main \
+            -f surface=desktop \
+            -f version="$VERSION"

.github/workflows/ci-android.yml

@@ -20,10 +20,6 @@ on:
     branches: [main, dev]
     paths:
       - "app/**"
-      - "relay-core/**"
-      - "relay-ui/**"
-      - "ui-preview/**"
-      - "quest/**"
       - "gradle/**"
       - "build.gradle.kts"
       - "settings.gradle.kts"

.github/workflows/ci-desktop.yml

@@ -107,6 +107,18 @@ jobs:
       - name: Setup Rust
         uses: dtolnay/rust-toolchain@stable
 
+      - name: Restore exact-source tray build cache
+        uses: actions/cache@v6
+        with:
+          path: |
+            ~/.cargo/registry/index
+            ~/.cargo/registry/cache
+            ~/.cargo/git/db
+            desktop/tray/target
+          key: ${{ runner.os }}-tray-rust-${{ hashFiles('desktop/tray/Cargo.lock') }}-${{ hashFiles('desktop/tray/Cargo.toml', 'desktop/tray/build.rs', 'desktop/tray/src/**/*.rs') }}
+          restore-keys: |
+            ${{ runner.os }}-tray-rust-${{ hashFiles('desktop/tray/Cargo.lock') }}-
+
       - name: Install deps
         run: npm ci && npm --prefix tray ci
 

.github/workflows/ci-plugin.yml

@@ -111,4 +111,8 @@ jobs:
             plugin/tests/test_git_state.py \
             plugin/tests/test_git_state_write.py \
             plugin/tests/test_git_state_extras.py \
-            plugin/tests/test_mobile_plugin_store.py
+            plugin/tests/test_mobile_plugin_store.py \
+            plugin/tests/test_android_tool.py \
+            plugin/tests/test_android_navigate.py \
+            plugin/tests/test_phone_platform.py \
+            plugin/tests/test_desktop_tool_availability.py

.github/workflows/ci-required.yml

@@ -34,6 +34,7 @@ on:
           - all-final
 
 permissions:
+  actions: read
   contents: read
   pull-requests: read
 
@@ -52,6 +53,8 @@ jobs:
       dashboard: ${{ steps.filter.outputs.dashboard }}
       contract: ${{ steps.filter.outputs.contract }}
       docs: ${{ steps.filter.outputs.docs }}
+      release_pr: ${{ steps.release.outputs.release_pr }}
+      tree: ${{ steps.tree.outputs.tree }}
     steps:
       - name: Checkout pull request merge
         if: github.event_name == 'pull_request'
@@ -69,6 +72,26 @@ jobs:
       - name: Test path classifier
         run: node .github/scripts/classify-ci-paths.test.cjs
 
+      - name: Record checked tree
+        id: tree
+        run: echo "tree=$(git rev-parse 'HEAD^{tree}')" >> "$GITHUB_OUTPUT"
+
+      - name: Detect canonical release promotion
+        id: release
+        env:
+          BASE_REF: ${{ github.base_ref }}
+          HEAD_REF: ${{ github.head_ref }}
+          HEAD_REPOSITORY: ${{ github.event.pull_request.head.repo.full_name }}
+        run: |
+          if [ "$GITHUB_EVENT_NAME" = "pull_request" ] && \
+             [ "$BASE_REF" = "main" ] && \
+             [ "$HEAD_REF" = "dev" ] && \
+             [ "$HEAD_REPOSITORY" = "$GITHUB_REPOSITORY" ]; then
+            echo "release_pr=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "release_pr=false" >> "$GITHUB_OUTPUT"
+          fi
+
       - name: Classify changed files
         id: filter
         uses: actions/github-script@v8
@@ -123,43 +146,117 @@ jobs:
             core.notice(`Changed paths: ${paths.join(', ')}`);
             core.notice(`Selected checks: ${Object.entries(outputs).filter(([, value]) => value).map(([key]) => key).join(', ') || 'none'}`);
 
-  android:
+  release-proof:
+    name: Reuse exact-tree required checks
     needs: changes
-    if: needs.changes.outputs.android == 'true' && (github.event_name != 'workflow_dispatch' || inputs.android_preset == 'auto')
+    if: needs.changes.outputs.release_pr == 'true'
+    runs-on: ubuntu-latest
+    outputs:
+      reuse: ${{ steps.proof.outputs.reuse }}
+      artifact_id: ${{ steps.proof.outputs.artifact_id }}
+      run_id: ${{ steps.proof.outputs.run_id }}
+      tree: ${{ steps.proof.outputs.tree }}
+    steps:
+      - name: Checkout simulated release merge
+        uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+
+      - name: Locate exact-tree proof
+        id: proof
+        env:
+          GH_TOKEN: ${{ github.token }}
+          DEV_SHA: ${{ github.event.pull_request.head.sha }}
+        run: |
+          set -euo pipefail
+          merge_tree=$(git rev-parse 'HEAD^{tree}')
+          dev_tree=$(git rev-parse "${DEV_SHA}^{tree}")
+          echo "reuse=false" >> "$GITHUB_OUTPUT"
+          echo "tree=$dev_tree" >> "$GITHUB_OUTPUT"
+          if [ "$merge_tree" != "$dev_tree" ]; then
+            echo "Release merge changes the dev tree ($dev_tree -> $merge_tree); running full CI."
+            exit 0
+          fi
+
+          artifact_name="required-checks-${dev_tree}"
+          artifact=$(gh api "/repos/${GITHUB_REPOSITORY}/actions/artifacts?name=${artifact_name}" \
+            --jq '[.artifacts[] | select(.expired == false)] | sort_by(.created_at) | last')
+          artifact_id=$(jq -r '.id // empty' <<<"$artifact")
+          run_id=$(jq -r '.workflow_run.id // empty' <<<"$artifact")
+          if [ -z "$artifact_id" ] || [ -z "$run_id" ]; then
+            echo "No reusable proof exists for tree $dev_tree; running full CI."
+            exit 0
+          fi
+
+          run=$(gh api "/repos/${GITHUB_REPOSITORY}/actions/runs/${run_id}")
+          conclusion=$(jq -r '.conclusion' <<<"$run")
+          workflow_path=$(jq -r '.path' <<<"$run")
+          if [ "$workflow_path" != ".github/workflows/ci-required.yml" ] || [ "$conclusion" != "success" ]; then
+            echo "::error::Required-check proof came from ${workflow_path} with conclusion ${conclusion}"
+            exit 1
+          fi
+          echo "artifact_id=$artifact_id" >> "$GITHUB_OUTPUT"
+          echo "run_id=$run_id" >> "$GITHUB_OUTPUT"
+          echo "reuse=true" >> "$GITHUB_OUTPUT"
+
+      - name: Download exact-tree proof
+        if: steps.proof.outputs.reuse == 'true'
+        uses: actions/download-artifact@v8
+        with:
+          artifact-ids: ${{ steps.proof.outputs.artifact_id }}
+          github-token: ${{ github.token }}
+          repository: ${{ github.repository }}
+          run-id: ${{ steps.proof.outputs.run_id }}
+          path: required-check-proof
+
+      - name: Verify exact-tree proof
+        if: steps.proof.outputs.reuse == 'true'
+        env:
+          EXPECTED_TREE: ${{ steps.proof.outputs.tree }}
+        run: |
+          jq -e \
+            --arg repository "$GITHUB_REPOSITORY" \
+            --arg tree "$EXPECTED_TREE" \
+            '.schemaVersion == 1 and .repository == $repository and .tree == $tree' \
+            required-check-proof/required-checks.json
+
+  android:
+    needs: [changes, release-proof]
+    if: ${{ always() && needs.changes.result == 'success' && needs.changes.outputs.android == 'true' && needs.release-proof.outputs.reuse != 'true' && (github.event_name != 'workflow_dispatch' || inputs.android_preset == 'auto') }}
     uses: ./.github/workflows/ci-android.yml
 
   android_on_demand:
-    needs: changes
-    if: github.event_name == 'workflow_dispatch' && inputs.android_preset != 'auto'
+    needs: [changes, release-proof]
+    if: ${{ always() && needs.changes.result == 'success' && needs.release-proof.outputs.reuse != 'true' && github.event_name == 'workflow_dispatch' && inputs.android_preset != 'auto' }}
     uses: ./.github/workflows/android-on-demand.yml
     with:
       head_sha: ${{ inputs.head_sha }}
       preset: ${{ inputs.android_preset }}
 
   desktop:
-    needs: changes
-    if: needs.changes.outputs.desktop == 'true' && (github.event_name != 'workflow_dispatch' || inputs.android_preset == 'auto')
+    needs: [changes, release-proof]
+    if: ${{ always() && needs.changes.result == 'success' && needs.changes.outputs.desktop == 'true' && needs.release-proof.outputs.reuse != 'true' && (github.event_name != 'workflow_dispatch' || inputs.android_preset == 'auto') }}
     uses: ./.github/workflows/ci-desktop.yml
 
   plugin:
-    needs: changes
-    if: needs.changes.outputs.plugin == 'true' && (github.event_name != 'workflow_dispatch' || inputs.android_preset == 'auto')
+    needs: [changes, release-proof]
+    if: ${{ always() && needs.changes.result == 'success' && needs.changes.outputs.plugin == 'true' && needs.release-proof.outputs.reuse != 'true' && (github.event_name != 'workflow_dispatch' || inputs.android_preset == 'auto') }}
     uses: ./.github/workflows/ci-plugin.yml
 
   dashboard:
-    needs: changes
-    if: needs.changes.outputs.dashboard == 'true' && (github.event_name != 'workflow_dispatch' || inputs.android_preset == 'auto')
+    needs: [changes, release-proof]
+    if: ${{ always() && needs.changes.result == 'success' && needs.changes.outputs.dashboard == 'true' && needs.release-proof.outputs.reuse != 'true' && (github.event_name != 'workflow_dispatch' || inputs.android_preset == 'auto') }}
     uses: ./.github/workflows/ci-dashboard.yml
 
   contract:
-    needs: changes
-    if: needs.changes.outputs.contract == 'true' && (github.event_name != 'workflow_dispatch' || inputs.android_preset == 'auto')
+    needs: [changes, release-proof]
+    if: ${{ always() && needs.changes.result == 'success' && needs.changes.outputs.contract == 'true' && needs.release-proof.outputs.reuse != 'true' && (github.event_name != 'workflow_dispatch' || inputs.android_preset == 'auto') }}
     uses: ./.github/workflows/ci-contract.yml
 
   docs:
     name: Build public docs
-    needs: changes
-    if: needs.changes.outputs.docs == 'true' && (github.event_name != 'workflow_dispatch' || inputs.android_preset == 'auto')
+    needs: [changes, release-proof]
+    if: ${{ always() && needs.changes.result == 'success' && needs.changes.outputs.docs == 'true' && needs.release-proof.outputs.reuse != 'true' && (github.event_name != 'workflow_dispatch' || inputs.android_preset == 'auto') }}
     runs-on: ubuntu-latest
     defaults:
       run:
@@ -181,10 +278,12 @@ jobs:
   guard:
     name: Required checks
     if: always()
-    needs: [changes, android, android_on_demand, desktop, plugin, dashboard, contract, docs]
+    needs: [changes, release-proof, android, android_on_demand, desktop, plugin, dashboard, contract, docs]
     runs-on: ubuntu-latest
     env:
       CHANGES_RESULT: ${{ needs.changes.result }}
+      RELEASE_PROOF_RESULT: ${{ needs.release-proof.result }}
+      REUSED_REQUIRED_CHECKS: ${{ needs.release-proof.outputs.reuse }}
       ANDROID_RESULT: ${{ needs.android.result }}
       ANDROID_ON_DEMAND_RESULT: ${{ needs.android_on_demand.result }}
       DESKTOP_RESULT: ${{ needs.desktop.result }}
@@ -197,7 +296,7 @@ jobs:
         shell: bash
         run: |
           failed=0
-          for check in CHANGES ANDROID ANDROID_ON_DEMAND DESKTOP PLUGIN DASHBOARD CONTRACT DOCS; do
+          for check in CHANGES RELEASE_PROOF ANDROID ANDROID_ON_DEMAND DESKTOP PLUGIN DASHBOARD CONTRACT DOCS; do
             result_var="${check}_RESULT"
             result="${!result_var}"
             echo "$check: $result"
@@ -207,3 +306,26 @@ jobs:
             esac
           done
           exit "$failed"
+
+      - name: Write exact-tree proof
+        if: ${{ needs.release-proof.outputs.reuse != 'true' }}
+        env:
+          CHECKED_TREE: ${{ needs.changes.outputs.tree }}
+        run: |
+          mkdir -p required-check-proof
+          jq -n \
+            --arg repository "$GITHUB_REPOSITORY" \
+            --arg tree "$CHECKED_TREE" \
+            --arg commit "$GITHUB_SHA" \
+            --arg run_id "$GITHUB_RUN_ID" \
+            '{schemaVersion: 1, repository: $repository, tree: $tree, commit: $commit, runId: $run_id}' \
+            > required-check-proof/required-checks.json
+
+      - name: Upload exact-tree proof
+        if: ${{ needs.release-proof.outputs.reuse != 'true' }}
+        uses: actions/upload-artifact@v7
+        with:
+          name: required-checks-${{ needs.changes.outputs.tree }}
+          path: required-check-proof/required-checks.json
+          if-no-files-found: error
+          retention-days: 30

.github/workflows/play-preflight-android.yml

@@ -2,10 +2,11 @@
 #
 # Run manually from the final dev or untagged main tree before creating
 # android-v*. The job
-# builds the same signed release artifacts, scans final DEX, and uploads the
-# Google Play bundle as a production DRAFT. A successful upload is the automated
-# Play gate while no public GitHub Release or sideload APK exists. Console-only
-# pre-review and pre-launch reports are informational and do not block release.
+# builds the signed release artifacts once, scans the final packages, and uploads
+# the Google Play bundle as a production DRAFT. The exact signed APK/AAB,
+# mappings, manifest, and checksums remain private Actions artifacts until
+# approval publishes those same bytes. Console-only pre-review and pre-launch
+# reports are informational and do not block release.
 
 name: Hermes-Relay Android Play Preflight
 
@@ -98,7 +99,12 @@ jobs:
           HERMES_KEYSTORE_PASSWORD: ${{ secrets.HERMES_KEYSTORE_PASSWORD }}
           HERMES_KEY_ALIAS: ${{ secrets.HERMES_KEY_ALIAS }}
           HERMES_KEY_PASSWORD: ${{ secrets.HERMES_KEY_PASSWORD }}
-        run: ./gradlew bundleRelease assembleRelease --console=plain
+        run: |
+          ./gradlew \
+            :app:bundleGooglePlayRelease \
+            :app:assembleGooglePlayRelease \
+            :app:assembleSideloadRelease \
+            --console=plain
 
       - name: Scan final release DEX
         run: |
@@ -106,6 +112,12 @@ jobs:
             --apk app/build/outputs/apk/googlePlay/release/*.apk \
             --apk app/build/outputs/apk/sideload/release/*.apk
 
+      - name: Verify packaged native compatibility
+        run: |
+          python3 scripts/check-android-native-compat.py \
+            app/build/outputs/apk/googlePlay/release/*.apk \
+            app/build/outputs/apk/sideload/release/*.apk
+
       - name: Upload private production draft to Play
         env:
           PLAY_SERVICE_ACCOUNT_JSON: ${{ secrets.PLAY_SERVICE_ACCOUNT_JSON }}
@@ -121,27 +133,27 @@ jobs:
             --resolution-strategy=ignore \
             --release-name="Hermes-Relay Android v${{ steps.metadata.outputs.version }}"
 
-      - name: Record successful preflight for the exact commit
+      - name: Package immutable preflight artifacts
         run: |
-          mkdir -p app/build/reports
-          cat > app/build/reports/play-preflight.json <<EOF
-          {
-            "version": "${{ steps.metadata.outputs.version }}",
-            "versionCode": "${{ steps.metadata.outputs.version_code }}",
-            "commit": "$GITHUB_SHA",
-            "tree": "${{ steps.metadata.outputs.tree }}",
-            "track": "production",
-            "status": "draft"
-          }
-          EOF
+          python3 scripts/android_release_artifacts.py package \
+            --version "${{ steps.metadata.outputs.version }}" \
+            --version-code "${{ steps.metadata.outputs.version_code }}" \
+            --commit "$GITHUB_SHA" \
+            --tree "${{ steps.metadata.outputs.tree }}" \
+            --sideload-apk app/build/outputs/apk/sideload/release/*.apk \
+            --google-play-aab app/build/outputs/bundle/googlePlayRelease/*.aab \
+            --sideload-mapping app/build/outputs/mapping/sideloadRelease/mapping.txt \
+            --google-play-mapping app/build/outputs/mapping/googlePlayRelease/mapping.txt \
+            --output app/build/preflight-artifacts
 
-      - name: Upload preflight proof
+      - name: Upload immutable preflight artifacts
         uses: actions/upload-artifact@v7
         with:
           name: play-preflight-${{ steps.metadata.outputs.version }}-${{ steps.metadata.outputs.tree }}
-          path: app/build/reports/play-preflight.json
+          path: app/build/preflight-artifacts/*
           if-no-files-found: error
           retention-days: 30
+          compression-level: 0
 
       - name: Preflight summary
         run: |
@@ -152,4 +164,4 @@ jobs:
           echo "- Release tree: \`${{ steps.metadata.outputs.tree }}\`" >> "$GITHUB_STEP_SUMMARY"
           echo "- Play track/status: **Production draft**" >> "$GITHUB_STEP_SUMMARY"
           echo "" >> "$GITHUB_STEP_SUMMARY"
-          echo "The signed build, DEX scan, and Play draft upload passed. Ensure this exact release tree is on main, then run **Hermes-Relay Android Release Approval** from main. Console-only reports are informational and non-blocking." >> "$GITHUB_STEP_SUMMARY"
+          echo "The signed build, package scans, and Play draft upload passed. Approval will publish these exact private artifacts if the unchanged tree reaches main. Console-only reports are informational and non-blocking." >> "$GITHUB_STEP_SUMMARY"

.github/workflows/release-android.yml

@@ -36,6 +36,9 @@ jobs:
       version: ${{ steps.version.outputs.version }}
       version_code: ${{ steps.version.outputs.version_code }}
       prerelease: ${{ steps.version.outputs.prerelease }}
+      release_tree: ${{ steps.version.outputs.release_tree }}
+      preflight_artifact_id: ${{ steps.preflight.outputs.artifact_id }}
+      preflight_run_id: ${{ steps.preflight.outputs.run_id }}
     steps:
       - uses: actions/checkout@v7
         with:
@@ -66,6 +69,7 @@ jobs:
           echo "version=$REF_VERSION" >> "$GITHUB_OUTPUT"
           echo "version_code=$VERSION_CODE" >> "$GITHUB_OUTPUT"
           echo "prerelease=$PRERELEASE" >> "$GITHUB_OUTPUT"
+          echo "release_tree=$(git rev-parse 'HEAD^{tree}')" >> "$GITHUB_OUTPUT"
 
       - name: Verify version sync
         run: |
@@ -110,25 +114,38 @@ jobs:
           fi
 
       - name: Require successful Play preflight for this exact release tree
+        id: preflight
         if: ${{ !contains(steps.version.outputs.version, '-') }}
         env:
           GH_TOKEN: ${{ github.token }}
           VERSION: ${{ steps.version.outputs.version }}
         run: |
-          RELEASE_TREE=$(git rev-parse 'HEAD^{tree}')
+          RELEASE_TREE="${{ steps.version.outputs.release_tree }}"
           ARTIFACT_NAME="play-preflight-${VERSION}-${RELEASE_TREE}"
-          COUNT=$(gh api "/repos/${GITHUB_REPOSITORY}/actions/artifacts?name=${ARTIFACT_NAME}" \
-            --jq '[.artifacts[] | select(.expired == false)] | length')
-          if [ "$COUNT" -lt 1 ]; then
+          ARTIFACT=$(gh api "/repos/${GITHUB_REPOSITORY}/actions/artifacts?name=${ARTIFACT_NAME}" \
+            --jq '[.artifacts[] | select(.expired == false)] | sort_by(.created_at) | last')
+          ARTIFACT_ID=$(jq -r '.id // empty' <<<"$ARTIFACT")
+          RUN_ID=$(jq -r '.workflow_run.id // empty' <<<"$ARTIFACT")
+          if [ -z "$ARTIFACT_ID" ] || [ -z "$RUN_ID" ]; then
             echo "::error::No successful Play preflight found for version $VERSION with tree $RELEASE_TREE"
             echo "Run Hermes-Relay Android Play Preflight from the final dev tree, merge that unchanged tree to main, then approve the release."
             exit 1
           fi
-          echo "Play preflight proof found: $ARTIFACT_NAME"
+          RUN=$(gh api "/repos/${GITHUB_REPOSITORY}/actions/runs/${RUN_ID}")
+          CONCLUSION=$(jq -r '.conclusion' <<<"$RUN")
+          WORKFLOW_PATH=$(jq -r '.path' <<<"$RUN")
+          if [ "$WORKFLOW_PATH" != ".github/workflows/play-preflight-android.yml" ] || [ "$CONCLUSION" != "success" ]; then
+            echo "::error::Preflight artifact came from ${WORKFLOW_PATH} with conclusion ${CONCLUSION}"
+            exit 1
+          fi
+          echo "artifact_id=$ARTIFACT_ID" >> "$GITHUB_OUTPUT"
+          echo "run_id=$RUN_ID" >> "$GITHUB_OUTPUT"
+          echo "Play preflight artifacts verified: $ARTIFACT_NAME (run $RUN_ID, artifact $ARTIFACT_ID)"
 
   ci:
-    name: CI Checks
+    name: CI Checks (prerelease only)
     needs: validate
+    if: ${{ needs.validate.outputs.prerelease == 'true' }}
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
@@ -168,6 +185,7 @@ jobs:
   release:
     name: Build & Publish Release
     needs: [validate, ci]
+    if: ${{ always() && needs.validate.result == 'success' && (needs.ci.result == 'success' || needs.ci.result == 'skipped') }}
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
@@ -186,31 +204,33 @@ jobs:
         with:
           cache-read-only: false
 
-      - name: Decode release keystore
+      - name: Download exact stable preflight artifacts
+        if: ${{ needs.validate.outputs.prerelease != 'true' }}
+        uses: actions/download-artifact@v8
+        with:
+          artifact-ids: ${{ needs.validate.outputs.preflight_artifact_id }}
+          github-token: ${{ github.token }}
+          repository: ${{ github.repository }}
+          run-id: ${{ needs.validate.outputs.preflight_run_id }}
+          path: app/build/preflight-artifacts
+
+      - name: Verify exact stable preflight artifacts
+        if: ${{ needs.validate.outputs.prerelease != 'true' }}
+        run: |
+          python3 scripts/android_release_artifacts.py verify \
+            --version "${{ needs.validate.outputs.version }}" \
+            --version-code "${{ needs.validate.outputs.version_code }}" \
+            --tree "${{ needs.validate.outputs.release_tree }}" \
+            --directory app/build/preflight-artifacts
+
+      - name: Decode release keystore for candidate build
         env:
           HERMES_KEYSTORE_BASE64: ${{ secrets.HERMES_KEYSTORE_BASE64 }}
-        if: env.HERMES_KEYSTORE_BASE64 != ''
+        if: ${{ needs.validate.outputs.prerelease == 'true' && env.HERMES_KEYSTORE_BASE64 != '' }}
         run: |
           echo "$HERMES_KEYSTORE_BASE64" | base64 -d > "$RUNNER_TEMP/release.keystore"
           echo "HERMES_KEYSTORE_PATH=$RUNNER_TEMP/release.keystore" >> "$GITHUB_ENV"
 
-      - name: Build stable release artifacts (APK + AAB)
-        if: ${{ needs.validate.outputs.prerelease != 'true' }}
-        env:
-          HERMES_KEYSTORE_PASSWORD: ${{ secrets.HERMES_KEYSTORE_PASSWORD }}
-          HERMES_KEY_ALIAS: ${{ secrets.HERMES_KEY_ALIAS }}
-          HERMES_KEY_PASSWORD: ${{ secrets.HERMES_KEY_PASSWORD }}
-        # `assembleRelease` and `bundleRelease` are flavor-wide task aliases
-        # (added by `flavorDimensions += "track"` in app/build.gradle.kts), so
-        # this one line builds ALL four artifacts at once. Filenames come from
-        # `archivesName` (set in app/build.gradle.kts) which injects the app
-        # version, so `<version>` below is `libs.versions.appVersionName`:
-        #   app/build/outputs/apk/googlePlay/release/hermes-relay-<version>-googlePlay-release.apk
-        #   app/build/outputs/apk/sideload/release/hermes-relay-<version>-sideload-release.apk
-        #   app/build/outputs/bundle/googlePlayRelease/hermes-relay-<version>-googlePlay-release.aab
-        #   app/build/outputs/bundle/sideloadRelease/hermes-relay-<version>-sideload-release.aab
-        run: ./gradlew bundleRelease assembleRelease
-
       - name: Build side-by-side release candidate APK
         if: ${{ needs.validate.outputs.prerelease == 'true' }}
         env:
@@ -234,10 +254,10 @@ jobs:
         if: ${{ needs.validate.outputs.prerelease != 'true' }}
         uses: actions/upload-artifact@v7
         with:
-          name: android-r8-mappings-${{ needs.validate.outputs.version }}-${{ github.sha }}
+          name: android-r8-mappings-${{ needs.validate.outputs.version }}-${{ needs.validate.outputs.release_tree }}
           path: |
-            app/build/outputs/mapping/googlePlayRelease/mapping.txt
-            app/build/outputs/mapping/sideloadRelease/mapping.txt
+            app/build/preflight-artifacts/mapping-googlePlayRelease.txt
+            app/build/preflight-artifacts/mapping-sideloadRelease.txt
           if-no-files-found: error
           retention-days: 90
 
@@ -254,8 +274,7 @@ jobs:
         if: ${{ needs.validate.outputs.prerelease != 'true' }}
         run: |
           python3 scripts/check-android-collection-apis.py \
-            --apk app/build/outputs/apk/googlePlay/release/*.apk \
-            --apk app/build/outputs/apk/sideload/release/*.apk
+            --apk app/build/preflight-artifacts/*-sideload-release.apk
 
       - name: Scan candidate DEX for unsupported collection APIs
         if: ${{ needs.validate.outputs.prerelease == 'true' }}
@@ -267,8 +286,7 @@ jobs:
         if: ${{ needs.validate.outputs.prerelease != 'true' }}
         run: |
           python3 scripts/check-android-native-compat.py \
-            app/build/outputs/apk/googlePlay/release/*.apk \
-            app/build/outputs/apk/sideload/release/*.apk
+            app/build/preflight-artifacts/*-sideload-release.apk
 
       - name: Verify candidate packaged ONNX Runtime compatibility
         if: ${{ needs.validate.outputs.prerelease == 'true' }}
@@ -278,23 +296,10 @@ jobs:
 
       - name: List produced artifacts (debug aid)
         run: |
-          echo "=== APK outputs ==="
+          echo "=== Reused stable artifacts ==="
+          find app/build/preflight-artifacts -maxdepth 1 -type f -print 2>/dev/null || true
+          echo "=== Candidate APK outputs ==="
           find app/build/outputs/apk -name '*.apk' -print 2>/dev/null || true
-          echo "=== AAB outputs ==="
-          find app/build/outputs/bundle -name '*.aab' -print 2>/dev/null || true
-
-      - name: Generate stable checksums
-        if: ${{ needs.validate.outputs.prerelease != 'true' }}
-        # Flavor dimension adds an extra path segment to the AGP output layout.
-        # APKs live under `apk/<flavor>/release/`, AABs under `bundle/<flavor>Release/`
-        # (note the concatenated camelCase — AGP path quirk, documented but
-        # different between APK and AAB). Checksums cover EXACTLY the files
-        # attached to the GitHub Release (see the 2-asset policy on the
-        # release step below) so SHA256SUMS.txt matches the assets 1:1.
-        run: |
-          cd app/build/outputs
-          sha256sum apk/sideload/release/*.apk bundle/googlePlayRelease/*.aab > SHA256SUMS.txt
-          cat SHA256SUMS.txt
 
       - name: Generate candidate checksums
         if: ${{ needs.validate.outputs.prerelease == 'true' }}
@@ -340,9 +345,9 @@ jobs:
           # Deliberate 2-asset policy (#144): attach ONLY the installable
           # sideload APK and Play AAB, plus checksums covering those files.
           files: |
-            app/build/outputs/apk/sideload/release/*.apk
-            app/build/outputs/bundle/googlePlayRelease/*.aab
-            app/build/outputs/SHA256SUMS.txt
+            app/build/preflight-artifacts/*-sideload-release.apk
+            app/build/preflight-artifacts/*-googlePlay-release.aab
+            app/build/preflight-artifacts/SHA256SUMS.txt
 
       - name: Create candidate GitHub prerelease
         if: ${{ needs.validate.outputs.prerelease == 'true' }}
@@ -364,18 +369,17 @@ jobs:
         run: |
           echo "## Hermes-Relay Android v${{ needs.validate.outputs.version }}" >> "$GITHUB_STEP_SUMMARY"
           echo "" >> "$GITHUB_STEP_SUMMARY"
-          if [ "$PRERELEASE" = "true" ] && [ -n "$HERMES_KEYSTORE_BASE64" ]; then
-            echo "✅ **Release-signed HR Candidate app** — separate package ID; never uploaded to Play" >> "$GITHUB_STEP_SUMMARY"
-          elif [ "$PRERELEASE" = "true" ]; then
-            echo "⚠️ **Debug-signed HR Candidate app** — separate package ID; never uploaded to Play" >> "$GITHUB_STEP_SUMMARY"
+          if [ "$PRERELEASE" != "true" ]; then
+            echo "✅ **Published the exact signed Play-preflight artifacts**" >> "$GITHUB_STEP_SUMMARY"
           elif [ -n "$HERMES_KEYSTORE_BASE64" ]; then
-            echo "✅ **Signed with release keystore** — suitable for Play Store upload" >> "$GITHUB_STEP_SUMMARY"
+            echo "✅ **Release-signed HR Candidate app** — separate package ID; never uploaded to Play" >> "$GITHUB_STEP_SUMMARY"
           else
-            echo "⚠️ **Debug-signed** (no \`HERMES_KEYSTORE_BASE64\` secret) — NOT suitable for Play Store. Add the secret in repo settings to enable release signing." >> "$GITHUB_STEP_SUMMARY"
+            echo "⚠️ **Debug-signed HR Candidate app** — separate package ID; never uploaded to Play" >> "$GITHUB_STEP_SUMMARY"
           fi
           echo "" >> "$GITHUB_STEP_SUMMARY"
           echo "### Artifacts" >> "$GITHUB_STEP_SUMMARY"
           echo '```' >> "$GITHUB_STEP_SUMMARY"
+          find app/build/preflight-artifacts -maxdepth 1 -type f -exec ls -la {} + >> "$GITHUB_STEP_SUMMARY" 2>/dev/null || true
           find app/build/outputs/apk -name '*.apk' -exec ls -la {} + >> "$GITHUB_STEP_SUMMARY" 2>/dev/null || true
           find app/build/outputs/bundle -name '*.aab' -exec ls -la {} + >> "$GITHUB_STEP_SUMMARY" 2>/dev/null || true
           echo '```' >> "$GITHUB_STEP_SUMMARY"

.github/workflows/release-cli.yml

@@ -307,6 +307,18 @@ jobs:
       - name: Setup Rust
         uses: dtolnay/rust-toolchain@stable
 
+      - name: Restore exact-source tray build cache
+        uses: actions/cache@v6
+        with:
+          path: |
+            ~/.cargo/registry/index
+            ~/.cargo/registry/cache
+            ~/.cargo/git/db
+            desktop/tray/target
+          key: ${{ runner.os }}-tray-rust-${{ hashFiles('desktop/tray/Cargo.lock') }}-${{ hashFiles('desktop/tray/Cargo.toml', 'desktop/tray/build.rs', 'desktop/tray/src/**/*.rs') }}
+          restore-keys: |
+            ${{ runner.os }}-tray-rust-${{ hashFiles('desktop/tray/Cargo.lock') }}-
+
       - name: Install deps
         run: npm ci && npm --prefix tray ci
 
@@ -429,6 +441,11 @@ jobs:
             if ($versionOutput -ne "hermes-relay $env:EXPECTED_DESKTOP_VERSION") {
               throw "installed CLI version mismatch: expected $env:EXPECTED_DESKTOP_VERSION, got '$versionOutput'"
             }
+            $tray = Join-Path $installDir 'hermes-relay-tray.exe'
+            $trayVersion = (Get-Item -LiteralPath $tray).VersionInfo.ProductVersion
+            if ($trayVersion -ne $env:EXPECTED_DESKTOP_VERSION) {
+              throw "installed UI version mismatch: expected $env:EXPECTED_DESKTOP_VERSION, got '$trayVersion'"
+            }
             $helpOutput = (& $cli --help | Out-String)
             if ($LASTEXITCODE -ne 0 -or $helpOutput -notmatch 'Usage:') {
               throw 'installed CLI --help smoke failed'
@@ -469,7 +486,7 @@ jobs:
               throw "installer lifecycle changed the pre-existing tray startup preference"
             }
 
-            Write-Host "packaged installer lifecycle smoke OK version=$versionOutput install=$installDir"
+            Write-Host "packaged installer lifecycle smoke OK cli=$versionOutput ui=$trayVersion install=$installDir"
           } finally {
             Get-Process -Name 'hermes-relay-tray' -ErrorAction SilentlyContinue |
               Stop-Process -Force -ErrorAction SilentlyContinue

.github/workflows/release-plugin.yml

@@ -107,7 +107,11 @@ jobs:
             plugin/tests/test_voice_routes.py \
             plugin/tests/test_session_grants.py \
             plugin/tests/test_proactive_channel.py \
-            plugin/tests/test_android_phone_status.py
+            plugin/tests/test_android_phone_status.py \
+            plugin/tests/test_android_tool.py \
+            plugin/tests/test_android_navigate.py \
+            plugin/tests/test_phone_platform.py \
+            plugin/tests/test_desktop_tool_availability.py
 
   package:
     name: Build and publish Plugin package

.gitignore

@@ -24,10 +24,7 @@ Thumbs.db
 local.properties
 /build/
 /app/build/
-/relay-core/build/
-/relay-ui/build/
-/ui-preview/build/
-/quest/build/
+/experiments/quest/**/build/
 /app/release/
 *.apk
 *.aab

AGENTS.md

@@ -17,7 +17,7 @@ contract here and in `RELEASE.md`.
 - Android local/cloud verification → **[docs/android-build-lane.md](docs/android-build-lane.md)**
 - Android emulator lanes → **[docs/android-emulator-testing.md](docs/android-emulator-testing.md)** — suggest the smallest relevant API 36 lanes; never run the full matrix automatically
 - `android_*` toolset + MCP → **[docs/mcp-tooling.md](docs/mcp-tooling.md)**
-- Follow-ups / deferred work / known gaps → **[TODO.md](TODO.md)** (the single home for "what's next" — never DEVLOG, never scattered code comments)
+- Follow-ups / deferred work / known gaps → **[docs/project/TODO.md](docs/project/TODO.md)** (the single home for "what's next" — never DEVLOG, never scattered code comments)
 
 ## Branch contract
 

CHANGELOG.md

@@ -6,9 +6,43 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/), and this
 
 ## [Unreleased]
 
+### Fixed
+
+- Android Dashboard sign-in removes pasted line breaks from username and password fields, matching the browser login while preserving every other credential character. (#541)
+- **Relay tool availability avoids repeated Windows loopback delays and preserves multi-PC capabilities.** Host-local Android, Desktop, and Phone paths use explicit IPv4 loopback, while Desktop checks share a bounded health snapshot that preserves per-client advertisements and fails closed when Hermes-Relay is unavailable. (#562, #563)
+- Android keeps saved Dashboard sign-ins bound to their connection when switching gateways, rather than letting a stale resolver route invalidate another connection's session.
+- Bot Mode no longer crashes when different connections have bots with the same profile name. Both the conversation list and Active Now strip preserve each bot's connection, and opening progress appears only on the selected bot.
+- Android feedback uses themed banners and action cards instead of platform toasts and default snackbars. Dashboard errors no longer misidentify missing resources as an outdated Relay. Developer settings includes local-only message previews.
+- Missing chat attachments show their error and retry in the attachment card without repeated global popups. Global action messages occupy the top message area instead of covering the composer.
+- Chat distinguishes session preparation from response streaming and retains initialization errors that arrive before the session acknowledgement. Long-press the agent header to open a live session-diagnostics drawer.
+- Delegated-agent activity survives parent replies and leaves compact history entries for later read-only review. The activity strip appears only while work runs; historical process views cannot stop or dismiss live work. (#447)
+- **`android_*` tools resolve bridge credentials written after host startup.** Requests retry profile-scoped env and active bridge-session credentials after a stale token is rejected, and vision navigation now shares the same current Relay transport instead of the retired standalone default.
+- **`android_setup` accepts both its canonical and legacy schema keys.** `bridge_session_token` and `pairing_code` are accepted, while a missing token returns a structured error.
+- **Android tool setup tests use a temporary Hermes home.** Test runs no longer write bridge settings into a developer environment.
+
+## [Android 1.15.1] - 2026-09-02
+
 ### Changed
 
-- **Android Chat and Voice use tablet space intentionally.** Expanded layouts keep introductions, transcripts, composer controls, and status chrome on readable centered rails, while landscape Voice Focus separates identity controls from conversation activity without changing phone or portrait interaction behavior.
+- Chat and Bot Chat offer a compact Correct now / Queue next tray behind the composer. Chat settings sets the default; each message can override it. Stop pauses pending work until Resume, and editing or removing queued messages preserves the remaining order.
+- Wider Chat and Voice layouts keep text and controls centered and readable, including landscape Voice Focus.
+
+### Fixed
+
+- Delivery and correction labels remain readable inside user-message bubbles.
+- Voice errors use a scrollable dialog with separate Retry and Dismiss actions.
+- Attachment previews stay open through rotation, and videos retain their original proportions. (#483)
+- Release builds preserve the native configuration names required for wake-word startup. (#444)
+- Standard Hermes attachments stream to disk while enforcing download size limits. (#531)
+- Session refresh no longer sustains a request loop. History loads, chat rendering, image previews, and media exports keep memory use bounded.
+- Image-generation progress remains visible between interim replies and media delivery.
+- New Gateway chats wait for session readiness before the first prompt; ownership refusals preserve the retryable prompt and server error.
+
+## [0.4.0-beta.7] - 2026-09-02
+
+### Fixed
+
+- Windows updates detect a colocated management UI, report both installed versions, and update the CLI and UI together through the verified bundle installer. CLI-only installations keep their standalone updater.
 
 ## [Android 1.15.0] - 2026-08-31
 
@@ -1275,7 +1309,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/), and this
 
 - **Voice-exit chime firing on every Add-connection tap.** `ConnectionSwitchCoordinator.switchConnection` fires the `voiceStopCallback` unconditionally at step 3 (correct for connection-to-connection switches while voice is active), but `beginAddConnection` also routes through `switchConnection` to bind the placeholder Connection's auth store before the pair wizard runs — and `VoiceViewModel.exitVoiceMode()` was playing `sfxPlayer.playExit()` regardless of whether voice mode was actually on. Logcat confirmed the chime on every Add-connection FAB tap. Fix adds an idempotence guard at the top of `exitVoiceMode()`: early-return when `_uiState.value.voiceMode` is already false. Teardown is still safe to skip because every inner statement is null-guarded + try/catch-wrapped and would be a no-op on an already-stopped voice session; the only meaningful line is the `playExit()` SFX, which is what we're silencing.
 - **500 ms freeze on every Add-connection tap.** `ConnectionSwitchCoordinator.switchConnection` runs a `withTimeoutOrNull(AUTH_HYDRATE_TIMEOUT_MS = 500L)` block at step 10 to wait for the freshly-bound `AuthManager` to flip `AuthState` from `Loading` to `Paired`. The comment acknowledged Add-connection is the common path and the 500 ms was meant to be "imperceptible," but on-device it wasn't — the user perceived the delay (and the voice chime masking it) on every tap. The placeholder Connection created by `beginAddConnection` has `pairedAt == null` and an empty EncryptedSharedPreferences store, so `AuthState` will NEVER reach `Paired` — the 500 ms is pure stall. Fix short-circuits the hydrate wait when `target.pairedAt == null`: skip `withTimeoutOrNull` entirely for placeholders and log at DEBUG instead of the misleading "auth hydrate timeout" INFO. Real paired-to-paired switches still run the full hydrate wait because both sides have `pairedAt != null`.
-- **KDoc nested-comment trap in `ConnectionViewModel.relayReady` doc block.** A literal `/voice/*` path pattern inside the `relayReady` KDoc opened a nested block comment (Kotlin supports nested `/* */`, Java does not) whose `*/` then closed only the nested level — leaving the outer `/**` open for the remaining ~2200 lines of the file. Symptom: `MainActivity.kt:67` "Unresolved reference 'isReady'" plus ~50 cascading "Cannot infer type" errors across `PairedDevicesScreen`, `SettingsScreen`, `TerminalScreen`. Real errors (`Missing '}`, `Unclosed comment`) were the last two lines of `./gradlew compileGooglePlayDebugKotlin` output, easy to miss. Fix was a two-character rewrite: path patterns now wrapped in backticks AND `/*` → `/...` so the glob-looking character isn't in a block-comment position. Lesson logged in `DEVLOG.md` 2026-04-21; worth a sweep of other KDoc blocks for shell/regex-looking patterns before the next large diff.
+- **KDoc nested-comment trap in `ConnectionViewModel.relayReady` doc block.** A literal `/voice/*` path pattern inside the `relayReady` KDoc opened a nested block comment (Kotlin supports nested `/* */`, Java does not) whose `*/` then closed only the nested level — leaving the outer `/**` open for the remaining ~2200 lines of the file. Symptom: `MainActivity.kt:67` "Unresolved reference 'isReady'" plus ~50 cascading "Cannot infer type" errors across `PairedDevicesScreen`, `SettingsScreen`, `TerminalScreen`. Real errors (`Missing '}`, `Unclosed comment`) were the last two lines of `./gradlew compileGooglePlayDebugKotlin` output, easy to miss. Fix was a two-character rewrite: path patterns now wrapped in backticks AND `/*` → `/...` so the glob-looking character isn't in a block-comment position. Lesson logged in `docs/project/DEVLOG.md` 2026-04-21; worth a sweep of other KDoc blocks for shell/regex-looking patterns before the next large diff.
 
 - **Orphan placeholder connections from abandoned Add-connection flows.** The `beginAddConnection` path pre-creates a placeholder Connection and switches to it before the pair wizard runs — so `applyPairingPayload` lands the token in the right auth store. Previously, cleanup of the placeholder was wired only to the explicit Cancel button and TopAppBar back arrow. System back (gesture back / predictive back) bypassed that branch, leaving the placeholder in the connection list forever. Two-part fix: (a) `PairScreen` now installs a `BackHandler` that routes system back through the same `onCancel` → `discardPlaceholderConnection` branch the explicit back arrow uses; (b) `ConnectionViewModel.init` sweeps for any existing orphans (tuple: `pairedAt == null && apiServerUrl.isBlank() && label == PLACEHOLDER_LABEL`) on cold start and removes them — the tuple cannot be produced by any real pairing, so the sweep is safe without a dry-run. If the active connection at startup points at an orphan, the sweep switches to the first surviving real connection before deleting. Fixes the "why does my chip say 'New connection…'" symptom on devices that were affected pre-fix.
 - **Pair flow now auto-starts the camera on Add connection.** `ConnectionWizard` gains an `autoStart: String?` param (currently only `"scan"` is honored). The Add-connection FAB on `ConnectionsSettingsScreen` passes it so the wizard fires the camera permission launcher on first composition instead of forcing users through the Method chooser — one obvious next step, one-tap flow. Re-pair surfaces intentionally leave `autoStart` null so the full Scan / Enter code / Show code chooser stays available there. The deep-link arg is plumbed through `Screen.Pair`'s route (`pair?connectionId=...&autoStart=...`) and `PairScreen`'s new `autoStart` param; unrecognized values fall through to the default Method step so future builds can add more targets without breaking old ones.
@@ -2092,7 +2126,7 @@ picker.
 - **`CLAUDE.md`** — updated Git section with the new branching policy,
   added file-table entries for `hermes-relay-update`,
   `register_code_command`, and the expanded `install.sh`
-- **`TODO.md`** — captures open research questions around proper
+- **`docs/project/TODO.md`** — captures open research questions around proper
   Hermes plugin/skill/tool distribution
 - **`user-docs` vitepress site** — new "For AI Agents" copy-paste
   block on the home view, Feature Matrix component, two-track explainer,

CLI_RELEASE_NOTES.md

@@ -1,22 +1,18 @@
 # Hermes-Relay CLI+UI v__VERSION__
 
-**Release Date:** 2026-08-31
+**Release Date:** 2026-09-02
 
-This beta preserves complete multi-route pairing while preventing Desktop from dialing Dashboard-ingress Relay routes before Dashboard WebSocket ticket support is available. (Related: #399)
+This beta fixes Windows updates so the installed CLI and management UI advance together. Explicit CLI-only installations keep their standalone update path.
 
 **Beta phase.** Assets remain unsigned, so Windows SmartScreen and macOS Gatekeeper may warn on first launch. Standalone CLI binaries ship for Windows x64, Linux x64/arm64, and macOS x64/arm64; the management UI is Windows-only.
 
 ## What's changed
 
-### Changed
-
-- **Saved hosts retain the full route topology.** Dashboard, Relay, optional API, route priority, transport protection, certificate pins, and the selected host survive LAN, Tailscale, and public-route changes without creating duplicate hosts.
-- **API-less pairing is first-class.** Dashboard plus direct Relay can pair without inventing an optional API server, while secure-first ranking retains plain LAN as the final fallback.
-
 ### Fixed
 
-- **Dashboard-ingress Relay routes fail closed on Desktop.** The daemon, host selector, and Relay transport reject ingress that requires a Dashboard WebSocket ticket and choose a compatible direct Relay fallback instead of attempting an unauthenticated dial.
-- **Pairing accepts the current v3 candidate shape.** Optional API records, same-origin Dashboard/Relay routes, and legacy top-level payloads remain compatible without collapsing route ownership.
+- `hermes-relay update` detects an installed management UI beside the CLI and reports both installed versions.
+- Bundle installations use the checksum-verified Windows installer to update and restart the affected CLI and UI together.
+- Explicit CLI-only installations continue to use the standalone binary updater.
 
 ## Install
 

CONTRIBUTING.md

@@ -82,6 +82,11 @@ Use the narrowest command that proves the change:
 5. `scripts/dev.bat prepush` only when full local verification is explicitly
    wanted or cloud execution is unavailable.
 
+Android release preparation uses `python scripts/android-prepush.py
+--release-prep` while version notes are changing. It keeps local feedback to
+metadata and release-presentation tests; the exact pushed commit still goes
+through required CI and Play preflight before publication.
+
 `install-fast` is intentionally phone-specific. Use `install` for a universal
 sideload debug APK or when the target ABI is not arm64. Release builds remain
 universal and are unaffected unless `-Phermes.devAbi` is explicitly supplied.
@@ -254,16 +259,20 @@ translations may ship as `ai-translated`; do not claim fluent review unless a
 review reference is recorded. Focused correction PRs from fluent contributors
 are the canonical way to improve wording and can advance a locale to
 `community-reviewed` or `verified` under `docs/translation-playbook.md`.
-Translated READMEs use separate `README.<locale>.md` files; `README.md` remains
-the canonical project description. User docs may be added incrementally under
-`user-docs/<locale>/`, with links back to canonical English reference material.
+Translated README entrypoints live under `docs/readme/` as
+`README.<locale>.md`; root `README.md` remains the canonical project
+description. Keep translated entrypoints concise: summarize onboarding and
+core capabilities, link to localized user docs where available, and link back
+to English for fast-moving architecture, security, and operator detail. User
+docs may be added incrementally under `user-docs/<locale>/`, with links back to
+canonical English reference material.
 
 ## Changelog & writing conventions
 
-This is a **public repo** — `CHANGELOG.md`, `DEVLOG.md`, the README, and everything under `docs/` ship publicly. Keep them clean:
+This is a **public repo** — `CHANGELOG.md`, `docs/project/DEVLOG.md`, the README, and everything under `docs/` ship publicly. Keep them clean:
 
-- **`CHANGELOG.md`** follows [Keep a Changelog](https://keepachangelog.com/) (Added / Changed / Fixed). Append your change to the `## [Unreleased]` block in the PR. Entries can carry detail while they accumulate, but at release-prep the version block is **condensed to crisp public bullets** (1–2 lines each) — the deep "how we debugged it" narrative belongs in commit messages and `DEVLOG.md`, not the public changelog.
-- **`DEVLOG.md`** is a factual engineering log — what changed, why, and how it was verified. Keep it depersonalized and third-person; it's a record, not a diary.
+- **`CHANGELOG.md`** follows [Keep a Changelog](https://keepachangelog.com/) (Added / Changed / Fixed). Append your change to the `## [Unreleased]` block in the PR. Entries can carry detail while they accumulate, but at release-prep the version block is **condensed to crisp public bullets** (1–2 lines each) — the deep "how we debugged it" narrative belongs in commit messages and `docs/project/DEVLOG.md`, not the public changelog.
+- **`docs/project/DEVLOG.md`** is a factual engineering log — what changed, why, and how it was verified. Keep it depersonalized and third-person; it's a record, not a diary.
 - **No non-public wording anywhere committed:** no personal names (attribute impersonally — identity lives in git history), no real server hostnames/IPs or internal deployment names, no AI/assistant process self-narration, no fork/branch plumbing in user-facing notes. Generic example IPs in setup docs are fine.
 
 Release notes (`RELEASE_NOTES.md`, `app/src/main/assets/whats_new.txt`, `docs/play-store-listing.md`) are theme-framed and user-facing; see [RELEASE.md](RELEASE.md) §2 "Scrub for public distribution" for the full checklist.

README.md

@@ -21,7 +21,13 @@
 </p>
 
 <p align="center">
-  <strong>English</strong> · <a href="README.zh-CN.md">简体中文</a><br>
+  <strong>English</strong> ·
+  <a href="docs/readme/README.de.md">Deutsch</a> ·
+  <a href="docs/readme/README.es.md">Español</a> ·
+  <a href="docs/readme/README.ja.md">日本語</a> ·
+  <a href="docs/readme/README.pt-BR.md">Português (Brasil)</a> ·
+  <a href="docs/readme/README.ru.md">Русский</a> ·
+  <a href="docs/readme/README.zh-CN.md">简体中文</a><br>
   <a href="https://hermes-relay.dev/docs/">Documentation</a> ·
   <a href="https://github.com/Codename-11/hermes-relay/releases">Releases</a> ·
   <a href="https://github.com/Codename-11/hermes-relay/discussions">Discussions</a> ·
@@ -214,7 +220,7 @@ hermes-relay update                            # self-update via GitHub Releases
 
 It pairs against the **same relay and credential store** as the Android app — pair once from either, both work. Tagged on the `desktop-v*` [release track](https://github.com/Codename-11/hermes-relay/releases?q=desktop), with historical releases still visible under `cli-v*`.
 
-On Windows, the default installer adds the optional compact **Hermes-Relay CLI UI** tray popup for host selection and pairing, connection and daemon state, per-host Ask/Trusted/Full Access, local grant dialogs, authorized-client revocation, activity, settings, and emergency stop. It is a management surface only—chat, TUI, plugins, voice, and agent sessions remain CLI/upstream concerns.
+On Windows, the default installer adds the optional compact **Hermes-Relay CLI UI** tray popup for host selection and pairing, connection and daemon state, per-host Ask/Trusted/Full Access, local grant dialogs, authorized-client revocation, activity, settings, and emergency stop. `hermes-relay update` detects this bundle and updates the CLI and UI together; explicit CLI-only installations stay headless and continue using the standalone binary updater. The UI is a management surface only—chat, TUI, plugins, voice, and agent sessions remain CLI/upstream concerns.
 
 <table>
   <tr>

README.zh-CN.md

@@ -1,109 +0,0 @@
-<p align="center">
-  <img src="assets/play-store-feature-1024x500.png" alt="Hermes-Relay — 随身携带您的 Hermes 代理" width="800">
-</p>
-
-<p align="center">
-  <strong>运行在您的电脑上，连接到您的设备。</strong><br>
-  Hermes-Relay 是 <a href="https://github.com/NousResearch/hermes-agent">Hermes Agent</a> 的原生 Android 客户端，提供流式聊天、免手动语音和代理管理；另有单文件 CLI，让代理在已配对的电脑上安全使用终端、文件和截图工具。
-</p>
-
-<p align="center">
-  <strong>简体中文</strong> · <a href="README.md">English</a><br>
-  <a href="https://hermes-relay.dev/docs/zh-CN/">中文文档</a> ·
-  <a href="https://github.com/Codename-11/hermes-relay/releases">版本下载</a> ·
-  <a href="https://github.com/Codename-11/hermes-relay/discussions">社区讨论</a> ·
-  <a href="CHANGELOG.md">更新日志</a>
-</p>
-
-> 英文 [README.md](README.md) 是最新、完整的项目说明。本页维护中文安装入口和核心功能摘要；协议、架构和维护者文档以英文版本为准。
-
-## 功能简介
-
-- **Android 应用**：流式聊天、会话历史、文件附件、Hermes 管理、语音模式、原生插件页面、Petdex 悬浮宠物、多连接和配置文件；也可将 Hermes 设为 Android 助手。
-- **无需插件的标准路径**：聊天、管理和标准语音可直接连接未修改的上游 Hermes Agent。
-- **可选 Relay 插件**：增加终端、手机控制、媒体传输、通知助手、Relay 语音、电脑工具，以及需确认的代理创建插件页面草稿。
-- **安全连接**：二维码配对、Android Keystore、证书固定、按通道授权和可配置会话有效期。
-- **远程使用**：可配置 Tailscale 或 HTTPS 地址，在家庭局域网和远程路由之间自动切换。
-- **两种 Android 发行渠道**：Google Play 版本适合日常使用；sideload 版本包含完整手机控制能力。
-
-## 快速开始
-
-### 1. 安装 Android 应用
-
-- [Google Play](https://play.google.com/store/apps/details?id=com.axiomlabs.hermesrelay)：自动更新，包含聊天、语音、管理、终端、媒体和通知功能。
-- [GitHub Releases](https://github.com/Codename-11/hermes-relay/releases)：下载最新 `android-v*` 版本中以 `-sideload-release.apk` 结尾的文件，获得完整手机控制功能。
-
-### 2. 启动 Hermes API 服务
-
-手机需要能够访问 Hermes API 服务，并使用 API 密钥进行身份验证：
-
-```bash
-hermes setup --portal
-
-mkdir -p ~/.hermes
-API_SERVER_KEY="$(openssl rand -hex 32)"
-cat >> ~/.hermes/.env <<EOF
-API_SERVER_ENABLED=true
-API_SERVER_HOST=0.0.0.0
-API_SERVER_PORT=8642
-API_SERVER_KEY=$API_SERVER_KEY
-EOF
-chmod 600 ~/.hermes/.env
-
-echo "Android API URL: http://<电脑IP>:8642   key: $API_SERVER_KEY"
-hermes gateway
-```
-
-`0.0.0.0` 会让同一网络中的设备访问 API。请保留强密钥；离开可信局域网时，应使用 Tailscale 或 HTTPS 反向代理，不要直接把端口暴露到互联网。
-
-### 3. 在手机上连接
-
-打开应用后，可以：
-
-- 扫描局域网中的 Hermes；
-- 手动输入 `http://<主机>:8642` 和 API 密钥；
-- 扫描包含 API、Dashboard 和可选 Relay 地址的设置二维码。
-
-如需在手机上管理模型、密钥、技能和配置文件，请运行 Hermes Dashboard，并在应用的 **管理** 页面登录一次。同一登录会话也会启用标准语音。
-
-### 4. 可选：安装 Relay
-
-仅在需要终端、手机控制、媒体路由、Relay 会话、实时语音、电脑工具或代理创建插件页面草稿时安装：
-
-```bash
-hermes plugins install Codename-11/hermes-relay/plugin --enable
-hermes relay doctor
-hermes relay start --no-ssl
-hermes pair
-```
-
-已安装的 Hermes 插件可通过已认证的 Dashboard 向 Android 提供由应用安全渲染的原生页面，无需在手机上运行插件代码。Relay 1.5.0 另支持需用户确认的代理创建页面草稿。
-
-完整说明请阅读[中文快速开始](https://hermes-relay.dev/docs/zh-CN/guide/quick-start)；远程访问、协议和高级配置暂时链接到英文参考文档。
-
-安装问题、早期想法、一般交流和作品分享请使用 [GitHub Discussions](https://github.com/Codename-11/hermes-relay/discussions)。可复现的错误和明确、可执行的功能请求请提交到 [Issues](https://github.com/Codename-11/hermes-relay/issues/new)。
-
-## 中文界面
-
-<table>
-  <tr>
-    <td align="center" width="33%"><img src="assets/screenshots/Zh01.jpg" alt="中文设置界面" width="100%"><br><sub><b>设置</b></sub></td>
-    <td align="center" width="33%"><img src="assets/screenshots/Zh02.jpg" alt="中文管理界面" width="100%"><br><sub><b>管理</b></sub></td>
-    <td align="center" width="33%"><img src="assets/screenshots/Zh03.jpg" alt="中文导航界面" width="100%"><br><sub><b>导航</b></sub></td>
-  </tr>
-</table>
-
-## 参与翻译
-
-Android 英文资源是规范来源。新增语言必须保持资源名称、类型和格式参数一致，并通过：
-
-```bash
-python scripts/check-android-locales.py
-./gradlew lint
-```
-
-翻译规范、目录命名、复数和占位符规则见 [docs/localization.md](docs/localization.md)。
-
-## 许可证
-
-[MIT](LICENSE) — Copyright (c) 2026 [Axiom-Labs](https://codename-11.dev)

RELEASE.md

@@ -628,6 +628,21 @@ and the release notes and learn only what the software does.
 
 ### 3. Build and verify locally
 
+During release-note/version iteration, use the narrow release-prep lane:
+
+```powershell
+python scripts/android-prepush.py --release-prep
+```
+
+It runs release metadata checks plus the rendered Changelog/What's New tests in
+the serialized Android lane. Once the exact commit is pushed, current-head CI
+and Play preflight own lint, focused shards, both-flavor assemblies, signing,
+and final package scans. Do not repeat the complete local release build unless
+cloud execution is unavailable or explicit local artifact/device proof is
+needed.
+
+For that explicit full local proof:
+
 ```bat
 scripts\dev.bat bundle
 keytool -printcert -jarfile app\build\outputs\bundle\googlePlayRelease\hermes-relay-*-googlePlay-release.aab
@@ -661,14 +676,17 @@ The preflight workflow:
 3. builds and release-signs the same APK/AAB variants used by the public release;
 4. scans the final minified APK DEX for unsupported collection calls;
 5. uploads the Google Play AAB as a private **Production draft**; and
-6. records a 30-day preflight proof keyed to the version and Git tree hash.
+6. retains the exact signed sideload APK, Play AAB, R8 mappings, manifest, and
+   checksums as one immutable 30-day artifact keyed to version and Git tree.
 
 No sideload APK or GitHub Release is published by preflight. A successful signed
-build, final DEX scan, and Production-draft upload is the automated Play release
-gate. Play Console pre-review and pre-launch reports are informational and
-non-blocking because their detailed results are not exposed through the release
-automation API. If the release source changes after preflight, rerun it—the
-approval workflow matches the complete Git tree, not just the version number.
+build, final package scans, and Production-draft upload is the automated Play
+release gate. The private artifact is immutable and hash-verified again before
+publication; the stable release workflow does not rebuild those bytes. Play
+Console pre-review and pre-launch reports are informational and non-blocking
+because their detailed results are not exposed through the release automation
+API. If the release source changes after preflight, rerun it—the approval
+workflow matches the complete Git tree, not just the version number.
 
 GitHub exposes manual workflows only after their workflow file exists on the
 default branch. For the first release that introduces this process, merge the
@@ -709,12 +727,13 @@ from `main`; every release job explicitly checks out and verifies the immutable
 an existing tag or changing its artifact tree. Manual stable tags are still
 guarded by the same preflight proof in the tag workflow.
 
-The tag-triggered `.github/workflows/release-android.yml` rebuilds and scans the
-artifacts, changes the existing Play Production draft to `completed` (submitting
-it for review), and only after Play accepts that operation creates the public
-GitHub Release with the sideload APK. A missing preflight, changed release tree,
-missing Play credential, or Play submission failure prevents public GitHub
-publication.
+The tag-triggered `.github/workflows/release-android.yml` downloads the exact
+private preflight artifact by ID, verifies its source workflow, manifest, tree,
+version, sizes, and hashes, reruns the package scanners, then changes the
+existing Play Production draft to `completed` (submitting it for review). Only
+after Play accepts that operation does it publish those same APK/AAB bytes on
+GitHub. A missing preflight, changed release tree, artifact mismatch, missing
+Play credential, or Play submission failure prevents public publication.
 
 Plugin/Python version files are intentionally not part of an Android app
 release unless the plugin package itself is also being released.
@@ -801,6 +820,10 @@ The release workflow rejects version drift and requires prerelease tags to be
 contained in `origin/dev` and stable tags to be contained in `origin/main`. It
 reruns CLI tests, builds all four standalone binaries, tests and packages the
 Windows tray, generates checksums, and publishes the GitHub Release.
+Trusted desktop CI and the release installer job share a Cargo/target cache
+keyed by the lockfile and exact tray sources. A `main` push for the release tree
+warms the exact cache before the immutable tag build; a miss safely performs the
+ordinary Rust/Tauri build.
 
 ### 6. Play review and publishing behavior
 
@@ -901,7 +924,7 @@ gradlew promoteReleaseArtifact --from-track=internal --promote-track=production
   (This step was only needed as a retrofit for v0.1.0 — v0.1.1+ inherit
   the Download section automatically from `RELEASE_NOTES.md`.)
 - Confirm Play Console shows the new versionCode on the target track.
-- Update `DEVLOG.md` with a short entry for the release.
+- Update `docs/project/DEVLOG.md` with a short entry for the release.
 
 ## CI Behavior
 
@@ -909,26 +932,37 @@ Android, Plugin, dashboard, and desktop now have separate CI/release lanes.
 This keeps a dashboard CSS fix from running the full server suite, and keeps
 plugin changes from forcing an Android app `versionCode` bump.
 
+Every successful `Required checks` run records a short-lived proof keyed to the
+checked Git tree. For the canonical `dev` → `main` release PR, CI first proves
+the simulated merge tree is identical to the `dev` tree. If an unexpired proof
+from a successful Required-checks run exists, the PR verifies and reuses it;
+otherwise it automatically falls back to the normal path-aware matrix. Content
+changes can never reuse an older proof because they change the tree hash.
+
 On every push of a tag matching `android-v*`, `.github/workflows/release-android.yml`:
 
 1. Verifies a stable tag resolves to a commit contained in `main`, or a
    prerelease tag resolves to a commit contained in `dev`, and that the tag matches `appVersionName` in
    `gradle/libs.versions.toml` (mismatches fail the workflow).
-2. Runs the Android debug build and the stable sideload pairing/connection
-   regression slice with explicit timeouts.
-3. Decodes `HERMES_KEYSTORE_BASE64` into `$RUNNER_TEMP/release.keystore`
-   and exports `HERMES_KEYSTORE_PATH` (skipped if the secret is unset).
-4. For stable releases, builds all four flavored release artifacts
-   (`./gradlew bundleRelease assembleRelease`); only the sideload APK and
-   googlePlay AAB are attached. For prereleases, builds only the side-by-side
-   `sideloadCandidate` APK.
-5. Generates `SHA256SUMS.txt` covering the two attached files.
-6. For stable releases only, promotes the exact preflighted Production draft to
+2. For stable releases, verifies and downloads the exact immutable Play
+   preflight artifact; prereleases run the focused CI slice and build the
+   side-by-side `sideloadCandidate` APK.
+3. Revalidates stable artifact hashes, DEX collection compatibility, packaged
+   native compatibility, and retained R8 mappings without recompiling.
+4. Generates candidate checksums when applicable; stable checksums come from
+   the verified preflight artifact and cover the two public files.
+5. For stable releases only, promotes the exact preflighted Production draft to
    `completed`; prereleases never upload to Play.
-7. Creates a GitHub Release named `Hermes-Relay Android v<version>` with `RELEASE_NOTES.md` as
+6. Creates a GitHub Release named `Hermes-Relay Android v<version>` with `RELEASE_NOTES.md` as
    the body. Attaches the APK, AAB, and `SHA256SUMS.txt`. Tags any version
    containing a dash (e.g. `android-v0.2.0-beta.1`) as a prerelease automatically.
-8. Prints a `$GITHUB_STEP_SUMMARY` with the release and Play result.
+7. Prints a `$GITHUB_STEP_SUMMARY` with the release and Play result.
+
+For an approved multi-surface train, run **Hermes-Relay Coordinated Release
+Approval** from `main`, select the affected surfaces, and enter their prepared
+versions. It dispatches Android, Plugin, and CLI+UI approval jobs concurrently;
+each surface keeps its independent source, validation, tag, artifact, and
+publication workflow.
 
 On every direct push of a tag matching `server-v*`, or after an approved
 dispatch from `.github/workflows/approve-release-extensions.yml`,

RELEASE_NOTES.md

@@ -1,10 +1,10 @@
-# Hermes-Relay Android v1.15.0
+# Hermes-Relay Android v1.15.1
 
-**Release Date:** August 31, 2026
+**Release Date:** September 2, 2026
 
 ## Download
 
-> Installing on your phone? Download `hermes-relay-1.15.0-sideload-release.apk` and tap it for the full feature set, or install the conservative build from [Google Play](https://play.google.com/store/apps/details?id=com.axiomlabs.hermesrelay).
+> Installing on your phone? Download `hermes-relay-1.15.1-sideload-release.apk` and tap it for the full feature set, or install the conservative build from [Google Play](https://play.google.com/store/apps/details?id=com.axiomlabs.hermesrelay).
 
 The `.aab` file is a Play Console upload bundle and cannot be installed by tapping it on a phone.
 
@@ -12,32 +12,29 @@ Verify the download against `SHA256SUMS.txt`. See the [sideload guide](https://h
 
 ## Summary
 
-This release makes the everyday Android experience work through current upstream Hermes without treating the optional Hermes-Relay Plugin as a prerequisite. It also strengthens parent access, cross-client activity, transport ownership, recovery, and release visibility.
+This patch improves chat, media, and voice reliability. It reduces memory-heavy work, keeps attachment previews stable through rotation, and makes follow-up message behavior and voice errors easier to understand.
 
 ## Changed
 
-- **Upstream-first standard surfaces.** Chat attachments, inbound host files, current-session Git reads, Nous usage bars, and keyed Hermes notices use authenticated Dashboard/Gateway contracts first. Relay remains an additive compatibility and enhancement layer.
-- **Clear Settings ownership.** Media sits with Chat and Voice under Hermes. Proactive Threads, Terminal, Notification Companion, Relay sessions, enhanced voice, and Device Control stay grouped under Relay tools.
-- **App-specific supervised parent access.** Parents choose a PIN or password and receive a six-word recovery phrase; Android device credentials and biometrics no longer grant parent authority.
-- **Complete What's New history.** Release highlights, the remaining improvements and fixes, compatibility notes, toast counts, and history now come from one structured inventory.
+- Choose Correct now or Queue next from a slim tray behind the composer. Chat settings sets the default; the tray overrides one message. Stop pauses the queue, Resume continues it, and editing or removing an item preserves its successors.
+- Chat and Voice use readable centered layouts on wider screens, including landscape Voice Focus.
 
 ## Fixed
 
-- Host-local images, audio, video, and files download through the authenticated Dashboard and remain loaded across history reconciliation instead of flashing `Relay URL not configured` or returning to Loading.
-- Standard voice remains usable after explicit Relay removal, while temporary Relay outages preserve configured choices and default-profile preferences stay isolated across connections.
-- Android can display uniquely matched Desktop/TUI Working and Waiting activity without resuming, activating, or interrupting the external turn.
-- Dashboard/Gateway chats preserve their transcript, draft, profile, and session through sign-out or outages instead of silently changing to Direct API.
-- Completed text survives Dashboard-history authentication expiry and returns the existing sign-in recovery path.
-- Long-running context compaction refreshes the turn watchdog instead of being interrupted as idle.
-- Bot Chat history renders immediately after its route-owned handler binds.
-- An exact idle live-session snapshot settles an Android-owned turn whose terminal frame was lost, reconciles history, and drains its queued follow-up.
-- Supervised Add Gateway remains parent-owned across relock, back navigation, and pending setup cancellation.
-- Completed generated images stay visible during marker persistence lag and retain the intended image-generation presentation.
+- Correction and delivery labels remain visible inside user-message bubbles.
+- Voice errors open in a scrollable dialog with separate Retry and Dismiss actions.
+- Attachment previews remain open through rotation, and video previews preserve their proportions.
+- Release optimization preserves the native speech configuration required for wake-word startup.
+- Standard Hermes attachments download directly to disk with bounded size checks.
+- Session refresh avoids repeated request loops; history loads, Markdown, image previews, and media exports keep memory use bounded.
+- Image-generation progress stays visible through gaps between interim replies and returned media.
+- The first prompt waits for Gateway session readiness. Ownership refusals retain the prompt for retry and show the original server error.
 
 ## Install / Verify
 
-- App version: **1.15.0** (versionCode **53**).
-- Standard Chat, sessions, profiles, Manage, standard voice, outbound attachments, and ordinary inbound files work against current unmodified upstream Hermes without the optional Hermes-Relay Plugin.
-- Install Hermes-Relay Plugin v1.11.1 for Terminal, proactive Threads/offline delivery, Notification Companion, Relay sessions, provider-native/realtime voice, compatibility media metadata, Secure Link, and phone/device control.
-- Explicit Direct API/API-only connections remain supported and are never used as a silent failover for a Dashboard-owned chat.
-- Granular Device Control and the system Voice Focus overlay remain sideload-only; the Google Play build does not declare their restricted permissions.
+- App version: **1.15.1** (versionCode **54**).
+- Standard Chat, sessions, profiles, Manage, voice, and ordinary media use current upstream Hermes. Speech-to-text still requires a configured provider on the host.
+- Hermes-Relay Plugin **1.11.1** remains the current optional plugin release; this Android patch does not require a new plugin version.
+- Paused text queues can be restored. Attachment bytes are not persisted in preferences; unrestorable attachment queues must be reviewed and sent again.
+- Explicit Direct API/API-only connections remain supported and are not used as silent failover for Dashboard-owned chats.
+- Granular Device Control and the system Voice Focus overlay remain sideload-only.

app/build.gradle.kts

@@ -367,8 +367,9 @@ dependencies {
     implementation(libs.okhttp)
     implementation(libs.okhttp.sse)
 
-    // Media3 ExoPlayer — gapless TTS queue playback (replaces MediaPlayer in VoicePlayer)
+    // Media3 ExoPlayer + lifecycle-aware Compose video surface.
     implementation(libs.media3.exoplayer)
+    implementation(libs.media3.ui.compose)
 
     // android-vad Silero — on-device VAD for barge-in (B2)
     // Bundled ONNX Silero model (~2.2 MB); pulled from JitPack.

app/proguard-rules.pro

@@ -55,6 +55,9 @@
 -keep class androidx.camera.** { *; }
 -dontwarn androidx.camera.**
 
+# sherpa-onnx JNI resolves Kotlin configuration classes and fields by name.
+-keep class com.k2fsa.sherpa.onnx.** { *; }
+
 # ── General ──────────────────────────────────────────────────────────
 -keepattributes SourceFile,LineNumberTable
 -renamesourcefileattribute SourceFile

app/src/androidTest/kotlin/com/hermesandroid/relay/ui/screens/ChatDebugDrawerInstrumentedTest.kt

@@ -0,0 +1,65 @@
+package com.hermesandroid.relay.ui.screens
+
+import androidx.activity.ComponentActivity
+import androidx.compose.foundation.layout.Box
+import androidx.compose.foundation.layout.fillMaxSize
+import androidx.compose.foundation.layout.fillMaxWidth
+import androidx.compose.foundation.layout.height
+import androidx.compose.material3.Text
+import androidx.compose.runtime.getValue
+import androidx.compose.runtime.mutableStateOf
+import androidx.compose.runtime.remember
+import androidx.compose.runtime.setValue
+import androidx.compose.ui.Modifier
+import androidx.compose.ui.platform.testTag
+import androidx.compose.ui.test.assertIsDisplayed
+import androidx.compose.ui.test.junit4.v2.createAndroidComposeRule
+import androidx.compose.ui.test.longClick
+import androidx.compose.ui.test.onNodeWithContentDescription
+import androidx.compose.ui.test.onNodeWithTag
+import androidx.compose.ui.test.onNodeWithText
+import androidx.compose.ui.test.performClick
+import androidx.compose.ui.test.performTouchInput
+import androidx.compose.ui.unit.dp
+import com.hermesandroid.relay.network.upstream.GatewayConnectionState
+import com.hermesandroid.relay.ui.components.ChatDebugDrawer
+import com.hermesandroid.relay.ui.components.ChatDebugOverlay
+import com.hermesandroid.relay.ui.components.chatDebugHeaderGesture
+import com.hermesandroid.relay.ui.theme.HermesRelayTheme
+import org.junit.Assert.assertEquals
+import org.junit.Rule
+import org.junit.Test
+
+class ChatDebugDrawerInstrumentedTest {
+    @get:Rule val compose = createAndroidComposeRule<ComponentActivity>()
+
+    @Test
+    fun longPressOpensDiagnosticsBelowHeaderAndCloseRestoresChat() {
+        compose.setContent {
+            var open by remember { mutableStateOf(false) }
+            HermesRelayTheme(appThemeId = "hermes-relay", themePreference = "dark") {
+                Box(Modifier.fillMaxSize()) {
+                    Text("Hermes", Modifier.fillMaxWidth().height(64.dp).testTag("header")
+                        .chatDebugHeaderGesture(true, onClick = {}, onHold = { open = true }))
+                    ChatDebugOverlay(open, 64.dp, onClose = { open = false }) {
+                        ChatDebugDrawer(
+                            profile = "Server Default", model = "Example", sessionId = "session",
+                            gateway = true, signedIn = true, signInRequired = false,
+                            socketState = GatewayConnectionState.Ready, preparing = false,
+                            streaming = false, loadingHistory = false, directoryUnavailable = false,
+                            failure = null, onClose = { open = false }, onConnections = {},
+                        )
+                    }
+                }
+            }
+        }
+        val header = compose.onNodeWithTag("header")
+        val before = header.fetchSemanticsNode().boundsInRoot
+        header.performTouchInput { longClick() }
+        compose.onNodeWithText("Session diagnostics").assertIsDisplayed()
+        assertEquals(before, header.fetchSemanticsNode().boundsInRoot)
+        compose.onNodeWithContentDescription("Close session diagnostics").performClick()
+        compose.onNodeWithText("Session diagnostics").assertDoesNotExist()
+        header.assertIsDisplayed()
+    }
+}

app/src/androidTest/kotlin/com/hermesandroid/relay/viewmodel/ChatActivityReceiptInstrumentedTest.kt

@@ -0,0 +1,183 @@
+package com.hermesandroid.relay.viewmodel
+
+import android.os.Handler
+import android.os.Looper
+import androidx.activity.ComponentActivity
+import androidx.compose.foundation.layout.Column
+import androidx.compose.material3.MaterialTheme
+import androidx.compose.runtime.getValue
+import androidx.compose.runtime.mutableStateOf
+import androidx.compose.runtime.remember
+import androidx.compose.runtime.setValue
+import androidx.compose.ui.Modifier
+import androidx.compose.ui.platform.testTag
+import androidx.compose.ui.test.assertIsDisplayed
+import androidx.compose.ui.test.junit4.v2.createAndroidComposeRule
+import androidx.compose.ui.test.onNodeWithContentDescription
+import androidx.compose.ui.test.onNodeWithTag
+import androidx.compose.ui.test.onNodeWithText
+import androidx.compose.ui.test.performClick
+import androidx.lifecycle.Lifecycle
+import androidx.lifecycle.compose.collectAsStateWithLifecycle
+import com.hermesandroid.relay.data.AgentDisplay
+import com.hermesandroid.relay.data.ChatActivityPhase
+import com.hermesandroid.relay.data.InMemoryChatActivityStore
+import com.hermesandroid.relay.data.projectChatActivityReceipts
+import com.hermesandroid.relay.network.upstream.ChatHandler
+import com.hermesandroid.relay.network.upstream.DashboardApiClient
+import com.hermesandroid.relay.network.upstream.GatewayChatClient
+import com.hermesandroid.relay.network.upstream.HermesApiClient
+import com.hermesandroid.relay.ui.components.ChatActivityReceipt
+import com.hermesandroid.relay.ui.components.GatewayBackgroundProcessSheet
+import com.hermesandroid.relay.ui.components.GatewayBackgroundProcessStrip
+import com.hermesandroid.relay.ui.components.SubagentPreviewVisibility
+import kotlinx.coroutines.CoroutineScope
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.SupervisorJob
+import kotlinx.coroutines.cancel
+import kotlinx.coroutines.runBlocking
+import kotlinx.serialization.json.buildJsonObject
+import kotlinx.serialization.json.put
+import okhttp3.OkHttpClient
+import okhttp3.WebSocket
+import org.junit.After
+import org.junit.Assert.assertTrue
+import org.junit.Before
+import org.junit.Rule
+import org.junit.Test
+
+/** Real Gateway callbacks drive production activity surfaces through Android lifecycle changes. */
+class ChatActivityReceiptInstrumentedTest {
+    @get:Rule val compose = createAndroidComposeRule<ComponentActivity>()
+
+    private lateinit var fixture: AndroidGatewayContractFixture
+    private lateinit var gatewayScope: CoroutineScope
+    private lateinit var gateway: GatewayChatClient
+    private lateinit var handler: ChatHandler
+    private lateinit var viewModel: ChatViewModel
+    private lateinit var socket: WebSocket
+    private val owner = AgentDisplay.profileContextKey("fixture-connection", "research")
+
+    @Before
+    fun setUp() {
+        fixture = AndroidGatewayContractFixture().also { it.profileName = "research" }
+        gatewayScope = CoroutineScope(SupervisorJob() + Dispatchers.IO)
+        val http = OkHttpClient()
+        gateway = GatewayChatClient(
+            initialDashboardClient = DashboardApiClient(fixture.server.url("/").toString().trimEnd('/'), okHttpClient = http),
+            okHttpClient = http,
+            callbackDispatcher = { block -> Handler(Looper.getMainLooper()).post(block) },
+            scope = gatewayScope,
+            reconnectJitterUnit = { 0.0 },
+        )
+        handler = ChatHandler().also { it.setSessionId(STORED_SESSION_ID) }
+        viewModel = ChatViewModel().also {
+            it.initialize(HermesApiClient(fixture.server.url("/").toString(), "fixture-key"), handler)
+            it.streamingEndpoint = "gateway"
+            it.setSessionProfileNameProvider { "research" }
+            it.setProfileMessageLoader { Result.success(emptyList()) }
+            it.setChatActivityStore(InMemoryChatActivityStore())
+            it.switchProfileContext(owner, STORED_SESSION_ID)
+            it.updateGatewayClient(gateway)
+            it.setChatVisible(true)
+        }
+        compose.setContent {
+            val messages by viewModel.messages.collectAsStateWithLifecycle()
+            val records by viewModel.activityRecords.collectAsStateWithLifecycle()
+            val children by viewModel.subagentActivities.collectAsStateWithLifecycle()
+            val retained by viewModel.retainedActivityPreview.collectAsStateWithLifecycle()
+            val childPreview by viewModel.subagentChildPreview.collectAsStateWithLifecycle()
+            val session by viewModel.currentSessionId.collectAsStateWithLifecycle()
+            var sheetOpen by remember { mutableStateOf(false) }
+            MaterialTheme {
+                Column {
+                    GatewayBackgroundProcessStrip(
+                        processes = emptyList(), subagentActivities = children,
+                        subagentPreviewVisibility = SubagentPreviewVisibility(), loading = false,
+                        onClick = { viewModel.openCurrentActivityPreview(); sheetOpen = true },
+                        modifier = Modifier.testTag("active-activity"),
+                    )
+                    projectChatActivityReceipts(messages, records, owner, session).forEach { message ->
+                        message.activityRecord?.let { record ->
+                            ChatActivityReceipt(
+                                record = record,
+                                onClick = { sheetOpen = viewModel.openRetainedActivity(record) },
+                                modifier = Modifier.testTag("activity-receipt"),
+                            )
+                        }
+                    }
+                }
+                if (sheetOpen) {
+                    GatewayBackgroundProcessSheet(
+                        processes = retained?.processes.orEmpty(),
+                        subagentActivities = retained?.record?.previewActivities() ?: children,
+                        subagentChildPreview = childPreview,
+                        subagentPreviewVisibility = SubagentPreviewVisibility(),
+                        loading = false, stoppingProcessIds = emptySet(),
+                        onRefresh = viewModel::refreshBackgroundProcesses,
+                        onStop = viewModel::stopBackgroundProcess,
+                        onDismissProcess = viewModel::dismissBackgroundProcess,
+                        onOpenSubagentChild = viewModel::openSubagentChildPreview,
+                        onDismiss = { viewModel.closeActivityPreview(); sheetOpen = false },
+                        readOnlyHistory = retained != null,
+                        historyNotice = "Recorded activity. Available child history is read-only.",
+                    )
+                }
+            }
+        }
+        assertTrue(runBlocking { gateway.prewarmAwait(STORED_SESSION_ID) })
+        socket = fixture.awaitServerSocket()
+        fixture.awaitRpc("session.resume")
+    }
+
+    @After
+    fun tearDown() {
+        viewModel.updateGatewayClient(null)
+        gateway.shutdown()
+        gatewayScope.cancel()
+        fixture.shutdown()
+    }
+
+    @Test
+    fun detachedCompletionLeavesReopenableReceiptAcrossActivityResume() {
+        viewModel.sendMessage("Delegate a background task")
+        fixture.awaitRpc("prompt.submit")
+        socket.send(fixture.event("message.start", null, LIVE_SESSION_ID))
+        socket.send(fixture.event("subagent.start", buildJsonObject {
+            put("subagent_id", "receipt-child")
+            put("delegation_id", "receipt-delegation")
+            put("task_count", 1)
+            put("goal", "Inspect activity lifecycle")
+        }, LIVE_SESSION_ID))
+        compose.waitUntil(5_000) { viewModel.subagentActivities.value.size == 1 }
+        compose.onNodeWithTag("active-activity").assertIsDisplayed()
+        socket.send(fixture.event("message.complete", buildJsonObject { put("text", "Launched") }, LIVE_SESSION_ID))
+        compose.waitUntil(5_000) { !handler.isStreaming.value }
+        compose.onNodeWithTag("active-activity").assertIsDisplayed()
+
+        socket.send(fixture.event("subagent.complete", buildJsonObject {
+            put("subagent_id", "receipt-child")
+            put("delegation_id", "receipt-delegation")
+            put("status", "completed")
+        }, LIVE_SESSION_ID))
+        compose.waitUntil(5_000) { viewModel.activityRecords.value.singleOrNull()?.phase == ChatActivityPhase.COMPLETE }
+        compose.onNodeWithTag("active-activity").assertDoesNotExist()
+        compose.onNodeWithTag("activity-receipt").assertIsDisplayed().performClick()
+        compose.onNodeWithText("Chat activity").assertIsDisplayed()
+        compose.onNodeWithText("Recorded activity. Available child history is read-only.").assertIsDisplayed()
+        compose.onNodeWithText("Stop").assertDoesNotExist()
+        compose.onNodeWithContentDescription("Close activity preview").performClick()
+        compose.onNodeWithTag("activity-receipt").assertIsDisplayed()
+
+        compose.activityRule.scenario.moveToState(Lifecycle.State.STARTED)
+        compose.activityRule.scenario.moveToState(Lifecycle.State.RESUMED)
+        compose.onNodeWithTag("active-activity").assertDoesNotExist()
+        compose.onNodeWithTag("activity-receipt").assertIsDisplayed().performClick()
+        compose.onNodeWithText("Chat activity").assertIsDisplayed()
+    }
+
+    private companion object {
+        const val STORED_SESSION_ID = "20260821_120000_fixture"
+        const val LIVE_SESSION_ID = "fixture-live-1"
+    }
+}

app/src/androidTest/kotlin/com/hermesandroid/relay/viewmodel/GatewayExternalFixtureInstrumentedTest.kt

@@ -15,6 +15,10 @@ import androidx.compose.ui.test.assertTextEquals
 import androidx.compose.ui.test.junit4.v2.createAndroidComposeRule
 import androidx.compose.ui.test.onAllNodesWithText
 import androidx.compose.ui.test.onNodeWithTag
+import androidx.compose.ui.test.onAllNodesWithContentDescription
+import androidx.compose.ui.test.onNodeWithContentDescription
+import androidx.compose.ui.test.onNodeWithText
+import androidx.compose.ui.test.performClick
 import androidx.test.platform.app.InstrumentationRegistry
 import androidx.lifecycle.compose.collectAsStateWithLifecycle
 import com.hermesandroid.relay.data.MessageRole
@@ -171,6 +175,81 @@ class GatewayExternalFixtureInstrumentedTest {
         }
     }
 
+    @Test
+    fun queuedStopResume_preservesWorkAcrossLifecycleAndUsesExplicitResume() {
+        val base = InstrumentationRegistry.getArguments().getString(ARG_FIXTURE_BASE_URL)?.trimEnd('/')
+        assumeTrue("Pass a queued_stop_resume fixture URL", !base.isNullOrBlank())
+        requireNotNull(base)
+        val http = OkHttpClient.Builder().callTimeout(10, TimeUnit.SECONDS).build()
+        assertEquals("queued_stop_resume", readFixtureJson(http, "$base/__fixture__/state")["scenario"]?.jsonString())
+        val dashboard = DashboardApiClient(base, http)
+        val scope = CoroutineScope(SupervisorJob() + Dispatchers.IO).also { gatewayScope = it }
+        val gateway = GatewayChatClient(
+            initialDashboardClient = dashboard, okHttpClient = http, scope = scope,
+            callbackDispatcher = { block -> Handler(Looper.getMainLooper()).post(block) },
+            reconnectJitterUnit = { 0.0 },
+        ).also { gatewayClient = it }
+        val handler = ChatHandler().also { it.setSessionId(STORED_SESSION_ID) }
+        val vm = ChatViewModel().also {
+            it.initialize(null, handler)
+            it.streamingEndpoint = "gateway"
+            it.setProfileMessageLoaderWithMode { profile, session, mode -> dashboard.getSessionMessages(session, profile, mode) }
+            it.updateGatewayClient(gateway)
+            it.switchProfileContext(com.hermesandroid.relay.data.AgentDisplay.profileContextKey("fixture-queue", null), STORED_SESSION_ID)
+        }.also { viewModel = it }
+        compose.setContent {
+            val queue by vm.queuedMessages.collectAsStateWithLifecycle()
+            val paused by vm.queuePaused.collectAsStateWithLifecycle()
+            com.hermesandroid.relay.ui.theme.HermesRelayTheme(themePreference = "dark") {
+                androidx.compose.material3.Surface {
+                    Column {
+                        com.hermesandroid.relay.ui.components.ChatBusyActionSelector(
+                            com.hermesandroid.relay.data.BusyMessageAction.QueueNext, {}, onStop = vm::cancelStream,
+                        )
+                        com.hermesandroid.relay.ui.components.ChatMessageQueue(
+                            queue, paused, vm::resumeQueue, vm::clearQueue, {}, vm::removeQueuedAt, canEdit = true,
+                        )
+                    }
+                }
+            }
+        }
+        assertTrue(runBlocking { gateway.prewarmAwait(STORED_SESSION_ID) })
+        compose.runOnIdle { vm.sendMessage("Original work") }
+        compose.waitUntil(10_000) { handler.isStreaming.value && vm.steerableTurn.value }
+        compose.runOnIdle {
+            vm.sendMessage("Remove this follow-up", com.hermesandroid.relay.data.BusyMessageAction.QueueNext)
+            vm.sendMessage("Keep this follow-up", com.hermesandroid.relay.data.BusyMessageAction.QueueNext)
+        }
+        compose.onAllNodesWithContentDescription("Remove queued message")[0].performClick()
+        compose.onNodeWithContentDescription("Stop streaming").performClick()
+        compose.onNodeWithText("Queue paused").assertIsDisplayed()
+        assertEquals(listOf("Keep this follow-up"), vm.queuedMessages.value)
+
+        compose.activityRule.scenario.moveToState(androidx.lifecycle.Lifecycle.State.CREATED)
+        compose.activityRule.scenario.moveToState(androidx.lifecycle.Lifecycle.State.RESUMED)
+        compose.onNodeWithText("Keep this follow-up").assertIsDisplayed()
+        compose.onNodeWithText("Resume").performClick()
+        try {
+            compose.waitUntil(15_000) {
+                vm.queuedMessages.value.isEmpty() && !handler.isStreaming.value &&
+                    handler.messages.value.any { it.content == "Resumed follow-up." }
+            }
+        } catch (error: androidx.compose.ui.test.ComposeTimeoutException) {
+            throw AssertionError(
+                "Synthetic queue fixture did not settle: queued=${vm.queuedMessages.value.size}, " +
+                    "paused=${vm.queuePaused.value}, streaming=${handler.isStreaming.value}, " +
+                    "messages=${handler.messages.value.map { it.role to it.content }}, " +
+                    "error=${handler.error.value}",
+                error,
+            )
+        }
+        val evidence = readFixtureJson(http, "$base/__fixture__/evidence")["entries"] as JsonArray
+        assertEquals(2, evidence.rpcCount("prompt.submit"))
+        assertEquals(1, evidence.rpcCount("session.interrupt"))
+        assertEquals(0, evidence.rpcCount("session.redirect"))
+        assertEquals("gateway", vm.streamingEndpoint)
+    }
+
     private fun JsonArray.rpcCount(method: String): Int = count { element ->
         val entry = element as? JsonObject ?: return@count false
         entry["kind"]?.jsonString() == "rpc" && entry["method"]?.jsonString() == method

app/src/androidTest/kotlin/com/hermesandroid/relay/viewmodel/GatewayForegroundRecoveryInstrumentedTest.kt

@@ -28,6 +28,8 @@ import com.hermesandroid.relay.network.upstream.DashboardApiClient
 import com.hermesandroid.relay.network.upstream.GatewayChatClient
 import com.hermesandroid.relay.network.upstream.HermesApiClient
 import com.hermesandroid.relay.network.upstream.models.MessageItem
+import com.hermesandroid.relay.ui.components.GatewayBackgroundProcessStrip
+import com.hermesandroid.relay.ui.components.SubagentPreviewVisibility
 import kotlinx.coroutines.CoroutineScope
 import kotlinx.coroutines.Dispatchers
 import kotlinx.coroutines.SupervisorJob
@@ -115,9 +117,18 @@ class GatewayForegroundRecoveryInstrumentedTest {
         compose.setContent {
             val messages by viewModel.messages.collectAsStateWithLifecycle()
             val streaming by viewModel.isStreaming.collectAsStateWithLifecycle()
+            val children by viewModel.subagentActivities.collectAsStateWithLifecycle()
             val signInRequired by historySignInRequired.collectAsStateWithLifecycle()
             MaterialTheme {
                 Column(Modifier.testTag("contract-transcript")) {
+                    GatewayBackgroundProcessStrip(
+                        processes = emptyList(),
+                        subagentActivities = children,
+                        subagentPreviewVisibility = SubagentPreviewVisibility(),
+                        loading = false,
+                        onClick = {},
+                        modifier = Modifier.testTag("child-activity"),
+                    )
                     Text(
                         text = if (streaming) "STREAMING" else "IDLE",
                         modifier = Modifier.testTag("stream-state"),
@@ -153,6 +164,37 @@ class GatewayForegroundRecoveryInstrumentedTest {
         fixture.shutdown()
     }
 
+    @Test
+    fun detachedChildActivity_survivesParentTerminalAndActivityResume() {
+        viewModel.sendMessage("Delegate a background task")
+        fixture.awaitRpc("prompt.submit")
+        serverSocket.send(fixture.event("message.start", null, LIVE_SESSION_ID))
+        serverSocket.send(fixture.event("subagent.start", buildJsonObject {
+            put("subagent_id", "detached-child")
+            put("goal", "Inspect")
+        }, LIVE_SESSION_ID))
+        compose.waitUntil(5_000) { viewModel.subagentActivities.value.size == 1 }
+        compose.onNodeWithTag("child-activity").assertIsDisplayed()
+        serverSocket.send(fixture.event("message.complete", buildJsonObject { put("text", "Launched") }, LIVE_SESSION_ID))
+        compose.waitUntil(5_000) { !handler.isStreaming.value }
+        compose.activityRule.scenario.moveToState(Lifecycle.State.STARTED)
+        serverSocket.send(fixture.event("subagent.progress", buildJsonObject {
+            put("subagent_id", "detached-child")
+            put("text", "Still working")
+        }, LIVE_SESSION_ID))
+        compose.activityRule.scenario.moveToState(Lifecycle.State.RESUMED)
+        compose.waitUntil(5_000) { viewModel.subagentActivities.value.single().events.last().text == "Still working" }
+        compose.onNodeWithTag("child-activity").assertIsDisplayed()
+        assertFalse(viewModel.subagentActivities.value.single().isTerminal)
+        compose.onNodeWithTag("stream-state").assertTextEquals("IDLE")
+        serverSocket.send(fixture.event("subagent.complete", buildJsonObject {
+            put("subagent_id", "detached-child")
+            put("status", "completed")
+        }, LIVE_SESSION_ID))
+        compose.waitUntil(5_000) { viewModel.subagentActivities.value.single().isTerminal }
+        compose.onNodeWithTag("child-activity").assertDoesNotExist()
+    }
+
     @Test
     fun terminalGapActivate_recoversForegroundTurnWithoutNavigationOrCrossSessionLeak() {
         viewModel.sendMessage("Run a long foreground task")

app/src/googlePlay/play/release-notes/en-US/default.txt

@@ -1,3 +1,3 @@
-v1.15.0 - Standard Hermes first, with clearer Relay boundaries
+v1.15.1 - Steadier chat, media, and voice
 
-Standard Chat, Voice, attachments, returned files, current-session Git, usage, and Hermes notices now prefer upstream Dashboard and Gateway support without requiring Relay. Returned media stays loaded, voice survives Relay removal, and Settings clearly separates standard Hermes from Relay tools. Supervised Mode also gains app-specific parent access and recovery.
+More reliable chats and media: fewer memory-heavy refreshes, smoother large histories, and attachment previews that survive rotation. Choose whether follow-ups correct the current response or wait in a queue. Voice errors are easier to read, image-generation progress stays visible, and wake-word startup and first-message readiness are fixed.

app/src/main/assets/changelog.json

@@ -1,6 +1,83 @@
 {
  "schema": 3,
  "versions": [
+  {
+   "version": "1.15.1",
+   "title": "Steadier chat, media, and voice",
+   "date": "2026-09-02",
+   "summary": "Chats use less memory, attachment previews stay in place, and voice failures are easier to recover from. Follow-up controls make it clear whether a message changes the current response or waits for the next turn.",
+   "changes": [
+    {
+     "id": "follow-up-controls",
+     "kind": "improved",
+     "title": "Choose when follow-up messages are sent",
+     "summary": "A slim tray behind the composer offers Correct now or Queue next. Chat settings sets the default, and a composer choice applies to one message. Stop pauses pending work until Resume; editing or removing an item keeps the remaining queue usable.",
+     "highlight": true
+    },
+    {
+     "id": "tablet-layouts",
+     "kind": "improved",
+     "title": "Make better use of wider screens",
+     "summary": "Chat and Voice keep text and controls on readable centered layouts. Landscape Voice Focus separates identity controls from conversation activity."
+    },
+    {
+     "id": "delivery-labels",
+     "kind": "fixed",
+     "title": "Read message delivery status clearly",
+     "summary": "Correction and delivery labels use contrasting text instead of disappearing into the message bubble."
+    },
+    {
+     "id": "voice-error-dialog",
+     "kind": "fixed",
+     "title": "Read and dismiss voice errors",
+     "summary": "Voice errors open in a contained dialog with scrollable details and separate Retry and Dismiss actions, without overlapping chat controls."
+    },
+    {
+     "id": "attachment-previews",
+     "kind": "fixed",
+     "title": "Keep attachment previews open through rotation",
+     "summary": "Image, video, audio, PDF, text, and file previews stay open as the screen rotates. Videos retain their original proportions.",
+     "highlight": true
+    },
+    {
+     "id": "wake-word-startup",
+     "kind": "fixed",
+     "title": "Fix wake-word startup in release builds",
+     "summary": "Release optimization now preserves the native speech configuration names needed to initialize wake-word detection."
+    },
+    {
+     "id": "attachment-downloads",
+     "kind": "fixed",
+     "title": "Download attachments with less memory",
+     "summary": "Standard Hermes attachments stream into the on-disk cache while download size limits remain enforced."
+    },
+    {
+     "id": "chat-memory-safety",
+     "kind": "fixed",
+     "title": "Keep large chats and media manageable",
+     "summary": "Automatic session refresh no longer loops. Routine history loads, chat rendering, image previews, and media exports use bounded memory instead of allocating entire large responses.",
+     "highlight": true
+    },
+    {
+     "id": "image-progress",
+     "kind": "fixed",
+     "title": "Keep image-generation progress visible",
+     "summary": "The working indicator stays visible between interim replies and the generated image, including gateways that omit tool activity events."
+    },
+    {
+     "id": "first-message-readiness",
+     "kind": "fixed",
+     "title": "Wait for new chats to be ready",
+     "summary": "The first message waits for the Gateway session to initialize. Ownership refusals keep the prompt retryable and show the server's error."
+    }
+   ],
+   "compatibility": [
+    "Standard Chat, sessions, media, and voice continue to use upstream Hermes. Voice transcription still requires a configured speech-to-text provider on the Hermes host.",
+    "Paused text queues can be restored. Attachment bytes are not stored in preferences; an attachment queue that cannot be restored must be reviewed and sent again."
+   ],
+   "playNotes": "More reliable chats and media: fewer memory-heavy refreshes, smoother large histories, and attachment previews that survive rotation. Choose whether follow-ups correct the current response or wait in a queue. Voice errors are easier to read, image-generation progress stays visible, and wake-word startup and first-message readiness are fixed.",
+   "sections": []
+  },
   {
    "version": "1.15.0",
    "title": "Standard Hermes first, with clearer Relay boundaries",

app/src/main/assets/whats_new.txt

@@ -1,29 +1,24 @@
-v1.15.0 - Standard Hermes first, with clearer Relay boundaries
+v1.15.1 - Steadier chat, media, and voice
 
 Summary
-* Chat, voice, attachments, inbound files, current-session Git, usage, and Hermes notices now prefer current upstream Dashboard and Gateway support. Relay stays optional for compatibility and the tools it uniquely provides.
+* Chats use less memory, attachment previews stay in place, and voice failures are easier to recover from. Follow-up controls make it clear whether a message changes the current response or waits for the next turn.
 
 Highlights
-* Use standard Hermes without Relay prompts — Chat attachments, inbound files, current-session Git, Nous usage, and Hermes notices use upstream routes first.
-* Keep returned files loaded — Images, audio, video, and documents download through the Dashboard and no longer flash Relay errors or return to Loading.
-* Use app-specific parent access — A parent PIN or password plus recovery phrase protects Supervised Mode without trusting the phone unlock credential.
+* Choose when follow-up messages are sent — A slim tray behind the composer offers Correct now or Queue next. Chat settings sets the default, and a composer choice applies to one message. Stop pauses pending work until Resume; editing or removing an item keeps the remaining queue usable.
+* Keep attachment previews open through rotation — Image, video, audio, PDF, text, and file previews stay open as the screen rotates. Videos retain their original proportions.
+* Keep large chats and media manageable — Automatic session refresh no longer loops. Routine history loads, chat rendering, image previews, and media exports use bounded memory instead of allocating entire large responses.
 
 Improved
-* See which features need Relay — Media sits with standard Hermes settings while Threads, Terminal, notifications, enhanced voice, and device tools stay under Relay tools.
-* Read the complete release record — What's New shows one release summary, selected highlights, every remaining change, and relevant compatibility notes.
+* Make better use of wider screens — Chat and Voice keep text and controls on readable centered layouts. Landscape Voice Focus separates identity controls from conversation activity.
 
 Fixed
-* Keep Standard voice after removing Relay — Dashboard voice remains ready, temporary outages preserve choices, and shared default-profile settings stay isolated.
-* Observe another client's activity safely — A uniquely matched Desktop or TUI turn can show Working or Waiting without Android taking control.
-* Keep each chat on its chosen transport — Dashboard chats preserve their transcript, draft, profile, and session through sign-out or outages instead of silently changing databases.
-* Preserve completed replies at sign-in expiry — A Dashboard history authentication failure keeps completed text visible and opens the existing sign-in recovery path.
-* Let long context compaction finish — Visible compaction activity refreshes the turn watchdog instead of being interrupted as idle.
-* Render Bot Chat history immediately — Route-owned Bot Chats observe their bound history from first composition.
-* Settle turns after a lost terminal frame — An exact idle live-session snapshot reconciles the Android-owned turn and drains its queued follow-up.
-* Keep Gateway setup parent-owned — Relock and back navigation cancel the exact pending setup without bypassing parent authority.
-* Keep completed generated images visible — Generated media survives marker persistence lag and retains its intended Chat animation.
+* Read message delivery status clearly — Correction and delivery labels use contrasting text instead of disappearing into the message bubble.
+* Read and dismiss voice errors — Voice errors open in a contained dialog with scrollable details and separate Retry and Dismiss actions, without overlapping chat controls.
+* Fix wake-word startup in release builds — Release optimization now preserves the native speech configuration names needed to initialize wake-word detection.
+* Download attachments with less memory — Standard Hermes attachments stream into the on-disk cache while download size limits remain enforced.
+* Keep image-generation progress visible — The working indicator stays visible between interim replies and the generated image, including gateways that omit tool activity events.
+* Wait for new chats to be ready — The first message waits for the Gateway session to initialize. Ownership refusals keep the prompt retryable and show the server's error.
 
 Compatibility
-* Current upstream Hermes provides standard Chat, sessions, Manage, voice, attachments, inbound files, current-session Git reads, usage, and notices without the optional Hermes-Relay Plugin.
-* Hermes-Relay Plugin 1.11.1 remains required for Terminal, proactive Threads and offline delivery, Notification Companion, Relay sessions, enhanced voice, Secure Link, and phone or device control.
-* Granular Device Control and the system Voice Focus overlay remain sideload-only.
+* Standard Chat, sessions, media, and voice continue to use upstream Hermes. Voice transcription still requires a configured speech-to-text provider on the Hermes host.
+* Paused text queues can be restored. Attachment bytes are not stored in preferences; an attachment queue that cannot be restored must be reviewed and sent again.

app/src/main/kotlin/com/hermesandroid/relay/data/ChatActivityProjection.kt

@@ -0,0 +1,102 @@
+package com.hermesandroid.relay.data
+
+/** Presentation only: canonical rows retain their wire identity, role and content. */
+internal fun projectChatActivityReceipts(
+    messages: List<ChatMessage>,
+    records: List<ChatActivityRecord>,
+    scopeKey: String?,
+    sessionId: String?,
+): List<ChatMessage> {
+    val originals = messages.filterNot {
+        it.clientOnly && it.id.startsWith("activity:") && it.activityRecord != null
+    }
+    if (scopeKey.isNullOrBlank() || sessionId.isNullOrBlank()) {
+        return originals.map { it.copy(activityRecord = null) }
+    }
+    val owned = records.filter { it.scopeKey == scopeKey && it.sessionId == sessionId }
+        .sortedByDescending { it.updatedAt }
+        .distinctBy { it.id }
+    val represented = mutableSetOf<String>()
+    val canonical = originals.map { message ->
+        val process = message.hermesProcessNotificationOrNull()
+        val delegation = message.activitySourceId?.takeIf { it.startsWith("delegation:") }
+            ?.removePrefix("delegation:")?.takeIf { it.isNotBlank() }
+        val kind = when {
+            message.activitySourceId != null -> ChatActivityKind.SUBAGENTS
+            process != null -> ChatActivityKind.PROCESS
+            else -> return@map message.copy(activityRecord = null)
+        }
+        val sourceId = delegation ?: process?.processId
+        val processTerminal = process?.let { notice ->
+            PROCESS_TERMINAL_HEADLINE.matchEntire(notice.headline)?.let { match ->
+                match.groupValues[2].toIntOrNull()?.let { code ->
+                    val phase = when {
+                        match.groupValues[1].startsWith("terminated by ") -> ChatActivityPhase.CANCELLED
+                        code == 0 -> ChatActivityPhase.COMPLETE
+                        else -> ChatActivityPhase.FAILED
+                    }
+                    phase to code
+                }
+            }
+        }
+        // A process id can be reused after a registry restart. A canonical row has
+        // no start-generation field, so multiple generations must remain unmatched.
+        val matching = if (sourceId == null) emptyList() else owned.filter {
+            it.kind == kind && it.sourceId == sourceId
+        }
+        val record = matching.singleOrNull()?.also { represented += it.id }
+            ?: ChatActivityRecord(
+                id = "canonical:${message.id}",
+                scopeKey = scopeKey,
+                sessionId = sessionId,
+                kind = kind,
+                sourceId = sourceId ?: "unavailable:${message.id}",
+                title = process?.headline ?: message.content,
+                phase = when {
+                    kind == ChatActivityKind.PROCESS -> processTerminal?.first ?: ChatActivityPhase.UNKNOWN
+                    (message.activityFailedCount ?: 0) > 0 ->
+                        if (message.activityFailedCount == message.activityTaskCount) {
+                            ChatActivityPhase.FAILED
+                        } else ChatActivityPhase.UNKNOWN
+                    (message.activityTaskCount ?: 0) > 0 -> ChatActivityPhase.COMPLETE
+                    else -> ChatActivityPhase.UNKNOWN
+                },
+                createdAt = message.timestamp,
+                updatedAt = message.timestamp,
+                taskCount = message.activityTaskCount?.coerceAtLeast(0) ?: 0,
+                processId = process?.processId,
+                exitCode = processTerminal?.second,
+            )
+        // Aggregate completion metadata never rewrites captured child phases.
+        message.copy(activityRecord = record)
+    }
+    val pending = owned.filter { it.phase != ChatActivityPhase.RUNNING && it.id !in represented }
+        .sortedWith(compareBy<ChatActivityRecord> { it.updatedAt }.thenBy { it.id })
+        .map { record ->
+            ChatMessage(
+                id = "activity:${record.id}",
+                role = MessageRole.SYSTEM,
+                content = record.title,
+                timestamp = record.updatedAt,
+                clientOnly = true,
+                activityRecord = record,
+            )
+        }
+    // Stable merge: history order is authoritative even if server timestamps
+    // regress. Only insert local receipts; never sort canonical messages.
+    var next = 0
+    return buildList {
+        canonical.forEach { message ->
+            while (next < pending.size && pending[next].timestamp < message.timestamp) {
+                add(pending[next++])
+            }
+            add(message)
+        }
+        while (next < pending.size) add(pending[next++])
+    }
+}
+
+/** Upstream completion envelope only; never search arbitrary command/output text. */
+private val PROCESS_TERMINAL_HEADLINE = Regex(
+    """Background process \S+ (completed normally|exited|terminated by [^\r\n]+|marked lost because the process backend disappeared|failed to start) \(exit code (-?\d+)(?:, SIGTERM)?\)\.""",
+)

app/src/main/kotlin/com/hermesandroid/relay/data/ChatActivityStore.kt

@@ -0,0 +1,222 @@
+package com.hermesandroid.relay.data
+
+import android.content.Context
+import androidx.datastore.core.DataStore
+import androidx.datastore.preferences.core.Preferences
+import androidx.datastore.preferences.core.edit
+import androidx.datastore.preferences.core.stringPreferencesKey
+import java.io.IOException
+import kotlinx.coroutines.flow.first
+import kotlinx.coroutines.sync.Mutex
+import kotlinx.coroutines.sync.withLock
+import kotlinx.serialization.Serializable
+import kotlinx.serialization.encodeToString
+import kotlinx.serialization.json.Json
+import kotlinx.serialization.json.JsonArray
+import kotlinx.serialization.json.JsonObject
+import kotlinx.serialization.json.jsonPrimitive
+import kotlinx.serialization.json.intOrNull
+
+@Serializable
+enum class ChatActivityKind { SUBAGENTS, PROCESS }
+
+@Serializable
+enum class ChatActivityPhase { RUNNING, COMPLETE, FAILED, CANCELLED, UNKNOWN }
+
+@Serializable
+data class ChatActivityChild(
+    val id: String,
+    val childSessionId: String? = null,
+    val goal: String = "",
+    val phase: ChatActivityPhase = ChatActivityPhase.UNKNOWN,
+    val summary: String? = null,
+)
+
+/** Local presentation metadata and exact references, never transcripts or process output. */
+@Serializable
+data class ChatActivityRecord(
+    val id: String,
+    val scopeKey: String,
+    val sessionId: String,
+    val kind: ChatActivityKind,
+    val sourceId: String,
+    val title: String,
+    val phase: ChatActivityPhase,
+    val createdAt: Long,
+    val updatedAt: Long,
+    val children: List<ChatActivityChild> = emptyList(),
+    val taskCount: Int = 0,
+    val processId: String? = null,
+    val processStartedAt: String? = null,
+    val exitCode: Int? = null,
+)
+
+interface ChatActivityStore {
+    /** Recovery is not live evidence: RUNNING becomes UNKNOWN, including child phases. */
+    suspend fun read(scopeKey: String, sessionId: String): List<ChatActivityRecord>
+    suspend fun upsert(record: ChatActivityRecord)
+    suspend fun removeRecord(scopeKey: String, sessionId: String, id: String)
+    suspend fun removeSession(scopeKey: String, sessionId: String)
+}
+
+/**
+ * Bounded app-private history references in the shared settings DataStore.
+ * Retains 30 days, 128 records overall, 32 per exact owner/session, and 32 children
+ * per record. Titles are 160 characters; goals/summaries 512. Identity fields are
+ * rejected above 512 characters (scope 2048), never truncated into another owner.
+ * The complete encoded envelope is capped at 1 MiB, evicting oldest records first.
+ * Five minutes of future skew allows monotonic local revisions within one clock tick.
+ * All read/modify/write operations occur inside DataStore's serialized edit.
+ */
+class DataStoreChatActivityStore(
+    private val dataStore: DataStore<Preferences>,
+    private val now: () -> Long = System::currentTimeMillis,
+) : ChatActivityStore {
+    constructor(context: Context) : this(context.applicationContext.relayDataStore)
+
+    override suspend fun read(scopeKey: String, sessionId: String): List<ChatActivityRecord> {
+        val raw = try {
+            dataStore.data.first()[CHAT_ACTIVITY_KEY]
+        } catch (_: IOException) {
+            return emptyList()
+        }
+        return boundChatActivities(decodeChatActivities(raw), now())
+            .filter { it.scopeKey == scopeKey && it.sessionId == sessionId }
+            .map(ChatActivityRecord::recovered)
+    }
+
+    override suspend fun upsert(record: ChatActivityRecord) {
+        dataStore.edit { preferences ->
+            val records = mergeChatActivity(decodeChatActivities(preferences[CHAT_ACTIVITY_KEY]), record, now())
+            preferences[CHAT_ACTIVITY_KEY] = encodeChatActivities(records)
+        }
+    }
+
+    override suspend fun removeSession(scopeKey: String, sessionId: String) {
+        dataStore.edit { preferences ->
+            val remaining = boundChatActivities(decodeChatActivities(preferences[CHAT_ACTIVITY_KEY]), now())
+                .filterNot { it.scopeKey == scopeKey && it.sessionId == sessionId }
+            if (remaining.isEmpty()) preferences.remove(CHAT_ACTIVITY_KEY)
+            else preferences[CHAT_ACTIVITY_KEY] = encodeChatActivities(remaining)
+        }
+    }
+
+    override suspend fun removeRecord(scopeKey: String, sessionId: String, id: String) {
+        dataStore.edit { preferences ->
+            val remaining = boundChatActivities(decodeChatActivities(preferences[CHAT_ACTIVITY_KEY]), now())
+                .filterNot { it.scopeKey == scopeKey && it.sessionId == sessionId && it.id == id }
+            if (remaining.isEmpty()) preferences.remove(CHAT_ACTIVITY_KEY)
+            else preferences[CHAT_ACTIVITY_KEY] = encodeChatActivities(remaining)
+        }
+    }
+}
+
+/** Test/ephemeral implementation with the same bounds and recovery semantics. */
+class InMemoryChatActivityStore(
+    private val now: () -> Long = System::currentTimeMillis,
+) : ChatActivityStore {
+    private val mutex = Mutex()
+    private var records = emptyList<ChatActivityRecord>()
+
+    override suspend fun read(scopeKey: String, sessionId: String): List<ChatActivityRecord> = mutex.withLock {
+        records = boundChatActivities(records, now())
+        records.filter { it.scopeKey == scopeKey && it.sessionId == sessionId }
+            .map(ChatActivityRecord::recovered)
+    }
+
+    override suspend fun upsert(record: ChatActivityRecord) = mutex.withLock {
+        records = mergeChatActivity(records, record, now())
+    }
+
+    override suspend fun removeSession(scopeKey: String, sessionId: String) = mutex.withLock {
+        records = boundChatActivities(records, now())
+            .filterNot { it.scopeKey == scopeKey && it.sessionId == sessionId }
+    }
+
+    override suspend fun removeRecord(scopeKey: String, sessionId: String, id: String) = mutex.withLock {
+        records = boundChatActivities(records, now())
+            .filterNot { it.scopeKey == scopeKey && it.sessionId == sessionId && it.id == id }
+    }
+}
+
+internal const val CHAT_ACTIVITY_MAX_AGE_MS = 30L * 24L * 60L * 60L * 1_000L
+private const val MAX_RECORDS = 128
+private const val MAX_SESSION_RECORDS = 32
+private const val MAX_PAYLOAD_BYTES = 1_048_576
+private val CHAT_ACTIVITY_KEY = stringPreferencesKey("chat_activity_records_v1")
+private val activityJson = Json { ignoreUnknownKeys = true; encodeDefaults = true }
+
+@Serializable
+private data class ChatActivityEnvelope(val version: Int = 1, val records: List<ChatActivityRecord>)
+
+private fun encodeChatActivities(records: List<ChatActivityRecord>): String =
+    activityJson.encodeToString(ChatActivityEnvelope(records = records))
+
+internal fun decodeChatActivities(raw: String?): List<ChatActivityRecord> {
+    if (raw == null || raw.length > MAX_PAYLOAD_BYTES || raw.toByteArray().size > MAX_PAYLOAD_BYTES) {
+        return emptyList()
+    }
+    val envelope = runCatching { activityJson.parseToJsonElement(raw) as? JsonObject }.getOrNull()
+        ?: return emptyList()
+    val version = runCatching { envelope["version"]?.jsonPrimitive?.intOrNull }.getOrNull()
+    if (version != 1) return emptyList()
+    val rows = envelope["records"] as? JsonArray ?: return emptyList()
+    // One corrupt or newer row must not hide independently valid records.
+    return rows.mapNotNull { row ->
+        runCatching { activityJson.decodeFromJsonElement(ChatActivityRecord.serializer(), row) }.getOrNull()
+    }
+}
+
+private fun ChatActivityRecord.identity() = Triple(scopeKey, sessionId, id)
+
+private fun mergeChatActivity(
+    existing: List<ChatActivityRecord>,
+    record: ChatActivityRecord,
+    now: Long,
+): List<ChatActivityRecord> {
+    // Sorting first also rejects a late write for an older generation of the same record.
+    return boundChatActivities(listOf(record) + existing, now)
+}
+
+internal fun boundChatActivities(records: List<ChatActivityRecord>, now: Long): List<ChatActivityRecord> {
+    val counts = mutableMapOf<Pair<String, String>, Int>()
+    val bounded = records.mapNotNull { it.bounded(now) }
+        .sortedByDescending(ChatActivityRecord::updatedAt)
+        .distinctBy { it.identity() }
+        .filter {
+            val owner = it.scopeKey to it.sessionId
+            val count = counts.getOrDefault(owner, 0)
+            counts[owner] = count + 1
+            count < MAX_SESSION_RECORDS
+        }.take(MAX_RECORDS).toMutableList()
+    while (bounded.isNotEmpty() && encodeChatActivities(bounded).toByteArray().size > MAX_PAYLOAD_BYTES) {
+        bounded.removeAt(bounded.lastIndex)
+    }
+    return bounded
+}
+
+private fun validIdentity(value: String, max: Int = 512) = value.isNotBlank() && value.length <= max
+
+private fun ChatActivityRecord.bounded(now: Long): ChatActivityRecord? {
+    if (!validIdentity(scopeKey, 2048) || !validIdentity(sessionId) || !validIdentity(id) ||
+        !validIdentity(sourceId) || (processId != null && !validIdentity(processId)) ||
+        (processStartedAt != null && !validIdentity(processStartedAt)) ||
+        createdAt < 0 || updatedAt < createdAt || updatedAt > now + 300_000L ||
+        now - updatedAt > CHAT_ACTIVITY_MAX_AGE_MS
+    ) return null
+    return copy(
+        title = title.take(160),
+        taskCount = taskCount.coerceIn(0, 10_000),
+        children = children.asSequence().filter {
+            validIdentity(it.id) && (it.childSessionId == null || validIdentity(it.childSessionId))
+        }.distinctBy(ChatActivityChild::id).take(32)
+            .map { it.copy(goal = it.goal.take(512), summary = it.summary?.take(512)) }.toList(),
+    )
+}
+
+private fun ChatActivityRecord.recovered() = copy(
+    phase = if (phase == ChatActivityPhase.RUNNING) ChatActivityPhase.UNKNOWN else phase,
+    children = children.map {
+        if (it.phase == ChatActivityPhase.RUNNING) it.copy(phase = ChatActivityPhase.UNKNOWN) else it
+    },
+)

app/src/main/kotlin/com/hermesandroid/relay/data/ChatInputPreferences.kt

@@ -22,6 +22,26 @@ enum class PhysicalKeyboardEnterBehavior(val storedValue: String) {
     }
 }
 
+/** Default intent for a message submitted while an agent is responding. */
+enum class BusyMessageAction(val storedValue: String) {
+    CorrectNow("correct_now"),
+    QueueNext("queue_next");
+
+    companion object {
+        fun fromStoredValue(value: String?): BusyMessageAction =
+            entries.firstOrNull { it.storedValue == value } ?: CorrectNow
+    }
+}
+
+fun canCorrectBusyMessage(
+    steerable: Boolean,
+    hasAttachments: Boolean,
+    hasPendingInput: Boolean,
+    status: String?,
+    text: String,
+): Boolean = steerable && !hasAttachments && !hasPendingInput &&
+    status?.contains("compact", ignoreCase = true) != true && !text.trimStart().startsWith("/")
+
 /** Device-level chat input preferences shared by every Hermes profile. */
 class ChatInputPreferencesRepository(
     private val dataStore: DataStore<Preferences>,
@@ -29,6 +49,7 @@ class ChatInputPreferencesRepository(
     constructor(context: Context) : this(context.relayDataStore)
 
     companion object {
+        internal val KEY_BUSY_MESSAGE_ACTION = stringPreferencesKey("busy_message_action")
         internal val KEY_PHYSICAL_KEYBOARD_ENTER =
             stringPreferencesKey("physical_keyboard_enter_behavior")
         internal val KEY_CONVERT_LARGE_PASTES =
@@ -45,6 +66,14 @@ class ChatInputPreferencesRepository(
         }
         .distinctUntilChanged()
 
+    val busyMessageAction: Flow<BusyMessageAction> = dataStore.data
+        .map { BusyMessageAction.fromStoredValue(it[KEY_BUSY_MESSAGE_ACTION]) }
+        .distinctUntilChanged()
+
+    suspend fun setBusyMessageAction(action: BusyMessageAction) {
+        dataStore.edit { it[KEY_BUSY_MESSAGE_ACTION] = action.storedValue }
+    }
+
     val convertLargePastesToAttachments: Flow<Boolean> = dataStore.data
         .map { preferences -> preferences[KEY_CONVERT_LARGE_PASTES] ?: true }
         .distinctUntilChanged()

app/src/main/kotlin/com/hermesandroid/relay/data/ChatMessage.kt

@@ -170,6 +170,12 @@ data class ChatMessage(
      * but server history never owns these presentation blocks.
      */
     val moaReferences: List<MoaReference> = emptyList(),
+    /** Exact upstream identity on a persisted activity-completion marker. */
+    val activitySourceId: String? = null,
+    val activityTaskCount: Int? = null,
+    val activityFailedCount: Int? = null,
+    /** Read-only UI projection; never sent as model history or voice input. */
+    val activityRecord: ChatActivityRecord? = null,
 )
 
 data class MessageReaction(

app/src/main/kotlin/com/hermesandroid/relay/data/ChatTurnCheckpointStore.kt

@@ -35,6 +35,9 @@ data class ChatTurnCheckpoint(
     val baselineAssistantCount: Int,
     val pendingAsk: ChatTurnAskCheckpoint? = null,
     val queuedMessages: List<ChatQueuedMessageCheckpoint> = emptyList(),
+    val queuePaused: Boolean = false,
+    /** Only pending local work remains; never reattach the completed/stopped turn. */
+    val queueOnly: Boolean = false,
     val startedAt: Long,
     val updatedAt: Long,
 ) {

app/src/main/kotlin/com/hermesandroid/relay/network/relay/BridgeCommandHandler.kt

@@ -348,7 +348,7 @@ class BridgeCommandHandler(
      * the multiplexer. The two paths are fully independent.
      *
      * Caught by Bailey's on-device test 2026-04-14 — see the v0.4.1
-     * "voice intent local dispatch loop" entry in ROADMAP.md.
+     * "voice intent local dispatch loop" entry in docs/project/ROADMAP.md.
      */
     suspend fun handleLocalCommand(envelope: Envelope): LocalDispatchResult {
         if (envelope.type != "bridge.command") {

app/src/main/kotlin/com/hermesandroid/relay/network/upstream/ChatHandler.kt

@@ -1451,6 +1451,12 @@ class ChatHandler {
         val loaded = renderedItems.mapNotNull { item ->
             val displayKind = item.displayKind?.trim()?.lowercase()
             if (displayKind == "hidden") return@mapNotNull null
+            val activitySourceId = if (displayKind == "async_delegation_complete") {
+                item.displayMetadata.stringField("delegation_id")?.let { "delegation:$it" }
+                    ?: "unavailable:${item.id}"
+            } else null
+            val activityTaskCount = if (activitySourceId != null) item.displayMetadata.intField("task_count") else null
+            val activityFailedCount = if (activitySourceId != null) item.displayMetadata.intField("failed_count") else null
             val role = when {
                 displayKind == "model_switch" ||
                     displayKind == "async_delegation_complete" ||
@@ -1611,6 +1617,9 @@ class ChatHandler {
                 // this as the same visible row across the post-turn reload.
                 prior.copy(
                     id = messageId,
+                    activitySourceId = activitySourceId,
+                    activityTaskCount = activityTaskCount,
+                    activityFailedCount = activityFailedCount,
                     rowId = item.resolvedRowId,
                     reactions = item.reactions,
                     role = role,
@@ -1643,6 +1652,9 @@ class ChatHandler {
                 // nothing local to carry).
                 ChatMessage(
                     id = messageId,
+                    activitySourceId = activitySourceId,
+                    activityTaskCount = activityTaskCount,
+                    activityFailedCount = activityFailedCount,
                     rowId = item.resolvedRowId,
                     reactions = item.reactions,
                     role = role,

app/src/main/kotlin/com/hermesandroid/relay/network/upstream/DashboardApiClient.kt

@@ -49,10 +49,10 @@ import okhttp3.Request
 import okhttp3.RequestBody
 import okhttp3.RequestBody.Companion.toRequestBody
 import okhttp3.Response
+import java.io.ByteArrayOutputStream
 import java.io.IOException
 import java.io.InputStream
 import java.io.OutputStream
-import java.io.ByteArrayOutputStream
 import java.net.URLEncoder
 import java.util.concurrent.TimeUnit
 import kotlin.coroutines.resume
@@ -294,6 +294,34 @@ internal fun copyBounded(
     return written
 }
 
+internal fun copyMediaBounded(
+    input: InputStream,
+    output: OutputStream,
+    declaredLength: Long?,
+    limitBytes: Long,
+): Long {
+    require(limitBytes > 0)
+    require(declaredLength == null || declaredLength >= 0)
+    if (declaredLength != null && declaredLength > limitBytes) {
+        throw IOException("File exceeds the configured download limit")
+    }
+    val buffer = ByteArray(DEFAULT_BUFFER_SIZE)
+    var written = 0L
+    while (true) {
+        val read = input.read(buffer)
+        if (read < 0) break
+        written += read
+        if (written > limitBytes) {
+            throw IOException("File exceeds the configured download limit")
+        }
+        output.write(buffer, 0, read)
+    }
+    if (declaredLength != null && written != declaredLength) {
+        throw IOException("Media file changed while it was being downloaded")
+    }
+    return written
+}
+
 /** One entry from `GET /api/audio/elevenlabs/voices` — non-secret voice metadata. */
 data class ElevenLabsVoice(
     val voiceId: String,
@@ -312,14 +340,14 @@ data class ElevenLabsVoices(
 )
 
 /**
- * Bytes fetched from upstream's authenticated managed-files surface.
+ * Metadata for a file streamed from upstream's authenticated managed-files surface.
  *
  * The Dashboard applies its own managed-root, sensitive-file, and maximum-size
- * policy before these bytes leave the Hermes host. Android applies the user's
+ * policy before the file leaves the Hermes host. Android applies the user's
  * stricter inbound-media cap while reading the response as a second boundary.
  */
 data class DashboardFetchedFile(
-    val bytes: ByteArray,
+    val sizeBytes: Long,
     val contentType: String,
     val fileName: String?,
 )
@@ -401,13 +429,14 @@ class DashboardApiClient(
      * This is the same authenticated `/api/files/download` route official
      * Desktop uses for remote gateway files. The caller supplies its display
      * cap so a malicious or stale Content-Length cannot cause an unbounded
-     * allocation. Audio/video are downloaded into Android's local media cache;
+     * allocation. The supplied output is normally Android's on-disk media cache;
      * local playback supplies seeking, so `/api/files/stream` is unnecessary
      * on this path.
      */
     suspend fun downloadManagedFile(
         serverPath: String,
         maxBytes: Long,
+        output: OutputStream,
     ): Result<DashboardFetchedFile> = withContext(Dispatchers.IO) {
         if (serverPath.isBlank()) {
             return@withContext Result.failure(IOException("Media path is empty"))
@@ -428,29 +457,11 @@ class DashboardApiClient(
             if (declaredLength != null && declaredLength > maxBytes) {
                 throw IOException("File exceeds the configured download limit")
             }
-            val initialSize = declaredLength
-                ?.coerceAtMost(Int.MAX_VALUE.toLong())
-                ?.toInt()
-                ?: DEFAULT_BUFFER_SIZE
-            val output = ByteArrayOutputStream(initialSize)
-            body.byteStream().use { input ->
-                val buffer = ByteArray(DEFAULT_BUFFER_SIZE)
-                var readTotal = 0L
-                while (true) {
-                    val count = input.read(buffer)
-                    if (count < 0) break
-                    readTotal += count
-                    if (readTotal > maxBytes) {
-                        throw IOException("File exceeds the configured download limit")
-                    }
-                    output.write(buffer, 0, count)
-                }
-                if (declaredLength != null && readTotal != declaredLength) {
-                    throw IOException("Media file changed while it was being downloaded")
-                }
+            val readTotal = body.byteStream().use { input ->
+                copyMediaBounded(input, output, declaredLength, maxBytes)
             }
             DashboardFetchedFile(
-                bytes = output.toByteArray(),
+                sizeBytes = readTotal,
                 contentType = response.header("Content-Type")
                     ?.substringBefore(';')
                     ?.trim()
@@ -1345,7 +1356,7 @@ class DashboardApiClient(
     suspend fun getSessionMessages(
         sessionId: String,
         profile: String? = null,
-        mode: SessionMessageLoadMode = SessionMessageLoadMode.COMPLETE,
+        mode: SessionMessageLoadMode = SessionMessageLoadMode.LATEST,
     ): Result<List<MessageItem>> = withContext(Dispatchers.IO) {
         val name = profile?.trim().orEmpty()
         loadSessionMessages(mode) { page ->
@@ -1514,10 +1525,14 @@ class DashboardApiClient(
         password: String,
         next: String = "/",
     ): Result<DashboardLoginResponse> = withContext(Dispatchers.IO) {
+        // Match the Dashboard's single-line HTML username/password controls:
+        // remove only forbidden line breaks and preserve every other code point.
+        val normalizedUsername = username.replace("\r", "").replace("\n", "")
+        val normalizedPassword = password.replace("\r", "").replace("\n", "")
         val payload = buildJsonObject {
             put("provider", provider)
-            put("username", username)
-            put("password", password)
+            put("username", normalizedUsername)
+            put("password", normalizedPassword)
             put("next", next)
         }
         val httpUrl = resolveUrl("/auth/password-login")
@@ -1749,6 +1764,7 @@ class DashboardApiClient(
         // Mirrors current upstream `_MANAGED_FILE_MAX_BYTES`; enforcing it
         // client-side avoids uploading a body the Dashboard will reject.
         internal const val MAX_BACKUP_TRANSFER_BYTES = 100L * 1024L * 1024L
+        internal const val MAX_JSON_RESPONSE_BYTES = 8L * 1024L * 1024L
 
         fun pathSegment(value: String): String =
             URLEncoder.encode(value, "UTF-8").replace("+", "%20")
@@ -2477,17 +2493,44 @@ data class StoredDashboardCookie(
 }
 
 private fun Response.readJsonObject(json: Json): JsonObject {
-    val raw = body.string()
+    val raw = body.readUtf8Bounded(DashboardApiClient.MAX_JSON_RESPONSE_BYTES)
     if (raw.isBlank()) return JsonObject(emptyMap())
     return json.parseToJsonElement(raw).jsonObject
 }
 
 private fun Response.readJsonElement(json: Json): JsonElement {
-    val raw = body.string()
+    val raw = body.readUtf8Bounded(DashboardApiClient.MAX_JSON_RESPONSE_BYTES)
     if (raw.isBlank()) return JsonObject(emptyMap())
     return json.parseToJsonElement(raw)
 }
 
+internal fun okhttp3.ResponseBody.readUtf8Bounded(maxBytes: Long): String {
+    require(maxBytes in 1..Int.MAX_VALUE.toLong()) { "Invalid response byte limit" }
+    val declaredLength = contentLength()
+    if (declaredLength > maxBytes) {
+        throw IOException("Dashboard response exceeds Android's bounded JSON limit")
+    }
+    val initialSize = when {
+        declaredLength in 1..maxBytes -> declaredLength.toInt()
+        else -> minOf(maxBytes, DEFAULT_BUFFER_SIZE.toLong()).toInt()
+    }
+    val output = ByteArrayOutputStream(initialSize)
+    byteStream().use { input ->
+        val buffer = ByteArray(DEFAULT_BUFFER_SIZE)
+        var total = 0L
+        while (true) {
+            val read = input.read(buffer)
+            if (read < 0) break
+            total += read
+            if (total > maxBytes) {
+                throw IOException("Dashboard response exceeds Android's bounded JSON limit")
+            }
+            output.write(buffer, 0, read)
+        }
+    }
+    return output.toString(Charsets.UTF_8.name())
+}
+
 private fun contentDispositionFileName(header: String): String? {
     val encoded = Regex("""filename\*=UTF-8''([^;]+)""", RegexOption.IGNORE_CASE)
         .find(header)
@@ -2576,7 +2619,11 @@ internal fun Throwable.isDashboardManagedFilesUnsupported(): Boolean {
 }
 
 private fun apiFailure(response: Response, operation: String): IOException {
-    val bodyDetail = runCatching { response.body.string() }.getOrDefault("")
+    val bodyDetail = try {
+        response.body.readUtf8Bounded(4L * 1024L)
+    } catch (_: Exception) {
+        ""
+    }
     val detail = bodyDetail.take(240).ifBlank { response.message }
     return DashboardHttpException(
         statusCode = response.code,

app/src/main/kotlin/com/hermesandroid/relay/network/upstream/GatewayChatClient.kt

@@ -119,6 +119,8 @@ class GatewayChatClient(
     private val promptSubmitTimeoutMs: Long = PROMPT_SUBMIT_REQUEST_TIMEOUT_MS,
     /** Test seam — idle-progress watchdog base. Production keeps [TURN_TIMEOUT_MS]. */
     private val turnIdleTimeoutMs: Long = TURN_TIMEOUT_MS,
+    /** Test seam — lazy session.create/resume readiness barrier. */
+    private val sessionReadyTimeoutMs: Long = SESSION_READY_TIMEOUT_MS,
     /** Test seam — compaction idle lease. Production keeps [COMPACTING_TIMEOUT_MS]. */
     private val compactingTimeoutMs: Long = COMPACTING_TIMEOUT_MS,
     /** Random source for ordinary reconnect full-jitter. */
@@ -191,6 +193,7 @@ class GatewayChatClient(
          * would have been abandoned server-side anyway.
          */
         private const val PROMPT_SUBMIT_REQUEST_TIMEOUT_MS = 1_800_000L
+        private const val SESSION_READY_TIMEOUT_MS = 300_000L
         private const val CONNECT_TIMEOUT_MS = 20_000L
 
         /**
@@ -413,6 +416,10 @@ class GatewayChatClient(
     @Volatile
     private var webSocket: WebSocket? = null
 
+    /** Profile explicitly routed by the Dashboard `/api/ws?profile=` handshake. */
+    @Volatile
+    private var connectedSocketProfile: String? = null
+
     /** Completed when the server's `gateway.ready` event arrives for the current socket. */
     @Volatile
     private var readySignal: CompletableDeferred<Unit>? = null
@@ -421,6 +428,12 @@ class GatewayChatClient(
     /** Invalidates an older async prewarm when a newer session selection wins. */
     private val prewarmRequestGeneration = AtomicLong(0)
     private val pendingRpcs = ConcurrentHashMap<Long, CompletableDeferred<JsonObject>>()
+    private val lazyLiveSessions = ConcurrentHashMap.newKeySet<String>()
+    private val readyLiveSessions = ConcurrentHashMap.newKeySet<String>()
+    private val sessionReadyWaiters = ConcurrentHashMap<String, CompletableDeferred<Unit>>()
+    private val sessionReadyFailures = ConcurrentHashMap<String, String>()
+    private val _preparingSessionId = MutableStateFlow<String?>(null)
+    val preparingSessionId: StateFlow<String?> = _preparingSessionId.asStateFlow()
 
     /** Monotonic client-local fence for lazy child watch open/close races. */
     private val childWatchGeneration = AtomicLong(0)
@@ -623,6 +636,13 @@ class GatewayChatClient(
     @Volatile
     private var processEventListener: ((GatewayProcessEvent) -> Unit)? = null
 
+    @Volatile
+    private var subagentEventListener: ((String, String?, GatewaySubagentEvent) -> Unit)? = null
+
+    fun setSubagentEventListener(listener: ((String, String?, GatewaySubagentEvent) -> Unit)?) {
+        subagentEventListener = listener
+    }
+
     /** Process-wide durable-session invalidation/liveness edge. */
     @Volatile
     private var sessionDirectoryInvalidationListener: (() -> Unit)? = null
@@ -832,7 +852,7 @@ class GatewayChatClient(
                         // through the normal failed-turn callback instead.
                         cleanupStagedAttachments(stagedImagePaths)
                         turn.tracer.done("submit-rejected")
-                        turn.callbacks.onError(
+                        turn.callbacks.onSubmitRejected(
                             submitError?.message ?: "Hermes rejected the new session",
                         )
                         return@launch
@@ -899,6 +919,9 @@ class GatewayChatClient(
         liveSessionId = null
         storedSessionId = null
         liveSessionProfile = null
+        failSessionReadyWaiters("gateway session cleared")
+        lazyLiveSessions.clear()
+        readyLiveSessions.clear()
         cancelledTurnDrain = null
         _serverTools.value = null
     }
@@ -1550,7 +1573,10 @@ class GatewayChatClient(
                         .orEmpty()
                         .also { recoveryEvents = null }
                 }
-                buffered.forEach { event -> boundTurn?.onEvent(event.type, event.payload) }
+                buffered.forEach { event ->
+                    dispatchSubagentEvent(event.type, event.payload, event.sessionId)
+                    boundTurn.onEvent(event.type, event.payload)
+                }
                 queued?.let { queuedTurn ->
                     queuedTurnProvider?.invoke(queuedTurn)?.let { registration ->
                         boundTurn.installQueuedSuccessor(registration)
@@ -2937,6 +2963,7 @@ class GatewayChatClient(
         unmatchedTurnCompleteListener = null
         backgroundInteractionListener = null
         processEventListener = null
+        subagentEventListener = null
         sessionDirectoryInvalidationListener = null
         closeSocket("client shutdown")
         backgroundCloseJob?.cancel()
@@ -3057,9 +3084,10 @@ class GatewayChatClient(
             )
         }
         val ticketMs = (System.nanoTime() - connectStart) / 1_000_000
+        val socketProfile = currentSessionProfile()
         val url = dashboardClient.gatewayWebSocketUrl(
             ticket = ticket.ticket,
-            profile = currentSessionProfile(),
+            profile = socketProfile,
         )
             ?: throw GatewayConnectAttemptException(
                 "could not build /api/ws URL",
@@ -3093,6 +3121,7 @@ class GatewayChatClient(
         if (readyFailure != null) {
             socket.cancel()
             webSocket = null
+            connectedSocketProfile = null
             throw (readyFailure as? GatewayConnectAttemptException
                 ?: GatewayConnectAttemptException(
                     "gateway connection failed: ${readyFailure.message}",
@@ -3105,6 +3134,7 @@ class GatewayChatClient(
         val wsMs = (System.nanoTime() - connectStart) / 1_000_000 - ticketMs
         Log.i(TAG, "Gateway connected (/api/ws ready) — ticket=${ticketMs}ms ws=${wsMs}ms")
         hasEverReachedReady = true
+        connectedSocketProfile = socketProfile
         coldStartFailureEpisodes = 0
         _reconnectDisposition.value = GatewayReconnectDisposition.None
         _connectionState.value = GatewayConnectionState.Ready
@@ -3279,7 +3309,8 @@ class GatewayChatClient(
             ?.stringField("profile_name")
             ?.trim()
             ?.takeIf { it.isNotEmpty() }
-        if (actual != expected) {
+        val socketConfirmed = actual == null && connectedSocketProfile == expected
+        if (actual != expected && !socketConfirmed) {
             val detail = actual?.let { "Hermes returned profile '$it'" }
                 ?: "Hermes did not confirm profile ownership"
             throw GatewayPreflightException(
@@ -3389,6 +3420,7 @@ class GatewayChatClient(
             requestedStoredId != null &&
             liveSessionProfile == requestedProfile
         ) {
+            awaitSessionReadyIfRequired(liveSessionId!!)
             return
         }
 
@@ -3418,6 +3450,7 @@ class GatewayChatClient(
                 liveSessionProfile = requestedProfile
                 updateCancelledDrainLiveSession(requestedStoredId, live)
                 applySessionResultInfo(result)
+                awaitSessionReadyIfRequired(live, result)
                 return
             }
             throw GatewayAuthoritativeResumeException(
@@ -3453,6 +3486,52 @@ class GatewayChatClient(
         if (cancelledTurnDrain?.storedSessionId != stored) cancelledTurnDrain = null
         if (settledTurnDrain?.storedSessionId != stored) settledTurnDrain = null
         turn.callbacks.onSessionId(stored)
+        awaitSessionReadyIfRequired(live, created)
+    }
+
+    /**
+     * Wait for current upstream's authoritative deferred-build edge instead of
+     * racing a lazy session into compute-host turn isolation. Without this
+     * barrier, the parent runtime can claim the durable lease before the child
+     * rechecks it, causing the child to reject itself as a second live owner.
+     */
+    private suspend fun awaitSessionReadyIfRequired(
+        liveId: String,
+        sessionResult: JsonObject? = null,
+    ) {
+        sessionReadyFailures[liveId]?.let { throw GatewayPreflightException(it) }
+        val lazy = (sessionResult?.get("info") as? JsonObject)?.booleanField("lazy") == true
+        if (lazy) lazyLiveSessions += liveId
+        if (liveId !in lazyLiveSessions) return
+        if (readyLiveSessions.remove(liveId)) {
+            lazyLiveSessions.remove(liveId)
+            return
+        }
+        val waiter = sessionReadyWaiters.computeIfAbsent(liveId) { CompletableDeferred() }
+        if (readyLiveSessions.remove(liveId)) waiter.complete(Unit)
+        sessionReadyFailures[liveId]?.let { waiter.completeExceptionally(GatewayRpcException(it)) }
+        val preparingStoredId = storedSessionId
+        _preparingSessionId.value = preparingStoredId
+        try {
+            withTimeout(sessionReadyTimeoutMs) { waiter.await() }
+            lazyLiveSessions.remove(liveId)
+        } catch (error: Exception) {
+            throw GatewayPreflightException(
+                error.message ?: "Hermes session initialization timed out",
+            )
+        } finally {
+            if (_preparingSessionId.value == preparingStoredId) _preparingSessionId.value = null
+            sessionReadyWaiters.remove(liveId, waiter)
+        }
+    }
+
+    private fun failSessionReadyWaiters(message: String) {
+        _preparingSessionId.value = null
+        sessionReadyFailures.clear()
+        sessionReadyWaiters.values.forEach {
+            it.completeExceptionally(GatewayRpcException(message))
+        }
+        sessionReadyWaiters.clear()
     }
 
     private fun createListener(ready: CompletableDeferred<Unit>) = object : WebSocketListener() {
@@ -3631,6 +3710,40 @@ class GatewayChatClient(
             return
         }
 
+        // Lazy create/resume returns before its AIAgent exists. The deferred
+        // build publishes exact-session session.info when it is ready. Record
+        // that edge before live-session routing so a fast build cannot race
+        // the RPC response and strand the first submit.
+        if (type == "session.info" && !eventSessionId.isNullOrBlank() &&
+            payload?.booleanField("lazy") != true
+        ) {
+            sessionReadyFailures.remove(eventSessionId)
+            readyLiveSessions += eventSessionId
+            sessionReadyWaiters.remove(eventSessionId)?.complete(Unit)
+        }
+
+        // Deferred agent construction can fail after lazy session.create/
+        // resume returns but before prompt.submit. Fail the readiness barrier
+        // immediately so the optimistic prompt remains retryable/Not sent
+        // instead of waiting for the five-minute readiness timeout.
+        if (type == "error" && !eventSessionId.isNullOrBlank() &&
+            (eventSessionId in lazyLiveSessions || sessionReadyWaiters.containsKey(eventSessionId) ||
+                payload?.stringField("message")?.startsWith("agent init failed:") == true)
+        ) {
+            val message = payload?.stringField("message")
+                ?: "Hermes session initialization failed"
+            // A fast deferred build can fail before the lazy RPC acknowledgement.
+            // Retain the exact runtime failure so the subsequent readiness wait
+            // cannot lose that edge and hang until its deadline.
+            if (sessionReadyFailures.size >= 64) sessionReadyFailures.keys.firstOrNull()?.let(sessionReadyFailures::remove)
+            sessionReadyFailures[eventSessionId] = message.take(2_000)
+            lazyLiveSessions.remove(eventSessionId)
+            readyLiveSessions.remove(eventSessionId)
+            sessionReadyWaiters.remove(eventSessionId)
+                ?.completeExceptionally(GatewayRpcException(message))
+            return
+        }
+
         // Upstream emits session.reclaimed process-wide, so it is identified
         // by payload rather than params.session_id. Retire only an exact live
         // runtime we own; preserve the durable id so the next send resumes it.
@@ -3830,6 +3943,7 @@ class GatewayChatClient(
         dispatchProcessEvent(type, payload, eventSessionId)
         if (consumeCancelledTurnEvent(type, eventSessionId)) return
         if (consumeSettledTurnTerminal(type, eventSessionId)) return
+        dispatchSubagentEvent(type, payload, eventSessionId)
         var turn = activeTurn
         if (turn == null && type == "message.start") {
             // Unsolicited turns are accepted only with an explicit exact live-
@@ -3891,10 +4005,25 @@ class GatewayChatClient(
     }
 
     /**
-     * Deliver session-scoped process events before the active-turn gate. The
-     * gateway socket is process-wide, so an exact non-blank live id match is
-     * required; missing/foreign ids must never leak another window's process.
+     * Detached child updates belong to the session even between parent turns.
+     * Recheck socket, session, profile and listener ownership on UI dispatch.
      */
+    private fun dispatchSubagentEvent(type: String, payload: JsonObject?, eventSessionId: String?) {
+        val liveId = liveSessionId ?: return
+        val storedId = storedSessionId ?: return
+        if (eventSessionId.isNullOrBlank() || eventSessionId != liveId) return
+        val event = GatewayEventMapper.parseSubagentEvent(type, payload) ?: return
+        val profile = liveSessionProfile
+        val socket = webSocket
+        val listener = subagentEventListener ?: return
+        callbackDispatcher {
+            if (webSocket === socket && liveSessionId == liveId && storedSessionId == storedId &&
+                liveSessionProfile == profile && subagentEventListener === listener
+            ) listener(storedId, profile, event)
+        }
+    }
+
+    /** Process updates likewise require an exact live-session match before turn admission. */
     private fun dispatchProcessEvent(type: String, payload: JsonObject?, eventSessionId: String?) {
         val liveId = liveSessionId ?: return
         if (eventSessionId.isNullOrBlank() || eventSessionId != liveId) return
@@ -3945,6 +4074,7 @@ class GatewayChatClient(
         // id on the shared gateway stream) keeps matching after reconnect.
         val preservedLiveId = liveSessionId
         webSocket = null
+        connectedSocketProfile = null
         readySignal = null
         liveSessionId = null
         attachMethodForSocket = null
@@ -3958,6 +4088,9 @@ class GatewayChatClient(
             it.completeExceptionally(GatewayRpcException("gateway connection lost"))
         }
         pendingRpcs.clear()
+        failSessionReadyWaiters("gateway connection lost")
+        lazyLiveSessions.clear()
+        readyLiveSessions.clear()
         failChildWatches("Child watch disconnected from the gateway")
         val turn = activeTurn
         if (turn == null) {
@@ -4133,8 +4266,12 @@ class GatewayChatClient(
     private fun closeSocket(reason: String) {
         webSocket?.close(1000, reason)
         webSocket = null
+        connectedSocketProfile = null
         readySignal = null
         liveSessionId = null
+        failSessionReadyWaiters("gateway socket closed")
+        lazyLiveSessions.clear()
+        readyLiveSessions.clear()
         attachMethodForSocket = null
         commandsCatalogCache = null
         _processCapability.value = GatewayProcessCapability.Unknown
@@ -4811,6 +4948,9 @@ class GatewayChatClient(
         onStatusClear = { kind -> dispatchIfCurrent(stillCurrent) { callbacks.onStatusClear(kind) } },
         onNoticeShow = { notice -> dispatchIfCurrent(stillCurrent) { callbacks.onNoticeShow(notice) } },
         onNoticeClear = { key -> dispatchIfCurrent(stillCurrent) { callbacks.onNoticeClear(key) } },
+        onSubmitRejected = { message ->
+            dispatchIfCurrent(stillCurrent) { callbacks.onSubmitRejected(message) }
+        },
     )
 
     private fun dispatchIfCurrent(stillCurrent: () -> Boolean, callback: () -> Unit) {

app/src/main/kotlin/com/hermesandroid/relay/network/upstream/GatewayEventMapper.kt

@@ -196,7 +196,8 @@ class GatewayEventMapper(
 
             "tool.start" -> {
                 clearActivityStatuses()
-                val name = payload.string("name") ?: "unknown"
+                val identity = payload.effectiveToolIdentity()
+                val name = identity.name
                 // A pending generating placeholder for this name is adopted
                 // (consumed FIFO) whether or not the server sent a real id.
                 val adopted = generatingIdsByName[name]?.removeFirstOrNull()
@@ -208,7 +209,7 @@ class GatewayEventMapper(
                     }
                     else -> syntheticToolId(name)
                 }
-                val argsPreview = payload?.get("args")
+                val argsPreview = identity.argsPreview ?: payload?.get("args")
                     ?.takeUnless { it is JsonPrimitive && it.contentOrNull.isNullOrBlank() }
                     ?.toString()
                     ?.takeIf { it.isNotBlank() && it != "null" }
@@ -220,7 +221,7 @@ class GatewayEventMapper(
 
             "tool.complete" -> {
                 clearActivityStatuses()
-                val name = payload.string("name") ?: "unknown"
+                val name = payload.effectiveToolIdentity().name
                 val toolId = payload.string("tool_id")
                     ?: openSyntheticIdsByName[name]?.removeFirstOrNull()
                     ?: return
@@ -279,41 +280,19 @@ class GatewayEventMapper(
 
             "error" -> {
                 turnEnded = true
-                callbacks.onError(payload.string("message") ?: "Gateway error")
+                val message = payload.string("message") ?: "Gateway error"
+                if (isSessionOwnershipRejection(message)) {
+                    callbacks.onSubmitRejected(message)
+                } else {
+                    callbacks.onError(message)
+                }
             }
 
             "subagent.spawn_requested", "subagent.start", "subagent.thinking", "subagent.tool",
             "subagent.progress", "subagent.complete",
             -> {
                 clearActivityStatuses()
-                val phase = when (type) {
-                    "subagent.spawn_requested" -> GatewaySubagentEvent.Phase.SPAWN_REQUESTED
-                    "subagent.start" -> GatewaySubagentEvent.Phase.START
-                    "subagent.thinking" -> GatewaySubagentEvent.Phase.THINKING
-                    "subagent.tool" -> GatewaySubagentEvent.Phase.TOOL
-                    "subagent.progress" -> GatewaySubagentEvent.Phase.PROGRESS
-                    else -> GatewaySubagentEvent.Phase.COMPLETE
-                }
-                callbacks.onSubagentEvent(
-                    GatewaySubagentEvent(
-                        phase = phase,
-                        taskIndex = payload.int("task_index") ?: 0,
-                        taskCount = payload.int("task_count") ?: 1,
-                        goal = payload.string("goal") ?: "",
-                        status = payload.string("status"),
-                        summary = payload.string("summary"),
-                        toolName = payload.string("tool_name"),
-                        // subagent.tool sets tool_preview AND mirrors it into
-                        // text; thinking/progress carry text only.
-                        preview = payload.string("tool_preview") ?: payload.string("text"),
-                        durationSeconds = payload.double("duration_seconds"),
-                        subagentId = payload.string("subagent_id"),
-                        childSessionId = payload.string("child_session_id"),
-                        parentId = payload.string("parent_id"),
-                        depth = payload.int("depth"),
-                        model = payload.string("model"),
-                    ),
-                )
+                parseSubagentEvent(type, payload)?.let(callbacks.onSubagentEvent)
             }
 
             "tool.output_risk" -> {
@@ -461,6 +440,42 @@ class GatewayEventMapper(
     }
 
     companion object {
+        /** Shared by turn transcripts and the session-owned activity stream. */
+        fun parseSubagentEvent(type: String, payload: JsonObject?): GatewaySubagentEvent? {
+            if (type !in setOf(
+                    "subagent.spawn_requested", "subagent.start", "subagent.thinking",
+                    "subagent.tool", "subagent.progress", "subagent.complete",
+                )) return null
+            val phase = when (type) {
+                "subagent.spawn_requested" -> GatewaySubagentEvent.Phase.SPAWN_REQUESTED
+                "subagent.start" -> GatewaySubagentEvent.Phase.START
+                "subagent.thinking" -> GatewaySubagentEvent.Phase.THINKING
+                "subagent.tool" -> GatewaySubagentEvent.Phase.TOOL
+                "subagent.progress" -> GatewaySubagentEvent.Phase.PROGRESS
+                else -> GatewaySubagentEvent.Phase.COMPLETE
+            }
+
+            return GatewaySubagentEvent(
+                phase = phase,
+                taskIndex = payload.int("task_index") ?: 0,
+                taskCount = payload.int("task_count") ?: 1,
+                goal = payload.string("goal") ?: "",
+                status = payload.string("status"),
+                summary = payload.string("summary"),
+                toolName = payload.string("tool_name"),
+                // subagent.tool sets tool_preview AND mirrors it into
+                // text; thinking/progress carry text only.
+                preview = payload.string("tool_preview") ?: payload.string("text"),
+                durationSeconds = payload.double("duration_seconds"),
+                subagentId = payload.string("subagent_id"),
+                childSessionId = payload.string("child_session_id"),
+                parentId = payload.string("parent_id"),
+                depth = payload.int("depth"),
+                model = payload.string("model"),
+                delegationId = payload.string("delegation_id"),
+            )
+        }
+
         const val PROVIDER_WAIT_STATUS_KIND = "provider_wait"
         const val COMPACTION_STATUS_KIND = "compacting"
         const val ERROR_STATUS_KIND = "error"
@@ -469,6 +484,19 @@ class GatewayEventMapper(
         private const val MAX_MOA_REFERENCE_CHARS = 16_000
         private val OUTPUT_RISK_LEVELS = setOf("low", "medium", "high", "critical")
         private val TERMINAL_EVENTS = setOf("message.complete", "error")
+
+        /**
+         * Isolated-turn paths can acknowledge `prompt.submit` and then emit
+         * the ownership refusal as a plain terminal `error` event. That event
+         * has no JSON-RPC code or structured reason, so match both stable
+         * clauses from upstream's canonical message.
+         */
+        internal fun isSessionOwnershipRejection(message: String): Boolean {
+            val normalized = message.lowercase()
+            return "already has a live owner (" in normalized &&
+                "only one surface at a time may run a session" in normalized
+        }
+
         internal fun isFailedMoaReference(text: String): Boolean {
             val normalized = text.trimStart().lowercase()
             return normalized.startsWith("[failed:") || normalized.startsWith("[skipped:")
@@ -609,6 +637,34 @@ private const val MAX_CLARIFY_CHOICES = 4
 private const val SUDO_TIMEOUT_SECONDS = 120
 private const val SECRET_TIMEOUT_SECONDS = 300
 
+private data class GatewayToolIdentity(
+    val name: String,
+    val argsPreview: String?,
+)
+
+/**
+ * Older Tool Search gateways can expose the model-visible `tool_call` bridge
+ * instead of the effective tool identity that current upstream callbacks use.
+ * Unwrap only the bridge's explicit structured `{name, arguments}` envelope;
+ * never infer a tool from prompt text or result content.
+ */
+private fun JsonObject?.effectiveToolIdentity(): GatewayToolIdentity {
+    val outerName = string("name") ?: "unknown"
+    val outerArgs = this?.get("args") as? JsonObject
+    if (outerName != "tool_call" || outerArgs == null) {
+        return GatewayToolIdentity(outerName, null)
+    }
+    val effectiveName = outerArgs.string("name")
+        ?.trim()
+        ?.takeIf { it.isNotEmpty() }
+        ?: return GatewayToolIdentity(outerName, null)
+    val effectiveArgs = outerArgs["arguments"]
+        ?.takeUnless { it is JsonPrimitive && it.contentOrNull.isNullOrBlank() }
+        ?.toString()
+        ?.takeIf { it.isNotBlank() && it != "null" }
+    return GatewayToolIdentity(effectiveName, effectiveArgs)
+}
+
 private fun JsonObject?.string(key: String): String? =
     (this?.get(key) as? JsonPrimitive)?.contentOrNull
 

app/src/main/kotlin/com/hermesandroid/relay/network/upstream/GatewayModels.kt

@@ -293,6 +293,8 @@ data class GatewaySubagentEvent(
     val depth: Int? = null,
     /** Effective child model, when the emitter exposes it. */
     val model: String? = null,
+    /** Exact delegation group id shared with persisted async completion metadata. */
+    val delegationId: String? = null,
 ) {
     enum class Phase { SPAWN_REQUESTED, START, THINKING, TOOL, PROGRESS, COMPLETE }
 }
@@ -741,6 +743,12 @@ class GatewayTurnCallbacks(
     val onNoticeShow: (GatewayAgentNotice) -> Unit = { _ -> },
     /** Exact-key dismissal for an upstream notice. */
     val onNoticeClear: (key: String) -> Unit = { _ -> },
+    /**
+     * The Gateway authoritatively refused `prompt.submit` before a model turn
+     * began. The composed user row remains local and retryable; callers must
+     * not treat this as a dropped stream or reconcile it from history.
+     */
+    val onSubmitRejected: (String) -> Unit = onError,
 )
 
 /**

app/src/main/kotlin/com/hermesandroid/relay/network/upstream/HermesApiClient.kt

@@ -726,10 +726,10 @@ class HermesApiClient(
 
     suspend fun getMessages(
         sessionId: String,
-        mode: SessionMessageLoadMode = SessionMessageLoadMode.COMPLETE,
+        mode: SessionMessageLoadMode = SessionMessageLoadMode.LATEST,
     ): List<MessageItem> = withContext(Dispatchers.IO) {
         loadSessionMessages(mode) { page ->
-            runCatching {
+            try {
                 val url = "$baseUrl/api/sessions/$sessionId/messages".toHttpUrlOrNull()
                     ?.newBuilder()
                     ?.addQueryParameter("limit", page.limit.toString())
@@ -740,14 +740,20 @@ class HermesApiClient(
                 val request = authRequest(url.toString()).get().build()
                 client.newCall(request).execute().use { response ->
                     if (!response.isSuccessful) error("HTTP ${response.code}")
-                    val body = response.body?.string() ?: error("empty response body")
+                    val body = response.body.readUtf8Bounded(
+                        DashboardApiClient.MAX_JSON_RESPONSE_BYTES,
+                    )
                     val parsed = json.decodeFromString<MessageListResponse>(body)
                     SessionMessagePage(
                         messages = parsed.data ?: parsed.items ?: parsed.messages ?: emptyList(),
                         pagination = parsed.pagination,
                         payloadChars = body.length,
                     )
-                }
+                }.let { Result.success(it) }
+            } catch (error: CancellationException) {
+                throw error
+            } catch (error: Exception) {
+                Result.failure(error)
             }
         }.getOrElse { error ->
             if (error is CancellationException) throw error

app/src/main/kotlin/com/hermesandroid/relay/network/upstream/SessionMessagePagination.kt

@@ -72,7 +72,7 @@ internal suspend fun loadSessionMessages(
         Result.success(collected)
     } catch (error: CancellationException) {
         throw error
-    } catch (error: Throwable) {
+    } catch (error: Exception) {
         Result.failure(error)
     }
 }

app/src/main/kotlin/com/hermesandroid/relay/network/upstream/StandardHermesVoiceClient.kt

@@ -195,7 +195,7 @@ class StandardHermesVoiceClient(
                 .let { Result.success<VoiceSpeechStream?>(it) }
         } catch (cancelled: CancellationException) {
             throw cancelled
-        } catch (error: Throwable) {
+        } catch (error: Exception) {
             Result.failure(error)
         }
     }
@@ -222,7 +222,9 @@ class StandardHermesVoiceClient(
                 if (!response.isSuccessful) {
                     return Result.failure(apiFailure(response, operation))
                 }
-                val body = response.body.string()
+                val body = response.body.readUtf8Bounded(
+                    DashboardApiClient.MAX_JSON_RESPONSE_BYTES,
+                )
                 if (body.isBlank()) {
                     return Result.failure(IOException("$operation returned an empty response"))
                 }
@@ -245,7 +247,11 @@ class StandardHermesVoiceClient(
     }
 
     private fun apiFailure(response: Response, operation: String): IOException {
-        val body = runCatching { response.body.string() }.getOrDefault("")
+        val body = try {
+            response.body.readUtf8Bounded(4L * 1024L)
+        } catch (_: Exception) {
+            ""
+        }
         val detail = body.takeIf { it.isNotBlank() } ?: response.message
         val message = when (response.code) {
             400 -> "$operation rejected that input - ${detail.ifBlank { "bad request" }}"

app/src/main/kotlin/com/hermesandroid/relay/ui/RelayApp.kt

@@ -36,7 +36,7 @@ import androidx.compose.material.icons.filled.Settings
 import androidx.compose.material3.MaterialTheme
 import androidx.compose.material3.Scaffold
 import androidx.compose.material3.SnackbarDuration
-import androidx.compose.material3.SnackbarHost
+import com.hermesandroid.relay.ui.components.ThemedMessageHost
 import androidx.compose.material3.SnackbarHostState
 import androidx.compose.material3.SnackbarResult
 import androidx.compose.material3.Surface
@@ -117,6 +117,7 @@ import com.hermesandroid.relay.ui.components.pet.PetSafeAreaRegistry
 import com.hermesandroid.relay.ui.components.pet.petPerchSurface
 import com.hermesandroid.relay.ui.components.pet.platformModalOwnsPetLayer
 import com.hermesandroid.relay.ui.components.ConnectionSwitcherSheet
+import com.hermesandroid.relay.ui.components.ChatMediaViewerHost
 import com.hermesandroid.relay.ui.components.ChatTransportStatusBadge
 import com.hermesandroid.relay.ui.components.ChatTransportTier
 import com.hermesandroid.relay.ui.components.ConnectionSecurityGlyph
@@ -229,11 +230,7 @@ val LocalSnackbarHost = staticCompositionLocalOf<SnackbarHostState> {
 // Short-lived snackbar by default; retryable errors get Long so users have
 // time to tap the action before it auto-dismisses.
 suspend fun SnackbarHostState.showHumanError(err: HumanError): SnackbarResult {
-    return showSnackbar(
-        message = err.body,
-        actionLabel = err.actionLabel,
-        duration = if (err.retryable) SnackbarDuration.Long else SnackbarDuration.Short,
-    )
+    return showSnackbar(com.hermesandroid.relay.ui.components.HumanErrorVisuals(err))
 }
 
 /** Startup chrome should wait for either standard chat surface, not Relay. */
@@ -1951,6 +1948,8 @@ fun RelayApp() {
         // child TopAppBar doesn't double-pad when this banner owns the top edge.
         val activeMessageCount by UiMessageBus.activeCount.collectAsState()
         val showMessageBanner = activeMessageCount > 0
+        val modalMessageHostActive by UiMessageBus.modalHostActive.collectAsState()
+        val showActionMessage = snackbarHostState.currentSnackbarData != null && !modalMessageHostActive
         // Update availability (unified): googlePlay = Play In-App Update FLEXIBLE,
         // sideload = GitHub releases. The handle filters dismissed versions +
         // throttles checks internally, exposing a surfaceable status for the
@@ -2076,6 +2075,14 @@ fun RelayApp() {
             includeStatusBarPadding =
                 !showUnattendedBanner && !showDemoBanner && !showHostResourcePressure,
         )
+        // Action feedback owns layout space at the top, never the composer's
+        // touch area. Modal windows keep their own scoped host.
+        ThemedMessageHost(
+            snackbarHostState,
+            modifier = if (showActionMessage && !showMessageBanner &&
+                !showUnattendedBanner && !showDemoBanner && !showHostResourcePressure
+            ) Modifier.windowInsetsPadding(WindowInsets.statusBars) else Modifier,
+        )
 
         // The update banner AND the connection-status indicator now render as
         // floating overlay TOASTS in the Box below (see the top-overlay Column
@@ -2116,7 +2123,7 @@ fun RelayApp() {
                     // participates in the top-inset accounting.
                     if (showUnattendedBanner || showDemoBanner || showHostResourcePressure ||
                         connectionChipVisible ||
-                        showMessageBanner
+                        showMessageBanner || showActionMessage
                     ) {
                         Modifier.consumeWindowInsets(WindowInsets.statusBars)
                     } else {
@@ -2124,7 +2131,6 @@ fun RelayApp() {
                     }
                 ),
             contentWindowInsets = WindowInsets(0),
-            snackbarHost = { SnackbarHost(snackbarHostState) },
             bottomBar = {
                 if (
                     !suppressGlobalChrome &&
@@ -2211,7 +2217,10 @@ fun RelayApp() {
                 }
             }
         ) { innerPadding ->
-            CompositionLocalProvider(LocalSnackbarHost provides snackbarHostState) {
+            CompositionLocalProvider(
+                LocalSnackbarHost provides snackbarHostState,
+                com.hermesandroid.relay.ui.components.LocalMessageActionHost provides snackbarHostState,
+            ) {
             Column(
                 modifier = Modifier
                     .fillMaxSize()
@@ -2475,103 +2484,110 @@ fun RelayApp() {
 
                     val screenChatLabel = stringResource(R.string.screen_chat_label)
 
-                    ChatScreen(
-                        chatViewModel = chatViewModel,
-                        connectionViewModel = connectionViewModel,
-                        voiceViewModel = voiceViewModel,
-                        voiceClient = voiceClient,
-                        maxBubbleWidth = maxBubbleWidth,
-                        voicePresentationMode = voicePresentationMode,
-                        onVoicePresentationModeChange = { mode ->
-                            connectionSwitchScope.launch {
-                                voicePreferences.setPresentationMode(mode)
-                            }
-                        },
-                        openAgentSheetOnEntry = openAgentSheetArg,
-                        onAgentSheetArgConsumed = {
-                            backStackEntry.arguments?.putBoolean(
-                                Screen.Chat.ARG_OPEN_AGENT_SHEET, false,
-                            )
-                        },
-                        // AgentInfoSheet footer jumps straight into the full
-                        // Connections CRUD screen — saves a detour through
-                        // Settings → Gateways.
-                        onNavigateToConnections = {
-                            navController.navigate(Screen.ConnectionsSettings.route)
-                        },
-                        onNavigateToConnect = {
-                            navController.navigate(Screen.Pair.route()) {
-                                launchSingleTop = true
-                            }
-                        },
-                        onRepairConnection = {
-                            navController.navigate(
-                                Screen.Pair.route(
-                                    connectionId = activeConnectionId,
-                                    autoStart = "relay",
-                                ),
-                            ) {
-                                launchSingleTop = true
-                            }
-                        },
-                        // Empty-chat "needs connection" card also offers the offline
-                        // demo, so a skipped / never-connected first run can explore
-                        // without leaving Chat. Safe here — this state only shows when
-                        // nothing is configured, so there's no placeholder in flight.
-                        onTryDemo = enterDemo,
-                        onNavigateToDashboardSignIn = {
-                            navController.navigate(Screen.DashboardSignIn.route()) {
-                                launchSingleTop = true
-                            }
-                        },
-                        onNavigateToBridge = {
-                            rememberBridgeReturn(
-                                route = Screen.Chat.route(openAgentSheet = false),
-                                label = screenChatLabel,
-                            )
-                            navController.navigate(Screen.Bridge.route) {
-                                popUpTo(navController.graph.findStartDestination().id) {
-                                    saveState = true
+                    ChatMediaViewerHost(
+                        activeConnectionId,
+                        effectiveSessionProfileName,
+                        currentChatSessionId,
+                        chatSupervisedPolicy,
+                    ) {
+                        ChatScreen(
+                            chatViewModel = chatViewModel,
+                            connectionViewModel = connectionViewModel,
+                            voiceViewModel = voiceViewModel,
+                            voiceClient = voiceClient,
+                            maxBubbleWidth = maxBubbleWidth,
+                            voicePresentationMode = voicePresentationMode,
+                            onVoicePresentationModeChange = { mode ->
+                                connectionSwitchScope.launch {
+                                    voicePreferences.setPresentationMode(mode)
                                 }
-                                launchSingleTop = true
-                                restoreState = true
-                            }
-                        },
-                        onNavigateToTerminal = {
-                            navController.navigate(Screen.Terminal.route) {
-                                launchSingleTop = true
-                            }
-                        },
-                        onNavigateToSettings = {
-                            navController.navigate(Screen.Settings.route) {
-                                launchSingleTop = true
-                            }
-                        },
-                        onNavigateToAppearanceSettings = {
-                            navController.navigate(Screen.AppearanceSettings.route) {
-                                launchSingleTop = true
-                            }
-                        },
-                        onNavigateToVoiceSettings = {
-                            navController.navigate(Screen.VoiceSettings.route) {
-                                launchSingleTop = true
-                            }
-                        },
-                        onNavigateToProfileInspector = { profileName ->
-                            navController.navigate(Screen.ProfileInspector.route(profileName)) {
-                                launchSingleTop = true
-                            }
-                        },
-                        supervisedPolicy = chatSupervisedPolicy,
-                        onNavigateToBotMode = {
-                            navController.navigate(Screen.BotMode.route) { launchSingleTop = true }
-                        },
-                        gitWorkspaceAvailable = gitWorkspaceAvailable,
-                        gitWorkspaceSummary = gitWorkspaceSummary,
-                        onNavigateToGitWorkspace = {
-                            navController.navigate(Screen.GitState.route) { launchSingleTop = true }
-                        },
-                    )
+                            },
+                            openAgentSheetOnEntry = openAgentSheetArg,
+                            onAgentSheetArgConsumed = {
+                                backStackEntry.arguments?.putBoolean(
+                                    Screen.Chat.ARG_OPEN_AGENT_SHEET, false,
+                                )
+                            },
+                            // AgentInfoSheet footer jumps straight into the full
+                            // Connections CRUD screen — saves a detour through
+                            // Settings → Gateways.
+                            onNavigateToConnections = {
+                                navController.navigate(Screen.ConnectionsSettings.route)
+                            },
+                            onNavigateToConnect = {
+                                navController.navigate(Screen.Pair.route()) {
+                                    launchSingleTop = true
+                                }
+                            },
+                            onRepairConnection = {
+                                navController.navigate(
+                                    Screen.Pair.route(
+                                        connectionId = activeConnectionId,
+                                        autoStart = "relay",
+                                    ),
+                                ) {
+                                    launchSingleTop = true
+                                }
+                            },
+                            // Empty-chat "needs connection" card also offers the offline
+                            // demo, so a skipped / never-connected first run can explore
+                            // without leaving Chat. Safe here — this state only shows when
+                            // nothing is configured, so there's no placeholder in flight.
+                            onTryDemo = enterDemo,
+                            onNavigateToDashboardSignIn = {
+                                navController.navigate(Screen.DashboardSignIn.route()) {
+                                    launchSingleTop = true
+                                }
+                            },
+                            onNavigateToBridge = {
+                                rememberBridgeReturn(
+                                    route = Screen.Chat.route(openAgentSheet = false),
+                                    label = screenChatLabel,
+                                )
+                                navController.navigate(Screen.Bridge.route) {
+                                    popUpTo(navController.graph.findStartDestination().id) {
+                                        saveState = true
+                                    }
+                                    launchSingleTop = true
+                                    restoreState = true
+                                }
+                            },
+                            onNavigateToTerminal = {
+                                navController.navigate(Screen.Terminal.route) {
+                                    launchSingleTop = true
+                                }
+                            },
+                            onNavigateToSettings = {
+                                navController.navigate(Screen.Settings.route) {
+                                    launchSingleTop = true
+                                }
+                            },
+                            onNavigateToAppearanceSettings = {
+                                navController.navigate(Screen.AppearanceSettings.route) {
+                                    launchSingleTop = true
+                                }
+                            },
+                            onNavigateToVoiceSettings = {
+                                navController.navigate(Screen.VoiceSettings.route) {
+                                    launchSingleTop = true
+                                }
+                            },
+                            onNavigateToProfileInspector = { profileName ->
+                                navController.navigate(Screen.ProfileInspector.route(profileName)) {
+                                    launchSingleTop = true
+                                }
+                            },
+                            supervisedPolicy = chatSupervisedPolicy,
+                            onNavigateToBotMode = {
+                                navController.navigate(Screen.BotMode.route) { launchSingleTop = true }
+                            },
+                            gitWorkspaceAvailable = gitWorkspaceAvailable,
+                            gitWorkspaceSummary = gitWorkspaceSummary,
+                            onNavigateToGitWorkspace = {
+                                navController.navigate(Screen.GitState.route) { launchSingleTop = true }
+                            },
+                        )
+                    }
                 }
                 composable(Screen.BotMode.route) {
                     BotModeScreen(

app/src/main/kotlin/com/hermesandroid/relay/ui/UiMessageBus.kt

@@ -9,7 +9,7 @@ import kotlinx.coroutines.flow.asStateFlow
 import java.util.concurrent.atomic.AtomicLong
 
 /** Visual tone of a transient banner message. */
-enum class UiMessageSeverity { Info, Success, Status, Warning }
+enum class UiMessageSeverity { Info, Success, Status, Warning, Error }
 
 data class UiMessage(
     val id: Long,
@@ -23,6 +23,7 @@ data class UiMessage(
 sealed interface UiMessageEvent {
     data class Show(val message: UiMessage) : UiMessageEvent
     data class Clear(val key: String) : UiMessageEvent
+    data object ClearAll : UiMessageEvent
 }
 
 internal fun reduceUiMessages(
@@ -30,6 +31,7 @@ internal fun reduceUiMessages(
     event: UiMessageEvent,
     maxRetained: Int,
 ): List<UiMessage> = when (event) {
+    UiMessageEvent.ClearAll -> emptyList()
     is UiMessageEvent.Clear -> current.filterNot { it.key == event.key }
     is UiMessageEvent.Show -> {
         val incoming = event.message
@@ -41,15 +43,14 @@ internal fun reduceUiMessages(
 }
 
 /**
- * App-wide bus for transient, non-error status/confirmation messages that
+ * App-wide bus for transient status, confirmation, and error messages that
  * surface in the top [com.hermesandroid.relay.ui.components.MessageBannerHost]
  * — a thin banner that takes its own space (content slides down, no overlay),
  * shows the newest line collapsed, expands to a few recent lines, auto-dismisses
  * and coalesces duplicates.
  *
- * App-owned errors and persistent/actionable messages keep going to the
- * snackbar so they demand acknowledgement. Upstream keyed AgentNotices may use
- * the warning tone here because their own sticky/clear lifecycle owns them.
+ * Messages requiring Retry or Undo use ThemedMessageHost and retain their
+ * action-result contract. Upstream keyed AgentNotices own their sticky/clear lifecycle.
  * Migrate frequent
  * `snackbarHostState.showSnackbar("…")` confirmations/status to [info] /
  * [success] / [status] here.
@@ -62,6 +63,23 @@ object UiMessageBus {
     const val STATUS_TTL_MS = 6_000L
 
     private val counter = AtomicLong(0L)
+    private val hosts = linkedMapOf<Long, Boolean>()
+    private val _activeHost = MutableStateFlow<Long?>(null)
+    internal val activeHost = _activeHost.asStateFlow()
+    private val _modalHostActive = MutableStateFlow(false)
+    internal val modalHostActive = _modalHostActive.asStateFlow()
+    internal fun registerHost(primary: Boolean): Long = synchronized(hosts) {
+        counter.incrementAndGet().also {
+            hosts[it] = primary
+            _activeHost.value = hosts.keys.lastOrNull()
+            _modalHostActive.value = hosts.values.any { primaryHost -> !primaryHost }
+        }
+    }
+    internal fun unregisterHost(id: Long) { synchronized(hosts) {
+        hosts.remove(id)
+        _activeHost.value = hosts.keys.lastOrNull()
+        _modalHostActive.value = hosts.values.any { !it }
+    } }
     private val _events = MutableSharedFlow<UiMessageEvent>(extraBufferCapacity = 24)
     val events: SharedFlow<UiMessageEvent> = _events.asSharedFlow()
 
@@ -97,6 +115,11 @@ object UiMessageBus {
         key.trim().takeIf(String::isNotEmpty)?.let { _events.tryEmit(UiMessageEvent.Clear(it)) }
     }
 
+    fun clearAll() { _events.tryEmit(UiMessageEvent.ClearAll) }
+
+    fun warning(text: String, ttlMillis: Long = STATUS_TTL_MS) = post(text, UiMessageSeverity.Warning, ttlMillis)
+    fun error(text: String, ttlMillis: Long = 10_000L) = post(text, UiMessageSeverity.Error, ttlMillis)
+
     /** Neutral confirmation/info (e.g. "Pairing code copied"). */
     fun info(text: String, ttlMillis: Long = DEFAULT_TTL_MS) =
         post(text, UiMessageSeverity.Info, ttlMillis)

app/src/main/kotlin/com/hermesandroid/relay/ui/components/ActiveConnectionSections.kt

@@ -1,6 +1,6 @@
 package com.hermesandroid.relay.ui.components
 
-import android.widget.Toast
+import com.hermesandroid.relay.ui.UiMessageBus
 import androidx.compose.foundation.BorderStroke
 import androidx.compose.foundation.background
 import androidx.compose.foundation.clickable
@@ -209,7 +209,7 @@ fun ActiveCardRelayStatusSection(
     val relayUiState by connectionViewModel.relayUiState.collectAsState()
     val relayRowState by connectionViewModel.relayRowState.collectAsState()
 
-    // Pre-resolve strings for Toast (non-composable context)
+    // Pre-resolve strings for action callbacks (non-composable context).
     val reconnectingRelayToast = stringResource(R.string.active_section_reconnecting_relay)
     val relayStatusText = when (relayRowState.phase) {
         RelayUiState.NotConfigured -> stringResource(R.string.relay_state_optional)
@@ -250,11 +250,7 @@ fun ActiveCardRelayStatusSection(
         onClick = {
             if (relayUiState == RelayUiState.Stale) {
                 connectionViewModel.reconnectIfStale()
-                Toast.makeText(
-                    context,
-                    reconnectingRelayToast,
-                    Toast.LENGTH_SHORT,
-                ).show()
+                UiMessageBus.status(reconnectingRelayToast)
             } else {
                 onOpenRelayInfo()
             }
@@ -817,7 +813,7 @@ private fun ManualUrlSubsection(
     }
     val autoRelayUrl = RelayUrlDeriver.deriveFromApiUrl(apiUrlInput)
 
-    // Pre-resolve strings for Toast (non-composable context)
+    // Pre-resolve strings for action callbacks (non-composable context).
     val apiHermesVoiceReachableToast = stringResource(R.string.active_section_api_hermes_voice_reachable)
     val apiRelayVoiceReachableToast = stringResource(R.string.active_section_api_relay_voice_reachable)
     val apiReachableVoiceReviewToast = stringResource(R.string.active_section_api_reachable_voice_review)
@@ -926,21 +922,21 @@ private fun ManualUrlSubsection(
                         relayOverrideVisible = true
                         result.relayUrl?.let { relayUrlInput = it }
                     }
-                    Toast.makeText(
-                        context,
-                        when {
-                            result.apiReachable && result.voiceConfigReachable ->
-                                if (result.voiceRoute == "standard") {
-                                    apiHermesVoiceReachableToast
-                                } else {
-                                    apiRelayVoiceReachableToast
-                                }
-                            result.apiReachable ->
-                                apiReachableVoiceReviewToast
-                            else -> cannotReachApiToast
-                        },
-                        Toast.LENGTH_SHORT,
-                    ).show()
+                    val feedback = when {
+                        result.apiReachable && result.voiceConfigReachable ->
+                            if (result.voiceRoute == "standard") {
+                                apiHermesVoiceReachableToast
+                            } else {
+                                apiRelayVoiceReachableToast
+                            }
+                        result.apiReachable -> apiReachableVoiceReviewToast
+                        else -> cannotReachApiToast
+                    }
+                    when {
+                        result.apiReachable && result.voiceConfigReachable -> UiMessageBus.success(feedback)
+                        result.apiReachable -> UiMessageBus.warning(feedback)
+                        else -> UiMessageBus.error(feedback)
+                    }
                 }
             },
             enabled = apiUrlInput.isNotBlank() && !isTestingApi && inputApiKeyError == null,

app/src/main/kotlin/com/hermesandroid/relay/ui/components/AttachmentGallery.kt

@@ -31,6 +31,7 @@ import androidx.compose.runtime.mutableStateMapOf
 import androidx.compose.runtime.mutableStateOf
 import androidx.compose.runtime.remember
 import androidx.compose.runtime.rememberCoroutineScope
+import androidx.compose.runtime.saveable.rememberSaveable
 import androidx.compose.runtime.setValue
 import androidx.compose.ui.Alignment
 import androidx.compose.ui.Modifier
@@ -128,10 +129,11 @@ fun AttachmentGallery(
     val exportAllowed = LocalImageExportAllowed.current
     val scope = rememberCoroutineScope()
     val blurMode = LocalMediaBlurMode.current
+    val viewerController = LocalChatMediaViewerController.current
     val revealed = remember { mutableStateMapOf<String, Boolean>() }
-    var viewerStartIndex by remember { mutableStateOf<Int?>(null) }
+    var viewerStartIndex by rememberSaveable { mutableStateOf<Int?>(null) }
 
-    viewerStartIndex?.let { startIndex ->
+    viewerStartIndex?.takeIf { viewerController == null }?.let { startIndex ->
         AttachmentGalleryViewer(
             attachments = attachments,
             initialIndex = startIndex.coerceIn(attachments.indices),
@@ -184,7 +186,21 @@ fun AttachmentGallery(
                                     .testTag("attachment-gallery-tile-$galleryIndex")
                                     .clip(RoundedCornerShape(GALLERY_CORNER))
                                     .combinedClickable(
-                                        onClick = { viewerStartIndex = galleryIndex },
+                                        onClick = {
+                                            if (viewerController != null) {
+                                                viewerController.openGallery(
+                                                    attachments = attachments,
+                                                    initialIndex = galleryIndex,
+                                                    initiallyRevealedKeys = revealed
+                                                        .filterValues { it }
+                                                        .keys,
+                                                    blurMode = blurMode,
+                                                    exportAllowed = exportAllowed,
+                                                )
+                                            } else {
+                                                viewerStartIndex = galleryIndex
+                                            }
+                                        },
                                         onLongClick = { menuExpanded = true },
                                     ),
                             )

app/src/main/kotlin/com/hermesandroid/relay/ui/components/AttachmentViewer.kt

@@ -9,8 +9,7 @@ import android.media.audiofx.Visualizer
 import android.net.Uri
 import android.os.Build
 import android.os.ParcelFileDescriptor
-import android.view.SurfaceView
-import android.widget.Toast
+import com.hermesandroid.relay.ui.UiMessageBus
 import androidx.annotation.OptIn
 import androidx.compose.foundation.Image
 import androidx.compose.foundation.background
@@ -63,10 +62,12 @@ import androidx.compose.runtime.Composable
 import androidx.compose.runtime.DisposableEffect
 import androidx.compose.runtime.LaunchedEffect
 import androidx.compose.runtime.getValue
+import androidx.compose.runtime.mutableLongStateOf
 import androidx.compose.runtime.mutableStateMapOf
 import androidx.compose.runtime.mutableStateOf
 import androidx.compose.runtime.remember
 import androidx.compose.runtime.rememberCoroutineScope
+import androidx.compose.runtime.saveable.rememberSaveable
 import androidx.compose.runtime.setValue
 import androidx.compose.runtime.staticCompositionLocalOf
 import androidx.compose.ui.Alignment
@@ -86,13 +87,13 @@ import androidx.compose.ui.platform.testTag
 import androidx.compose.ui.text.font.FontFamily
 import androidx.compose.ui.unit.dp
 import androidx.compose.ui.unit.IntSize
-import androidx.compose.ui.viewinterop.AndroidView
 import androidx.compose.ui.window.Dialog
 import androidx.compose.ui.window.DialogProperties
 import androidx.media3.common.MediaItem
 import androidx.media3.common.Player
 import androidx.media3.common.util.UnstableApi
 import androidx.media3.exoplayer.ExoPlayer
+import androidx.media3.ui.compose.ContentFrame
 import coil3.compose.AsyncImage
 import com.hermesandroid.relay.data.Attachment
 import com.hermesandroid.relay.data.AttachmentRenderMode
@@ -290,7 +291,7 @@ fun Modifier.zoomable(maxScale: Float = 6f): Modifier {
  * Dispatches on [Attachment.renderMode]:
  *  - IMAGE → zoomable image (Coil from the cached URI, or a decoded bitmap),
  *            honoring the sensitive blur gate.
- *  - VIDEO → ExoPlayer on a hand-wired [SurfaceView] with transport controls.
+ *  - VIDEO → ExoPlayer through Media3's lifecycle-aware Compose content frame.
  *  - AUDIO → ExoPlayer mini-player with scrubber + a Visualizer amplitude meter.
  *  - PDF   → [PdfRenderer] paginated pages in a LazyColumn.
  *  - TEXT  → in-app monospace text viewer.
@@ -311,109 +312,112 @@ fun AttachmentViewer(
         onDismissRequest = onDismiss,
         properties = DialogProperties(usePlatformDefaultWidth = false),
     ) {
-        val context = LocalContext.current
-        val exportAllowed = LocalImageExportAllowed.current ||
-            attachment.renderMode != AttachmentRenderMode.IMAGE
-        AllowDeviceRotation()
-        val scope = rememberCoroutineScope()
-        var busy by remember { mutableStateOf(false) }
+        MessageOverlayScope {
+            val context = LocalContext.current
+            val exportAllowed = LocalImageExportAllowed.current ||
+                attachment.renderMode != AttachmentRenderMode.IMAGE
+            AllowDeviceRotation()
+            val scope = rememberCoroutineScope()
+            var busy by remember { mutableStateOf(false) }
 
-        val blurMode = LocalMediaBlurMode.current
-        var revealed by remember(attachment.cachedUri, attachment.relayToken) {
-            mutableStateOf(initiallyRevealed)
-        }
-        val blurred = !revealed &&
-            attachment.renderMode == AttachmentRenderMode.IMAGE &&
-            shouldBlurImage(blurMode, attachment.sensitive)
-
-        val title = attachment.fileName
-            ?: attachment.contentType.substringBefore(';').ifBlank { stringResource(R.string.attachment_title) }
-
-        // --- One shared Share / Save / Open-externally action set ----------
-        fun runWithBytes(action: suspend (ByteArray) -> Unit) {
-            scope.launch {
-                busy = true
-                val bytes = attachmentBytes(context, attachment)
-                if (bytes == null) {
-                    busy = false
-                    viewerToast(context, context.getString(R.string.inbound_attach_share_failed))
-                    return@launch
-                }
-                action(bytes)
-                busy = false
+            val blurMode = LocalMediaBlurMode.current
+            var revealed by remember(attachment.cachedUri, attachment.relayToken) {
+                mutableStateOf(initiallyRevealed)
             }
-        }
+            val blurred = !revealed &&
+                attachment.renderMode == AttachmentRenderMode.IMAGE &&
+                shouldBlurImage(blurMode, attachment.sensitive)
 
-        val onShare = {
-            runWithBytes { bytes ->
-                val uri = MediaSaver.stageForShare(context, bytes, attachment.fileName, attachment.contentType)
-                MediaSaver.share(context, uri, attachment.contentType)
-            }
-        }
-        val onSave = {
-            runWithBytes { bytes ->
-                val result = if (attachment.renderMode == AttachmentRenderMode.IMAGE) {
-                    MediaSaver.saveImage(context, bytes, attachment.fileName, attachment.contentType)
-                } else {
-                    MediaSaver.saveFile(context, bytes, attachment.fileName, attachment.contentType)
-                }
-                when (result) {
-                    is MediaSaver.SaveResult.Saved ->
-                        viewerToast(context, context.getString(R.string.inbound_attach_saved, result.location))
-                    MediaSaver.SaveResult.UseShareInstead -> {
-                        val uri = MediaSaver.stageForShare(context, bytes, attachment.fileName, attachment.contentType)
-                        MediaSaver.share(context, uri, attachment.contentType)
+            val title = attachment.fileName
+                ?: attachment.contentType.substringBefore(';').ifBlank { stringResource(R.string.attachment_title) }
+
+            // --- One shared Share / Save / Open-externally action set ----------
+            fun runWithBytes(action: suspend (ByteArray) -> Unit) {
+                scope.launch {
+                    busy = true
+                    val bytes = attachmentBytes(context, attachment)
+                    if (bytes == null) {
+                        busy = false
+                        UiMessageBus.error(context.getString(R.string.inbound_attach_share_failed))
+                        return@launch
                     }
-                    is MediaSaver.SaveResult.Failed ->
-                        viewerToast(context, context.getString(R.string.inbound_attach_save_failed, result.message))
+                    action(bytes)
+                    busy = false
                 }
             }
-        }
-        val onOpenExternal = {
-            val cached = attachment.cachedUri
-            if (!cached.isNullOrBlank()) {
-                MediaSaver.open(context, Uri.parse(cached), attachment.contentType)
-            } else {
+
+            val onShare = {
                 runWithBytes { bytes ->
                     val uri = MediaSaver.stageForShare(context, bytes, attachment.fileName, attachment.contentType)
-                    MediaSaver.open(context, uri, attachment.contentType)
+                    MediaSaver.share(context, uri, attachment.contentType)
                 }
             }
-        }
-
-        Box(
-            modifier = modifier
-                .fillMaxSize()
-                .background(Color.Black.copy(alpha = 0.96f)),
-        ) {
-            // Body fills; toolbar floats on top. PDF/TEXT add their own top
-            // inset so the first line clears the toolbar.
-            Box(modifier = Modifier.fillMaxSize(), contentAlignment = Alignment.Center) {
-                when (attachment.renderMode) {
-                    AttachmentRenderMode.IMAGE -> ImageBody(
-                        attachment = attachment,
-                        blurred = blurred,
-                        onReveal = { revealed = true },
-                    )
-                    AttachmentRenderMode.VIDEO -> VideoBody(attachment)
-                    AttachmentRenderMode.AUDIO -> AudioBody(attachment)
-                    AttachmentRenderMode.PDF -> PdfBody(attachment)
-                    AttachmentRenderMode.TEXT -> TextBody(attachment)
-                    AttachmentRenderMode.GENERIC -> GenericBody(attachment, onOpenExternal)
+            val onSave = {
+                runWithBytes { bytes ->
+                    val result = if (attachment.renderMode == AttachmentRenderMode.IMAGE) {
+                        MediaSaver.saveImage(context, bytes, attachment.fileName, attachment.contentType)
+                    } else {
+                        MediaSaver.saveFile(context, bytes, attachment.fileName, attachment.contentType)
+                    }
+                    when (result) {
+                        is MediaSaver.SaveResult.Saved ->
+                            UiMessageBus.success(context.getString(R.string.inbound_attach_saved, result.location))
+                        MediaSaver.SaveResult.UseShareInstead -> {
+                            val uri = MediaSaver.stageForShare(context, bytes, attachment.fileName, attachment.contentType)
+                            MediaSaver.share(context, uri, attachment.contentType)
+                        }
+                        is MediaSaver.SaveResult.Failed ->
+                            UiMessageBus.error(context.getString(R.string.inbound_attach_save_failed, result.message))
+                    }
+                }
+            }
+            val onOpenExternal = {
+                val cached = attachment.cachedUri
+                if (!cached.isNullOrBlank()) {
+                    MediaSaver.open(context, Uri.parse(cached), attachment.contentType)
+                } else {
+                    runWithBytes { bytes ->
+                        val uri = MediaSaver.stageForShare(context, bytes, attachment.fileName, attachment.contentType)
+                        MediaSaver.open(context, uri, attachment.contentType)
+                    }
                 }
             }
 
-            MediaViewerToolbar(
-                title = title,
-                busy = busy,
-                actionsEnabled = !blurred,
-                exportAllowed = exportAllowed,
-                onShare = onShare,
-                onSave = onSave,
-                onOpenExternal = onOpenExternal,
-                onClose = onDismiss,
-                modifier = Modifier.align(Alignment.TopCenter),
-            )
+            Box(
+                modifier = modifier
+                    .fillMaxSize()
+                    .background(Color.Black.copy(alpha = 0.96f))
+                    .testTag("attachment-viewer"),
+            ) {
+                // Body fills; toolbar floats on top. PDF/TEXT add their own top
+                // inset so the first line clears the toolbar.
+                Box(modifier = Modifier.fillMaxSize(), contentAlignment = Alignment.Center) {
+                    when (attachment.renderMode) {
+                        AttachmentRenderMode.IMAGE -> ImageBody(
+                            attachment = attachment,
+                            blurred = blurred,
+                            onReveal = { revealed = true },
+                        )
+                        AttachmentRenderMode.VIDEO -> VideoBody(attachment)
+                        AttachmentRenderMode.AUDIO -> AudioBody(attachment)
+                        AttachmentRenderMode.PDF -> PdfBody(attachment)
+                        AttachmentRenderMode.TEXT -> TextBody(attachment)
+                        AttachmentRenderMode.GENERIC -> GenericBody(attachment, onOpenExternal)
+                    }
+                }
+
+                MediaViewerToolbar(
+                    title = title,
+                    busy = busy,
+                    actionsEnabled = !blurred,
+                    exportAllowed = exportAllowed,
+                    onShare = onShare,
+                    onSave = onSave,
+                    onOpenExternal = onOpenExternal,
+                    onClose = onDismiss,
+                    modifier = Modifier.align(Alignment.TopCenter),
+                )
+            }
         }
     }
 }
@@ -450,164 +454,165 @@ internal fun AttachmentGalleryViewer(
         onDismissRequest = onDismiss,
         properties = DialogProperties(usePlatformDefaultWidth = false),
     ) {
-        val context = LocalContext.current
-        val exportAllowed = LocalImageExportAllowed.current
-        AllowDeviceRotation()
-        val scope = rememberCoroutineScope()
-        var busy by remember { mutableStateOf(false) }
-        val revealed = remember { mutableStateMapOf<String, Boolean>() }
-        LaunchedEffect(initiallyRevealedKeys) {
-            initiallyRevealedKeys.forEach { revealed[it] = true }
-        }
-        val pagerState = rememberPagerState(
-            initialPage = initialIndex.coerceIn(attachments.indices),
-            pageCount = { attachments.size },
-        )
-
-        val currentIndex = pagerState.currentPage.coerceIn(attachments.indices)
-        val attachment = attachments[currentIndex]
-        val currentKey = galleryAttachmentKey(attachment, currentIndex)
-        val blurMode = LocalMediaBlurMode.current
-        val currentBlurred = revealed[currentKey] != true &&
-            shouldBlurImage(blurMode, attachment.sensitive)
-        val title = attachment.fileName
-            ?: attachment.contentType.substringBefore(';').ifBlank { "Image" }
-        val toolbarTitle = "$title · ${currentIndex + 1} of ${attachments.size}"
-
-        // Capture the currently visible attachment in each click lambda. A
-        // swipe while IO is running must not redirect Save/Share to a new page.
-        fun runWithBytes(action: suspend (Attachment, ByteArray) -> Unit) {
-            if (currentBlurred || busy) return
-            val target = attachment
-            scope.launch {
-                busy = true
-                try {
-                    val bytes = attachmentBytes(context, target)
-                    if (bytes == null) {
-                        viewerToast(context, "Couldn't read this image")
-                        return@launch
-                    }
-                    action(target, bytes)
-                } catch (error: Exception) {
-                    viewerToast(
-                        context,
-                        error.message?.takeIf { it.isNotBlank() }
-                            ?: "Couldn't complete that image action",
-                    )
-                } finally {
-                    busy = false
-                }
+        MessageOverlayScope {
+            val context = LocalContext.current
+            val exportAllowed = LocalImageExportAllowed.current
+            AllowDeviceRotation()
+            val scope = rememberCoroutineScope()
+            var busy by remember { mutableStateOf(false) }
+            val revealed = remember { mutableStateMapOf<String, Boolean>() }
+            LaunchedEffect(initiallyRevealedKeys) {
+                initiallyRevealedKeys.forEach { revealed[it] = true }
             }
-        }
+            val pagerState = rememberPagerState(
+                initialPage = initialIndex.coerceIn(attachments.indices),
+                pageCount = { attachments.size },
+            )
 
-        val onShare = {
-            runWithBytes { target, bytes ->
-                val uri = MediaSaver.stageForShare(
-                    context,
-                    bytes,
-                    target.fileName,
-                    target.contentType,
-                )
-                MediaSaver.share(context, uri, target.contentType)
-            }
-        }
-        val onSave = {
-            runWithBytes { target, bytes ->
-                when (val result = MediaSaver.saveImage(
-                    context,
-                    bytes,
-                    target.fileName,
-                    target.contentType,
-                )) {
-                    is MediaSaver.SaveResult.Saved ->
-                        viewerToast(context, "Saved to ${result.location}")
-                    MediaSaver.SaveResult.UseShareInstead -> {
-                        val uri = MediaSaver.stageForShare(
-                            context,
-                            bytes,
-                            target.fileName,
-                            target.contentType,
+            val currentIndex = pagerState.currentPage.coerceIn(attachments.indices)
+            val attachment = attachments[currentIndex]
+            val currentKey = galleryAttachmentKey(attachment, currentIndex)
+            val blurMode = LocalMediaBlurMode.current
+            val currentBlurred = revealed[currentKey] != true &&
+                shouldBlurImage(blurMode, attachment.sensitive)
+            val title = attachment.fileName
+                ?: attachment.contentType.substringBefore(';').ifBlank { "Image" }
+            val toolbarTitle = "$title · ${currentIndex + 1} of ${attachments.size}"
+
+            // Capture the currently visible attachment in each click lambda. A
+            // swipe while IO is running must not redirect Save/Share to a new page.
+            fun runWithBytes(action: suspend (Attachment, ByteArray) -> Unit) {
+                if (currentBlurred || busy) return
+                val target = attachment
+                scope.launch {
+                    busy = true
+                    try {
+                        val bytes = attachmentBytes(context, target)
+                        if (bytes == null) {
+                            UiMessageBus.error("Couldn't read this image")
+                            return@launch
+                        }
+                        action(target, bytes)
+                    } catch (error: Exception) {
+                        UiMessageBus.error(
+                            error.message?.takeIf { it.isNotBlank() }
+                                ?: "Couldn't complete that image action",
                         )
-                        MediaSaver.share(context, uri, target.contentType)
+                    } finally {
+                        busy = false
                     }
-                    is MediaSaver.SaveResult.Failed ->
-                        viewerToast(context, "Save failed: ${result.message}")
                 }
             }
-        }
-        val onOpenExternal: () -> Unit = openExternal@{
-            if (currentBlurred || busy) return@openExternal
-            val target = attachment
-            val cached = target.cachedUri
-            if (!cached.isNullOrBlank()) {
-                runCatching {
-                    MediaSaver.open(context, Uri.parse(cached), target.contentType)
-                }.onFailure {
-                    viewerToast(context, "Couldn't open this image")
-                }
-            } else {
-                runWithBytes { item, bytes ->
+
+            val onShare = {
+                runWithBytes { target, bytes ->
                     val uri = MediaSaver.stageForShare(
                         context,
                         bytes,
-                        item.fileName,
-                        item.contentType,
+                        target.fileName,
+                        target.contentType,
                     )
-                    MediaSaver.open(context, uri, item.contentType)
+                    MediaSaver.share(context, uri, target.contentType)
                 }
             }
-        }
-
-        Box(
-            modifier = modifier
-                .fillMaxSize()
-                .background(Color.Black.copy(alpha = 0.96f)),
-        ) {
-            HorizontalPager(
-                state = pagerState,
-                beyondViewportPageCount = 0,
-                pageSpacing = 12.dp,
-                modifier = Modifier
-                    .fillMaxSize()
-                    .testTag("attachment-gallery-pager"),
-            ) { page ->
-                val pageAttachment = attachments[page]
-                val pageKey = galleryAttachmentKey(pageAttachment, page)
-                val blurred = revealed[pageKey] != true && shouldBlurImage(
-                    blurMode,
-                    pageAttachment.sensitive,
-                )
-                ImageBody(
-                    attachment = pageAttachment,
-                    blurred = blurred,
-                    onReveal = { revealed[pageKey] = true },
-                )
+            val onSave = {
+                runWithBytes { target, bytes ->
+                    when (val result = MediaSaver.saveImage(
+                        context,
+                        bytes,
+                        target.fileName,
+                        target.contentType,
+                    )) {
+                        is MediaSaver.SaveResult.Saved ->
+                            UiMessageBus.success("Saved to ${result.location}")
+                        MediaSaver.SaveResult.UseShareInstead -> {
+                            val uri = MediaSaver.stageForShare(
+                                context,
+                                bytes,
+                                target.fileName,
+                                target.contentType,
+                            )
+                            MediaSaver.share(context, uri, target.contentType)
+                        }
+                        is MediaSaver.SaveResult.Failed ->
+                            UiMessageBus.error("Save failed: ${result.message}")
+                    }
+                }
+            }
+            val onOpenExternal: () -> Unit = openExternal@{
+                if (currentBlurred || busy) return@openExternal
+                val target = attachment
+                val cached = target.cachedUri
+                if (!cached.isNullOrBlank()) {
+                    runCatching {
+                        MediaSaver.open(context, Uri.parse(cached), target.contentType)
+                    }.onFailure {
+                        UiMessageBus.error("Couldn't open this image")
+                    }
+                } else {
+                    runWithBytes { item, bytes ->
+                        val uri = MediaSaver.stageForShare(
+                            context,
+                            bytes,
+                            item.fileName,
+                            item.contentType,
+                        )
+                        MediaSaver.open(context, uri, item.contentType)
+                    }
+                }
             }
 
-            MediaViewerToolbar(
-                title = toolbarTitle,
-                busy = busy,
-                actionsEnabled = !currentBlurred,
-                exportAllowed = exportAllowed,
-                onShare = onShare,
-                onSave = onSave,
-                onOpenExternal = onOpenExternal,
-                onClose = onDismiss,
-                modifier = Modifier.align(Alignment.TopCenter),
-            )
+            Box(
+                modifier = modifier
+                    .fillMaxSize()
+                    .background(Color.Black.copy(alpha = 0.96f)),
+            ) {
+                HorizontalPager(
+                    state = pagerState,
+                    beyondViewportPageCount = 0,
+                    pageSpacing = 12.dp,
+                    modifier = Modifier
+                        .fillMaxSize()
+                        .testTag("attachment-gallery-pager"),
+                ) { page ->
+                    val pageAttachment = attachments[page]
+                    val pageKey = galleryAttachmentKey(pageAttachment, page)
+                    val blurred = revealed[pageKey] != true && shouldBlurImage(
+                        blurMode,
+                        pageAttachment.sensitive,
+                    )
+                    ImageBody(
+                        attachment = pageAttachment,
+                        blurred = blurred,
+                        onReveal = { revealed[pageKey] = true },
+                    )
+                }
 
-            Text(
-                text = "${currentIndex + 1} / ${attachments.size}",
-                style = MaterialTheme.typography.labelMedium,
-                color = Color.White,
-                modifier = Modifier
-                    .align(Alignment.BottomCenter)
-                    .windowInsetsPadding(WindowInsets.safeDrawing)
-                    .padding(bottom = 12.dp)
-                    .clip(RoundedCornerShape(50))
-                    .background(Color.Black.copy(alpha = 0.55f))
-                    .padding(horizontal = 12.dp, vertical = 6.dp),
-            )
+                MediaViewerToolbar(
+                    title = toolbarTitle,
+                    busy = busy,
+                    actionsEnabled = !currentBlurred,
+                    exportAllowed = exportAllowed,
+                    onShare = onShare,
+                    onSave = onSave,
+                    onOpenExternal = onOpenExternal,
+                    onClose = onDismiss,
+                    modifier = Modifier.align(Alignment.TopCenter),
+                )
+
+                Text(
+                    text = "${currentIndex + 1} / ${attachments.size}",
+                    style = MaterialTheme.typography.labelMedium,
+                    color = Color.White,
+                    modifier = Modifier
+                        .align(Alignment.BottomCenter)
+                        .windowInsetsPadding(WindowInsets.safeDrawing)
+                        .padding(bottom = 12.dp)
+                        .clip(RoundedCornerShape(50))
+                        .background(Color.Black.copy(alpha = 0.55f))
+                        .padding(horizontal = 12.dp, vertical = 6.dp),
+                )
+            }
         }
     }
 }
@@ -737,17 +742,27 @@ private fun VideoBody(attachment: Attachment) {
         return
     }
 
+    var savedPosition by rememberSaveable(uri.toString()) { mutableLongStateOf(0L) }
+    var wantsToPlay by rememberSaveable(uri.toString()) { mutableStateOf(true) }
+    var muted by rememberSaveable(uri.toString()) { mutableStateOf(false) }
     val player = remember(uri) {
         ExoPlayer.Builder(context).build().apply {
             setMediaItem(MediaItem.fromUri(uri))
+            if (savedPosition > 0L) seekTo(savedPosition)
+            playWhenReady = wantsToPlay
+            volume = if (muted) 0f else 1f
             prepare()
-            playWhenReady = true
         }
     }
-    DisposableEffect(player) { onDispose { player.release() } }
+    DisposableEffect(player) {
+        onDispose {
+            savedPosition = player.currentPosition.coerceAtLeast(0L)
+            wantsToPlay = player.playWhenReady
+            player.release()
+        }
+    }
 
-    var isPlaying by remember { mutableStateOf(true) }
-    var muted by remember { mutableStateOf(false) }
+    var isPlaying by remember { mutableStateOf(player.isPlaying) }
     var position by remember { mutableStateOf(0L) }
     var duration by remember { mutableStateOf(0L) }
 
@@ -761,24 +776,30 @@ private fun VideoBody(attachment: Attachment) {
     LaunchedEffect(player) {
         while (true) {
             position = player.currentPosition.coerceAtLeast(0L)
+            savedPosition = position
             duration = player.duration.takeIf { it > 0L } ?: 0L
             delay(250)
         }
     }
 
     Column(modifier = Modifier.fillMaxSize(), verticalArrangement = Arrangement.Center) {
-        AndroidView(
-            factory = { ctx ->
-                SurfaceView(ctx).also { player.setVideoSurfaceView(it) }
-            },
-            modifier = Modifier.fillMaxWidth().weight(1f, fill = false).aspectRatio(16f / 9f),
-        )
+        Box(
+            modifier = Modifier.fillMaxWidth().weight(1f),
+            contentAlignment = Alignment.Center,
+        ) {
+            ContentFrame(
+                player = player,
+                modifier = Modifier.fillMaxSize().testTag("attachment-video-content"),
+                contentScale = ContentScale.Fit,
+            )
+        }
         PlaybackControls(
             isPlaying = isPlaying,
             position = position,
             duration = duration,
             onPlayPause = {
-                if (player.isPlaying) player.pause() else player.play()
+                wantsToPlay = !player.playWhenReady
+                player.playWhenReady = wantsToPlay
             },
             onSeek = { player.seekTo(it) },
             trailing = {
@@ -1173,10 +1194,6 @@ private fun rememberPlayableUri(attachment: Attachment): Uri? {
     return uri
 }
 
-private fun viewerToast(context: Context, message: String) {
-    Toast.makeText(context, message, Toast.LENGTH_SHORT).show()
-}
-
 private const val MAX_TEXT_BYTES = 2 * 1024 * 1024
 
 // --- Non-composable IO helpers ---------------------------------------------

app/src/main/kotlin/com/hermesandroid/relay/ui/components/ChatActivityReceipt.kt

@@ -0,0 +1,118 @@
+package com.hermesandroid.relay.ui.components
+
+import androidx.compose.foundation.clickable
+import androidx.compose.foundation.layout.Column
+import androidx.compose.foundation.layout.Row
+import androidx.compose.foundation.layout.Spacer
+import androidx.compose.foundation.layout.fillMaxWidth
+import androidx.compose.foundation.layout.heightIn
+import androidx.compose.foundation.layout.padding
+import androidx.compose.foundation.layout.size
+import androidx.compose.foundation.layout.width
+import androidx.compose.material.icons.Icons
+import androidx.compose.material.icons.filled.AccountTree
+import androidx.compose.material.icons.filled.ChevronRight
+import androidx.compose.material.icons.filled.Terminal
+import androidx.compose.material3.Icon
+import androidx.compose.material3.MaterialTheme
+import androidx.compose.material3.Surface
+import androidx.compose.material3.Text
+import androidx.compose.runtime.Composable
+import androidx.compose.ui.Alignment
+import androidx.compose.ui.Modifier
+import androidx.compose.ui.res.stringResource
+import androidx.compose.ui.semantics.Role
+import androidx.compose.ui.semantics.semantics
+import androidx.compose.ui.semantics.stateDescription
+import androidx.compose.ui.text.style.TextOverflow
+import androidx.compose.ui.unit.dp
+import com.hermesandroid.relay.R
+import com.hermesandroid.relay.data.ChatActivityKind
+import com.hermesandroid.relay.data.ChatActivityPhase
+import com.hermesandroid.relay.data.ChatActivityRecord
+
+/** Stable transcript entry into the same read-only preview used by active work. */
+@Composable
+internal fun ChatActivityReceipt(
+    record: ChatActivityRecord,
+    onClick: () -> Unit,
+    modifier: Modifier = Modifier,
+) {
+    val subagents = record.kind == ChatActivityKind.SUBAGENTS
+    val title = stringResource(
+        if (subagents) R.string.chat_activity_receipt_subagents else R.string.chat_activity_receipt_process,
+    )
+    val action = stringResource(
+        if (subagents) R.string.chat_activity_receipt_view_activity else R.string.chat_activity_receipt_view_output,
+    )
+    val status = if (subagents && record.children.isNotEmpty()) {
+        val groups = record.children.groupingBy { it.phase }.eachCount().toMutableMap()
+        val missing = (record.taskCount - record.children.size).coerceAtLeast(0)
+        if (missing > 0) groups[ChatActivityPhase.UNKNOWN] = (groups[ChatActivityPhase.UNKNOWN] ?: 0) + missing
+        val labels = groups.map { (phase, count) ->
+            stringResource(R.string.chat_activity_receipt_count_phase, count, activityPhaseLabel(phase))
+        }
+        labels.joinToString(" · ")
+    } else if (subagents && record.taskCount > 0) {
+        stringResource(R.string.chat_activity_receipt_count_phase, record.taskCount, activityPhaseLabel(record.phase))
+    } else {
+        activityPhaseLabel(record.phase)
+    }
+    Surface(
+        modifier = modifier
+            .fillMaxWidth()
+            .heightIn(min = 48.dp)
+            .semantics(mergeDescendants = true) { stateDescription = status }
+            .clickable(role = Role.Button, onClickLabel = action, onClick = onClick),
+        shape = MaterialTheme.shapes.medium,
+        color = MaterialTheme.colorScheme.surfaceVariant.copy(alpha = 0.58f),
+    ) {
+        Row(
+            modifier = Modifier.padding(horizontal = 12.dp, vertical = 10.dp),
+            verticalAlignment = Alignment.CenterVertically,
+        ) {
+            Icon(
+                imageVector = if (subagents) Icons.Filled.AccountTree else Icons.Filled.Terminal,
+                contentDescription = null,
+                tint = if (record.phase == ChatActivityPhase.FAILED) {
+                    MaterialTheme.colorScheme.error
+                } else {
+                    MaterialTheme.colorScheme.onSurfaceVariant
+                },
+                modifier = Modifier.size(16.dp),
+            )
+            Spacer(Modifier.width(8.dp))
+            Column(modifier = Modifier.weight(1f)) {
+                Text(
+                    text = "$title · $status",
+                    style = MaterialTheme.typography.labelMedium,
+                    maxLines = 2,
+                    overflow = TextOverflow.Ellipsis,
+                )
+                Text(
+                    text = action,
+                    style = MaterialTheme.typography.bodySmall,
+                    color = MaterialTheme.colorScheme.onSurfaceVariant,
+                )
+            }
+            Spacer(Modifier.width(8.dp))
+            Icon(
+                imageVector = Icons.Filled.ChevronRight,
+                contentDescription = null,
+                tint = MaterialTheme.colorScheme.onSurfaceVariant,
+                modifier = Modifier.size(18.dp),
+            )
+        }
+    }
+}
+
+@Composable
+private fun activityPhaseLabel(phase: ChatActivityPhase): String = stringResource(
+    when (phase) {
+        ChatActivityPhase.RUNNING -> R.string.bg_processes_running
+        ChatActivityPhase.COMPLETE -> R.string.agent_activity_status_completed
+        ChatActivityPhase.FAILED -> R.string.agent_activity_status_failed
+        ChatActivityPhase.CANCELLED -> R.string.task_status_cancelled
+        ChatActivityPhase.UNKNOWN -> R.string.agent_activity_status_unavailable
+    },
+)

app/src/main/kotlin/com/hermesandroid/relay/ui/components/ChatBusyControls.kt

@@ -0,0 +1,215 @@
+package com.hermesandroid.relay.ui.components
+
+import androidx.activity.compose.BackHandler
+import androidx.compose.animation.AnimatedVisibility
+import androidx.compose.animation.core.tween
+import androidx.compose.animation.expandVertically
+import androidx.compose.animation.shrinkVertically
+import androidx.compose.animation.fadeIn
+import androidx.compose.animation.fadeOut
+import androidx.compose.animation.slideInVertically
+import androidx.compose.animation.slideOutVertically
+import androidx.compose.foundation.clickable
+import androidx.compose.foundation.layout.Arrangement
+import androidx.compose.foundation.layout.Column
+import androidx.compose.foundation.layout.Box
+import androidx.compose.foundation.layout.Row
+import androidx.compose.foundation.layout.Spacer
+import androidx.compose.foundation.layout.size
+import androidx.compose.foundation.layout.fillMaxWidth
+import androidx.compose.foundation.layout.heightIn
+import androidx.compose.foundation.layout.padding
+import androidx.compose.foundation.rememberScrollState
+import androidx.compose.foundation.selection.selectable
+import androidx.compose.foundation.verticalScroll
+import androidx.compose.material.icons.Icons
+import androidx.compose.material.icons.filled.Close
+import androidx.compose.material.icons.filled.Check
+import androidx.compose.material.icons.filled.Stop
+import androidx.compose.material.icons.filled.ExpandLess
+import androidx.compose.material.icons.filled.ExpandMore
+import androidx.compose.material3.Icon
+import androidx.compose.material3.IconButton
+import androidx.compose.material3.MaterialTheme
+import androidx.compose.material3.Surface
+import androidx.compose.material3.Text
+import androidx.compose.material3.TextButton
+import androidx.compose.runtime.Composable
+import androidx.compose.runtime.getValue
+import androidx.compose.runtime.setValue
+import androidx.compose.runtime.mutableStateOf
+import androidx.compose.runtime.remember
+import androidx.compose.ui.Alignment
+import androidx.compose.ui.Modifier
+import androidx.compose.ui.platform.testTag
+import androidx.compose.ui.res.pluralStringResource
+import androidx.compose.ui.res.stringResource
+import androidx.compose.ui.semantics.Role
+import androidx.compose.ui.unit.dp
+import androidx.compose.ui.unit.Dp
+import androidx.compose.ui.zIndex
+import com.hermesandroid.relay.ui.theme.appearanceTopRoundedCornerShape
+import com.hermesandroid.relay.R
+import com.hermesandroid.relay.data.BusyMessageAction
+
+private val COMPOSER_TRAY_UNDERLAP = 12.dp
+
+/** A separate rear surface tucked beneath the composer's foreground edge. */
+@Composable
+fun ChatComposerLayers(
+    action: BusyMessageAction?,
+    onActionChange: (BusyMessageAction) -> Unit,
+    correctionAvailable: Boolean,
+    onStop: (() -> Unit)?,
+    modifier: Modifier = Modifier,
+    content: @Composable () -> Unit,
+) {
+    Column(
+        modifier = modifier.fillMaxWidth(),
+        verticalArrangement = Arrangement.spacedBy(-COMPOSER_TRAY_UNDERLAP),
+    ) {
+        if (action != null) {
+            ChatBusyActionSelector(
+                action, onActionChange,
+                correctionAvailable = correctionAvailable,
+                onStop = onStop,
+                bottomUnderlap = COMPOSER_TRAY_UNDERLAP,
+                modifier = Modifier.fillMaxWidth().padding(horizontal = 20.dp).zIndex(0f),
+            )
+        }
+        Box(Modifier.fillMaxWidth().zIndex(1f).testTag("chatComposerForeground")) { content() }
+    }
+}
+
+/** Compact current intent; optional plain-text choices slide out from behind it. */
+@Composable
+fun ChatBusyActionSelector(
+    action: BusyMessageAction,
+    onActionChange: (BusyMessageAction) -> Unit,
+    modifier: Modifier = Modifier,
+    correctionAvailable: Boolean = true,
+    onStop: (() -> Unit)? = null,
+    bottomUnderlap: Dp = 0.dp,
+) {
+    var expanded by remember { mutableStateOf(false) }
+    BackHandler(enabled = expanded) { expanded = false }
+    Surface(
+        modifier = modifier.testTag("chatBusyActionTray"),
+        color = MaterialTheme.colorScheme.surfaceContainerLow.copy(alpha = 0.82f),
+        shape = appearanceTopRoundedCornerShape(12.dp),
+        tonalElevation = 0.dp,
+    ) {
+        Column(Modifier.padding(bottom = bottomUnderlap)) {
+            AnimatedVisibility(
+                visible = expanded,
+                enter = expandVertically(tween(220), expandFrom = Alignment.Bottom) +
+                    slideInVertically(tween(220)) { it } + fadeIn(tween(160)),
+                exit = shrinkVertically(tween(180), shrinkTowards = Alignment.Bottom) +
+                    slideOutVertically(tween(180)) { it } + fadeOut(tween(120)),
+            ) {
+                Row(
+                    Modifier.fillMaxWidth().testTag("chatBusyActionDrawer").padding(horizontal = 8.dp),
+                    verticalAlignment = Alignment.CenterVertically,
+                ) {
+                    BusyMessageAction.entries.forEach { option ->
+                        val available = option == BusyMessageAction.QueueNext || correctionAvailable
+                        Row(
+                            Modifier.weight(1f).heightIn(min = 48.dp)
+                                .testTag("chatBusyAction-${option.storedValue}")
+                                .selectable(selected = option == action, enabled = available, role = Role.RadioButton) {
+                                    onActionChange(option)
+                                    expanded = false
+                                }.padding(horizontal = 8.dp),
+                            verticalAlignment = Alignment.CenterVertically,
+                            horizontalArrangement = Arrangement.spacedBy(6.dp),
+                        ) {
+                            if (option == action) {
+                                Icon(Icons.Default.Check, null, Modifier.size(14.dp),
+                                    tint = MaterialTheme.colorScheme.onSurface)
+                            } else Spacer(Modifier.size(14.dp))
+                            Text(
+                                stringResource(if (option == BusyMessageAction.CorrectNow) R.string.chat_correct_now else R.string.chat_queue_next),
+                                style = MaterialTheme.typography.labelMedium,
+                                color = MaterialTheme.colorScheme.onSurface.copy(alpha = if (available) 1f else 0.38f),
+                            )
+                        }
+                    }
+                }
+            }
+            Row(
+                Modifier.fillMaxWidth().padding(horizontal = 12.dp),
+                verticalAlignment = Alignment.CenterVertically,
+            ) {
+                Row(
+                    Modifier.weight(1f).heightIn(min = 40.dp)
+                        .testTag("chatBusyActionTrigger")
+                        .clickable(role = Role.Button) { expanded = !expanded },
+                    verticalAlignment = Alignment.CenterVertically,
+                    horizontalArrangement = Arrangement.spacedBy(4.dp),
+                ) {
+                    Text(
+                        stringResource(if (action == BusyMessageAction.CorrectNow) R.string.chat_correct_now else R.string.chat_queue_next),
+                        style = MaterialTheme.typography.labelSmall,
+                        color = MaterialTheme.colorScheme.onSurfaceVariant,
+                    )
+                    Icon(
+                        if (expanded) Icons.Default.ExpandMore else Icons.Default.ExpandLess,
+                        null, Modifier.size(14.dp), tint = MaterialTheme.colorScheme.onSurfaceVariant,
+                    )
+                }
+                if (onStop != null) {
+                    IconButton(onClick = onStop) {
+                        Icon(Icons.Default.Stop, stringResource(R.string.chat_input_stop_streaming), Modifier.size(18.dp))
+                    }
+                }
+            }
+        }
+    }
+}
+
+@Composable
+fun ChatMessageQueue(
+    messages: List<String>,
+    paused: Boolean,
+    onResume: () -> Unit,
+    onClear: () -> Unit,
+    onEdit: (Int) -> Unit,
+    onRemove: (Int) -> Unit,
+    canEdit: Boolean,
+    modifier: Modifier = Modifier,
+) {
+    if (messages.isEmpty()) return
+    Column(modifier) {
+        Row(Modifier.fillMaxWidth(), verticalAlignment = Alignment.CenterVertically) {
+            Text(
+                if (paused) stringResource(R.string.chat_queue_paused)
+                else pluralStringResource(R.plurals.chat_queue_count, messages.size, messages.size),
+                style = MaterialTheme.typography.labelMedium,
+                modifier = Modifier.weight(1f),
+            )
+            if (paused) TextButton(onClick = onResume) { Text(stringResource(R.string.chat_queue_resume)) }
+            TextButton(onClick = onClear) { Text(stringResource(R.string.chat_clear)) }
+        }
+        Column(
+            Modifier.heightIn(max = 144.dp).verticalScroll(rememberScrollState()),
+            verticalArrangement = Arrangement.spacedBy(2.dp),
+        ) {
+            messages.forEachIndexed { index, text ->
+                Row(Modifier.fillMaxWidth(), verticalAlignment = Alignment.CenterVertically) {
+                    Text(
+                        text = text,
+                        maxLines = 2,
+                        overflow = androidx.compose.ui.text.style.TextOverflow.Ellipsis,
+                        style = MaterialTheme.typography.bodySmall,
+                        modifier = Modifier.weight(1f)
+                            .clickable(enabled = canEdit, role = Role.Button) { onEdit(index) }
+                            .padding(vertical = 12.dp),
+                    )
+                    IconButton(onClick = { onRemove(index) }) {
+                        Icon(Icons.Default.Close, stringResource(R.string.chat_queue_remove))
+                    }
+                }
+            }
+        }
+    }
+}

app/src/main/kotlin/com/hermesandroid/relay/ui/components/ChatDebugDrawer.kt

@@ -0,0 +1,197 @@
+package com.hermesandroid.relay.ui.components
+
+import androidx.compose.foundation.layout.Arrangement
+import androidx.compose.foundation.layout.Box
+import androidx.compose.foundation.layout.BoxScope
+import androidx.compose.foundation.layout.fillMaxSize
+import androidx.compose.foundation.background
+import androidx.compose.foundation.clickable
+import androidx.compose.foundation.combinedClickable
+import androidx.compose.animation.AnimatedVisibility
+import androidx.compose.animation.fadeIn
+import androidx.compose.animation.fadeOut
+import androidx.compose.animation.slideInVertically
+import androidx.compose.animation.slideOutVertically
+import androidx.activity.compose.BackHandler
+import androidx.compose.ui.draw.clipToBounds
+import androidx.compose.ui.unit.Dp
+import androidx.compose.foundation.layout.Column
+import androidx.compose.foundation.layout.Row
+import androidx.compose.foundation.layout.fillMaxWidth
+import androidx.compose.foundation.layout.heightIn
+import androidx.compose.foundation.layout.padding
+import androidx.compose.foundation.rememberScrollState
+import androidx.compose.foundation.shape.RoundedCornerShape
+import androidx.compose.foundation.verticalScroll
+import androidx.compose.material.icons.Icons
+import androidx.compose.material.icons.filled.Close
+import androidx.compose.material3.HorizontalDivider
+import androidx.compose.material3.Icon
+import androidx.compose.material3.IconButton
+import androidx.compose.material3.MaterialTheme
+import androidx.compose.material3.Surface
+import androidx.compose.material3.Text
+import androidx.compose.material3.TextButton
+import androidx.compose.runtime.Composable
+import androidx.compose.ui.Alignment
+import androidx.compose.ui.Modifier
+import androidx.compose.ui.res.stringResource
+import androidx.compose.ui.semantics.paneTitle
+import androidx.compose.ui.semantics.semantics
+import androidx.compose.ui.text.font.FontFamily
+import androidx.compose.ui.unit.dp
+import com.hermesandroid.relay.R
+import com.hermesandroid.relay.diagnostics.DiagnosticsLog
+import com.hermesandroid.relay.network.upstream.GatewayConnectionState
+import com.hermesandroid.relay.viewmodel.ConnectionStepState
+
+@Composable
+internal fun Modifier.chatDebugHeaderGesture(enabled: Boolean, onClick: () -> Unit, onHold: () -> Unit): Modifier =
+    combinedClickable(enabled = enabled, onClick = onClick, onLongClick = onHold,
+        onLongClickLabel = stringResource(R.string.chat_debug_open))
+
+@Composable
+internal fun BoxScope.ChatDebugOverlay(
+    visible: Boolean,
+    headerHeight: Dp,
+    onClose: () -> Unit,
+    content: @Composable () -> Unit,
+) {
+    BackHandler(enabled = visible, onBack = onClose)
+    if (visible) {
+        Box(Modifier.fillMaxSize().padding(top = headerHeight)
+            .background(MaterialTheme.colorScheme.scrim.copy(alpha = 0.28f))
+            .clickable(onClick = onClose))
+    }
+    AnimatedVisibility(
+        visible = visible,
+        enter = slideInVertically { -it } + fadeIn(),
+        exit = slideOutVertically { -it } + fadeOut(),
+        modifier = Modifier.align(Alignment.TopCenter).padding(top = headerHeight).fillMaxWidth().clipToBounds(),
+    ) { content() }
+}
+
+/** Read-only snapshot of the visible conversation; opening it sends no RPCs. */
+@Composable
+internal fun ChatDebugDrawer(
+    profile: String,
+    model: String,
+    sessionId: String?,
+    gateway: Boolean,
+    signedIn: Boolean,
+    signInRequired: Boolean,
+    socketState: GatewayConnectionState,
+    preparing: Boolean,
+    streaming: Boolean,
+    loadingHistory: Boolean,
+    directoryUnavailable: Boolean,
+    failure: String?,
+    onClose: () -> Unit,
+    onConnections: () -> Unit,
+    modifier: Modifier = Modifier,
+) {
+    val title = stringResource(R.string.chat_debug_title)
+    val safeFailure = DiagnosticsLog.redactReportText(failure)?.take(600)
+    val ready = socketState == GatewayConnectionState.Ready
+    val steps = buildList {
+        if (gateway) {
+            add(ConnectionSetupTimelineStep(
+                stringResource(R.string.chat_debug_sign_in),
+                stringResource(when {
+                    signInRequired -> R.string.chat_debug_sign_in_needed
+                    signedIn -> R.string.chat_debug_authenticated
+                    else -> R.string.chat_debug_auth_unknown
+                }),
+                when {
+                    signInRequired -> ConnectionStepState.Failed
+                    signedIn -> ConnectionStepState.Done
+                    else -> ConnectionStepState.Pending
+                },
+            ))
+            add(ConnectionSetupTimelineStep(
+                stringResource(R.string.chat_debug_gateway),
+                stringResource(when (socketState) {
+                    GatewayConnectionState.Ready -> R.string.chat_debug_socket_ready
+                    GatewayConnectionState.MintingTicket -> R.string.chat_debug_ticket
+                    GatewayConnectionState.Connecting -> R.string.chat_debug_socket_connecting
+                    GatewayConnectionState.AwaitingReady -> R.string.chat_debug_socket_waiting
+                    GatewayConnectionState.Idle -> R.string.chat_debug_socket_idle
+                }),
+                when {
+                    ready -> ConnectionStepState.Done
+                    signInRequired -> ConnectionStepState.Failed
+                    socketState != GatewayConnectionState.Idle -> ConnectionStepState.Active
+                    else -> ConnectionStepState.Pending
+                },
+            ))
+        }
+        add(ConnectionSetupTimelineStep(
+            stringResource(R.string.chat_debug_session),
+            stringResource(when {
+                preparing -> R.string.chat_debug_preparing_detail
+                loadingHistory -> R.string.chat_debug_history_loading
+                directoryUnavailable -> R.string.chat_debug_history_failed
+                sessionId != null -> R.string.chat_debug_session_selected
+                else -> R.string.chat_debug_session_new
+            }),
+            when {
+                preparing || loadingHistory -> ConnectionStepState.Active
+                directoryUnavailable -> ConnectionStepState.Failed
+                sessionId != null -> ConnectionStepState.Done
+                else -> ConnectionStepState.Pending
+            },
+        ))
+        add(ConnectionSetupTimelineStep(
+            stringResource(R.string.chat_debug_response),
+            stringResource(when {
+                safeFailure != null -> R.string.chat_debug_response_failed
+                preparing -> R.string.chat_debug_response_waiting
+                streaming -> R.string.chat_debug_response_active
+                else -> R.string.chat_debug_response_idle
+            }),
+            when {
+                safeFailure != null -> ConnectionStepState.Failed
+                preparing -> ConnectionStepState.Pending
+                streaming -> ConnectionStepState.Active
+                else -> ConnectionStepState.Pending
+            },
+        ))
+    }
+    Surface(
+        modifier = modifier.fillMaxWidth().semantics { paneTitle = title },
+        shape = RoundedCornerShape(bottomStart = 24.dp, bottomEnd = 24.dp),
+        color = MaterialTheme.colorScheme.surface,
+        shadowElevation = 8.dp,
+    ) {
+        Column(Modifier.heightIn(max = 560.dp).verticalScroll(rememberScrollState()).padding(20.dp),
+            verticalArrangement = Arrangement.spacedBy(16.dp)) {
+            Row(verticalAlignment = Alignment.CenterVertically) {
+                Column(Modifier.weight(1f)) {
+                    Text(title, style = MaterialTheme.typography.titleLarge)
+                    Text(listOf(if (gateway) "Gateway" else "Direct API", profile, model)
+                        .filter(String::isNotBlank).joinToString(" · "), style = MaterialTheme.typography.bodySmall,
+                        color = MaterialTheme.colorScheme.onSurfaceVariant)
+                }
+                IconButton(onClick = onClose) {
+                    Icon(Icons.Filled.Close, stringResource(R.string.chat_debug_close))
+                }
+            }
+            ConnectionSetupTimeline(steps)
+            if (safeFailure != null) {
+                Surface(color = MaterialTheme.colorScheme.errorContainer, shape = RoundedCornerShape(12.dp)) {
+                    Column(Modifier.padding(12.dp), verticalArrangement = Arrangement.spacedBy(8.dp)) {
+                        Text(safeFailure, style = MaterialTheme.typography.bodySmall)
+                        if (safeFailure.contains("agent init failed", ignoreCase = true)) {
+                            Text(stringResource(R.string.chat_debug_init_recovery), style = MaterialTheme.typography.bodySmall)
+                        }
+                    }
+                }
+            }
+            HorizontalDivider()
+            Text(stringResource(R.string.chat_debug_session_id, sessionId ?: "—"),
+                style = MaterialTheme.typography.labelSmall, fontFamily = FontFamily.Monospace,
+                color = MaterialTheme.colorScheme.onSurfaceVariant)
+            TextButton(onClick = onConnections) { Text(stringResource(R.string.chat_debug_connections)) }
+        }
+    }
+}

app/src/main/kotlin/com/hermesandroid/relay/ui/components/ChatFailurePanel.kt

@@ -53,7 +53,13 @@ fun ChatFailurePanel(
                 Spacer(Modifier.width(10.dp))
                 Column(modifier = Modifier.weight(1f)) {
                     Text(
-                        text = stringResource(R.string.chat_failure_title),
+                        text = stringResource(
+                            if (isInferenceUnavailableFailure(failure.rawError)) {
+                                R.string.chat_failure_inference_unavailable
+                            } else {
+                                R.string.chat_failure_title
+                            },
+                        ),
                         style = MaterialTheme.typography.bodyMedium,
                         fontWeight = FontWeight.SemiBold,
                     )
@@ -148,3 +154,10 @@ internal fun failureIdentity(route: String, model: String?, provider: String?):
         provider?.trim()?.takeIf { it.isNotEmpty() },
         model?.trim()?.takeIf { it.isNotEmpty() },
     ).distinct().joinToString(" · ")
+
+internal fun isInferenceUnavailableFailure(rawError: String): Boolean {
+    val message = rawError.lowercase()
+    return "agent init failed" in message ||
+        "no codex credentials stored" in message ||
+        "runtime resolution still failed" in message
+}

app/src/main/kotlin/com/hermesandroid/relay/ui/components/ChatImageContent.kt

@@ -2,6 +2,7 @@ package com.hermesandroid.relay.ui.components
 
 import android.content.Intent
 import android.graphics.BitmapFactory
+import android.net.Uri
 import androidx.compose.foundation.background
 import androidx.compose.foundation.clickable
 import androidx.compose.foundation.layout.Arrangement
@@ -29,6 +30,7 @@ import androidx.compose.runtime.collectAsState
 import androidx.compose.runtime.getValue
 import androidx.compose.runtime.mutableStateOf
 import androidx.compose.runtime.remember
+import androidx.compose.runtime.saveable.rememberSaveable
 import androidx.compose.runtime.setValue
 import androidx.compose.runtime.staticCompositionLocalOf
 import androidx.compose.ui.Alignment
@@ -97,9 +99,9 @@ private fun isSensitiveAltText(alt: String): Boolean {
 
 /**
  * Resolves a server-local image path — an absolute path the agent put in a
- * markdown image `![alt](/abs/path)` — to raw bytes, via the relay's
- * `/media/by-path` route when a relay session is paired. Returns null when no
- * relay is available or the fetch fails, so the renderer falls back to the
+ * markdown image `![alt](/abs/path)` — to an on-disk cache URI, via the relay's
+ * authenticated Dashboard route (or Relay compatibility route). Returns a
+ * failure when no route is available or the fetch fails, so the renderer falls back to the
  * "this image is on the server" notice. Provided by ChatScreen from
  * [com.hermesandroid.relay.viewmodel.ChatViewModel.resolveServerImage]; the
  * default is null, which preserves the standard (no-plugin) behavior where a
@@ -113,12 +115,12 @@ private fun isSensitiveAltText(alt: String): Boolean {
  * `RelayServerImage` on app open with a server-local image in history).
  */
 sealed interface ServerImageResult {
-    class Success(val bytes: ByteArray, val sensitive: Boolean = false) : ServerImageResult
+    class Success(val cachedUri: String, val sensitive: Boolean = false) : ServerImageResult
     class Failure(val reason: String) : ServerImageResult
 }
 
 fun interface RelayServerImageResolver {
-    /** Fetch the server-local file's bytes over the relay, or a
+    /** Fetch the server-local file into the media cache, or a
      *  [ServerImageResult.Failure] whose reason explains why (unpaired /
      *  sandboxed / missing / decode) so the UI can surface it instead of a
      *  generic placeholder. */
@@ -293,8 +295,10 @@ private sealed interface DataUrlImagePhase {
 @Composable
 private fun DataUrlChatImage(image: ChatInlineImage, maxWidth: Dp) {
     var phase by remember(image.src) { mutableStateOf<DataUrlImagePhase>(DataUrlImagePhase.Loading) }
-    var viewerOpen by remember(image.src) { mutableStateOf(false) }
+    var viewerOpen by rememberSaveable(image.src) { mutableStateOf(false) }
     val blurMode = LocalMediaBlurMode.current
+    val exportAllowed = LocalImageExportAllowed.current
+    val viewerController = LocalChatMediaViewerController.current
     var revealed by remember(image.src) { mutableStateOf(false) }
     LaunchedEffect(image.src) {
         phase = withInlineImageDecodeLock {
@@ -329,17 +333,17 @@ private fun DataUrlChatImage(image: ChatInlineImage, maxWidth: Dp) {
             reason = "Unsupported or oversized inline image.",
         )
         is DataUrlImagePhase.Loaded -> {
-            if (viewerOpen) {
+            val viewerSource = ChatImageViewerSource.Bitmap(
+                bitmap = current.bitmap,
+                displayName = image.alt.ifBlank { "image" },
+                mime = current.mime,
+                // Decode the already-retained data URL only when the user
+                // requests Save/Share; don't retain a second byte array.
+                bytesProvider = { decodeInlineImageDataUrlOffMain(image.src)?.bytes },
+            )
+            if (viewerController == null && viewerOpen) {
                 ChatImageViewer(
-                    source = ChatImageViewerSource.Bitmap(
-                        bitmap = current.bitmap,
-                        displayName = image.alt.ifBlank { "image" },
-                        mime = current.mime,
-                        // Decode the already-retained data URL only when the
-                        // user requests Save/Share; don't keep a second 5 MiB
-                        // byte array beside every thumbnail.
-                        bytesProvider = { decodeInlineImageDataUrlOffMain(image.src)?.bytes },
-                    ),
+                    source = viewerSource,
                     onDismiss = { viewerOpen = false },
                     sensitive = image.sensitive,
                     initiallyRevealed = revealed,
@@ -358,7 +362,19 @@ private fun DataUrlChatImage(image: ChatInlineImage, maxWidth: Dp) {
                             .widthIn(max = maxWidth)
                             .heightIn(max = 360.dp)
                             .clip(RoundedCornerShape(12.dp))
-                            .clickable { viewerOpen = true },
+                            .clickable {
+                                if (viewerController != null) {
+                                    viewerController.openImage(
+                                        source = viewerSource,
+                                        sensitive = image.sensitive,
+                                        initiallyRevealed = revealed,
+                                        blurMode = blurMode,
+                                        exportAllowed = exportAllowed,
+                                    )
+                                } else {
+                                    viewerOpen = true
+                                }
+                            },
                     )
                 }
             }
@@ -368,18 +384,21 @@ private fun DataUrlChatImage(image: ChatInlineImage, maxWidth: Dp) {
 
 @Composable
 private fun RemoteChatImage(image: ChatInlineImage, maxWidth: Dp) {
-    var viewerOpen by remember { mutableStateOf(false) }
+    var viewerOpen by rememberSaveable(image.src) { mutableStateOf(false) }
     val blurMode = LocalMediaBlurMode.current
+    val exportAllowed = LocalImageExportAllowed.current
+    val viewerController = LocalChatMediaViewerController.current
     var revealed by remember(image.src) { mutableStateOf(false) }
     val blurred = !revealed && shouldBlurImage(blurMode, image.sensitive)
-    if (viewerOpen) {
+    val viewerSource = ChatImageViewerSource.Coil(
+        model = image.src,
+        displayName = image.alt.ifBlank { "image" },
+        mime = "image/*",
+        bytesProvider = { MediaSaver.fetchRemoteBytes(image.src).first },
+    )
+    if (viewerController == null && viewerOpen) {
         ChatImageViewer(
-            source = ChatImageViewerSource.Coil(
-                model = image.src,
-                displayName = image.alt.ifBlank { "image" },
-                mime = "image/*",
-                bytesProvider = { MediaSaver.fetchRemoteBytes(image.src).first },
-            ),
+            source = viewerSource,
             onDismiss = { viewerOpen = false },
             sensitive = image.sensitive,
             initiallyRevealed = revealed,
@@ -395,7 +414,19 @@ private fun RemoteChatImage(image: ChatInlineImage, maxWidth: Dp) {
                     .widthIn(max = maxWidth)
                     .heightIn(max = 360.dp)
                     .clip(RoundedCornerShape(12.dp))
-                    .clickable { viewerOpen = true },
+                    .clickable {
+                        if (viewerController != null) {
+                            viewerController.openImage(
+                                source = viewerSource,
+                                sensitive = image.sensitive,
+                                initiallyRevealed = revealed,
+                                blurMode = blurMode,
+                                exportAllowed = exportAllowed,
+                            )
+                        } else {
+                            viewerOpen = true
+                        }
+                    },
             ) {
                 val state by painter.state.collectAsState()
                 when (state) {
@@ -461,6 +492,7 @@ private fun RelayServerImage(
     maxWidth: Dp,
     resolver: RelayServerImageResolver,
 ) {
+    val context = LocalContext.current
     var phase by remember(image.src) {
         mutableStateOf<RelayImagePhase>(
             cachedInlineImage(image.src)
@@ -473,20 +505,22 @@ private fun RelayServerImage(
         phase = withContext(Dispatchers.IO) {
             val result = try {
                 resolver.fetch(image.src)
-            } catch (t: Throwable) {
-                ServerImageResult.Failure(t.message ?: "relay fetch failed")
+            } catch (error: Exception) {
+                ServerImageResult.Failure(error.message ?: "relay fetch failed")
             }
             when (result) {
                 is ServerImageResult.Success -> {
-                    val bytes = result.bytes
-                    val bmp = runCatching {
-                        decodeOrientedBitmap(bytes)
-                    }.getOrNull()?.asImageBitmap()
+                    val cachedUri = Uri.parse(result.cachedUri)
+                    val bmp = try {
+                        decodeBoundedOrientedBitmap(context, cachedUri)
+                    } catch (_: Exception) {
+                        null
+                    }?.asImageBitmap()
                     if (bmp != null) {
                         putInlineImage(image.src, bmp, result.sensitive)
                         RelayImagePhase.Loaded(bmp, result.sensitive)
                     } else {
-                        RelayImagePhase.Failed("fetched ${bytes.size} B but couldn't decode the image")
+                        RelayImagePhase.Failed("fetched file could not be decoded as an image")
                     }
                 }
                 is ServerImageResult.Failure -> RelayImagePhase.Failed(result.reason)
@@ -527,23 +561,32 @@ private fun RelayServerImageContent(
     maxWidth: Dp,
     resolver: RelayServerImageResolver,
 ) {
-    var viewerOpen by remember { mutableStateOf(false) }
+    val context = LocalContext.current
+    var viewerOpen by rememberSaveable(image.src) { mutableStateOf(false) }
     val blurMode = LocalMediaBlurMode.current
+    val exportAllowed = LocalImageExportAllowed.current
+    val viewerController = LocalChatMediaViewerController.current
     var revealed by remember(image.src) { mutableStateOf(false) }
     val sensitive = image.sensitive || fetchedSensitive
     val blurred = !revealed && shouldBlurImage(blurMode, sensitive)
-    if (viewerOpen) {
+    val viewerSource = ChatImageViewerSource.Bitmap(
+        bitmap = bitmap,
+        displayName = image.alt.ifBlank {
+            image.src.substringAfterLast('/').ifBlank { "image" }
+        },
+        mime = "image/*",
+        // Save/Share re-fetch the original bytes on demand so we don't hold
+        // them in memory next to the decoded bitmap.
+        bytesProvider = {
+            (resolver.fetch(image.src) as? ServerImageResult.Success)?.let { fetched ->
+                context.contentResolver.openInputStream(Uri.parse(fetched.cachedUri))
+                    ?.use { it.readBytes() }
+            }
+        },
+    )
+    if (viewerController == null && viewerOpen) {
         ChatImageViewer(
-            source = ChatImageViewerSource.Bitmap(
-                bitmap = bitmap,
-                displayName = image.alt.ifBlank {
-                    image.src.substringAfterLast('/').ifBlank { "image" }
-                },
-                mime = "image/*",
-                // Save/Share re-fetch the original bytes on demand so we don't
-                // hold them in memory next to the decoded bitmap.
-                bytesProvider = { (resolver.fetch(image.src) as? ServerImageResult.Success)?.bytes },
-            ),
+            source = viewerSource,
             onDismiss = { viewerOpen = false },
             sensitive = sensitive,
             initiallyRevealed = revealed,
@@ -559,7 +602,19 @@ private fun RelayServerImageContent(
                     .widthIn(max = maxWidth)
                     .heightIn(max = 360.dp)
                     .clip(RoundedCornerShape(12.dp))
-                    .clickable { viewerOpen = true },
+                    .clickable {
+                        if (viewerController != null) {
+                            viewerController.openImage(
+                                source = viewerSource,
+                                sensitive = sensitive,
+                                initiallyRevealed = revealed,
+                                blurMode = blurMode,
+                                exportAllowed = exportAllowed,
+                            )
+                        } else {
+                            viewerOpen = true
+                        }
+                    },
             )
         }
     }

app/src/main/kotlin/com/hermesandroid/relay/ui/components/ChatImageViewer.kt

@@ -2,7 +2,7 @@
 
 package com.hermesandroid.relay.ui.components
 
-import android.widget.Toast
+import com.hermesandroid.relay.ui.UiMessageBus
 import androidx.compose.foundation.Image
 import androidx.compose.foundation.background
 import androidx.compose.foundation.layout.Arrangement
@@ -107,135 +107,141 @@ fun ChatImageViewer(
         onDismissRequest = onDismiss,
         properties = DialogProperties(usePlatformDefaultWidth = false),
     ) {
-        val context = LocalContext.current
-        val exportAllowed = LocalImageExportAllowed.current
-        AllowDeviceRotation()
-        val scope = rememberCoroutineScope()
+        MessageOverlayScope {
+            val context = LocalContext.current
+            val exportAllowed = LocalImageExportAllowed.current
+            AllowDeviceRotation()
+            val scope = rememberCoroutineScope()
 
-        var busy by remember { mutableStateOf(false) }
+            var busy by remember { mutableStateOf(false) }
 
-        val blurMode = LocalMediaBlurMode.current
-        var revealed by remember(source) { mutableStateOf(initiallyRevealed) }
-        val blurred = !revealed && shouldBlurImage(blurMode, sensitive)
+            val blurMode = LocalMediaBlurMode.current
+            var revealed by remember(source) { mutableStateOf(initiallyRevealed) }
+            val blurred = !revealed && shouldBlurImage(blurMode, sensitive)
 
-        val gestureModifier = Modifier.fillMaxSize().zoomable()
+            val gestureModifier = Modifier.fillMaxSize().zoomable()
 
-        Box(
-            modifier = Modifier
-                .fillMaxSize()
-                .background(Color.Black.copy(alpha = 0.94f)),
-            contentAlignment = Alignment.Center,
-        ) {
-            BlurredMedia(
-                blurred = blurred,
-                onReveal = { revealed = true },
-                modifier = Modifier.fillMaxSize(),
-            ) {
-                when (source) {
-                    is ChatImageViewerSource.Coil -> AsyncImage(
-                        model = source.model,
-                        contentDescription = source.displayName,
-                        contentScale = ContentScale.Fit,
-                        modifier = gestureModifier,
-                    )
-
-                    is ChatImageViewerSource.Bitmap -> Image(
-                        bitmap = source.bitmap,
-                        contentDescription = source.displayName,
-                        contentScale = ContentScale.Fit,
-                        modifier = gestureModifier,
-                    )
-                }
-            }
-
-            if (busy) {
-                CircularProgressIndicator(color = Color.White)
-            }
-
-            // Control bar — top-right, inset past the status bar / notch.
-            Row(
+            Box(
                 modifier = Modifier
-                    .align(Alignment.TopEnd)
-                    .windowInsetsPadding(WindowInsets.safeDrawing)
-                    .padding(8.dp),
-                horizontalArrangement = Arrangement.spacedBy(4.dp),
+                    .fillMaxSize()
+                    .background(Color.Black.copy(alpha = 0.94f)),
+                contentAlignment = Alignment.Center,
             ) {
-                val tint = IconButtonDefaults.iconButtonColors(contentColor = Color.White)
-                val cdClose = stringResource(R.string.cd_close_viewer)
-                val errorMsg = context.getString(R.string.image_viewer_error)
-                if (exportAllowed) {
-                    val cdShare = stringResource(R.string.cd_share)
-                    val cdSave = stringResource(R.string.cd_save)
-                    IconButton(
-                        onClick = {
-                            scope.launch {
-                                busy = true
-                                val bytes = runCatching { source.bytesProvider() }.getOrNull()
-                                busy = false
-                                if (bytes == null) {
-                                    toast(context, errorMsg)
-                                    return@launch
-                                }
-                                val uri = MediaSaver.stageForShare(
-                                    context,
-                                    bytes,
-                                    source.displayName,
-                                    source.mime,
-                                )
-                                MediaSaver.share(context, uri, source.mime)
-                            }
-                        },
-                        colors = tint,
-                    ) {
-                        Icon(Icons.Filled.Share, contentDescription = cdShare)
-                    }
-                    val savedFmt = context.getString(R.string.image_viewer_saved)
-                    val failedFmt = context.getString(R.string.image_viewer_failed)
-                    IconButton(
-                        onClick = {
-                            scope.launch {
-                                busy = true
-                                val bytes = runCatching { source.bytesProvider() }.getOrNull()
-                                if (bytes == null) {
-                                    busy = false
-                                    toast(context, errorMsg)
-                                    return@launch
-                                }
-                                when (val result = MediaSaver.saveImage(context, bytes, source.displayName, source.mime)) {
-                                    is MediaSaver.SaveResult.Saved -> {
-                                        busy = false
-                                        toast(context, savedFmt.format(result.location))
-                                    }
-                                    MediaSaver.SaveResult.UseShareInstead -> {
-                                        busy = false
-                                        val uri = MediaSaver.stageForShare(
-                                            context,
-                                            bytes,
-                                            source.displayName,
-                                            source.mime,
-                                        )
-                                        MediaSaver.share(context, uri, source.mime)
-                                    }
-                                    is MediaSaver.SaveResult.Failed -> {
-                                        busy = false
-                                        toast(context, failedFmt.format(result.message))
-                                    }
-                                }
-                            }
-                        },
-                        colors = tint,
-                    ) {
-                        Icon(Icons.Filled.Download, contentDescription = cdSave)
+                BlurredMedia(
+                    blurred = blurred,
+                    onReveal = { revealed = true },
+                    modifier = Modifier.fillMaxSize(),
+                ) {
+                    when (source) {
+                        is ChatImageViewerSource.Coil -> AsyncImage(
+                            model = source.model,
+                            contentDescription = source.displayName,
+                            contentScale = ContentScale.Fit,
+                            modifier = gestureModifier,
+                        )
+
+                        is ChatImageViewerSource.Bitmap -> Image(
+                            bitmap = source.bitmap,
+                            contentDescription = source.displayName,
+                            contentScale = ContentScale.Fit,
+                            modifier = gestureModifier,
+                        )
                     }
                 }
-                IconButton(onClick = onDismiss, colors = tint) {
-                    Icon(Icons.Filled.Close, contentDescription = cdClose)
+
+                if (busy) {
+                    CircularProgressIndicator(color = Color.White)
+                }
+
+                // Control bar — top-right, inset past the status bar / notch.
+                Row(
+                    modifier = Modifier
+                        .align(Alignment.TopEnd)
+                        .windowInsetsPadding(WindowInsets.safeDrawing)
+                        .padding(8.dp),
+                    horizontalArrangement = Arrangement.spacedBy(4.dp),
+                ) {
+                    val tint = IconButtonDefaults.iconButtonColors(contentColor = Color.White)
+                    val cdClose = stringResource(R.string.cd_close_viewer)
+                    val errorMsg = context.getString(R.string.image_viewer_error)
+                    if (exportAllowed) {
+                        val cdShare = stringResource(R.string.cd_share)
+                        val cdSave = stringResource(R.string.cd_save)
+                        IconButton(
+                            onClick = {
+                                scope.launch {
+                                    busy = true
+                                    val bytes = try {
+                                        source.bytesProvider()
+                                    } catch (_: Exception) {
+                                        null
+                                    }
+                                    busy = false
+                                    if (bytes == null) {
+                                        UiMessageBus.error(errorMsg)
+                                        return@launch
+                                    }
+                                    val uri = MediaSaver.stageForShare(
+                                        context,
+                                        bytes,
+                                        source.displayName,
+                                        source.mime,
+                                    )
+                                    MediaSaver.share(context, uri, source.mime)
+                                }
+                            },
+                            colors = tint,
+                        ) {
+                            Icon(Icons.Filled.Share, contentDescription = cdShare)
+                        }
+                        val savedFmt = context.getString(R.string.image_viewer_saved)
+                        val failedFmt = context.getString(R.string.image_viewer_failed)
+                        IconButton(
+                            onClick = {
+                                scope.launch {
+                                    busy = true
+                                    val bytes = try {
+                                        source.bytesProvider()
+                                    } catch (_: Exception) {
+                                        null
+                                    }
+                                    if (bytes == null) {
+                                        busy = false
+                                        UiMessageBus.error(errorMsg)
+                                        return@launch
+                                    }
+                                    when (val result = MediaSaver.saveImage(context, bytes, source.displayName, source.mime)) {
+                                        is MediaSaver.SaveResult.Saved -> {
+                                            busy = false
+                                            UiMessageBus.success(savedFmt.format(result.location))
+                                        }
+                                        MediaSaver.SaveResult.UseShareInstead -> {
+                                            busy = false
+                                            val uri = MediaSaver.stageForShare(
+                                                context,
+                                                bytes,
+                                                source.displayName,
+                                                source.mime,
+                                            )
+                                            MediaSaver.share(context, uri, source.mime)
+                                        }
+                                        is MediaSaver.SaveResult.Failed -> {
+                                            busy = false
+                                            UiMessageBus.error(failedFmt.format(result.message))
+                                        }
+                                    }
+                                }
+                            },
+                            colors = tint,
+                        ) {
+                            Icon(Icons.Filled.Download, contentDescription = cdSave)
+                        }
+                    }
+                    IconButton(onClick = onDismiss, colors = tint) {
+                        Icon(Icons.Filled.Close, contentDescription = cdClose)
+                    }
                 }
             }
         }
     }
 }
-
-private fun toast(context: android.content.Context, message: String) {
-    Toast.makeText(context, message, Toast.LENGTH_SHORT).show()
-}

app/src/main/kotlin/com/hermesandroid/relay/ui/components/ChatInputBar.kt

@@ -1,5 +1,6 @@
 package com.hermesandroid.relay.ui.components
 
+import com.hermesandroid.relay.data.BusyMessageAction
 import androidx.compose.animation.AnimatedContent
 import androidx.compose.animation.AnimatedVisibility
 import androidx.compose.animation.core.tween
@@ -191,6 +192,9 @@ fun ChatInputBar(
     physicalEnterSends: Boolean = true,
     largePasteThreshold: Int? = null,
     onLargePaste: (String) -> Unit = {},
+    busyAction: BusyMessageAction? = null,
+    correctionAvailable: Boolean = true,
+    onBusyActionChange: (BusyMessageAction) -> Unit = {},
 ) {
     val canSubmit = enabled && submitEnabled && trailing in setOf(
         ChatInputTrailing.SEND,
@@ -236,7 +240,7 @@ fun ChatInputBar(
         // Correction and queueing are materially different actions. Keep the
         // explanation, but lead with a visible state pill so the distinction
         // does not depend on the trailing icon or accent color alone.
-        AnimatedVisibility(visible = caption != null) {
+        AnimatedVisibility(visible = caption != null && busyAction == null) {
             val detail = caption ?: lastCaption.orEmpty()
             val actionLabel = when (trailing) {
                 ChatInputTrailing.STEER -> stringResource(R.string.chat_input_steer_response)
@@ -319,6 +323,12 @@ fun ChatInputBar(
             )
         }
 
+        ChatComposerLayers(
+            action = busyAction,
+            onActionChange = onBusyActionChange,
+            correctionAvailable = correctionAvailable,
+            onStop = onStop.takeUnless { trailing == ChatInputTrailing.STOP },
+        ) {
         Surface(
             shape = appearanceComposerShape(),
             color = MaterialTheme.colorScheme.surfaceContainerHigh,
@@ -646,6 +656,7 @@ fun ChatInputBar(
     }
 }
 }
+}
 
 internal data class LargeTextInsertion(
     val insertedText: String,

app/src/main/kotlin/com/hermesandroid/relay/ui/components/ChatMediaViewerHost.kt

@@ -0,0 +1,146 @@
+package com.hermesandroid.relay.ui.components
+
+import androidx.compose.runtime.Composable
+import androidx.compose.runtime.CompositionLocalProvider
+import androidx.compose.runtime.Stable
+import androidx.compose.runtime.getValue
+import androidx.compose.runtime.mutableStateOf
+import androidx.compose.runtime.remember
+import androidx.compose.runtime.setValue
+import androidx.compose.runtime.staticCompositionLocalOf
+import com.hermesandroid.relay.data.Attachment
+import com.hermesandroid.relay.data.BlurMode
+
+private sealed interface ChatMediaViewerRequest {
+    val blurMode: BlurMode
+    val exportAllowed: Boolean
+
+    data class SingleAttachment(
+        val attachment: Attachment,
+        val initiallyRevealed: Boolean,
+        override val blurMode: BlurMode,
+        override val exportAllowed: Boolean,
+    ) : ChatMediaViewerRequest
+
+    data class AttachmentGallery(
+        val attachments: List<Attachment>,
+        val initialIndex: Int,
+        val initiallyRevealedKeys: Set<String>,
+        override val blurMode: BlurMode,
+        override val exportAllowed: Boolean,
+    ) : ChatMediaViewerRequest
+
+    data class InlineImage(
+        val source: ChatImageViewerSource,
+        val sensitive: Boolean,
+        val initiallyRevealed: Boolean,
+        override val blurMode: BlurMode,
+        override val exportAllowed: Boolean,
+    ) : ChatMediaViewerRequest
+}
+
+@Stable
+internal class ChatMediaViewerController {
+    private var activeRequest by mutableStateOf<ChatMediaViewerRequest?>(null)
+
+    internal fun openAttachment(
+        attachment: Attachment,
+        initiallyRevealed: Boolean,
+        blurMode: BlurMode,
+        exportAllowed: Boolean,
+    ) {
+        activeRequest = ChatMediaViewerRequest.SingleAttachment(
+            attachment = attachment,
+            initiallyRevealed = initiallyRevealed,
+            blurMode = blurMode,
+            exportAllowed = exportAllowed,
+        )
+    }
+
+    internal fun openGallery(
+        attachments: List<Attachment>,
+        initialIndex: Int,
+        initiallyRevealedKeys: Set<String>,
+        blurMode: BlurMode,
+        exportAllowed: Boolean,
+    ) {
+        activeRequest = ChatMediaViewerRequest.AttachmentGallery(
+            attachments = attachments,
+            initialIndex = initialIndex,
+            initiallyRevealedKeys = initiallyRevealedKeys,
+            blurMode = blurMode,
+            exportAllowed = exportAllowed,
+        )
+    }
+
+    internal fun openImage(
+        source: ChatImageViewerSource,
+        sensitive: Boolean,
+        initiallyRevealed: Boolean,
+        blurMode: BlurMode,
+        exportAllowed: Boolean,
+    ) {
+        activeRequest = ChatMediaViewerRequest.InlineImage(
+            source = source,
+            sensitive = sensitive,
+            initiallyRevealed = initiallyRevealed,
+            blurMode = blurMode,
+            exportAllowed = exportAllowed,
+        )
+    }
+
+    internal fun dismiss() {
+        activeRequest = null
+    }
+
+    @Composable
+    internal fun RenderActiveViewer() {
+        val request = activeRequest ?: return
+        CompositionLocalProvider(
+            LocalMediaBlurMode provides request.blurMode,
+            LocalImageExportAllowed provides request.exportAllowed,
+        ) {
+            when (request) {
+                is ChatMediaViewerRequest.SingleAttachment -> AttachmentViewer(
+                    attachment = request.attachment,
+                    onDismiss = ::dismiss,
+                    initiallyRevealed = request.initiallyRevealed,
+                )
+                is ChatMediaViewerRequest.AttachmentGallery -> AttachmentGalleryViewer(
+                    attachments = request.attachments,
+                    initialIndex = request.initialIndex,
+                    onDismiss = ::dismiss,
+                    initiallyRevealedKeys = request.initiallyRevealedKeys,
+                )
+                is ChatMediaViewerRequest.InlineImage -> ChatImageViewer(
+                    source = request.source,
+                    onDismiss = ::dismiss,
+                    sensitive = request.sensitive,
+                    initiallyRevealed = request.initiallyRevealed,
+                )
+            }
+        }
+    }
+}
+
+internal val LocalChatMediaViewerController =
+    staticCompositionLocalOf<ChatMediaViewerController?> { null }
+
+/**
+ * Owns the active full-screen preview above transcript rows so responsive
+ * portrait/landscape reflow cannot dispose the viewer with its source bubble.
+ */
+@Composable
+internal fun ChatMediaViewerHost(
+    vararg ownerKeys: Any?,
+    content: @Composable () -> Unit,
+) {
+    // A preview never follows a connection/session/policy owner change. Aside
+    // from avoiding stale media, this makes export permission fail closed when
+    // supervised policy changes while a viewer is open.
+    val controller = remember(*ownerKeys) { ChatMediaViewerController() }
+    CompositionLocalProvider(LocalChatMediaViewerController provides controller) {
+        content()
+        controller.RenderActiveViewer()
+    }
+}

app/src/main/kotlin/com/hermesandroid/relay/ui/components/ChatTransportStatusBadge.kt

@@ -1,6 +1,6 @@
 package com.hermesandroid.relay.ui.components
 
-import android.widget.Toast
+import com.hermesandroid.relay.ui.UiMessageBus
 import androidx.compose.foundation.ExperimentalFoundationApi
 import androidx.compose.foundation.combinedClickable
 import androidx.compose.foundation.layout.padding
@@ -12,7 +12,6 @@ import androidx.compose.runtime.Composable
 import androidx.compose.runtime.remember
 import androidx.compose.ui.Modifier
 import androidx.compose.ui.graphics.Color
-import androidx.compose.ui.platform.LocalContext
 import androidx.compose.ui.text.font.FontWeight
 import androidx.compose.ui.unit.dp
 import com.hermesandroid.relay.network.upstream.GatewayAvailability
@@ -140,18 +139,13 @@ fun ChatTransportStatusBadge(
     modifier: Modifier = Modifier,
     onClick: (() -> Unit)? = null,
 ) {
-    val context = LocalContext.current
     val textColor = status.textColor()
     val background = status.backgroundColor()
     Surface(
         modifier = modifier.combinedClickable(
             onClick = { onClick?.invoke() },
             onLongClick = {
-                Toast.makeText(
-                    context,
-                    "${status.reason}: ${status.detail}",
-                    Toast.LENGTH_LONG,
-                ).show()
+                UiMessageBus.info("${status.reason}: ${status.detail}")
             },
         ),
         shape = RoundedCornerShape(999.dp),

app/src/main/kotlin/com/hermesandroid/relay/ui/components/ConnectionHandoffBanner.kt

@@ -73,7 +73,7 @@ private const val SWIPE_DISMISS_THRESHOLD_PX = 80f
  * progress" moment (pairing, long upload, a bridge action sequence). When first
  * reused, decouple it from [ConnectionStatusSnapshot] and rename to a generic
  * `StatusToast`. It also anchors [UpdateAvailableBanner]'s visual language + the
- * shared [ConnectionStepRow]/[StepGlyph] helpers. See TODO.md.
+ * shared [ConnectionStepRow]/[StepGlyph] helpers. See docs/project/TODO.md.
  *
  * Rendered as a top-aligned overlay inside a `Box` — it slides down OVER the UI
  * without shifting layout. Pair it with `AnimatedVisibility(enter =

app/src/main/kotlin/com/hermesandroid/relay/ui/components/ConnectionSetupTimeline.kt

@@ -13,6 +13,8 @@ import androidx.compose.foundation.layout.size
 import androidx.compose.foundation.shape.CircleShape
 import androidx.compose.material.icons.Icons
 import androidx.compose.material.icons.filled.Check
+import androidx.compose.material.icons.filled.Close
+import androidx.compose.material3.CircularProgressIndicator
 import androidx.compose.material3.Icon
 import androidx.compose.material3.MaterialTheme
 import androidx.compose.material3.Text
@@ -20,10 +22,12 @@ import androidx.compose.runtime.Composable
 import androidx.compose.ui.Alignment
 import androidx.compose.ui.Modifier
 import androidx.compose.ui.unit.dp
+import com.hermesandroid.relay.viewmodel.ConnectionStepState
 
 data class ConnectionSetupTimelineStep(
     val title: String,
     val detail: String,
+    val state: ConnectionStepState = ConnectionStepState.Done,
 )
 
 /** Compact completed-state timeline shared by connection and auth flows. */
@@ -43,13 +47,21 @@ fun ConnectionSetupTimeline(
                     Box(
                         modifier = Modifier
                             .size(28.dp)
-                            .background(MaterialTheme.colorScheme.primaryContainer, CircleShape),
+                            .background(when (step.state) {
+                                ConnectionStepState.Failed -> MaterialTheme.colorScheme.errorContainer
+                                ConnectionStepState.Pending -> MaterialTheme.colorScheme.surfaceVariant
+                                else -> MaterialTheme.colorScheme.primaryContainer
+                            }, CircleShape),
                         contentAlignment = Alignment.Center,
                     ) {
-                        Icon(
-                            imageVector = Icons.Filled.Check,
+                        if (step.state == ConnectionStepState.Active) {
+                            CircularProgressIndicator(Modifier.size(17.dp), strokeWidth = 2.dp)
+                        } else if (step.state == ConnectionStepState.Pending) {
+                            Text("·", color = MaterialTheme.colorScheme.onSurfaceVariant)
+                        } else Icon(
+                            imageVector = if (step.state == ConnectionStepState.Failed) Icons.Filled.Close else Icons.Filled.Check,
                             contentDescription = null,
-                            tint = MaterialTheme.colorScheme.onPrimaryContainer,
+                            tint = if (step.state == ConnectionStepState.Failed) MaterialTheme.colorScheme.error else MaterialTheme.colorScheme.onPrimaryContainer,
                             modifier = Modifier.size(17.dp),
                         )
                     }

app/src/main/kotlin/com/hermesandroid/relay/ui/components/ConnectionWizard.kt

@@ -6,7 +6,7 @@ import android.Manifest
 import android.content.ClipData
 import android.content.Intent
 import android.net.Uri
-import android.widget.Toast
+import com.hermesandroid.relay.ui.UiMessageBus
 import androidx.annotation.StringRes
 import androidx.activity.compose.rememberLauncherForActivityResult
 import androidx.activity.result.contract.ActivityResultContracts
@@ -343,11 +343,7 @@ fun ConnectionWizard(
             // user at the manual pairing paths (URL entry / 6-char code)
             // instead of leaving them on a vanishing toast with no scanner.
             step = WizardStep.Nearby
-            Toast.makeText(
-                context,
-                context.getString(R.string.cw_camera_denied),
-                Toast.LENGTH_LONG
-            ).show()
+            UiMessageBus.warning(context.getString(R.string.cw_camera_denied))
         }
     }
 

app/src/main/kotlin/com/hermesandroid/relay/ui/components/CrashReportDialog.kt

@@ -1,7 +1,6 @@
 package com.hermesandroid.relay.ui.components
 
-import android.content.Context
-import android.widget.Toast
+import com.hermesandroid.relay.ui.UiMessageBus
 import androidx.compose.foundation.background
 import androidx.compose.foundation.layout.Arrangement
 import androidx.compose.foundation.layout.Box
@@ -104,120 +103,119 @@ private fun CrashReportDialog(report: ReliabilityReport, onDismiss: () -> Unit)
         onDismissRequest = onDismiss,
         properties = DialogProperties(usePlatformDefaultWidth = false),
     ) {
-        Surface(
-            modifier = Modifier.fillMaxWidth(0.94f),
-            shape = appearanceRoundedCornerShape(24.dp),
-            color = MaterialTheme.colorScheme.surface,
-            tonalElevation = 6.dp,
-        ) {
-            Column(modifier = Modifier.padding(20.dp)) {
-                Row(verticalAlignment = Alignment.CenterVertically) {
-                    Icon(
-                        imageVector = Icons.Filled.WarningAmber,
-                        contentDescription = null,
-                        tint = MaterialTheme.colorScheme.error,
-                        modifier = Modifier.size(24.dp),
-                    )
-                    Spacer(Modifier.width(12.dp))
+        MessageOverlayScope {
+            Surface(
+                modifier = Modifier.fillMaxWidth(0.94f),
+                shape = appearanceRoundedCornerShape(24.dp),
+                color = MaterialTheme.colorScheme.surface,
+                tonalElevation = 6.dp,
+            ) {
+                Column(modifier = Modifier.padding(20.dp)) {
+                    Row(verticalAlignment = Alignment.CenterVertically) {
+                        Icon(
+                            imageVector = Icons.Filled.WarningAmber,
+                            contentDescription = null,
+                            tint = MaterialTheme.colorScheme.error,
+                            modifier = Modifier.size(24.dp),
+                        )
+                        Spacer(Modifier.width(12.dp))
+                        Text(
+                            text = stringResource(R.string.crash_title),
+                            style = MaterialTheme.typography.titleMedium,
+                            fontWeight = FontWeight.SemiBold,
+                        )
+                    }
+
+                    Spacer(Modifier.height(8.dp))
                     Text(
-                        text = stringResource(R.string.crash_title),
-                        style = MaterialTheme.typography.titleMedium,
-                        fontWeight = FontWeight.SemiBold,
+                        text = stringResource(R.string.crash_body),
+                        style = MaterialTheme.typography.bodyMedium,
+                        color = MaterialTheme.colorScheme.onSurfaceVariant,
                     )
-                }
 
-                Spacer(Modifier.height(8.dp))
-                Text(
-                    text = stringResource(R.string.crash_body),
-                    style = MaterialTheme.typography.bodyMedium,
-                    color = MaterialTheme.colorScheme.onSurfaceVariant,
-                )
+                    Text(
+                        text = stringResource(R.string.crash_privacy),
+                        style = MaterialTheme.typography.bodySmall,
+                        color = MaterialTheme.colorScheme.onSurfaceVariant,
+                        modifier = Modifier.padding(top = 6.dp),
+                    )
 
-                Text(
-                    text = stringResource(R.string.crash_privacy),
-                    style = MaterialTheme.typography.bodySmall,
-                    color = MaterialTheme.colorScheme.onSurfaceVariant,
-                    modifier = Modifier.padding(top = 6.dp),
-                )
-
-                if (showDetails) {
-                    Spacer(Modifier.height(14.dp))
-                    Box(
-                        modifier = Modifier
-                            .fillMaxWidth()
-                            .heightIn(min = 120.dp, max = 300.dp)
-                            .clip(appearanceRoundedCornerShape(12.dp))
-                            .background(MaterialTheme.colorScheme.surfaceVariant.copy(alpha = 0.45f)),
-                    ) {
-                        SelectionContainer {
-                            Text(
-                                text = reportText,
-                                fontFamily = FontFamily.Monospace,
-                                fontSize = 11.sp,
-                                lineHeight = 15.sp,
-                                color = MaterialTheme.colorScheme.onSurfaceVariant,
-                                modifier = Modifier
-                                    .verticalScroll(rememberScrollState())
-                                    .padding(12.dp),
-                            )
+                    if (showDetails) {
+                        Spacer(Modifier.height(14.dp))
+                        Box(
+                            modifier = Modifier
+                                .fillMaxWidth()
+                                .heightIn(min = 120.dp, max = 300.dp)
+                                .clip(appearanceRoundedCornerShape(12.dp))
+                                .background(MaterialTheme.colorScheme.surfaceVariant.copy(alpha = 0.45f)),
+                        ) {
+                            SelectionContainer {
+                                Text(
+                                    text = reportText,
+                                    fontFamily = FontFamily.Monospace,
+                                    fontSize = 11.sp,
+                                    lineHeight = 15.sp,
+                                    color = MaterialTheme.colorScheme.onSurfaceVariant,
+                                    modifier = Modifier
+                                        .verticalScroll(rememberScrollState())
+                                        .padding(12.dp),
+                                )
+                            }
                         }
                     }
-                }
 
-                Spacer(Modifier.height(18.dp))
-                // FlowRow so the actions wrap instead of clipping on narrow /
-                // foldable cover screens now that a fourth (Share) action exists.
-                FlowRow(
-                    modifier = Modifier.fillMaxWidth(),
-                    horizontalArrangement = Arrangement.spacedBy(8.dp, Alignment.End),
-                    verticalArrangement = Arrangement.spacedBy(4.dp),
-                ) {
-                    TextButton(onClick = onDismiss) { Text(stringResource(R.string.common_dismiss)) }
-                    if (!showDetails) {
-                        Button(onClick = { showDetails = true }) {
-                            Text(stringResource(R.string.crash_review))
-                        }
-                    } else {
-                        OutlinedButton(
-                            onClick = {
-                                IssueReport.copyToClipboard(context, reportText)
-                                toast(context, copiedMessage)
-                            },
-                        ) { Text(stringResource(R.string.common_copy)) }
-                    // Universal, GitHub-free path: hand the full report to the
-                    // system share sheet (email, chat apps, notes, Drive…). The
-                    // user picks the destination, so nothing leaves the device
-                    // until they choose to send it — same privacy posture as Copy.
-                        OutlinedButton(
-                            onClick = {
-                                val shared = IssueReport.share(
-                                    context,
-                                    reportSubject,
-                                    reportText,
-                                    chooserTitle = shareTitle,
-                                )
-                                if (!shared) {
+                    Spacer(Modifier.height(18.dp))
+                    // FlowRow so the actions wrap instead of clipping on narrow /
+                    // foldable cover screens now that a fourth (Share) action exists.
+                    FlowRow(
+                        modifier = Modifier.fillMaxWidth(),
+                        horizontalArrangement = Arrangement.spacedBy(8.dp, Alignment.End),
+                        verticalArrangement = Arrangement.spacedBy(4.dp),
+                    ) {
+                        TextButton(onClick = onDismiss) { Text(stringResource(R.string.common_dismiss)) }
+                        if (!showDetails) {
+                            Button(onClick = { showDetails = true }) {
+                                Text(stringResource(R.string.crash_review))
+                            }
+                        } else {
+                            OutlinedButton(
+                                onClick = {
                                     IssueReport.copyToClipboard(context, reportText)
-                                    toast(context, noShareMessage)
-                                }
-                                onDismiss()
-                            },
-                        ) { Text(stringResource(R.string.common_share)) }
-                        Button(
-                            onClick = {
-                                IssueReport.copyToClipboard(context, reportText)
-                                val opened = IssueReport.openUrl(context, CrashReporter.buildGithubIssueUrl(report))
-                                toast(context, if (opened) openedMessage else noBrowserMessage)
-                                onDismiss()
-                            },
-                        ) { Text(stringResource(R.string.common_report)) }
+                                    UiMessageBus.success(copiedMessage)
+                                },
+                            ) { Text(stringResource(R.string.common_copy)) }
+                        // Universal, GitHub-free path: hand the full report to the
+                        // system share sheet (email, chat apps, notes, Drive…). The
+                        // user picks the destination, so nothing leaves the device
+                        // until they choose to send it — same privacy posture as Copy.
+                            OutlinedButton(
+                                onClick = {
+                                    val shared = IssueReport.share(
+                                        context,
+                                        reportSubject,
+                                        reportText,
+                                        chooserTitle = shareTitle,
+                                    )
+                                    if (!shared) {
+                                        IssueReport.copyToClipboard(context, reportText)
+                                        UiMessageBus.warning(noShareMessage)
+                                    }
+                                    onDismiss()
+                                },
+                            ) { Text(stringResource(R.string.common_share)) }
+                            Button(
+                                onClick = {
+                                    IssueReport.copyToClipboard(context, reportText)
+                                    val opened = IssueReport.openUrl(context, CrashReporter.buildGithubIssueUrl(report))
+                                    if (opened) UiMessageBus.success(openedMessage)
+                                    else UiMessageBus.warning(noBrowserMessage)
+                                    onDismiss()
+                                },
+                            ) { Text(stringResource(R.string.common_report)) }
+                        }
                     }
                 }
             }
         }
     }
 }
-
-private fun toast(context: Context, message: String) {
-    Toast.makeText(context, message, Toast.LENGTH_LONG).show()
-}

app/src/main/kotlin/com/hermesandroid/relay/ui/components/DiagnosticDetailDialog.kt

@@ -1,7 +1,7 @@
 package com.hermesandroid.relay.ui.components
 
 import android.text.format.DateFormat
-import android.widget.Toast
+import com.hermesandroid.relay.ui.UiMessageBus
 import androidx.compose.foundation.background
 import androidx.compose.foundation.layout.Arrangement
 import androidx.compose.foundation.layout.Box
@@ -78,159 +78,158 @@ fun DiagnosticDetailDialog(entry: DiagnosticLogEntry, onDismiss: () -> Unit) {
         onDismissRequest = onDismiss,
         properties = DialogProperties(usePlatformDefaultWidth = false),
     ) {
-        Surface(
-            modifier = Modifier.fillMaxWidth(0.94f),
-            shape = appearanceRoundedCornerShape(24.dp),
-            color = MaterialTheme.colorScheme.surface,
-            tonalElevation = 6.dp,
-        ) {
-            Column(modifier = Modifier.padding(20.dp)) {
-                Row(verticalAlignment = Alignment.CenterVertically) {
-                    DiagnosticSeverityChip(entry.severity)
-                    Spacer(Modifier.width(10.dp))
-                    Text(
-                        text = entry.category.label,
-                        style = MaterialTheme.typography.labelMedium,
-                        color = MaterialTheme.colorScheme.onSurfaceVariant,
-                    )
-                }
+        MessageOverlayScope {
+            Surface(
+                modifier = Modifier.fillMaxWidth(0.94f),
+                shape = appearanceRoundedCornerShape(24.dp),
+                color = MaterialTheme.colorScheme.surface,
+                tonalElevation = 6.dp,
+            ) {
+                Column(modifier = Modifier.padding(20.dp)) {
+                    Row(verticalAlignment = Alignment.CenterVertically) {
+                        DiagnosticSeverityChip(entry.severity)
+                        Spacer(Modifier.width(10.dp))
+                        Text(
+                            text = entry.category.label,
+                            style = MaterialTheme.typography.labelMedium,
+                            color = MaterialTheme.colorScheme.onSurfaceVariant,
+                        )
+                    }
 
-                Spacer(Modifier.height(10.dp))
-                Text(
-                    text = entry.title,
-                    style = MaterialTheme.typography.titleMedium,
-                    fontWeight = FontWeight.SemiBold,
-                )
-
-                Spacer(Modifier.height(10.dp))
-                // Metadata rows — only render the ones that are present.
-                MetaRow("When", DateFormat.format("yyyy-MM-dd HH:mm:ss", entry.timestampMs).toString())
-                MetaRow("Severity", severityName)
-                MetaRow("Category", entry.category.label)
-                entry.operation?.let { MetaRow("Operation", it) }
-                entry.endpointRole?.let { MetaRow("Route", it) }
-                entry.configuredUrl?.let { MetaRow("Configured URL", it) }
-                entry.requestUrl?.let { MetaRow("Request", it) }
-                if (entry.configuredUrl == null && entry.requestUrl == null) {
-                    entry.url?.let { MetaRow("URL", it) }
-                }
-                entry.elapsedMs?.let { MetaRow("Elapsed", "${it}ms") }
-                entry.suggestion?.let { suggestion ->
                     Spacer(Modifier.height(10.dp))
                     Text(
-                        text = "Suggested next step",
-                        style = MaterialTheme.typography.labelMedium,
-                        color = MaterialTheme.colorScheme.onSurfaceVariant,
+                        text = entry.title,
+                        style = MaterialTheme.typography.titleMedium,
+                        fontWeight = FontWeight.SemiBold,
                     )
-                    Text(
-                        text = suggestion,
-                        style = MaterialTheme.typography.bodySmall,
-                        color = MaterialTheme.colorScheme.onSurface,
-                    )
-                }
 
-                Spacer(Modifier.height(14.dp))
-                val body = entry.stacktrace ?: entry.detail
-                if (body != null) {
-                    Box(
-                        modifier = Modifier
-                            .fillMaxWidth()
-                            .heightIn(min = 120.dp, max = 320.dp)
-                            .background(
-                                MaterialTheme.colorScheme.surfaceVariant.copy(alpha = 0.45f),
-                                appearanceRoundedCornerShape(12.dp),
-                            ),
-                    ) {
-                        SelectionContainer {
-                            Text(
-                                text = body,
-                                fontFamily = FontFamily.Monospace,
-                                fontSize = 11.sp,
-                                lineHeight = 15.sp,
-                                color = MaterialTheme.colorScheme.onSurfaceVariant,
-                                modifier = Modifier
-                                    .verticalScroll(rememberScrollState())
-                                    .padding(12.dp),
-                            )
-                        }
+                    Spacer(Modifier.height(10.dp))
+                    // Metadata rows — only render the ones that are present.
+                    MetaRow("When", DateFormat.format("yyyy-MM-dd HH:mm:ss", entry.timestampMs).toString())
+                    MetaRow("Severity", severityName)
+                    MetaRow("Category", entry.category.label)
+                    entry.operation?.let { MetaRow("Operation", it) }
+                    entry.endpointRole?.let { MetaRow("Route", it) }
+                    entry.configuredUrl?.let { MetaRow("Configured URL", it) }
+                    entry.requestUrl?.let { MetaRow("Request", it) }
+                    if (entry.configuredUrl == null && entry.requestUrl == null) {
+                        entry.url?.let { MetaRow("URL", it) }
+                    }
+                    entry.elapsedMs?.let { MetaRow("Elapsed", "${it}ms") }
+                    entry.suggestion?.let { suggestion ->
+                        Spacer(Modifier.height(10.dp))
+                        Text(
+                            text = "Suggested next step",
+                            style = MaterialTheme.typography.labelMedium,
+                            color = MaterialTheme.colorScheme.onSurfaceVariant,
+                        )
+                        Text(
+                            text = suggestion,
+                            style = MaterialTheme.typography.bodySmall,
+                            color = MaterialTheme.colorScheme.onSurface,
+                        )
                     }
-                } else {
-                    Text(
-                        text = stringResource(R.string.diagnostic_no_detail),
-                        style = MaterialTheme.typography.bodySmall,
-                        color = MaterialTheme.colorScheme.onSurfaceVariant,
-                    )
-                }
 
-                if (expectationVisible) {
                     Spacer(Modifier.height(14.dp))
-                    OutlinedTextField(
-                        value = expectation,
-                        onValueChange = { expectation = it },
-                        label = { Text("What were you expecting to happen?") },
-                        supportingText = {
-                            Text(stringResource(R.string.diagnostic_routine_hint))
-                        },
-                        minLines = 2,
-                        modifier = Modifier.fillMaxWidth(),
-                    )
-                }
-
-                Spacer(Modifier.height(18.dp))
-                FlowRow(
-                    modifier = Modifier.fillMaxWidth(),
-                    horizontalArrangement = Arrangement.spacedBy(8.dp, Alignment.End),
-                    verticalArrangement = Arrangement.spacedBy(4.dp),
-                ) {
-                    TextButton(onClick = onDismiss) { Text(stringResource(R.string.common_close)) }
-                    OutlinedButton(
-                        onClick = {
-                            IssueReport.copyToClipboard(context, plainText)
-                            toast(context, copiedToast)
-                        },
-                    ) { Text(stringResource(R.string.common_copy)) }
-                    OutlinedButton(
-                        onClick = {
-                            val shared = IssueReport.share(
-                                context,
-                                subject = "Hermes-Relay diagnostic — ${entry.title}",
-                                text = plainText,
-                                chooserTitle = exportChooserTitle,
-                            )
-                            if (!shared) {
-                                IssueReport.copyToClipboard(context, plainText)
-                                toast(context, "Copied — no app found to share to")
-                            }
-                        },
-                    ) { Text(stringResource(R.string.common_export)) }
-                    Button(
-                        enabled = !expectationVisible || expectation.isNotBlank(),
-                        onClick = {
-                            if (needsExpectation && !expectationVisible) {
-                                expectationVisible = true
-                                return@Button
-                            }
-                            // Copy full text first; the GitHub URL only carries the
-                            // head of long traces, so the user can paste the rest.
-                            IssueReport.copyToClipboard(context, plainText)
-                            val opened = IssueReport.openUrl(
-                                context,
-                                IssueReport.buildGithubIssueUrl(
-                                    title = DiagnosticIssuePrefill.issueTitle(entry),
-                                    bodyMarkdown = DiagnosticIssuePrefill.issueBody(
-                                        entry,
-                                        expectation = expectation.takeIf { expectationVisible },
-                                    ),
-                                    labels = DiagnosticIssuePrefill.issueLabels(entry),
+                    val body = entry.stacktrace ?: entry.detail
+                    if (body != null) {
+                        Box(
+                            modifier = Modifier
+                                .fillMaxWidth()
+                                .heightIn(min = 120.dp, max = 320.dp)
+                                .background(
+                                    MaterialTheme.colorScheme.surfaceVariant.copy(alpha = 0.45f),
+                                    appearanceRoundedCornerShape(12.dp),
                                 ),
-                            )
-                            toast(
-                                context,
-                                if (opened) "Full diagnostic copied — paste it into the issue if truncated"
-                                else "Copied — no browser found to open GitHub",
-                            )
-                        },
-                    ) { Text(stringResource(R.string.common_report)) }
+                        ) {
+                            SelectionContainer {
+                                Text(
+                                    text = body,
+                                    fontFamily = FontFamily.Monospace,
+                                    fontSize = 11.sp,
+                                    lineHeight = 15.sp,
+                                    color = MaterialTheme.colorScheme.onSurfaceVariant,
+                                    modifier = Modifier
+                                        .verticalScroll(rememberScrollState())
+                                        .padding(12.dp),
+                                )
+                            }
+                        }
+                    } else {
+                        Text(
+                            text = stringResource(R.string.diagnostic_no_detail),
+                            style = MaterialTheme.typography.bodySmall,
+                            color = MaterialTheme.colorScheme.onSurfaceVariant,
+                        )
+                    }
+
+                    if (expectationVisible) {
+                        Spacer(Modifier.height(14.dp))
+                        OutlinedTextField(
+                            value = expectation,
+                            onValueChange = { expectation = it },
+                            label = { Text("What were you expecting to happen?") },
+                            supportingText = {
+                                Text(stringResource(R.string.diagnostic_routine_hint))
+                            },
+                            minLines = 2,
+                            modifier = Modifier.fillMaxWidth(),
+                        )
+                    }
+
+                    Spacer(Modifier.height(18.dp))
+                    FlowRow(
+                        modifier = Modifier.fillMaxWidth(),
+                        horizontalArrangement = Arrangement.spacedBy(8.dp, Alignment.End),
+                        verticalArrangement = Arrangement.spacedBy(4.dp),
+                    ) {
+                        TextButton(onClick = onDismiss) { Text(stringResource(R.string.common_close)) }
+                        OutlinedButton(
+                            onClick = {
+                                IssueReport.copyToClipboard(context, plainText)
+                                UiMessageBus.success(copiedToast)
+                            },
+                        ) { Text(stringResource(R.string.common_copy)) }
+                        OutlinedButton(
+                            onClick = {
+                                val shared = IssueReport.share(
+                                    context,
+                                    subject = "Hermes-Relay diagnostic — ${entry.title}",
+                                    text = plainText,
+                                    chooserTitle = exportChooserTitle,
+                                )
+                                if (!shared) {
+                                    IssueReport.copyToClipboard(context, plainText)
+                                    UiMessageBus.warning("Copied — no app found to share to")
+                                }
+                            },
+                        ) { Text(stringResource(R.string.common_export)) }
+                        Button(
+                            enabled = !expectationVisible || expectation.isNotBlank(),
+                            onClick = {
+                                if (needsExpectation && !expectationVisible) {
+                                    expectationVisible = true
+                                    return@Button
+                                }
+                                // Copy full text first; the GitHub URL only carries the
+                                // head of long traces, so the user can paste the rest.
+                                IssueReport.copyToClipboard(context, plainText)
+                                val opened = IssueReport.openUrl(
+                                    context,
+                                    IssueReport.buildGithubIssueUrl(
+                                        title = DiagnosticIssuePrefill.issueTitle(entry),
+                                        bodyMarkdown = DiagnosticIssuePrefill.issueBody(
+                                            entry,
+                                            expectation = expectation.takeIf { expectationVisible },
+                                        ),
+                                        labels = DiagnosticIssuePrefill.issueLabels(entry),
+                                    ),
+                                )
+                                if (opened) UiMessageBus.success("Full diagnostic copied — paste it into the issue if truncated")
+                                else UiMessageBus.warning("Copied — no browser found to open GitHub")
+                            },
+                        ) { Text(stringResource(R.string.common_report)) }
+                    }
                 }
             }
         }
@@ -276,10 +275,6 @@ internal fun DiagnosticSeverityChip(severity: DiagnosticSeverity) {
     }
 }
 
-private fun toast(context: android.content.Context, message: String) {
-    Toast.makeText(context, message, Toast.LENGTH_LONG).show()
-}
-
 /** Full, copy/share-ready plain-text rendering of a single diagnostic entry. */
 private fun DiagnosticLogEntry.toPlainText(): String = buildString {
     appendLine("Hermes-Relay diagnostic")

app/src/main/kotlin/com/hermesandroid/relay/ui/components/GatewayBackgroundProcesses.kt

@@ -24,12 +24,12 @@ import androidx.compose.material.icons.filled.AccountTree
 import androidx.compose.material.icons.filled.CheckCircle
 import androidx.compose.material.icons.filled.Close
 import androidx.compose.material.icons.filled.ErrorOutline
+import androidx.compose.material.icons.filled.HelpOutline
+import androidx.compose.material.icons.filled.PauseCircleOutline
 import androidx.compose.material.icons.filled.ExpandLess
 import androidx.compose.material.icons.filled.ExpandMore
 import androidx.compose.material.icons.filled.Refresh
-import androidx.compose.material.icons.filled.PauseCircleOutline
 import androidx.compose.material.icons.filled.Stop
-import androidx.compose.material.icons.filled.Terminal
 import androidx.compose.material.icons.filled.Visibility
 import androidx.compose.material3.CircularProgressIndicator
 import androidx.compose.material3.ExperimentalMaterial3Api
@@ -66,7 +66,6 @@ import androidx.compose.ui.unit.dp
 import com.hermesandroid.relay.R
 import com.hermesandroid.relay.network.upstream.GatewayProcess
 import com.hermesandroid.relay.viewmodel.SubagentActivity
-import com.hermesandroid.relay.viewmodel.SubagentActivityPhase
 import com.hermesandroid.relay.viewmodel.SubagentChildPreview
 import kotlinx.coroutines.launch
 
@@ -84,27 +83,18 @@ internal fun GatewayBackgroundProcessStrip(
     onClick: () -> Unit,
     modifier: Modifier = Modifier,
 ) {
-    // Initial/switch refreshes are silent. The strip appears only after the
-    // session actually owns a process, avoiding a transient "Checking" row on
-    // every ordinary chat open.
+    // Completed work remains reachable from its transcript receipt. Only active
+    // work owns composer space; refreshing history must not resurrect the strip.
     val visibleActivities = subagentActivities.takeIf { subagentPreviewVisibility.showLifecycle }.orEmpty()
-    if (processes.isEmpty() && visibleActivities.isEmpty()) return
-
     val running = processes.count { it.isRunning }
     val runningAgents = visibleActivities.count { !it.isTerminal }
-    val failed = processes.count { !it.isRunning && (it.exitCode ?: 0) != 0 }
-    val failedAgents = visibleActivities.count { it.phase == SubagentActivityPhase.FAILED }
-    val interruptedAgents = visibleActivities.count {
-        it.phase == SubagentActivityPhase.INTERRUPTED ||
-            it.phase == SubagentActivityPhase.ENDED_WITH_PARENT
-    }
-    val failureCount = failed + failedAgents
+    if (running == 0 && runningAgents == 0) return
     val status = when {
+        runningAgents > 0 && running > 0 -> stringResource(
+            R.string.current_chat_activity_summary, runningAgents, running,
+        )
         runningAgents > 0 -> stringResource(R.string.subagent_lane_running_count, runningAgents)
-        running > 0 -> "$running ${stringResource(R.string.bg_processes_running)}"
-        failureCount > 0 -> "$failureCount ${stringResource(R.string.task_status_failed)}"
-        interruptedAgents > 0 -> stringResource(R.string.agent_activity_status_interrupted)
-        else -> stringResource(R.string.task_status_complete)
+        else -> "$running ${stringResource(R.string.bg_processes_running)}"
     }
     val openDescription = stringResource(R.string.current_chat_activity_open)
 
@@ -130,24 +120,7 @@ internal fun GatewayBackgroundProcessStrip(
             modifier = Modifier.padding(horizontal = 12.dp, vertical = 9.dp),
             verticalAlignment = Alignment.CenterVertically,
         ) {
-            if (running > 0 || runningAgents > 0 || loading) {
-                CircularProgressIndicator(modifier = Modifier.size(16.dp), strokeWidth = 2.dp)
-            } else {
-                Icon(
-                    imageVector = when {
-                        failureCount > 0 -> Icons.Filled.ErrorOutline
-                        interruptedAgents > 0 -> Icons.Filled.PauseCircleOutline
-                        else -> Icons.Filled.CheckCircle
-                    },
-                    contentDescription = null,
-                    modifier = Modifier.size(17.dp),
-                    tint = when {
-                        failureCount > 0 -> MaterialTheme.colorScheme.error
-                        interruptedAgents > 0 -> MaterialTheme.colorScheme.tertiary
-                        else -> MaterialTheme.colorScheme.primary
-                    },
-                )
-            }
+            CircularProgressIndicator(modifier = Modifier.size(16.dp), strokeWidth = 2.dp)
             Spacer(Modifier.width(9.dp))
             Text(
                 text = stringResource(R.string.current_chat_activity_title),
@@ -157,11 +130,7 @@ internal fun GatewayBackgroundProcessStrip(
             Text(
                 text = status,
                 style = MaterialTheme.typography.labelMedium,
-                color = if (failureCount > 0 && running == 0) {
-                    MaterialTheme.colorScheme.error
-                } else {
-                    MaterialTheme.colorScheme.onSurfaceVariant
-                },
+                color = MaterialTheme.colorScheme.onSurfaceVariant,
             )
             Icon(
                 imageVector = Icons.Filled.Visibility,
@@ -190,6 +159,8 @@ internal fun GatewayBackgroundProcessSheet(
     onDismissProcess: (String) -> Unit,
     onOpenSubagentChild: (String) -> Unit,
     onDismiss: () -> Unit,
+    readOnlyHistory: Boolean = false,
+    historyNotice: String? = null,
 ) {
     val sheetState = rememberModalBottomSheetState(skipPartiallyExpanded = false)
     val listState = androidx.compose.foundation.lazy.rememberLazyListState()
@@ -246,17 +217,19 @@ internal fun GatewayBackgroundProcessSheet(
             ) {
                 Column(modifier = Modifier.weight(1f)) {
                     Text(
-                        stringResource(R.string.current_chat_activity_title),
+                        stringResource(
+                            if (readOnlyHistory) R.string.chat_activity_history_title else R.string.current_chat_activity_title,
+                        ),
                         modifier = Modifier.semantics { heading() },
                         style = MaterialTheme.typography.titleLarge,
                     )
                     Text(
-                        stringResource(R.string.current_chat_activity_subtitle),
+                        historyNotice ?: stringResource(R.string.current_chat_activity_subtitle),
                         style = MaterialTheme.typography.bodySmall,
                         color = MaterialTheme.colorScheme.onSurfaceVariant,
                     )
                 }
-                if (processes.isNotEmpty()) IconButton(onClick = onRefresh, enabled = !loading) {
+                if (processes.isNotEmpty() && !readOnlyHistory) IconButton(onClick = onRefresh, enabled = !loading) {
                     if (loading) {
                         CircularProgressIndicator(modifier = Modifier.size(20.dp), strokeWidth = 2.dp)
                     } else {
@@ -300,7 +273,9 @@ internal fun GatewayBackgroundProcessSheet(
                         tint = MaterialTheme.colorScheme.onSurfaceVariant,
                     )
                     Text(
-                        stringResource(R.string.current_chat_activity_empty),
+                        stringResource(
+                            if (readOnlyHistory) R.string.chat_activity_history_empty else R.string.current_chat_activity_empty,
+                        ),
                         modifier = Modifier.padding(top = 12.dp),
                         color = MaterialTheme.colorScheme.onSurfaceVariant,
                     )
@@ -341,7 +316,7 @@ internal fun GatewayBackgroundProcessSheet(
                             GatewayProcessRow(
                                 process = process,
                                 stopping = process.id in stoppingProcessIds,
-                                onStop = { onStop(process.id) },
+                                onStop = if (readOnlyHistory) null else ({ onStop(process.id) }),
                                 onDismiss = null,
                             )
                         }
@@ -356,7 +331,7 @@ internal fun GatewayBackgroundProcessSheet(
                                 process = process,
                                 stopping = false,
                                 onStop = null,
-                                onDismiss = { onDismissProcess(process.id) },
+                                onDismiss = if (readOnlyHistory) null else ({ onDismissProcess(process.id) }),
                             )
                         }
                     }
@@ -384,7 +359,7 @@ private fun GatewayProcessRow(
     onDismiss: (() -> Unit)?,
 ) {
     var expanded by remember(process.id) { mutableStateOf(false) }
-    val failed = !process.isRunning && (process.exitCode ?: 0) != 0
+    val failed = processDisplayPhase(process) == ProcessDisplayPhase.FAILED
     val output = sanitizeTerminalText(
         process.outputTail.orEmpty().ifBlank { process.outputPreview.orEmpty() },
     ).trimEnd()
@@ -478,9 +453,11 @@ private fun GatewayProcessRow(
 
 @Composable
 private fun ProcessStateIcon(process: GatewayProcess, failed: Boolean, stopping: Boolean) {
+    val phase = processDisplayPhase(process)
     val tint: Color = when {
         failed -> MaterialTheme.colorScheme.error
         process.isRunning || stopping -> MaterialTheme.colorScheme.primary
+        phase == ProcessDisplayPhase.UNKNOWN || phase == ProcessDisplayPhase.CANCELLED -> MaterialTheme.colorScheme.onSurfaceVariant
         else -> MaterialTheme.colorScheme.tertiary
     }
     Surface(
@@ -501,6 +478,14 @@ private fun ProcessStateIcon(process: GatewayProcess, failed: Boolean, stopping:
                     modifier = Modifier.size(18.dp),
                     tint = tint,
                 )
+                phase == ProcessDisplayPhase.UNKNOWN || phase == ProcessDisplayPhase.CANCELLED -> Icon(
+                    imageVector = if (phase == ProcessDisplayPhase.UNKNOWN) Icons.Filled.HelpOutline else Icons.Filled.PauseCircleOutline,
+                    contentDescription = stringResource(
+                        if (phase == ProcessDisplayPhase.UNKNOWN) R.string.agent_activity_status_unavailable else R.string.task_status_cancelled,
+                    ),
+                    modifier = Modifier.size(18.dp),
+                    tint = tint,
+                )
                 else -> Icon(
                     Icons.Filled.CheckCircle,
                     contentDescription = stringResource(R.string.tool_completed_a11y),
@@ -514,8 +499,11 @@ private fun ProcessStateIcon(process: GatewayProcess, failed: Boolean, stopping:
 
 @Composable
 private fun processMetadata(process: GatewayProcess, failed: Boolean): String {
+    val phase = processDisplayPhase(process)
     val state = when {
         process.isRunning -> stringResource(R.string.bg_processes_running)
+        phase == ProcessDisplayPhase.UNKNOWN -> stringResource(R.string.agent_activity_status_unavailable)
+        phase == ProcessDisplayPhase.CANCELLED -> stringResource(R.string.task_status_cancelled)
         failed -> stringResource(R.string.task_status_failed) +
             process.exitCode?.let { " · exit $it" }.orEmpty()
         else -> stringResource(R.string.task_status_complete) +
@@ -525,6 +513,19 @@ private fun processMetadata(process: GatewayProcess, failed: Boolean): String {
         if (process.detached) " · recovered" else ""
 }
 
+internal enum class ProcessDisplayPhase { RUNNING, COMPLETE, FAILED, CANCELLED, UNKNOWN }
+
+/** A recovered or unfamiliar state is not evidence of successful completion. */
+internal fun processDisplayPhase(process: GatewayProcess): ProcessDisplayPhase = when {
+    process.isRunning -> ProcessDisplayPhase.RUNNING
+    process.status.equals("unknown", ignoreCase = true) -> ProcessDisplayPhase.UNKNOWN
+    process.status.equals("cancelled", ignoreCase = true) ||
+        process.status.equals("canceled", ignoreCase = true) -> ProcessDisplayPhase.CANCELLED
+    process.status.equals("failed", ignoreCase = true) || (process.exitCode ?: 0) != 0 -> ProcessDisplayPhase.FAILED
+    process.exitCode == 0 || process.status.lowercase() in setOf("complete", "completed", "exited") -> ProcessDisplayPhase.COMPLETE
+    else -> ProcessDisplayPhase.UNKNOWN
+}
+
 private val ansiTerminalEscape = Regex(
     "\u001B(?:\\].*?(?:\u0007|\u001B\\\\)|\\[[0-?]*[ -/]*[@-~]|[ -/]*[@-~])",
     RegexOption.DOT_MATCHES_ALL,

app/src/main/kotlin/com/hermesandroid/relay/ui/components/InboundAttachmentCard.kt

@@ -5,7 +5,7 @@ import android.graphics.Bitmap
 import android.graphics.pdf.PdfRenderer
 import android.media.MediaMetadataRetriever
 import android.net.Uri
-import android.widget.Toast
+import com.hermesandroid.relay.ui.UiMessageBus
 import androidx.compose.ui.res.stringResource
 import com.hermesandroid.relay.R
 import com.hermesandroid.relay.ui.theme.appearanceRoundedCornerShape
@@ -14,6 +14,7 @@ import androidx.compose.foundation.Image
 import androidx.compose.foundation.clickable
 import androidx.compose.foundation.combinedClickable
 import androidx.compose.foundation.layout.Arrangement
+import androidx.compose.foundation.layout.aspectRatio
 import androidx.compose.foundation.layout.Box
 import androidx.compose.foundation.layout.Column
 import androidx.compose.foundation.layout.Row
@@ -44,6 +45,7 @@ import androidx.compose.runtime.getValue
 import androidx.compose.runtime.mutableStateOf
 import androidx.compose.runtime.remember
 import androidx.compose.runtime.rememberCoroutineScope
+import androidx.compose.runtime.saveable.rememberSaveable
 import androidx.compose.runtime.setValue
 import androidx.compose.ui.Alignment
 import androidx.compose.ui.Modifier
@@ -302,17 +304,21 @@ private fun ImageRender(
     }
     LaunchedEffect(attachment.cachedUri, attachment.content) {
         val decoded = withContext(Dispatchers.IO) {
-            runCatching {
-                val bytes: ByteArray? = when {
+            try {
+                when {
                     !attachment.cachedUri.isNullOrBlank() ->
-                        context.contentResolver.openInputStream(Uri.parse(attachment.cachedUri))
-                            ?.use { it.readBytes() }
+                        decodeBoundedOrientedBitmap(context, Uri.parse(attachment.cachedUri))
+                            ?.asImageBitmap()
                     attachment.content.isNotBlank() ->
-                        android.util.Base64.decode(attachment.content, android.util.Base64.DEFAULT)
+                        android.util.Base64.decode(
+                            attachment.content,
+                            android.util.Base64.DEFAULT,
+                        ).let { decodeBoundedOrientedBitmap(it)?.asImageBitmap() }
                     else -> null
                 }
-                bytes?.let { decodeOrientedBitmap(it)?.asImageBitmap() }
-            }.getOrNull()
+            } catch (_: Exception) {
+                null
+            }
         }
         if (decoded != null) bitmap = decoded else decodeFailed = true
     }
@@ -329,9 +335,14 @@ private fun ImageRender(
     }
 
     val blurMode = LocalMediaBlurMode.current
+    val viewerController = LocalChatMediaViewerController.current
     var revealed by remember(attachment.cachedUri, attachment.content) { mutableStateOf(false) }
     val blurred = !revealed && shouldBlurImage(blurMode, attachment.sensitive)
-    var viewerOpen by remember { mutableStateOf(false) }
+    var viewerOpen by rememberSaveable(
+        attachment.cachedUri,
+        attachment.relayToken,
+        attachment.fileName,
+    ) { mutableStateOf(false) }
     var menuExpanded by remember { mutableStateOf(false) }
 
     val bmp = bitmap
@@ -352,7 +363,7 @@ private fun ImageRender(
         return
     }
 
-    if (viewerOpen) {
+    if (viewerController == null && viewerOpen) {
         AttachmentViewer(
             attachment = attachment,
             onDismiss = { viewerOpen = false },
@@ -367,12 +378,25 @@ private fun ImageRender(
                 contentDescription = attachment.fileName,
                 modifier = Modifier
                     .widthIn(max = maxWidth)
+                    .fillMaxWidth()
+                    .aspectRatio(bmp.width.toFloat() / bmp.height.coerceAtLeast(1))
                     .clip(RoundedCornerShape(8.dp))
                     .combinedClickable(
-                        onClick = { viewerOpen = true },
+                        onClick = {
+                            if (viewerController != null) {
+                                viewerController.openAttachment(
+                                    attachment = attachment,
+                                    initiallyRevealed = revealed,
+                                    blurMode = blurMode,
+                                    exportAllowed = exportAllowed,
+                                )
+                            } else {
+                                viewerOpen = true
+                            }
+                        },
                         onLongClick = { menuExpanded = true },
                     ),
-                contentScale = ContentScale.FillWidth,
+                contentScale = ContentScale.Fit,
             )
         }
         // One-tap save overlay — hidden while the blur cover is up so it
@@ -406,15 +430,20 @@ private fun FileCardRender(
     val scope = rememberCoroutineScope()
     val (emoji, typeLabel) = emojiAndLabelFor(attachment.renderMode, attachment.contentType)
     var menuExpanded by remember { mutableStateOf(false) }
-    var viewerOpen by remember { mutableStateOf(false) }
+    var viewerOpen by rememberSaveable(
+        attachment.cachedUri,
+        attachment.relayToken,
+        attachment.fileName,
+    ) { mutableStateOf(false) }
 
     // Real thumbnail when one is cheap (video first frame, PDF first page);
     // null falls back to the type emoji.
     val thumbnail = rememberAttachmentThumbnail(attachment)
     val blurMode = LocalMediaBlurMode.current
+    val viewerController = LocalChatMediaViewerController.current
     val blurThumb = thumbnail != null && shouldBlurThumb(blurMode, attachment)
 
-    if (viewerOpen) {
+    if (viewerController == null && viewerOpen) {
         // Non-image types don't blur in the viewer; open straight through.
         AttachmentViewer(
             attachment = attachment,
@@ -430,7 +459,18 @@ private fun FileCardRender(
             .widthIn(max = maxWidth)
             // Tap previews in-app; long-press surfaces Open-externally / Share / Save.
             .combinedClickable(
-                onClick = { viewerOpen = true },
+                onClick = {
+                    if (viewerController != null) {
+                        viewerController.openAttachment(
+                            attachment = attachment,
+                            initiallyRevealed = true,
+                            blurMode = blurMode,
+                            exportAllowed = exportAllowed,
+                        )
+                    } else {
+                        viewerOpen = true
+                    }
+                },
                 onLongClick = { menuExpanded = true },
             )
     ) {
@@ -576,7 +616,7 @@ fun SaveOverlayButton(onClick: () -> Unit, modifier: Modifier = Modifier) {
 private suspend fun shareAttachment(context: Context, attachment: Attachment) {
     val bytes = attachmentBytes(context, attachment)
     if (bytes == null) {
-        attachmentToast(context, context.getString(R.string.inbound_attach_share_failed))
+        UiMessageBus.error(context.getString(R.string.inbound_attach_share_failed))
         return
     }
     val uri = MediaSaver.stageForShare(context, bytes, attachment.fileName, attachment.contentType)
@@ -586,7 +626,7 @@ private suspend fun shareAttachment(context: Context, attachment: Attachment) {
 suspend fun saveAttachment(context: Context, attachment: Attachment) {
     val bytes = attachmentBytes(context, attachment)
     if (bytes == null) {
-        attachmentToast(context, context.getString(R.string.inbound_attach_share_failed))
+        UiMessageBus.error(context.getString(R.string.inbound_attach_share_failed))
         return
     }
     val result = if (attachment.renderMode == AttachmentRenderMode.IMAGE) {
@@ -596,13 +636,13 @@ suspend fun saveAttachment(context: Context, attachment: Attachment) {
     }
     when (result) {
         is MediaSaver.SaveResult.Saved ->
-            attachmentToast(context, context.getString(R.string.inbound_attach_saved, result.location))
+            UiMessageBus.success(context.getString(R.string.inbound_attach_saved, result.location))
         MediaSaver.SaveResult.UseShareInstead -> {
             val uri = MediaSaver.stageForShare(context, bytes, attachment.fileName, attachment.contentType)
             MediaSaver.share(context, uri, attachment.contentType)
         }
         is MediaSaver.SaveResult.Failed ->
-            attachmentToast(context, context.getString(R.string.inbound_attach_save_failed, result.message))
+            UiMessageBus.error(context.getString(R.string.inbound_attach_save_failed, result.message))
     }
 }
 
@@ -618,7 +658,7 @@ private suspend fun openAttachmentExternally(context: Context, attachment: Attac
     if (uri != null) {
         MediaSaver.open(context, uri, attachment.contentType)
     } else {
-        attachmentToast(context, context.getString(R.string.inbound_attach_open_failed))
+        UiMessageBus.error(context.getString(R.string.inbound_attach_open_failed))
     }
 }
 
@@ -648,7 +688,11 @@ private fun rememberAttachmentThumbnail(attachment: Attachment): ImageBitmap? {
     }
     LaunchedEffect(attachment.cachedUri, attachment.content, attachment.renderMode) {
         thumb = withContext(Dispatchers.IO) {
-            runCatching { generateThumbnail(context, attachment) }.getOrNull()
+            try {
+                generateThumbnail(context, attachment)
+            } catch (_: Exception) {
+                null
+            }
         }
     }
     return thumb
@@ -730,10 +774,6 @@ internal suspend fun attachmentBytes(context: Context, attachment: Attachment):
     }
 }
 
-private fun attachmentToast(context: Context, message: String) {
-    Toast.makeText(context, message, Toast.LENGTH_SHORT).show()
-}
-
 @Composable
 private fun emojiAndLabelFor(
     mode: AttachmentRenderMode,

app/src/main/kotlin/com/hermesandroid/relay/ui/components/InlineImageDataUrl.kt

@@ -46,7 +46,11 @@ internal fun decodeInlineImageDataUrl(
     // ceil(maxBytes / 3) * 4 plus at most two trailing padding characters.
     val maxEncoded = ((maxBytes.toLong() + 2L) / 3L) * 4L
     if (encoded.length.toLong() > maxEncoded) return null
-    val bytes = runCatching { Base64.getDecoder().decode(encoded) }.getOrNull() ?: return null
+    val bytes = try {
+        Base64.getDecoder().decode(encoded)
+    } catch (_: IllegalArgumentException) {
+        return null
+    }
     if (bytes.isEmpty() || bytes.size > maxBytes || !matchesImageMagic(mime, bytes)) return null
     return DecodedInlineImageData(bytes, mime)
 }

app/src/main/kotlin/com/hermesandroid/relay/ui/components/MarkdownContent.kt

@@ -73,7 +73,7 @@ fun MarkdownContent(
     modifier: Modifier = Modifier
 ) {
     ConfiguredMarkdownContent(
-        content = content,
+        content = markdownRenderWindow(content),
         textColor = textColor,
         modifier = modifier,
     )
@@ -318,7 +318,7 @@ fun StreamingMarkdownContent(
     var generation by remember { mutableIntStateOf(0) }
     key(generation) {
         NativeStreamingMarkdownGeneration(
-            content = content.withoutLeadingBlankLines(),
+            content = markdownRenderWindow(content.withoutLeadingBlankLines()),
             textColor = textColor,
             modifier = modifier,
             onResetRequired = { generation += 1 },
@@ -353,6 +353,17 @@ private fun NativeStreamingMarkdownGeneration(
     )
 }
 
+internal const val MAX_RENDERED_MARKDOWN_CHARS = 256_000
+private const val MARKDOWN_TRUNCATION_NOTICE =
+    "\n\n---\n_Response display was shortened for Android memory safety._"
+
+internal fun markdownRenderWindow(content: String): String =
+    if (content.length <= MAX_RENDERED_MARKDOWN_CHARS) {
+        content
+    } else {
+        content.take(MAX_RENDERED_MARKDOWN_CHARS) + MARKDOWN_TRUNCATION_NOTICE
+    }
+
 internal data class StreamingMarkdownAppendPlan(
     val resetRequired: Boolean,
     val delta: String,

app/src/main/kotlin/com/hermesandroid/relay/ui/components/MessageBanner.kt

@@ -32,6 +32,7 @@ import androidx.compose.material3.MaterialTheme
 import androidx.compose.material3.Surface
 import androidx.compose.material3.Text
 import androidx.compose.runtime.Composable
+import androidx.compose.runtime.collectAsState
 import androidx.compose.runtime.DisposableEffect
 import androidx.compose.runtime.LaunchedEffect
 import androidx.compose.runtime.getValue
@@ -47,6 +48,7 @@ import androidx.compose.ui.semantics.LiveRegionMode
 import androidx.compose.ui.semantics.liveRegion
 import androidx.compose.ui.semantics.semantics
 import androidx.compose.ui.graphics.Color
+import androidx.compose.ui.graphics.compositeOver
 import androidx.compose.ui.graphics.vector.ImageVector
 import androidx.compose.ui.res.stringResource
 import androidx.compose.ui.text.style.TextOverflow
@@ -64,21 +66,26 @@ private const val MAX_VISIBLE_EXPANDED = 3
 private const val ROW_MIN_HEIGHT_DP = 34
 
 /**
- * Top, thin, info-only banner host. Collects [UiMessageBus] and renders the
+ * Top, thin, themed banner host. Collects [UiMessageBus] and renders the
  * newest transient message on one line; tapping expands to the recent few
  * (scrolling past three). It takes its own vertical space — the Scaffold below
  * reflows, so content slides down smoothly instead of being covered by an
  * overlay. Auto-dismisses (paused while expanded) and coalesces duplicates so a
  * burst of the same status collapses to one refreshed row.
  *
- * App-owned errors stay on the snackbar. Keyed upstream AgentNotices may also
- * use the warning tone because their sticky/clear lifecycle is server-owned.
+ * Actionable messages use ThemedMessageHost. Modal hosts render above their
+ * dialog while the primary host retains messages for the return to the app.
  */
 @Composable
 fun MessageBannerHost(
     modifier: Modifier = Modifier,
     includeStatusBarPadding: Boolean = true,
+    primary: Boolean = true,
 ) {
+    val hostId = remember { UiMessageBus.registerHost(primary) }
+    val activeHost by UiMessageBus.activeHost.collectAsState()
+    val active = activeHost == hostId
+    DisposableEffect(hostId) { onDispose { UiMessageBus.unregisterHost(hostId) } }
     // Backing queue (oldest first; newest is last). expiresAt is kept in a
     // parallel map so coalescing/auto-dismiss can address rows by id.
     val shown = remember { mutableStateListOf<UiMessage>() }
@@ -122,12 +129,12 @@ fun MessageBannerHost(
     }
 
     // Collapse + report count to the scaffold (for inset accounting).
-    LaunchedEffect(shown.size) {
+    LaunchedEffect(shown.size, active) {
         if (shown.isEmpty()) expanded = false
-        UiMessageBus.reportActiveCount(shown.size)
+        if (primary) UiMessageBus.reportActiveCount(if (active) shown.size else 0)
     }
     DisposableEffect(Unit) {
-        onDispose { UiMessageBus.reportActiveCount(0) }
+        onDispose { if (primary) UiMessageBus.reportActiveCount(0) }
     }
 
     // Mirror the live queue into a retained copy so the exit animation still
@@ -147,7 +154,7 @@ fun MessageBannerHost(
     // under the notch. The smooth "slide" lives in animateContentSize below
     // (collapsed↔expanded and message-count changes).
     AnimatedVisibility(
-        visible = shown.isNotEmpty(),
+        visible = active && shown.isNotEmpty(),
         enter = fadeIn(tween(180)),
         exit = fadeOut(tween(160)),
         modifier = modifier,
@@ -155,7 +162,7 @@ fun MessageBannerHost(
         MessageBannerContent(
             messages = rendered,
             expanded = expanded,
-            onToggle = { if (rendered.size > 1) expanded = !expanded },
+            onToggle = { expanded = !expanded },
             includeStatusBarPadding = includeStatusBarPadding,
         )
     }
@@ -170,6 +177,7 @@ private fun MessageBannerContent(
 ) {
     val newest = messages.lastOrNull() ?: return
     val multiple = messages.size > 1
+    val expandable = multiple || newest.text.length > 80 || newest.severity in setOf(UiMessageSeverity.Warning, UiMessageSeverity.Error)
     val insetModifier = if (includeStatusBarPadding) {
         Modifier.windowInsetsPadding(WindowInsets.statusBars)
     } else {
@@ -190,14 +198,14 @@ private fun MessageBannerContent(
             tonalElevation = 0.dp,
             modifier = Modifier
                 .fillMaxWidth()
-                .then(if (multiple) Modifier.clickable(onClick = onToggle) else Modifier)
+                .then(if (expandable) Modifier.clickable(onClick = onToggle) else Modifier)
                 .animateContentSize(animationSpec = tween(durationMillis = 180)),
         ) {
             if (!expanded) {
                 MessageRow(
                     message = newest,
                     trailing = {
-                        if (multiple) {
+                        if (expandable) {
                             Row(
                                 horizontalArrangement = Arrangement.spacedBy(2.dp),
                                 verticalAlignment = Alignment.CenterVertically,
@@ -236,6 +244,7 @@ private fun MessageBannerContent(
                     ordered.forEachIndexed { index, message ->
                         MessageRow(
                             message = message,
+                            expanded = true,
                             trailing = {
                                 if (index == 0) {
                                     Icon(
@@ -256,6 +265,7 @@ private fun MessageBannerContent(
 @Composable
 private fun MessageRow(
     message: UiMessage,
+    expanded: Boolean = false,
     trailing: @Composable (() -> Unit)? = null,
 ) {
     Row(
@@ -275,7 +285,7 @@ private fun MessageRow(
         Text(
             text = message.text,
             style = MaterialTheme.typography.labelMedium,
-            maxLines = 1,
+            maxLines = if (expanded) 12 else 1,
             overflow = TextOverflow.Ellipsis,
             modifier = Modifier.weight(1f),
         )
@@ -284,22 +294,25 @@ private fun MessageRow(
 }
 
 @Composable
-private fun severityContainer(severity: UiMessageSeverity): Color = when (severity) {
+internal fun severityContainer(severity: UiMessageSeverity): Color = (when (severity) {
+    UiMessageSeverity.Error -> MaterialTheme.colorScheme.errorContainer
     UiMessageSeverity.Success -> MaterialTheme.colorScheme.tertiaryContainer.copy(alpha = 0.58f)
     UiMessageSeverity.Status -> MaterialTheme.colorScheme.secondaryContainer.copy(alpha = 0.74f)
     UiMessageSeverity.Warning -> MaterialTheme.colorScheme.errorContainer.copy(alpha = 0.72f)
     UiMessageSeverity.Info -> MaterialTheme.colorScheme.surfaceVariant.copy(alpha = 0.90f)
-}
+}).compositeOver(MaterialTheme.colorScheme.surface)
 
 @Composable
-private fun severityOnContainer(severity: UiMessageSeverity): Color = when (severity) {
+internal fun severityOnContainer(severity: UiMessageSeverity): Color = when (severity) {
+    UiMessageSeverity.Error -> MaterialTheme.colorScheme.onErrorContainer
     UiMessageSeverity.Success -> MaterialTheme.colorScheme.onTertiaryContainer
     UiMessageSeverity.Status -> MaterialTheme.colorScheme.onSecondaryContainer
     UiMessageSeverity.Warning -> MaterialTheme.colorScheme.onErrorContainer
     UiMessageSeverity.Info -> MaterialTheme.colorScheme.onSurfaceVariant
 }
 
-private fun severityIcon(severity: UiMessageSeverity): ImageVector = when (severity) {
+internal fun severityIcon(severity: UiMessageSeverity): ImageVector = when (severity) {
+    UiMessageSeverity.Error -> Icons.Filled.Warning
     UiMessageSeverity.Success -> Icons.Filled.CheckCircle
     UiMessageSeverity.Status -> Icons.Filled.Sync
     UiMessageSeverity.Warning -> Icons.Filled.Warning

app/src/main/kotlin/com/hermesandroid/relay/ui/components/MessageBubble.kt

@@ -856,13 +856,13 @@ fun MessageBubble(
                     }
                 }
 
-                // Delivery status — only on agent-Thread reply bubbles (a user
-                // message routed over the relay proactive channel). Null on every
-                // ordinary chat message, which render nothing here.
+                // Delivery status for local user messages, including steering.
+                // Use the bubble's foreground: accent-on-accent hides the label.
                 message.deliveryStatus?.takeIf { isUser }?.let { status ->
                     Spacer(modifier = Modifier.height(2.dp))
                     MessageDeliveryIndicator(
                         status = status,
+                        contentColor = textColor,
                         text = MessageDeliveryIndicatorText(
                             sending = stringResource(R.string.msg_bubble_sending),
                             queued = stringResource(R.string.msg_bubble_queued),

app/src/main/kotlin/com/hermesandroid/relay/ui/components/MessageDeliveryIndicator.kt

@@ -18,6 +18,7 @@ import androidx.compose.material3.minimumInteractiveComponentSize
 import androidx.compose.runtime.Composable
 import androidx.compose.ui.Alignment
 import androidx.compose.ui.Modifier
+import androidx.compose.ui.graphics.Color
 import androidx.compose.ui.graphics.vector.ImageVector
 import androidx.compose.ui.semantics.LiveRegionMode
 import androidx.compose.ui.semantics.Role
@@ -57,6 +58,7 @@ fun MessageDeliveryIndicator(
     modifier: Modifier = Modifier,
     failureMessage: String? = null,
     onRetry: (() -> Unit)? = null,
+    contentColor: Color? = null,
 ) {
     val retryAction = onRetry.takeIf { status == MessageDeliveryStatus.FAILED }
     val retryable = retryAction != null
@@ -67,7 +69,7 @@ fun MessageDeliveryIndicator(
         retryable = retryable,
     )
     val presentation = messageDeliveryPresentation(status)
-    val tint = when (presentation.colorRole) {
+    val tint = contentColor ?: when (presentation.colorRole) {
         DeliveryColorRole.NEUTRAL -> MaterialTheme.colorScheme.onSurfaceVariant
         DeliveryColorRole.ACCENT -> MaterialTheme.colorScheme.primary
         DeliveryColorRole.QUEUED -> MaterialTheme.colorScheme.tertiary

app/src/main/kotlin/com/hermesandroid/relay/ui/components/OrientationOverride.kt

@@ -11,16 +11,15 @@ import androidx.compose.ui.platform.LocalContext
 
 /**
  * Temporarily allow the device to rotate (portrait or landscape, following the
- * sensor) while this composable is in the composition, overriding the app-wide
- * portrait lock declared in the manifest (`MainActivity` screenOrientation).
+ * user's rotation preference) while this composable is in the composition,
+ * overriding the app-wide portrait lock declared in the manifest
+ * (`MainActivity` screenOrientation).
  * Restores the previous orientation (portrait) when it leaves the composition.
  *
  * Used by the full-screen media viewers ([ChatImageViewer], [AttachmentViewer])
  * so wide images and video can be viewed in landscape while the rest of the app
- * stays portrait-locked. Uses `SENSOR` (portrait + both landscapes, no
- * upside-down) so the viewer rotates with the device regardless of the system
- * auto-rotate toggle; swap to `SCREEN_ORIENTATION_USER` to instead respect that
- * toggle.
+ * stays portrait-locked. Uses `USER` so the viewer follows the device only when
+ * the user has enabled rotation instead of overriding their system preference.
  */
 @Composable
 fun AllowDeviceRotation() {
@@ -28,7 +27,7 @@ fun AllowDeviceRotation() {
     DisposableEffect(Unit) {
         val activity = context.findActivity()
         val previous = activity?.requestedOrientation
-        activity?.requestedOrientation = ActivityInfo.SCREEN_ORIENTATION_SENSOR
+        activity?.requestedOrientation = ActivityInfo.SCREEN_ORIENTATION_USER
         onDispose {
             activity?.requestedOrientation =
                 previous ?: ActivityInfo.SCREEN_ORIENTATION_PORTRAIT

app/src/main/kotlin/com/hermesandroid/relay/ui/components/OrientedBitmapDecoder.kt

@@ -1,8 +1,10 @@
 package com.hermesandroid.relay.ui.components
 
+import android.content.Context
 import android.graphics.Bitmap
 import android.graphics.BitmapFactory
 import android.graphics.Matrix
+import android.net.Uri
 import androidx.exifinterface.media.ExifInterface
 import java.io.ByteArrayInputStream
 
@@ -25,6 +27,11 @@ internal fun imageOrientationTransform(orientation: Int): ImageOrientationTransf
     else -> ImageOrientationTransform()
 }
 
+internal fun shouldApplyExifOrientation(mimeType: String?): Boolean = when (mimeType?.lowercase()) {
+    "image/png", "image/gif", "image/bmp" -> false
+    else -> true
+}
+
 /**
  * Decode image bytes for display and apply their EXIF orientation. BitmapFactory
  * returns the stored pixel layout and otherwise leaves portrait phone photos
@@ -41,14 +48,16 @@ internal fun decodeOrientedBitmap(
         BitmapFactory.decodeByteArray(bytes, 0, bytes.size, options)
     } ?: return null
 
-    val orientation = runCatching {
+    val orientation = try {
         ByteArrayInputStream(bytes).use { stream ->
             ExifInterface(stream).getAttributeInt(
                 ExifInterface.TAG_ORIENTATION,
                 ExifInterface.ORIENTATION_NORMAL,
             )
         }
-    }.getOrDefault(ExifInterface.ORIENTATION_NORMAL)
+    } catch (_: Exception) {
+        ExifInterface.ORIENTATION_NORMAL
+    }
     val transform = imageOrientationTransform(orientation)
     if (transform.rotationDegrees == 0f && !transform.flipHorizontal) return decoded
 
@@ -56,9 +65,81 @@ internal fun decodeOrientedBitmap(
         if (transform.rotationDegrees != 0f) postRotate(transform.rotationDegrees)
         if (transform.flipHorizontal) postScale(-1f, 1f)
     }
-    return runCatching {
+    val oriented = try {
         Bitmap.createBitmap(decoded, 0, 0, decoded.width, decoded.height, matrix, true)
-    }.getOrNull()?.also { oriented ->
-        if (oriented !== decoded) decoded.recycle()
+    } catch (_: Exception) {
+        null
+    }
+    return oriented?.also { bitmap ->
+        if (bitmap !== decoded) decoded.recycle()
     } ?: decoded
 }
+
+/** Decode a cached content URI without copying the encoded file into RAM. */
+internal fun decodeOrientedBitmap(context: Context, uri: Uri): Bitmap? =
+    decodeBoundedOrientedBitmap(context, uri)
+
+internal fun decodeBoundedOrientedBitmap(context: Context, uri: Uri): Bitmap? {
+    val bounds = BitmapFactory.Options().apply { inJustDecodeBounds = true }
+    val boundsInput = context.contentResolver.openInputStream(uri) ?: return null
+    boundsInput.use { input ->
+        // Bounds-only decode deliberately returns null; the populated Options
+        // are the result and must not be treated as a decode failure.
+        BitmapFactory.decodeStream(input, null, bounds)
+    }
+    val sample = inlineImageSampleSize(bounds.outWidth, bounds.outHeight) ?: return null
+    val decoded = context.contentResolver.openInputStream(uri)?.use { input ->
+        BitmapFactory.decodeStream(
+            input,
+            null,
+            BitmapFactory.Options().apply {
+                inSampleSize = sample
+                inPreferredConfig = Bitmap.Config.ARGB_8888
+            },
+        )
+    } ?: return null
+    val orientation = if (shouldApplyExifOrientation(bounds.outMimeType)) {
+        try {
+            context.contentResolver.openInputStream(uri)?.use { input ->
+                ExifInterface(input).getAttributeInt(
+                    ExifInterface.TAG_ORIENTATION,
+                    ExifInterface.ORIENTATION_NORMAL,
+                )
+            }
+        } catch (_: Exception) {
+            null
+        } ?: ExifInterface.ORIENTATION_NORMAL
+    } else {
+        ExifInterface.ORIENTATION_NORMAL
+    }
+    val transform = imageOrientationTransform(orientation)
+    if (transform.rotationDegrees == 0f && !transform.flipHorizontal) return decoded
+
+    val matrix = Matrix().apply {
+        if (transform.rotationDegrees != 0f) postRotate(transform.rotationDegrees)
+        if (transform.flipHorizontal) postScale(-1f, 1f)
+    }
+    val oriented = try {
+        Bitmap.createBitmap(decoded, 0, 0, decoded.width, decoded.height, matrix, true)
+    } catch (_: Exception) {
+        null
+    }
+    return oriented?.also { bitmap ->
+        if (bitmap !== decoded) decoded.recycle()
+    } ?: decoded
+}
+
+/** Decode an encoded chat image only after bounding its decoded pixel footprint. */
+internal fun decodeBoundedOrientedBitmap(bytes: ByteArray): Bitmap? {
+    if (bytes.isEmpty()) return null
+    val bounds = BitmapFactory.Options().apply { inJustDecodeBounds = true }
+    BitmapFactory.decodeByteArray(bytes, 0, bytes.size, bounds)
+    val sample = inlineImageSampleSize(bounds.outWidth, bounds.outHeight) ?: return null
+    return decodeOrientedBitmap(
+        bytes,
+        BitmapFactory.Options().apply {
+            inSampleSize = sample
+            inPreferredConfig = Bitmap.Config.ARGB_8888
+        },
+    )
+}

app/src/main/kotlin/com/hermesandroid/relay/ui/components/PendingAttachmentComposer.kt

@@ -296,12 +296,12 @@ internal fun formatAttachmentSize(bytes: Long): String {
 
 private suspend fun decodePendingAttachmentImage(attachment: Attachment): ImageBitmap? =
     withContext(Dispatchers.IO) {
-        runCatching {
+        try {
             val bytes = Base64.decode(attachment.content, Base64.DEFAULT)
-            if (bytes.isEmpty()) return@runCatching null
+            if (bytes.isEmpty()) return@withContext null
             val bounds = BitmapFactory.Options().apply { inJustDecodeBounds = true }
             BitmapFactory.decodeByteArray(bytes, 0, bytes.size, bounds)
-            if (bounds.outWidth <= 0 || bounds.outHeight <= 0) return@runCatching null
+            if (bounds.outWidth <= 0 || bounds.outHeight <= 0) return@withContext null
 
             var sample = 1
             while (
@@ -314,7 +314,9 @@ private suspend fun decodePendingAttachmentImage(attachment: Attachment): ImageB
                 bytes,
                 BitmapFactory.Options().apply { inSampleSize = sample },
             )?.asImageBitmap()
-        }.getOrNull()
+        } catch (_: Exception) {
+            null
+        }
     }
 
 private sealed interface PendingPreviewState {

app/src/main/kotlin/com/hermesandroid/relay/ui/components/SupportBundleDialog.kt

@@ -1,6 +1,6 @@
 package com.hermesandroid.relay.ui.components
 
-import android.widget.Toast
+import com.hermesandroid.relay.ui.UiMessageBus
 import androidx.compose.foundation.background
 import androidx.compose.foundation.layout.Arrangement
 import androidx.compose.foundation.layout.Box
@@ -92,68 +92,70 @@ fun SupportBundleDialog(state: SupportReviewState, onDismiss: () -> Unit) {
         onDismissRequest = onDismiss,
         properties = DialogProperties(usePlatformDefaultWidth = false),
     ) {
-        Surface(
-            modifier = Modifier.fillMaxWidth(0.94f),
-            shape = appearanceRoundedCornerShape(24.dp),
-            tonalElevation = 6.dp,
-        ) {
-            Column(modifier = Modifier.padding(20.dp)) {
-                Text(stringResource(R.string.support_bundle_title), style = MaterialTheme.typography.titleMedium)
-                Spacer(Modifier.height(6.dp))
-                Text(
-                    stringResource(R.string.support_bundle_privacy, state.recordCount),
-                    style = MaterialTheme.typography.bodySmall,
-                    color = MaterialTheme.colorScheme.onSurfaceVariant,
-                )
-                Spacer(Modifier.height(14.dp))
-                Box(
-                    modifier = Modifier
-                        .fillMaxWidth()
-                        .heightIn(min = 160.dp, max = 420.dp)
-                        .background(
-                            MaterialTheme.colorScheme.surfaceVariant.copy(alpha = 0.45f),
-                            appearanceRoundedCornerShape(12.dp),
-                        ),
-                ) {
-                    SelectionContainer {
-                        Text(
-                            text = state.text,
-                            fontFamily = FontFamily.Monospace,
-                            fontSize = 11.sp,
-                            lineHeight = 15.sp,
-                            modifier = Modifier.verticalScroll(rememberScrollState()).padding(12.dp),
-                        )
+        MessageOverlayScope {
+            Surface(
+                modifier = Modifier.fillMaxWidth(0.94f),
+                shape = appearanceRoundedCornerShape(24.dp),
+                tonalElevation = 6.dp,
+            ) {
+                Column(modifier = Modifier.padding(20.dp)) {
+                    Text(stringResource(R.string.support_bundle_title), style = MaterialTheme.typography.titleMedium)
+                    Spacer(Modifier.height(6.dp))
+                    Text(
+                        stringResource(R.string.support_bundle_privacy, state.recordCount),
+                        style = MaterialTheme.typography.bodySmall,
+                        color = MaterialTheme.colorScheme.onSurfaceVariant,
+                    )
+                    Spacer(Modifier.height(14.dp))
+                    Box(
+                        modifier = Modifier
+                            .fillMaxWidth()
+                            .heightIn(min = 160.dp, max = 420.dp)
+                            .background(
+                                MaterialTheme.colorScheme.surfaceVariant.copy(alpha = 0.45f),
+                                appearanceRoundedCornerShape(12.dp),
+                            ),
+                    ) {
+                        SelectionContainer {
+                            Text(
+                                text = state.text,
+                                fontFamily = FontFamily.Monospace,
+                                fontSize = 11.sp,
+                                lineHeight = 15.sp,
+                                modifier = Modifier.verticalScroll(rememberScrollState()).padding(12.dp),
+                            )
+                        }
                     }
-                }
-                Spacer(Modifier.height(18.dp))
-                FlowRow(
-                    modifier = Modifier.fillMaxWidth(),
-                    horizontalArrangement = Arrangement.spacedBy(8.dp, Alignment.End),
-                    verticalArrangement = Arrangement.spacedBy(4.dp),
-                ) {
-                    TextButton(onClick = onDismiss) { Text(stringResource(R.string.common_close)) }
-                    OutlinedButton(
-                        enabled = state.shareEnabled,
-                        onClick = {
-                            IssueReport.copyToClipboard(context, state.text)
-                            Toast.makeText(context, copied, Toast.LENGTH_LONG).show()
-                        },
-                    ) { Text(stringResource(R.string.common_copy)) }
-                    Button(
-                        enabled = state.shareEnabled,
-                        onClick = {
-                            if (!IssueReport.share(
-                                    context,
-                                    subject = chooser,
-                                    text = state.text,
-                                    chooserTitle = chooser,
-                                )
-                            ) {
+                    Spacer(Modifier.height(18.dp))
+                    FlowRow(
+                        modifier = Modifier.fillMaxWidth(),
+                        horizontalArrangement = Arrangement.spacedBy(8.dp, Alignment.End),
+                        verticalArrangement = Arrangement.spacedBy(4.dp),
+                    ) {
+                        TextButton(onClick = onDismiss) { Text(stringResource(R.string.common_close)) }
+                        OutlinedButton(
+                            enabled = state.shareEnabled,
+                            onClick = {
                                 IssueReport.copyToClipboard(context, state.text)
-                                Toast.makeText(context, noShare, Toast.LENGTH_LONG).show()
-                            }
-                        },
-                    ) { Text(stringResource(R.string.common_share)) }
+                                UiMessageBus.success(copied)
+                            },
+                        ) { Text(stringResource(R.string.common_copy)) }
+                        Button(
+                            enabled = state.shareEnabled,
+                            onClick = {
+                                if (!IssueReport.share(
+                                        context,
+                                        subject = chooser,
+                                        text = state.text,
+                                        chooserTitle = chooser,
+                                    )
+                                ) {
+                                    IssueReport.copyToClipboard(context, state.text)
+                                    UiMessageBus.warning(noShare)
+                                }
+                            },
+                        ) { Text(stringResource(R.string.common_share)) }
+                    }
                 }
             }
         }

app/src/main/kotlin/com/hermesandroid/relay/ui/components/ThemedMessageHost.kt

@@ -0,0 +1,88 @@
+package com.hermesandroid.relay.ui.components
+
+import androidx.compose.foundation.layout.Box
+import androidx.compose.foundation.layout.Column
+import androidx.compose.foundation.layout.Row
+import androidx.compose.foundation.layout.fillMaxWidth
+import androidx.compose.foundation.layout.heightIn
+import androidx.compose.foundation.layout.padding
+import androidx.compose.foundation.layout.size
+import androidx.compose.foundation.rememberScrollState
+import androidx.compose.foundation.shape.RoundedCornerShape
+import androidx.compose.foundation.verticalScroll
+import androidx.compose.material.icons.Icons
+import androidx.compose.material.icons.filled.Close
+import androidx.compose.material3.Icon
+import androidx.compose.material3.IconButton
+import androidx.compose.material3.MaterialTheme
+import androidx.compose.material3.SnackbarDuration
+import androidx.compose.material3.SnackbarHost
+import androidx.compose.material3.SnackbarHostState
+import androidx.compose.material3.SnackbarVisuals
+import androidx.compose.material3.Surface
+import androidx.compose.material3.Text
+import androidx.compose.material3.TextButton
+import androidx.compose.runtime.Composable
+import androidx.compose.runtime.collectAsState
+import androidx.compose.runtime.getValue
+import androidx.compose.runtime.staticCompositionLocalOf
+import androidx.compose.ui.Alignment
+import androidx.compose.ui.Modifier
+import androidx.compose.ui.res.stringResource
+import androidx.compose.ui.unit.dp
+import com.hermesandroid.relay.R
+import com.hermesandroid.relay.ui.UiMessageBus
+import com.hermesandroid.relay.ui.UiMessageSeverity
+import com.hermesandroid.relay.util.HumanError
+
+val LocalMessageActionHost = staticCompositionLocalOf<SnackbarHostState?> { null }
+
+data class HumanErrorVisuals(val error: HumanError) : SnackbarVisuals {
+    override val message get() = error.body
+    override val actionLabel get() = error.actionLabel
+    override val withDismissAction = true
+    override val duration get() = if (error.retryable) SnackbarDuration.Long else SnackbarDuration.Short
+}
+
+/** Uses the app banner's appearance while preserving existing suspend/action contracts. */
+@Composable
+fun ThemedMessageHost(hostState: SnackbarHostState, modifier: Modifier = Modifier, scoped: Boolean = false) {
+    val modalActive by UiMessageBus.modalHostActive.collectAsState()
+    if (!scoped && modalActive) return
+    SnackbarHost(hostState = hostState, modifier = modifier) { data ->
+        val error = (data.visuals as? HumanErrorVisuals)?.error
+        val severity = if (error != null) UiMessageSeverity.Error else UiMessageSeverity.Info
+        Surface(
+            modifier = Modifier.padding(12.dp).fillMaxWidth(),
+            shape = RoundedCornerShape(10.dp),
+            color = severityContainer(severity), contentColor = severityOnContainer(severity),
+        ) {
+            Column(Modifier.padding(start = 12.dp, end = 4.dp, top = 4.dp, bottom = 4.dp)) {
+                Row(verticalAlignment = Alignment.CenterVertically) {
+                    Icon(severityIcon(severity), null, Modifier.size(18.dp))
+                    Column(Modifier.weight(1f).padding(10.dp).heightIn(max = 200.dp).verticalScroll(rememberScrollState())) {
+                        error?.title?.let { Text(it, style = MaterialTheme.typography.titleSmall) }
+                        Text(data.visuals.message, style = MaterialTheme.typography.bodyMedium)
+                    }
+                    IconButton(onClick = data::dismiss) {
+                        Icon(Icons.Filled.Close, stringResource(R.string.common_dismiss))
+                    }
+                }
+                data.visuals.actionLabel?.let { label ->
+                    TextButton(onClick = data::performAction, modifier = Modifier.align(Alignment.End)) { Text(label) }
+                }
+            }
+        }
+    }
+}
+
+/** Modal-window host; the root retains the same bus events until their normal expiry. */
+@Composable
+fun MessageOverlayScope(modifier: Modifier = Modifier, content: @Composable () -> Unit) {
+    val actions = LocalMessageActionHost.current
+    Box(modifier) {
+        content()
+        MessageBannerHost(Modifier.align(Alignment.TopCenter), includeStatusBarPadding = false, primary = false)
+        if (actions != null) ThemedMessageHost(actions, Modifier.align(Alignment.BottomCenter), scoped = true)
+    }
+}

app/src/main/kotlin/com/hermesandroid/relay/ui/components/ToolProgressCard.kt

@@ -57,6 +57,18 @@ import androidx.compose.ui.text.style.TextOverflow
 import androidx.compose.ui.unit.dp
 import com.hermesandroid.relay.R
 import com.hermesandroid.relay.data.ToolCall
+import kotlinx.serialization.json.Json
+import kotlinx.serialization.json.JsonObject
+import kotlinx.serialization.json.JsonPrimitive
+
+/** A completed dispatch call is not evidence that its detached child finished. */
+internal fun isDetachedDelegationDispatch(toolCall: ToolCall): Boolean {
+    if (toolCall.name != "delegate_task" || !toolCall.isComplete || toolCall.success != true) return false
+    val result = toolCall.result ?: return false
+    val payload = runCatching { Json.parseToJsonElement(result) as? JsonObject }.getOrNull() ?: return false
+    return (payload["status"] as? JsonPrimitive)?.content == "dispatched" ||
+        (payload["mode"] as? JsonPrimitive)?.content == "background"
+}
 
 @Composable
 fun ToolProgressCard(
@@ -116,7 +128,9 @@ fun ToolProgressCard(
     }
 
     val toolIcon = toolIcon(toolCall.name)
+    val detachedDispatch = isDetachedDelegationDispatch(toolCall)
     val statusText = when {
+        detachedDispatch -> stringResource(R.string.tool_progress_status_dispatched)
         toolCall.isComplete && toolCall.success == true -> stringResource(R.string.tool_progress_status_completed)
         toolCall.isComplete && toolCall.success == false -> stringResource(R.string.tool_progress_status_failed)
         isPreparing -> stringResource(R.string.tool_preparing_a11y)
@@ -187,7 +201,7 @@ fun ToolProgressCard(
                 )
 
                 // Duration + completion time ("3.1s · 5:32 PM")
-                val metaLabel = listOfNotNull(duration, timeLabel).joinToString(" · ")
+                val metaLabel = if (detachedDispatch) statusText else listOfNotNull(duration, timeLabel).joinToString(" · ")
                 if (metaLabel.isNotEmpty()) {
                     Text(
                         text = metaLabel,

app/src/main/kotlin/com/hermesandroid/relay/ui/components/VoiceModeOverlay.kt

@@ -27,6 +27,7 @@ import androidx.compose.foundation.layout.fillMaxHeight
 import androidx.compose.foundation.layout.fillMaxSize
 import androidx.compose.foundation.layout.fillMaxWidth
 import androidx.compose.foundation.layout.height
+import androidx.compose.foundation.layout.heightIn
 import androidx.compose.foundation.layout.navigationBarsPadding
 import androidx.compose.foundation.layout.padding
 import androidx.compose.foundation.layout.size
@@ -39,6 +40,9 @@ import androidx.compose.foundation.lazy.items
 import androidx.compose.foundation.lazy.rememberLazyListState
 import androidx.compose.foundation.shape.CircleShape
 import androidx.compose.foundation.shape.RoundedCornerShape
+import androidx.compose.foundation.rememberScrollState
+import androidx.compose.foundation.text.selection.SelectionContainer
+import androidx.compose.foundation.verticalScroll
 import androidx.compose.material.icons.Icons
 import androidx.compose.material.icons.filled.CenterFocusStrong
 import androidx.compose.material.icons.filled.Close
@@ -48,10 +52,11 @@ import androidx.compose.material.icons.filled.ExpandMore
 import androidx.compose.material.icons.filled.GraphicEq
 import androidx.compose.material.icons.filled.Image
 import androidx.compose.material.icons.filled.Mic
-import androidx.compose.material.icons.filled.Refresh
+import androidx.compose.material.icons.filled.ErrorOutline
 import androidx.compose.material.icons.filled.Settings
 import androidx.compose.material.icons.filled.Stop
 import androidx.compose.material3.Icon
+import androidx.compose.material3.AlertDialog
 import androidx.compose.material3.IconButton
 import androidx.compose.material3.HorizontalDivider
 import androidx.compose.material3.LinearProgressIndicator
@@ -77,6 +82,7 @@ import androidx.compose.ui.input.pointer.pointerInput
 import androidx.compose.ui.layout.ContentScale
 import androidx.compose.ui.platform.LocalConfiguration
 import androidx.compose.ui.platform.LocalHapticFeedback
+import androidx.compose.ui.platform.LocalSoftwareKeyboardController
 import androidx.compose.ui.platform.testTag
 import androidx.compose.ui.semantics.Role
 import androidx.compose.ui.semantics.contentDescription
@@ -145,8 +151,7 @@ fun VoiceModeOverlay(
     onModeChange: (InteractionMode) -> Unit,
     onClearError: () -> Unit,
     modifier: Modifier = Modifier,
-    // Nullable so existing call sites compile; when wired, voice errors
-    // surface as global snackbars in addition to the inline banner below.
+    // Retained for callers; uiState.error owns the modal while voice is visible.
     errorEvents: SharedFlow<HumanError>? = null,
     // === PHASE3-voice-mode-transcript ===
     // Compact rolling transcript of the last N chat messages — the
@@ -255,7 +260,7 @@ fun VoiceModeOverlay(
         )
     }
 
-    // Voice errors surface ONLY on the overlay's own inline top banner
+    // Voice errors surface ONLY in the overlay's dialog
     // (uiState.error) while the overlay is up — we deliberately do NOT also pipe
     // them to the app-wide bottom snackbar. Doing both duplicated the message
     // and left a retry-only, un-dismissable toast at the bottom during long /
@@ -510,59 +515,15 @@ fun VoiceModeOverlay(
             )
         }
 
-        // Error banner
-        AnimatedVisibility(
-            visible = uiState.error != null,
-            enter = fadeIn(),
-            exit = fadeOut(),
-            modifier = Modifier
-                .align(Alignment.TopCenter)
-                .then(
-                    responsiveLayout.chromeMaxWidth?.let {
-                        Modifier.widthIn(max = it)
-                    } ?: Modifier,
-                )
-                .fillMaxWidth()
-                .padding(top = 64.dp, start = 16.dp, end = 16.dp),
-        ) {
-            Surface(
-                shape = appearanceRoundedCornerShape(12.dp),
-                color = MaterialTheme.colorScheme.errorContainer,
-                tonalElevation = 2.dp,
-            ) {
-                Row(
-                    modifier = Modifier.padding(12.dp),
-                    verticalAlignment = Alignment.CenterVertically,
-                    horizontalArrangement = Arrangement.spacedBy(8.dp),
-                ) {
-                    Text(
-                        text = uiState.error.orEmpty(),
-                        color = MaterialTheme.colorScheme.onErrorContainer,
-                        style = MaterialTheme.typography.bodySmall,
-                        modifier = Modifier.weight(1f),
-                    )
-                    // Dismiss clears the error and returns to Idle without
-                    // retrying, so a failed/timed-out turn never traps the user
-                    // on a retry-only banner.
-                    TextButton(onClick = { onClearError() }) {
-                        Text(stringResource(R.string.common_dismiss))
-                    }
-                    TextButton(
-                        onClick = {
-                            onClearError()
-                            onMicTap()
-                        },
-                    ) {
-                        Icon(
-                            imageVector = Icons.Filled.Refresh,
-                            contentDescription = null,
-                            modifier = Modifier.size(16.dp),
-                        )
-                        Spacer(Modifier.size(4.dp))
-                        Text(stringResource(R.string.voice_overlay_retry))
-                    }
-                }
-            }
+        uiState.error?.let { error ->
+            VoiceErrorDialog(
+                error = error,
+                onDismiss = onClearError,
+                onRetry = {
+                    onClearError()
+                    onMicTap()
+                },
+            )
         }
 
         // Mic button — dispatch by current voice state.
@@ -589,6 +550,60 @@ fun VoiceModeOverlay(
     }
 }
 
+@Composable
+private fun VoiceErrorDialog(
+    error: String,
+    onDismiss: () -> Unit,
+    onRetry: () -> Unit,
+) {
+    val keyboard = LocalSoftwareKeyboardController.current
+    LaunchedEffect(error) { keyboard?.hide() }
+
+    // Match ChatFailureDetailsDialog: keep provider detail selectable and inside
+    // a bounded surface, with actions outside the scroll area. A real dialog
+    // owns focus and blocks the underlying chat in both voice presentations.
+    AlertDialog(
+        onDismissRequest = onDismiss,
+        containerColor = MaterialTheme.colorScheme.surface,
+        icon = {
+            Icon(
+                imageVector = Icons.Default.ErrorOutline,
+                contentDescription = null,
+                tint = MaterialTheme.colorScheme.error,
+            )
+        },
+        title = { Text(stringResource(R.string.voice_overlay_error_title)) },
+        text = {
+            Surface(
+                color = MaterialTheme.colorScheme.surfaceVariant,
+                shape = MaterialTheme.shapes.small,
+            ) {
+                SelectionContainer {
+                    Text(
+                        text = error,
+                        style = MaterialTheme.typography.bodySmall,
+                        modifier = Modifier
+                            .fillMaxWidth()
+                            .heightIn(max = 320.dp)
+                            .verticalScroll(rememberScrollState())
+                            .padding(12.dp),
+                    )
+                }
+            }
+        },
+        confirmButton = {
+            TextButton(onClick = onRetry) {
+                Text(stringResource(R.string.voice_overlay_retry))
+            }
+        },
+        dismissButton = {
+            TextButton(onClick = onDismiss) {
+                Text(stringResource(R.string.common_dismiss))
+            }
+        },
+    )
+}
+
 @Composable
 private fun VoiceFocusIdentityPane(
     uiState: VoiceUiState,

app/src/main/kotlin/com/hermesandroid/relay/ui/screens/AboutScreen.kt

@@ -4,7 +4,7 @@ package com.hermesandroid.relay.ui.screens
 
 import android.content.Intent
 import android.net.Uri
-import android.widget.Toast
+import com.hermesandroid.relay.ui.UiMessageBus
 import androidx.compose.foundation.Image
 import androidx.compose.foundation.background
 import androidx.compose.foundation.clickable
@@ -94,7 +94,7 @@ fun AboutScreen(
     val scope = rememberCoroutineScope()
     val isDarkTheme = LocalBrand.current.isDark
 
-    // Pre-resolved Toast messages (Toast is not a composable scope)
+    // Pre-resolved messages for non-composable action callbacks.
     val devUnlockedMsg = stringResource(R.string.about_dev_options_unlocked)
     val updateCopiedMsg = stringResource(R.string.about_update_copied)
     val emDash = stringResource(R.string.about_em_dash)
@@ -235,17 +235,13 @@ fun AboutScreen(
                                         versionTapCount = 0
                                         scope.launch {
                                             FeatureFlags.unlockDevOptions(context)
-                                            Toast.makeText(
-                                                context,
-                                                devUnlockedMsg,
-                                                Toast.LENGTH_SHORT,
-                                            ).show()
+                                            UiMessageBus.success(devUnlockedMsg)
                                             onUnlockDeveloperOptions()
                                         }
                                     }
                                     remaining <= 3 -> {
                                         val tapsMsg = context.getString(R.string.about_taps_to_unlock, remaining)
-                                        Toast.makeText(context, tapsMsg, Toast.LENGTH_SHORT).show()
+                                        UiMessageBus.info(tapsMsg)
                                     }
                                 }
                             },
@@ -326,11 +322,7 @@ fun AboutScreen(
                             if (ru.updateAvailable && !ru.updateCommand.isNullOrBlank()) {
                                 TextButton(onClick = {
                                     clipboard.setText(AnnotatedString(ru.updateCommand))
-                                    Toast.makeText(
-                                        context,
-                                        updateCopiedMsg,
-                                        Toast.LENGTH_SHORT,
-                                    ).show()
+                                    UiMessageBus.success(updateCopiedMsg)
                                 }) {
                                     Text(stringResource(R.string.about_copy_fix))
                                 }

app/src/main/kotlin/com/hermesandroid/relay/ui/screens/AppearanceSettingsScreen.kt

@@ -59,7 +59,7 @@ import androidx.compose.material3.MaterialTheme
 import androidx.compose.material3.OutlinedButton
 import androidx.compose.material3.Scaffold
 import androidx.compose.material3.Slider
-import androidx.compose.material3.SnackbarHost
+import com.hermesandroid.relay.ui.components.ThemedMessageHost
 import androidx.compose.material3.SnackbarHostState
 import androidx.compose.material3.Surface
 import androidx.compose.material3.TextButton
@@ -268,7 +268,7 @@ fun AppearanceSettingsScreen(
                 }
             }
         },
-        snackbarHost = { SnackbarHost(snackbarHostState) },
+        snackbarHost = { ThemedMessageHost(snackbarHostState) },
     ) { innerPadding ->
         Column(
             modifier = Modifier

app/src/main/kotlin/com/hermesandroid/relay/ui/screens/BotChatScreen.kt

@@ -1,5 +1,9 @@
 package com.hermesandroid.relay.ui.screens
 
+import com.hermesandroid.relay.data.BusyMessageAction
+import com.hermesandroid.relay.data.canCorrectBusyMessage
+import com.hermesandroid.relay.ui.components.ChatComposerLayers
+import com.hermesandroid.relay.ui.components.ChatMessageQueue
 import androidx.compose.foundation.BorderStroke
 import androidx.compose.foundation.layout.Arrangement
 import androidx.compose.foundation.layout.Box
@@ -58,6 +62,7 @@ import com.hermesandroid.relay.network.upstream.DashboardApiClient
 import com.hermesandroid.relay.network.upstream.GatewayChatClient
 import com.hermesandroid.relay.network.upstream.SessionMessageLoadMode
 import com.hermesandroid.relay.network.upstream.models.MessageItem
+import com.hermesandroid.relay.ui.components.ChatMediaViewerHost
 import com.hermesandroid.relay.ui.components.MessageBubble
 import com.hermesandroid.relay.ui.theme.RelayRefresh
 import com.hermesandroid.relay.viewmodel.ChatViewModel
@@ -84,24 +89,28 @@ fun BotChatScreen(
     connectionViewModel: ConnectionViewModel,
     onBack: () -> Unit,
 ) {
-    BotChatScreen(
-        route = route,
-        bot = bot,
-        sessionId = sessionId,
-        gatewayClient = gatewayClient,
-        dashboardClient = dashboardClient,
-        chatViewModel = chatViewModel,
-        onBack = onBack,
-        handlerFactory = ::ChatHandler,
-        historyLoader = { profileName, storedSessionId, mode ->
-            dashboardClient.getSessionMessages(
-                sessionId = storedSessionId,
-                profile = profileName,
-                mode = mode,
-            )
-        },
-        profileIconFlow = connectionViewModel::profileIconFlow,
-    )
+    val busyMessageAction by connectionViewModel.busyMessageAction.collectAsState()
+    ChatMediaViewerHost(route.key, sessionId) {
+        BotChatScreen(
+            route = route,
+            bot = bot,
+            sessionId = sessionId,
+            gatewayClient = gatewayClient,
+            dashboardClient = dashboardClient,
+            chatViewModel = chatViewModel,
+            onBack = onBack,
+            handlerFactory = ::ChatHandler,
+            historyLoader = { profileName, storedSessionId, mode ->
+                dashboardClient.getSessionMessages(
+                    sessionId = storedSessionId,
+                    profile = profileName,
+                    mode = mode,
+                )
+            },
+            profileIconFlow = connectionViewModel::profileIconFlow,
+            busyMessageAction = busyMessageAction,
+        )
+    }
 }
 
 @OptIn(ExperimentalMaterial3Api::class)
@@ -117,6 +126,7 @@ internal fun BotChatScreen(
     handlerFactory: () -> ChatHandler,
     historyLoader: BotChatHistoryLoader,
     profileIconFlow: BotChatProfileIconFlow,
+    busyMessageAction: BusyMessageAction = BusyMessageAction.CorrectNow,
 ) {
     val handler = remember(route.key) { handlerFactory() }
     val context = LocalContext.current
@@ -133,6 +143,21 @@ internal fun BotChatScreen(
         .collectAsState(initial = null)
     val listState = rememberLazyListState()
     var composer by remember(route.key, sessionId) { mutableStateOf("") }
+    var editingQueuedMessage by remember(route.key, sessionId) { mutableStateOf(false) }
+    var busyActionOverride by remember(route.key, sessionId, busyMessageAction) {
+        mutableStateOf<BusyMessageAction?>(null)
+    }
+    val steerable by chatViewModel.steerableTurn.collectAsState()
+    val attachments by chatViewModel.pendingAttachments.collectAsState()
+    val pendingAsk by chatViewModel.pendingAsk.collectAsState()
+    val turnStatus by handler.turnStatus.collectAsState()
+    val queue by chatViewModel.queuedMessages.collectAsState()
+    val queuePaused by chatViewModel.queuePaused.collectAsState()
+    val correctionAvailable = canCorrectBusyMessage(
+        steerable, attachments.isNotEmpty(), pendingAsk != null, turnStatus, composer,
+    )
+    val effectiveBusyAction = if (correctionAvailable && !editingQueuedMessage) busyActionOverride ?: busyMessageAction
+        else BusyMessageAction.QueueNext
 
     DisposableEffect(chatViewModel, gatewayClient, dashboardClient, route.key) {
         chatViewModel.initialize(apiClient = null, chatHandler = handler)
@@ -234,49 +259,82 @@ internal fun BotChatScreen(
             )
         },
         bottomBar = {
+            ChatComposerLayers(
+                action = effectiveBusyAction.takeIf { isStreaming },
+                onActionChange = {
+                    editingQueuedMessage = false
+                    busyActionOverride = it
+                },
+                correctionAvailable = correctionAvailable,
+                onStop = if (composer.isNotBlank()) chatViewModel::cancelStream else null,
+                modifier = Modifier.imePadding(),
+            ) {
             Surface(
                 color = MaterialTheme.colorScheme.surfaceContainer,
                 border = BorderStroke(1.dp, MaterialTheme.colorScheme.outlineVariant),
                 shape = RoundedCornerShape(topStart = 18.dp, topEnd = 18.dp),
-                modifier = Modifier.imePadding(),
             ) {
-                Row(
-                    modifier = Modifier.padding(horizontal = 12.dp, vertical = 10.dp),
-                    verticalAlignment = Alignment.Bottom,
-                ) {
-                    OutlinedTextField(
-                        value = composer,
-                        onValueChange = { composer = it },
-                        placeholder = { Text(stringResource(R.string.chat_placeholder_message)) },
-                        modifier = Modifier.weight(1f),
-                        minLines = 1,
-                        maxLines = 6,
-                    )
-                    Spacer(Modifier.width(6.dp))
-                    IconButton(
-                        onClick = {
-                            if (isStreaming) {
-                                chatViewModel.cancelStream()
-                            } else {
-                                val text = composer.trim()
-                                if (text.isNotEmpty()) {
-                                    composer = ""
-                                    chatViewModel.sendMessage(text)
-                                }
+                Column {
+                    ChatMessageQueue(
+                        messages = queue,
+                        paused = queuePaused,
+                        onResume = chatViewModel::resumeQueue,
+                        onClear = chatViewModel::clearQueue,
+                        onRemove = chatViewModel::removeQueuedAt,
+                        canEdit = composer.isBlank() && attachments.isEmpty(),
+                        onEdit = { index ->
+                            chatViewModel.takeQueuedForEdit(index)?.let {
+                                composer = it
+                                editingQueuedMessage = true
                             }
                         },
-                        enabled = isStreaming || composer.isNotBlank(),
+                        modifier = Modifier.padding(horizontal = 12.dp),
+                    )
+                    Row(
+                        modifier = Modifier.padding(horizontal = 12.dp, vertical = 10.dp),
+                        verticalAlignment = Alignment.Bottom,
                     ) {
-                        Icon(
-                            if (isStreaming) Icons.Filled.Stop else Icons.AutoMirrored.Filled.Send,
-                            contentDescription = stringResource(
-                                if (isStreaming) R.string.chat_input_stop_streaming
-                                else R.string.chat_input_send_message,
-                            ),
+                        OutlinedTextField(
+                            value = composer,
+                            onValueChange = { composer = it },
+                            placeholder = { Text(stringResource(R.string.chat_placeholder_message)) },
+                            modifier = Modifier.weight(1f),
+                            minLines = 1,
+                            maxLines = 6,
                         )
+                        Spacer(Modifier.width(6.dp))
+                        IconButton(
+                            onClick = {
+                                if (isStreaming && composer.isBlank()) {
+                                    chatViewModel.cancelStream()
+                                } else {
+                                    val text = composer.trim()
+                                    if (text.isNotEmpty()) {
+                                        composer = ""
+                                        chatViewModel.sendMessage(text, effectiveBusyAction)
+                                        editingQueuedMessage = false
+                                        busyActionOverride = null
+                                    }
+                                }
+                            },
+                            enabled = isStreaming || composer.isNotBlank(),
+                        ) {
+                            Icon(
+                                if (isStreaming && composer.isBlank()) Icons.Filled.Stop else Icons.AutoMirrored.Filled.Send,
+                                contentDescription = stringResource(
+                                    when {
+                                        isStreaming && composer.isBlank() -> R.string.chat_input_stop_streaming
+                                        isStreaming && effectiveBusyAction == BusyMessageAction.CorrectNow -> R.string.chat_correct_now
+                                        isStreaming -> R.string.chat_queue_next
+                                        else -> R.string.chat_input_send_message
+                                    },
+                                ),
+                            )
+                        }
                     }
                 }
             }
+            }
         },
     ) { padding ->
         Box(

app/src/main/kotlin/com/hermesandroid/relay/ui/screens/BotModeScreen.kt

@@ -41,7 +41,7 @@ import androidx.compose.material3.IconButton
 import androidx.compose.material3.MaterialTheme
 import androidx.compose.material3.OutlinedTextField
 import androidx.compose.material3.Scaffold
-import androidx.compose.material3.SnackbarHost
+import com.hermesandroid.relay.ui.components.ThemedMessageHost
 import androidx.compose.material3.SnackbarHostState
 import androidx.compose.material3.Surface
 import androidx.compose.material3.Text
@@ -73,6 +73,7 @@ import com.hermesandroid.relay.R
 import com.hermesandroid.relay.data.BotGroupMessage
 import com.hermesandroid.relay.data.BotGroupRoom
 import com.hermesandroid.relay.data.BotGatewayRoute
+import com.hermesandroid.relay.data.BotGatewayRouteKey
 import com.hermesandroid.relay.data.BotModeState
 import com.hermesandroid.relay.data.BotRosterEntry
 import com.hermesandroid.relay.data.Connection
@@ -84,6 +85,13 @@ import kotlinx.coroutines.launch
 
 internal enum class BotModeFilter { All, Bots, Groups }
 
+/** Bundle-compatible key; length-prefix the connection so delimiters cannot alias owners. */
+internal val BotRosterEntry.lazyItemKey: String
+    get() {
+        val owner = route?.key ?: return "bot:unbound:${profile.name}"
+        return "bot:route:${owner.connectionId.length}:${owner.connectionId}:${owner.profileName}"
+    }
+
 private sealed interface BotModeRow {
     val activityAtMs: Long
 
@@ -109,7 +117,7 @@ fun BotModeScreen(
     val scope = rememberCoroutineScope()
     val resources = LocalResources.current
     val snackbar = remember { SnackbarHostState() }
-    var openingProfile by remember { mutableStateOf<String?>(null) }
+    var openingRoute by remember { mutableStateOf<BotGatewayRouteKey?>(null) }
     var showCreateBot by remember { mutableStateOf(false) }
     var creatingBot by remember { mutableStateOf(false) }
     var selectedGatewayId by rememberSaveable { mutableStateOf<String?>(null) }
@@ -136,10 +144,11 @@ fun BotModeScreen(
         onBack = onBack,
         onRefresh = connectionViewModel::refreshBotMode,
         onSelectGateway = { selectedGatewayId = it },
-        openingProfile = openingProfile,
+        openingRoute = openingRoute,
         onOpenBot = { bot ->
             val route = bot.route ?: return@BotModeContent
-            openingProfile = bot.profile.name
+            if (openingRoute != null) return@BotModeContent
+            openingRoute = route.key
             scope.launch {
                 val result = connectionViewModel.ensureCanonicalBotChat(route)
                     .map { it.resolvedSessionId }
@@ -147,12 +156,12 @@ fun BotModeScreen(
                     onSuccess = { onOpenBotChat(route, it) },
                     onFailure = { snackbar.showSnackbar(it.message ?: chatOpenFailed) },
                 )
-                openingProfile = null
+                openingRoute = null
             }
         },
         onOpenGroup = { onOpenGroup(it.key) },
         onNewBot = { showCreateBot = true },
-        snackbarHost = { SnackbarHost(snackbar) },
+        snackbarHost = { ThemedMessageHost(snackbar) },
         botAvatar = { bot, size ->
             BotProfileAvatar(
                 connectionViewModel = connectionViewModel,
@@ -206,7 +215,7 @@ internal fun BotModeContent(
     onBack: () -> Unit,
     onRefresh: () -> Unit,
     onSelectGateway: (String?) -> Unit,
-    openingProfile: String? = null,
+    openingRoute: BotGatewayRouteKey? = null,
     onOpenBot: (BotRosterEntry) -> Unit,
     onOpenGroup: (BotGroupRoom) -> Unit,
     onNewBot: () -> Unit,
@@ -404,12 +413,12 @@ internal fun BotModeContent(
                     contentPadding = PaddingValues(horizontal = 16.dp),
                     horizontalArrangement = Arrangement.spacedBy(18.dp),
                 ) {
-                    items(activeBots, key = { it.profile.name }) { bot ->
+                    items(activeBots, key = { it.lazyItemKey }) { bot ->
                         Column(
                             horizontalAlignment = Alignment.CenterHorizontally,
                             modifier = Modifier
                                 .width(78.dp)
-                                .clickable(enabled = openingProfile == null) { onOpenBot(bot) },
+                                .clickable(enabled = openingRoute == null) { onOpenBot(bot) },
                         ) {
                             Box {
                                 botAvatar(bot, 56.dp)
@@ -455,7 +464,7 @@ internal fun BotModeContent(
                     itemsIndexed(
                         items = rows,
                         key = { _, row -> when (row) {
-                            is BotModeRow.Bot -> "bot:${row.value.profile.name}"
+                            is BotModeRow.Bot -> row.value.lazyItemKey
                             is BotModeRow.Group -> "group:${row.value.key}"
                         } },
                     ) { index, row ->
@@ -463,7 +472,7 @@ internal fun BotModeContent(
                             is BotModeRow.Bot -> BotConversationRow(
                                 bot = row.value,
                                 connectionLabel = row.value.route?.connectionLabel,
-                                opening = openingProfile == row.value.profile.name,
+                                opening = openingRoute != null && openingRoute == row.value.route?.key,
                                 onClick = { onOpenBot(row.value) },
                                 avatar = { botAvatar(row.value, 56.dp) },
                                 nowMs = nowMs,

app/src/main/kotlin/com/hermesandroid/relay/ui/screens/ChatScreen.kt

@@ -2,6 +2,9 @@
 
 package com.hermesandroid.relay.ui.screens
 
+import com.hermesandroid.relay.data.BusyMessageAction
+import com.hermesandroid.relay.data.canCorrectBusyMessage
+import com.hermesandroid.relay.ui.components.ChatMessageQueue
 import androidx.compose.animation.AnimatedVisibility
 import androidx.compose.animation.animateContentSize
 import androidx.compose.foundation.Canvas
@@ -9,6 +12,14 @@ import androidx.compose.foundation.MutatePriority
 import com.hermesandroid.relay.ui.theme.LocalBrand
 import androidx.compose.foundation.background
 import androidx.compose.foundation.clickable
+import androidx.compose.ui.layout.onSizeChanged
+import androidx.compose.ui.platform.testTag
+import com.hermesandroid.relay.ui.components.ChatDebugDrawer
+import com.hermesandroid.relay.ui.components.ChatActivityReceipt
+import com.hermesandroid.relay.data.projectChatActivityReceipts
+import com.hermesandroid.relay.viewmodel.previewActivities
+import com.hermesandroid.relay.ui.components.ChatDebugOverlay
+import com.hermesandroid.relay.ui.components.chatDebugHeaderGesture
 import androidx.compose.foundation.layout.Arrangement
 import androidx.compose.foundation.layout.Box
 import androidx.compose.foundation.layout.Column
@@ -147,7 +158,7 @@ import androidx.compose.animation.fadeIn
 import androidx.compose.animation.fadeOut
 import androidx.compose.material.icons.filled.KeyboardArrowDown
 import androidx.compose.material3.SmallFloatingActionButton
-import androidx.compose.material3.SnackbarHost
+import com.hermesandroid.relay.ui.components.ThemedMessageHost
 import androidx.compose.material3.Scaffold
 import androidx.compose.material3.SnackbarHostState
 import androidx.compose.material3.SnackbarDuration
@@ -156,7 +167,7 @@ import android.content.ClipData
 import android.content.Intent
 import android.net.Uri
 import android.provider.Settings
-import android.widget.Toast
+import com.hermesandroid.relay.ui.UiMessageBus
 import androidx.activity.compose.rememberLauncherForActivityResult
 import androidx.activity.result.PickVisualMediaRequest
 import androidx.activity.result.contract.ActivityResultContracts
@@ -867,9 +878,17 @@ fun ChatScreen(
 
 
     val rawMessages by chatViewModel.messages.collectAsState()
-    val messages = remember(rawMessages, supervised, supervisedPolicy.capabilities.generatedImages) {
-        if (!supervised) rawMessages
-        else rawMessages.map { message ->
+    val activityRecords by chatViewModel.activityRecords.collectAsState()
+    val activityOwner by chatViewModel.conversationBinding.collectAsState()
+    val activitySessionId by chatViewModel.currentSessionId.collectAsState()
+    val receiptMessages = remember(rawMessages, activityRecords, activityOwner, activitySessionId, supervised, supervisedVisibility) {
+        if (activityOwner.transport == com.hermesandroid.relay.data.SessionTransport.SSE ||
+            (supervised && !supervisedVisibility.showWorkingStatus)
+        ) rawMessages else projectChatActivityReceipts(rawMessages, activityRecords, activityOwner.contextKey, activitySessionId)
+    }
+    val messages = remember(receiptMessages, supervised, supervisedPolicy.capabilities.generatedImages) {
+        if (!supervised) receiptMessages
+        else receiptMessages.map { message ->
             if (message.role == MessageRole.ASSISTANT) {
                 message.copy(
                     attachments = if (supervisedPolicy.capabilities.generatedImages) {
@@ -932,6 +951,10 @@ fun ChatScreen(
     val sessionArchivingSupported by chatViewModel.sessionArchivingSupported.collectAsState()
     val currentSessionId by chatViewModel.currentSessionId.collectAsState()
     val structuredChatFailure by chatViewModel.chatFailure.collectAsState()
+    val preparingGatewaySessionId by chatViewModel.gatewayPreparingSessionId.collectAsState()
+    val gatewaySocketState by chatViewModel.gatewaySocketState.collectAsState()
+    val preparingGatewaySession = isStreaming && currentSessionId != null &&
+        preparingGatewaySessionId == currentSessionId
     val visibleChatFailure = scopedChatFailure(
         structuredChatFailure,
         currentSessionId,
@@ -958,6 +981,7 @@ fun ChatScreen(
     val backgroundProcessesLoading by chatViewModel.backgroundProcessesLoading.collectAsState()
     val stoppingProcessIds by chatViewModel.stoppingProcessIds.collectAsState()
     val subagentActivities by chatViewModel.subagentActivities.collectAsState()
+    val retainedActivityPreview by chatViewModel.retainedActivityPreview.collectAsState()
     val subagentChildPreview by chatViewModel.subagentChildPreview.collectAsState()
     val isLoadingHistory by chatViewModel.isLoadingHistory.collectAsState()
     val isLoadingSessions by chatViewModel.isLoadingSessions.collectAsState()
@@ -1138,6 +1162,12 @@ fun ChatScreen(
 
     val availableSkills by chatViewModel.availableSkills.collectAsState()
     val queuedMessages by chatViewModel.queuedMessages.collectAsState()
+    val queuePaused by chatViewModel.queuePaused.collectAsState()
+    val busyMessageAction by connectionViewModel.busyMessageAction.collectAsState()
+    var busyActionOverride by remember(currentSessionId, busyMessageAction) {
+        mutableStateOf<BusyMessageAction?>(null)
+    }
+    var editingQueuedMessage by remember(currentSessionId) { mutableStateOf(false) }
     val recentPrompts by chatViewModel.recentPrompts.collectAsState()
     val recentPromptsEnabled by connectionViewModel.chatRecentPromptsEnabled.collectAsState()
     // Effective approval-bypass (server-computed: ORs global approvals.mode=off,
@@ -1190,7 +1220,10 @@ fun ChatScreen(
         // RPC burst while the session directory was also trying to hydrate.
     }
     DisposableEffect(chatViewModel) {
-        onDispose { chatViewModel.setChatVisible(false) }
+        onDispose {
+            chatViewModel.setChatVisible(false)
+            chatViewModel.closeActivityPreview()
+        }
     }
 
     // Cold-open recovery: the dashboard probe that flips gatewayAvailability to
@@ -1361,14 +1394,10 @@ fun ChatScreen(
                 }
         }
         if (request.payload.omittedUriCount > 0) {
-            Toast.makeText(
-                context,
-                context.getString(
+            UiMessageBus.warning(context.getString(
                     R.string.chat_shared_files_limited,
                     com.hermesandroid.relay.util.MAX_SHARED_CONTENT_ATTACHMENTS,
-                ),
-                Toast.LENGTH_LONG,
-            ).show()
+                ))
         }
         com.hermesandroid.relay.util.SharedContentRequest.consume(request.id)
     }
@@ -1398,11 +1427,18 @@ fun ChatScreen(
     }
     var showCommandPalette by remember { mutableStateOf(false) }
     var showTranscriptSearch by rememberSaveable { mutableStateOf(false) }
-    var pendingAttachmentPreview by remember { mutableStateOf<Attachment?>(null) }
+    var pendingAttachmentPreviewIndex by rememberSaveable(
+        composerDraftKey.connectionId,
+        composerDraftKey.profileId,
+        composerDraftKey.sessionId,
+    ) { mutableStateOf<Int?>(null) }
     var showModelSheet by remember { mutableStateOf(false) }
     var showEffortSheet by remember { mutableStateOf(false) }
     var showAgentInfo by remember { mutableStateOf(false) }
     var showProfileShelf by remember { mutableStateOf(false) }
+    var showChatDebug by remember { mutableStateOf(false) }
+    var chatHeaderHeightPx by remember { mutableStateOf(0) }
+    LaunchedEffect(currentSessionId, activeConnection?.id, supervised) { showChatDebug = false }
     var showProfileSwitcher by remember { mutableStateOf(false) }
     var showProfileManager by remember { mutableStateOf(false) }
     var showBackgroundProcesses by remember { mutableStateOf(false) }
@@ -1419,7 +1455,7 @@ fun ChatScreen(
     // A process inventory is scoped to one gateway session. Never leave a
     // sheet opened onto a different chat after a drawer/profile switch.
     LaunchedEffect(currentSessionId, selectedProfile?.name, activeConnection?.id) {
-        chatViewModel.closeSubagentChildPreview()
+        chatViewModel.closeActivityPreview()
         showBackgroundProcesses = false
     }
 
@@ -1786,7 +1822,7 @@ fun ChatScreen(
             cameraLauncher.launch(uri)
         }.onFailure {
             pendingCameraUri = null
-            Toast.makeText(context, context.getString(R.string.chat_camera_open_failed), Toast.LENGTH_SHORT).show()
+            UiMessageBus.error(context.getString(R.string.chat_camera_open_failed))
         }
     }
     var pendingCameraAfterPermission by remember { mutableStateOf(false) }
@@ -1798,11 +1834,7 @@ fun ChatScreen(
         if (granted && wanted) {
             launchCamera()
         } else if (!granted) {
-            Toast.makeText(
-                context,
-                context.getString(R.string.chat_camera_perm_needed),
-                Toast.LENGTH_SHORT,
-            ).show()
+            UiMessageBus.warning(context.getString(R.string.chat_camera_perm_needed))
         }
     }
     val requestCameraCapture: () -> Unit = {
@@ -2600,11 +2632,7 @@ fun ChatScreen(
                         clipboard.setClipEntry(
                             ClipEntry(ClipData.newPlainText(copySessionIdLabel, sessionId))
                         )
-                        Toast.makeText(
-                            context,
-                            copiedToClipboardMsg,
-                            Toast.LENGTH_SHORT,
-                        ).show()
+                        UiMessageBus.success(copiedToClipboardMsg)
                     }
                 },
                 threadsCapabilityActive = threadsCapabilityActive,
@@ -2750,6 +2778,7 @@ fun ChatScreen(
         ) {
             // Top bar — messaging app style with avatar, name, model subtitle
             TopAppBar(
+                modifier = Modifier.onSizeChanged { chatHeaderHeightPx = it.height },
                 navigationIcon = {
                     if (!supervised || supervisedPolicy.capabilities.conversationHistory) {
                         IconButton(onClick = { scope.launch { drawerState.open() } }) {
@@ -2793,6 +2822,7 @@ fun ChatScreen(
                     val showStreamingState = isStreaming &&
                         (!supervised || supervisedVisibility.showWorkingStatus)
                     val statusText = when {
+                        preparingGatewaySession -> stringResource(R.string.chat_debug_preparing)
                         headerChatReady -> if (showStreamingState) {
                             stringResource(R.string.chat_streaming)
                         } else {
@@ -2869,13 +2899,21 @@ fun ChatScreen(
                         verticalAlignment = Alignment.CenterVertically,
                         horizontalArrangement = Arrangement.spacedBy(12.dp),
                         modifier = Modifier
-                            .clickable(enabled = !supervised) {
+                            .chatDebugHeaderGesture(enabled = !supervised,
+                                onHold = {
+                                    haptic.performHapticFeedback(HapticFeedbackType.LongPress)
+                                    showProfileShelf = false
+                                    showChatDebug = !showChatDebug
+                                },
+                                onClick = {
+                                showChatDebug = false
                                 if (profileShelfAvailable) {
                                     showProfileShelf = !showProfileShelf
                                 } else {
                                     showAgentInfo = true
                                 }
-                            }
+                            })
+                            .testTag("chat-agent-header")
                             .semantics {
                                 contentDescription = if (profileShelfAvailable) {
                                     context.getString(
@@ -3656,7 +3694,15 @@ fun ChatScreen(
                                 )
                             }
 
-                            if (processNotification != null) {
+                            if (message.activityRecord != null && (!supervised || supervisedVisibility.showWorkingStatus)) {
+                                ChatActivityReceipt(
+                                    record = message.activityRecord,
+                                    onClick = {
+                                        showBackgroundProcesses = chatViewModel.openRetainedActivity(message.activityRecord, processNotification?.detail)
+                                    },
+                                    modifier = Modifier.padding(vertical = 4.dp),
+                                )
+                            } else if (processNotification != null) {
                                 val notificationModifier = Modifier.padding(
                                     top = if (isFirstInGroup) 6.dp else 2.dp,
                                 )
@@ -3898,6 +3944,9 @@ fun ChatScreen(
                                 // optional diagnostic scaffolding. Keep lanes
                                 // visible in Off, Compact, and Detailed modes.
                                 laneGroups.keys.filterNotNull().sorted().forEach { taskIndex ->
+                                    val laneCalls = laneGroups.getValue(taskIndex)
+                                    val retainedIds = activityRecords.flatMap { it.children }.mapTo(HashSet()) { it.id }
+                                    if (laneCalls.all { it.subagentId != null && it.subagentId in retainedIds }) return@forEach
                                     Spacer(modifier = Modifier.height(4.dp))
                                     SubagentLane(
                                         taskIndex = taskIndex,
@@ -4033,7 +4082,7 @@ fun ChatScreen(
                     }
 
                     // Copy feedback snackbar
-                    SnackbarHost(
+                    ThemedMessageHost(
                         hostState = snackbarHostState,
                         modifier = Modifier
                             .align(Alignment.BottomCenter)
@@ -4048,7 +4097,7 @@ fun ChatScreen(
                     subagentActivities = subagentActivities,
                     subagentPreviewVisibility = subagentPreviewVisibility,
                     loading = backgroundProcessesLoading,
-                    onClick = { showBackgroundProcesses = true },
+                    onClick = { chatViewModel.openCurrentActivityPreview(); showBackgroundProcesses = true },
                 )
             }
 
@@ -4110,69 +4159,21 @@ fun ChatScreen(
                 }
             }
 
-            AnimatedVisibility(visible = queuedMessages.isNotEmpty()) {
-                Column(
-                    modifier = Modifier
-                        .fillMaxWidth()
-                        .padding(horizontal = 20.dp),
-                ) {
-                    Row(
-                        modifier = Modifier.fillMaxWidth(),
-                        verticalAlignment = Alignment.CenterVertically,
-                        horizontalArrangement = Arrangement.SpaceBetween
-                    ) {
-                        Text(
-                            text = pluralStringResource(
-                                R.plurals.chat_queue_count,
-                                queuedMessages.size,
-                                queuedMessages.size,
-                            ),
-                            style = MaterialTheme.typography.labelSmall,
-                            color = MaterialTheme.colorScheme.primary
-                        )
-                        TextButton(
-                            onClick = { chatViewModel.clearQueue() },
-                            modifier = Modifier.height(28.dp)
-                        ) {
-                            Text(
-                                stringResource(R.string.chat_clear),
-                                style = MaterialTheme.typography.labelSmall
-                            )
-                        }
+            ChatMessageQueue(
+                messages = queuedMessages,
+                paused = queuePaused,
+                onResume = chatViewModel::resumeQueue,
+                onClear = chatViewModel::clearQueue,
+                onRemove = chatViewModel::removeQueuedAt,
+                canEdit = inputText.isBlank() && pendingAttachments.isEmpty(),
+                onEdit = { index ->
+                    chatViewModel.takeQueuedForEdit(index)?.let {
+                        inputText = it
+                        editingQueuedMessage = true
                     }
-                    // Per-item: tap the text to pull it back into the composer
-                    // for editing; ✕ to drop just that one. (Reorder omitted —
-                    // low value vs. drag-handle complexity on a transient queue.)
-                    queuedMessages.forEachIndexed { index, msg ->
-                        Row(
-                            modifier = Modifier.fillMaxWidth(),
-                            verticalAlignment = Alignment.CenterVertically,
-                        ) {
-                            Text(
-                                text = msg,
-                                style = MaterialTheme.typography.bodySmall,
-                                color = MaterialTheme.colorScheme.onSurfaceVariant,
-                                maxLines = 2,
-                                overflow = androidx.compose.ui.text.style.TextOverflow.Ellipsis,
-                                modifier = Modifier
-                                    .weight(1f)
-                                    .clickable {
-                                        chatViewModel.takeQueuedForEdit(index)?.let { t ->
-                                            inputText = if (inputText.isBlank()) t else "$inputText $t"
-                                        }
-                                    }
-                                    .padding(vertical = 4.dp),
-                            )
-                            TextButton(
-                                onClick = { chatViewModel.removeQueuedAt(index) },
-                                modifier = Modifier.height(28.dp),
-                            ) {
-                                Text("✕", style = MaterialTheme.typography.labelSmall)
-                            }
-                        }
-                    }
-                }
-            }
+                },
+                modifier = Modifier.fillMaxWidth().padding(horizontal = 20.dp),
+            )
 
             val quoteYouLabel = stringResource(R.string.chat_quote_you)
             val quoteHermesLabel = stringResource(R.string.chat_quote_hermes)
@@ -4218,15 +4219,17 @@ fun ChatScreen(
 
             PendingAttachmentComposer(
                 attachments = pendingAttachments,
-                onPreview = { attachment, _ -> pendingAttachmentPreview = attachment },
+                onPreview = { _, index -> pendingAttachmentPreviewIndex = index },
                 onRemove = chatViewModel::removeAttachment,
                 onMove = chatViewModel::moveAttachment,
                 modifier = Modifier.padding(horizontal = 16.dp, vertical = 4.dp),
             )
-            pendingAttachmentPreview?.let { attachment ->
+            pendingAttachmentPreviewIndex
+                ?.let(pendingAttachments::getOrNull)
+                ?.let { attachment ->
                 AttachmentViewer(
                     attachment = attachment,
-                    onDismiss = { pendingAttachmentPreview = null },
+                    onDismiss = { pendingAttachmentPreviewIndex = null },
                     initiallyRevealed = true,
                 )
             }
@@ -4279,25 +4282,32 @@ fun ChatScreen(
             // Gateway redirect is text-only. Attachment-bearing follow-ups must
             // retain their files in the session-owned queue instead of showing
             // a correction action that cannot carry them.
-            val canSteerCurrentMessage = steerableTurn && pendingAttachments.isEmpty() &&
+            val canSteerCurrentMessage = canCorrectBusyMessage(
+                steerableTurn, pendingAttachments.isNotEmpty(), pendingAsk != null, turnStatus, inputText,
+            ) &&
                 (!supervised || supervisedPolicy.capabilities.steerResponse)
+            val effectiveBusyAction = if (canSteerCurrentMessage && !editingQueuedMessage) busyActionOverride ?: busyMessageAction
+                else BusyMessageAction.QueueNext
+            val correctCurrentMessage = canSteerCurrentMessage &&
+                effectiveBusyAction == BusyMessageAction.CorrectNow
             val trailing = when {
                 !isStreaming && hasContent -> ChatInputTrailing.SEND
                 !isStreaming -> ChatInputTrailing.VOICE
                 isStreaming && !hasContent -> ChatInputTrailing.STOP
-                canSteerCurrentMessage -> ChatInputTrailing.STEER
+                correctCurrentMessage -> ChatInputTrailing.STEER
                 else -> ChatInputTrailing.QUEUE
             }
             val inputCaption = when {
-                isStreaming && hasContent && canSteerCurrentMessage ->
+                isStreaming && hasContent && correctCurrentMessage ->
                     stringResource(R.string.chat_sends_now)
+                isStreaming && hasContent && queuePaused -> stringResource(R.string.chat_queue_paused)
                 isStreaming && hasContent -> stringResource(R.string.chat_delivered_after_turn)
                 isStreaming && steerNotice != null -> steerNotice
                 else -> null
             }
             val inputPlaceholder = when {
                 editingMessage != null -> stringResource(R.string.chat_placeholder_edit)
-                isStreaming && canSteerCurrentMessage -> stringResource(R.string.chat_placeholder_steer)
+                isStreaming && correctCurrentMessage -> stringResource(R.string.chat_placeholder_steer)
                 isStreaming -> stringResource(R.string.chat_placeholder_queue)
                 else -> stringResource(R.string.chat_placeholder_message)
             }
@@ -4549,6 +4559,12 @@ fun ChatScreen(
             }
 
             ChatInputBar(
+                busyAction = effectiveBusyAction.takeIf { isStreaming },
+                correctionAvailable = canSteerCurrentMessage,
+                onBusyActionChange = {
+                    editingQueuedMessage = false
+                    busyActionOverride = it
+                },
                 value = inputText,
                 onValueChange = { inputText = it },
                 placeholder = inputPlaceholder,
@@ -4577,7 +4593,9 @@ fun ChatScreen(
                             }
                         }
                     } else {
-                        chatViewModel.sendMessage(outboundText)
+                        chatViewModel.sendMessage(outboundText, effectiveBusyAction)
+                        editingQueuedMessage = false
+                        busyActionOverride = null
                         inputText = ""
                         finishSuccessfulSend()
                     }
@@ -4587,17 +4605,11 @@ fun ChatScreen(
                         isDemoMode = isDemoMode,
                         voiceReady = voiceReady,
                         onDemoNotice = {
-                            Toast.makeText(
-                                context,
-                                "Voice is unavailable in the offline demo — connect to Hermes to use it",
-                                Toast.LENGTH_LONG,
-                            ).show()
+                            UiMessageBus.warning("Voice is unavailable in the offline demo — connect to Hermes to use it")
                         },
                         onStartVoice = requestVoiceMode,
                         onSetupNotice = {
-                            Toast.makeText(
-                                context,
-                                when (standardVoiceAvailability) {
+                            UiMessageBus.warning(when (standardVoiceAvailability) {
                                     com.hermesandroid.relay.viewmodel.StandardVoiceAvailability.SignInRequired ->
                                         standardVoiceSignInRouteHint?.let { route ->
                                             "Voice needs a one-time sign-in on the $route route — open Manage"
@@ -4606,9 +4618,7 @@ fun ChatScreen(
                                         "This Hermes build has no voice routes — update hermes-agent or pair Relay"
                                     else ->
                                         context.getString(R.string.chat_voice_needs_route)
-                                },
-                                Toast.LENGTH_SHORT,
-                            ).show()
+                                })
                         },
                     )
                 },
@@ -4832,6 +4842,30 @@ fun ChatScreen(
             }
         } // end Column
 
+        ChatDebugOverlay(
+            visible = showChatDebug && !supervised,
+            headerHeight = with(density) { chatHeaderHeightPx.toDp() },
+            onClose = { showChatDebug = false },
+        ) {
+            ChatDebugDrawer(
+                profile = AgentDisplay.profileDisplayName(conversationProfile)
+                    ?: stringResource(R.string.chat_server_default),
+                model = AgentDisplay.displayModelName(sessionModelState.model).orEmpty(),
+                sessionId = currentSessionId,
+                gateway = isGatewayTransport,
+                signedIn = chatGatewayAvailability == GatewayAvailability.Ready,
+                signInRequired = chatGatewayAvailability == GatewayAvailability.SignInRequired,
+                socketState = gatewaySocketState,
+                preparing = preparingGatewaySession,
+                streaming = isStreaming,
+                loadingHistory = isLoadingHistory,
+                directoryUnavailable = sessionListUnavailable,
+                failure = visibleChatFailure?.rawError,
+                onClose = { showChatDebug = false },
+                onConnections = { showChatDebug = false; onNavigateToConnections() },
+            )
+        }
+
         // Mic permission denied banner — title + body + Open Settings action.
         // System "Don't ask again" gives no callback, so a toast would leave
         // the user stranded. Banner + direct-to-app-details deep link is the
@@ -4971,8 +5005,8 @@ fun ChatScreen(
 
     if (showBackgroundProcesses) {
         GatewayBackgroundProcessSheet(
-            processes = backgroundProcesses,
-            subagentActivities = subagentActivities,
+            processes = retainedActivityPreview?.processes ?: backgroundProcesses,
+            subagentActivities = retainedActivityPreview?.record?.previewActivities() ?: subagentActivities,
             subagentChildPreview = subagentChildPreview,
             subagentPreviewVisibility = subagentPreviewVisibility,
             loading = backgroundProcessesLoading,
@@ -4981,8 +5015,10 @@ fun ChatScreen(
             onStop = chatViewModel::stopBackgroundProcess,
             onDismissProcess = chatViewModel::dismissBackgroundProcess,
             onOpenSubagentChild = chatViewModel::openSubagentChildPreview,
+            readOnlyHistory = retainedActivityPreview != null,
+            historyNotice = if (retainedActivityPreview != null) stringResource(R.string.chat_activity_history_notice) else null,
             onDismiss = {
-                chatViewModel.closeSubagentChildPreview()
+                chatViewModel.closeActivityPreview()
                 showBackgroundProcesses = false
             },
         )
@@ -5523,13 +5559,9 @@ private suspend fun ingestAttachmentFromUri(
     } catch (cancelled: CancellationException) {
         throw cancelled
     } catch (_: AttachmentTooLargeException) {
-        Toast.makeText(
-            context,
-            context.getString(R.string.chat_file_too_large, maxAttachmentMb),
-            Toast.LENGTH_SHORT,
-        ).show()
+        UiMessageBus.warning(context.getString(R.string.chat_file_too_large, maxAttachmentMb))
     } catch (e: Exception) {
-        Toast.makeText(context, context.getString(R.string.chat_failed_read_file), Toast.LENGTH_SHORT).show()
+        UiMessageBus.error(context.getString(R.string.chat_failed_read_file))
     }
 }
 

app/src/main/kotlin/com/hermesandroid/relay/ui/screens/ChatSettingsScreen.kt

@@ -1,5 +1,6 @@
 package com.hermesandroid.relay.ui.screens
 
+import com.hermesandroid.relay.ui.components.ChatBusyActionSelector
 import android.os.Build
 import androidx.activity.compose.rememberLauncherForActivityResult
 import androidx.activity.result.contract.ActivityResultContracts
@@ -499,6 +500,22 @@ fun ChatSettingsScreen(
 
                     HorizontalDivider()
 
+                    val busyMessageAction by connectionViewModel.busyMessageAction.collectAsState()
+                    Column(verticalArrangement = Arrangement.spacedBy(8.dp)) {
+                        Text(stringResource(R.string.chat_busy_default_title), style = MaterialTheme.typography.bodyMedium)
+                        Text(
+                            stringResource(R.string.chat_busy_default_description),
+                            style = MaterialTheme.typography.bodySmall,
+                            color = MaterialTheme.colorScheme.onSurfaceVariant,
+                        )
+                        ChatBusyActionSelector(
+                            action = busyMessageAction,
+                            onActionChange = connectionViewModel::setBusyMessageAction,
+                            modifier = Modifier.fillMaxWidth(),
+                        )
+                    }
+                    HorizontalDivider()
+
                     val physicalKeyboardEnterBehavior by
                         connectionViewModel.physicalKeyboardEnterBehavior.collectAsState()
                     Column(verticalArrangement = Arrangement.spacedBy(8.dp)) {

app/src/main/kotlin/com/hermesandroid/relay/ui/screens/CustomPetGuideScreen.kt

@@ -30,7 +30,7 @@ import androidx.compose.material3.MaterialTheme
 import androidx.compose.material3.OutlinedButton
 import androidx.compose.material3.OutlinedTextField
 import androidx.compose.material3.Scaffold
-import androidx.compose.material3.SnackbarHost
+import com.hermesandroid.relay.ui.components.ThemedMessageHost
 import androidx.compose.material3.SnackbarHostState
 import androidx.compose.material3.Text
 import androidx.compose.material3.TopAppBar
@@ -124,7 +124,7 @@ fun CustomPetGuideScreen(
                 colors = TopAppBarDefaults.topAppBarColors(containerColor = MaterialTheme.colorScheme.surface),
             )
         },
-        snackbarHost = { SnackbarHost(snackbarHostState) },
+        snackbarHost = { ThemedMessageHost(snackbarHostState) },
     ) { innerPadding ->
         Column(
             modifier = Modifier

app/src/main/kotlin/com/hermesandroid/relay/ui/screens/DeveloperSettingsScreen.kt

@@ -2,7 +2,7 @@
 
 package com.hermesandroid.relay.ui.screens
 
-import android.widget.Toast
+import com.hermesandroid.relay.ui.UiMessageBus
 import androidx.activity.compose.rememberLauncherForActivityResult
 import androidx.activity.result.contract.ActivityResultContracts
 import com.hermesandroid.relay.ui.theme.LocalBrand
@@ -92,11 +92,7 @@ fun DeveloperSettingsScreen(
     ) { uri ->
         if (uri != null && backupJson != null) {
             connectionViewModel.writeBackupToUri(uri, backupJson!!) { success ->
-                Toast.makeText(
-                    context,
-                    if (success) context.getString(R.string.dev_settings_exported) else context.getString(R.string.dev_settings_export_failed),
-                    Toast.LENGTH_SHORT
-                ).show()
+                UiMessageBus.post(if (success) context.getString(R.string.dev_settings_exported) else context.getString(R.string.dev_settings_export_failed), severity = if (success) com.hermesandroid.relay.ui.UiMessageSeverity.Success else com.hermesandroid.relay.ui.UiMessageSeverity.Error)
                 backupJson = null
             }
         }
@@ -108,11 +104,7 @@ fun DeveloperSettingsScreen(
     ) { uri ->
         if (uri != null) {
             connectionViewModel.importFromUri(uri) { success ->
-                Toast.makeText(
-                    context,
-                    if (success) context.getString(R.string.dev_settings_imported) else context.getString(R.string.dev_settings_import_failed),
-                    Toast.LENGTH_SHORT
-                ).show()
+                UiMessageBus.post(if (success) context.getString(R.string.dev_settings_imported) else context.getString(R.string.dev_settings_import_failed), severity = if (success) com.hermesandroid.relay.ui.UiMessageSeverity.Success else com.hermesandroid.relay.ui.UiMessageSeverity.Error)
             }
         }
     }
@@ -184,15 +176,11 @@ fun DeveloperSettingsScreen(
                         }
                         IconButton(onClick = {
                             connectionViewModel.resetOnboarding { success ->
-                                Toast.makeText(
-                                    context,
-                                    if (success) {
+                                UiMessageBus.post(if (success) {
                                         context.getString(R.string.dev_settings_onboarding_reset_toast)
                                     } else {
                                         context.getString(R.string.dev_settings_reset_failed)
-                                    },
-                                    Toast.LENGTH_SHORT,
-                                ).show()
+                                    }, severity = if (success) com.hermesandroid.relay.ui.UiMessageSeverity.Success else com.hermesandroid.relay.ui.UiMessageSeverity.Error)
                             }
                         }) {
                             Icon(
@@ -433,11 +421,7 @@ fun DeveloperSettingsScreen(
                         IconButton(onClick = {
                             scope.launch {
                                 FeatureFlags.lockDevOptions(context)
-                                Toast.makeText(
-                                    context,
-                                    context.getString(R.string.dev_settings_locked_toast),
-                                    Toast.LENGTH_SHORT,
-                                ).show()
+                                UiMessageBus.info(context.getString(R.string.dev_settings_locked_toast))
                                 onBack()
                             }
                         }) {
@@ -455,6 +439,7 @@ fun DeveloperSettingsScreen(
             // logged error, a live update). Gated by isDevBuild so it never
             // ships in a release APK.
             if (FeatureFlags.isDevBuild) {
+                MessagePreviewControls()
                 Text(
                     text = stringResource(R.string.dev_settings_test_harness),
                     style = MaterialTheme.typography.titleMedium,
@@ -501,7 +486,7 @@ fun DeveloperSettingsScreen(
                                         context.getString(R.string.dev_settings_sample_stacktrace),
                                     ),
                                 )
-                                Toast.makeText(context, context.getString(R.string.dev_settings_diagnostics_emitted_toast), Toast.LENGTH_SHORT).show()
+                                UiMessageBus.info(context.getString(R.string.dev_settings_diagnostics_emitted_toast))
                             },
                         )
 
@@ -518,7 +503,7 @@ fun DeveloperSettingsScreen(
                                     is UpdateStatus.Downloaded -> context.getString(R.string.dev_settings_update_state_downloaded)
                                     else -> context.getString(R.string.dev_settings_update_state_off)
                                 }
-                                Toast.makeText(context, context.getString(R.string.dev_settings_update_banner_preview_toast, state), Toast.LENGTH_SHORT).show()
+                                UiMessageBus.info(context.getString(R.string.dev_settings_update_banner_preview_toast, state))
                             },
                         )
 
@@ -568,11 +553,7 @@ fun DeveloperSettingsScreen(
                         showExportDialog = false
                         connectionViewModel.exportSettings { json ->
                             if (json == null) {
-                                Toast.makeText(
-                                    context,
-                                    context.getString(R.string.dev_settings_export_failed),
-                                    Toast.LENGTH_SHORT,
-                                ).show()
+                                UiMessageBus.error(context.getString(R.string.dev_settings_export_failed))
                             } else {
                                 backupJson = json
                                 exportLauncher.launch("hermes-relay-sensitive-backup.json")
@@ -633,15 +614,11 @@ fun DeveloperSettingsScreen(
                     onClick = {
                         showResetDialog = false
                         connectionViewModel.resetAppData { success ->
-                            Toast.makeText(
-                                context,
-                                if (success) {
+                            UiMessageBus.post(if (success) {
                                     context.getString(R.string.dev_settings_app_data_reset_toast)
                                 } else {
                                     context.getString(R.string.dev_settings_reset_failed)
-                                },
-                                Toast.LENGTH_SHORT,
-                            ).show()
+                                }, severity = if (success) com.hermesandroid.relay.ui.UiMessageSeverity.Success else com.hermesandroid.relay.ui.UiMessageSeverity.Error)
                         }
                     }
                 ) {
@@ -658,7 +635,7 @@ fun DeveloperSettingsScreen(
 }
 
 @Composable
-private fun TestHarnessRow(
+internal fun TestHarnessRow(
     title: String,
     subtitle: String,
     icon: androidx.compose.ui.graphics.vector.ImageVector,

app/src/main/kotlin/com/hermesandroid/relay/ui/screens/MediaSettingsScreen.kt

@@ -3,7 +3,7 @@
 package com.hermesandroid.relay.ui.screens
 
 import android.content.Context
-import android.widget.Toast
+import com.hermesandroid.relay.ui.UiMessageBus
 import com.hermesandroid.relay.ui.theme.LocalBrand
 import androidx.compose.foundation.layout.Arrangement
 import androidx.compose.foundation.layout.Column
@@ -285,11 +285,7 @@ fun MediaSettingsScreen(
                                         R.string.media_clear_cache_freed,
                                         formatBytesHuman(context, freed)
                                     )
-                                    Toast.makeText(
-                                        context,
-                                        freedMsg,
-                                        Toast.LENGTH_SHORT
-                                    ).show()
+                                    UiMessageBus.info(freedMsg)
                                 }
                             }
                         ) {

app/src/main/kotlin/com/hermesandroid/relay/ui/screens/MessagePreviewControls.kt

@@ -0,0 +1,83 @@
+package com.hermesandroid.relay.ui.screens
+
+import androidx.compose.foundation.layout.Arrangement
+import androidx.compose.foundation.layout.Column
+import androidx.compose.foundation.layout.fillMaxWidth
+import androidx.compose.foundation.layout.padding
+import androidx.compose.material.icons.Icons
+import androidx.compose.material.icons.filled.Science
+import androidx.compose.material3.Card
+import androidx.compose.material3.MaterialTheme
+import androidx.compose.material3.SnackbarResult
+import androidx.compose.material3.Text
+import androidx.compose.runtime.Composable
+import androidx.compose.runtime.DisposableEffect
+import androidx.compose.runtime.remember
+import androidx.compose.runtime.rememberCoroutineScope
+import androidx.compose.ui.Modifier
+import androidx.compose.ui.res.stringResource
+import androidx.compose.ui.unit.dp
+import com.hermesandroid.relay.R
+import com.hermesandroid.relay.ui.UiMessageBus
+import com.hermesandroid.relay.ui.UiMessageSeverity
+import com.hermesandroid.relay.ui.components.HumanErrorVisuals
+import com.hermesandroid.relay.ui.components.LocalMessageActionHost
+import com.hermesandroid.relay.util.HumanError
+import kotlinx.coroutines.Job
+import kotlinx.coroutines.launch
+
+/** Local-only samples; no network, diagnostics, or connection-state mutations. */
+@Composable
+internal fun MessagePreviewControls() {
+    val scope = rememberCoroutineScope()
+    val actionHost = LocalMessageActionHost.current
+    val jobs = remember { arrayOfNulls<Job>(1) }
+    val key = "developer-message-preview"
+    fun reset() {
+        jobs[0]?.cancel()
+        jobs[0] = null
+        UiMessageBus.clear(key)
+    }
+    DisposableEffect(Unit) { onDispose { reset() } }
+    Text(stringResource(R.string.dev_message_previews), style = MaterialTheme.typography.titleMedium)
+    Card(Modifier.fillMaxWidth()) {
+        Column(Modifier.padding(16.dp), verticalArrangement = Arrangement.spacedBy(8.dp)) {
+            Text(stringResource(R.string.dev_message_previews_desc), style = MaterialTheme.typography.bodySmall)
+            val samples = listOf(
+                R.string.dev_message_info to UiMessageSeverity.Info,
+                R.string.dev_message_success to UiMessageSeverity.Success,
+                R.string.dev_message_progress to UiMessageSeverity.Status,
+                R.string.dev_message_warning to UiMessageSeverity.Warning,
+                R.string.dev_message_error to UiMessageSeverity.Error,
+            )
+            samples.forEach { (label, severity) ->
+                val text = stringResource(label)
+                TestHarnessRow(text, stringResource(R.string.dev_message_preview_sample), Icons.Filled.Science, onClick = {
+                    reset()
+                    UiMessageBus.post(text, severity, ttlMillis = if (severity == UiMessageSeverity.Status) 0L else 10_000L, key = key)
+                })
+            }
+            val errorTitle = stringResource(R.string.dev_message_action)
+            val errorBody = stringResource(R.string.dev_message_action_body)
+            val retryLabel = stringResource(R.string.dev_message_retry)
+            val retryResult = stringResource(R.string.dev_message_retry_result)
+            TestHarnessRow(errorTitle, errorBody, Icons.Filled.Science, onClick = {
+                reset()
+                jobs[0] = scope.launch {
+                    val result = actionHost?.showSnackbar(HumanErrorVisuals(HumanError(
+                        title = errorTitle, body = errorBody, retryable = true, actionLabel = retryLabel,
+                    )))
+                    if (result == SnackbarResult.ActionPerformed) {
+                        UiMessageBus.post(retryResult, UiMessageSeverity.Success, key = key)
+                    }
+                }
+            })
+            TestHarnessRow(
+                stringResource(R.string.dev_message_clear),
+                stringResource(R.string.dev_message_clear_desc),
+                Icons.Filled.Science,
+                onClick = { reset() },
+            )
+        }
+    }
+}

app/src/main/kotlin/com/hermesandroid/relay/ui/screens/PairScreen.kt

@@ -2,7 +2,7 @@
 
 package com.hermesandroid.relay.ui.screens
 
-import android.widget.Toast
+import com.hermesandroid.relay.ui.UiMessageBus
 import androidx.activity.compose.BackHandler
 import androidx.compose.foundation.layout.Arrangement
 import androidx.compose.foundation.layout.Box
@@ -170,7 +170,7 @@ fun PairScreen(
                 ConnectionWizard(
                     connectionViewModel = connectionViewModel,
                     onComplete = {
-                        Toast.makeText(context, context.getString(R.string.pair_connection_updated), Toast.LENGTH_SHORT).show()
+                        UiMessageBus.success(context.getString(R.string.pair_connection_updated))
                         onComplete()
                     },
                     onCancel = onCancel,

app/src/main/kotlin/com/hermesandroid/relay/ui/screens/PairedDevicesScreen.kt

@@ -38,7 +38,7 @@ import androidx.compose.material3.IconButton
 import androidx.compose.material3.MaterialTheme
 import androidx.compose.material3.OutlinedButton
 import androidx.compose.material3.Scaffold
-import androidx.compose.material3.SnackbarHost
+import com.hermesandroid.relay.ui.components.ThemedMessageHost
 import androidx.compose.material3.SnackbarHostState
 import androidx.compose.material3.Text
 import androidx.compose.material3.TextButton
@@ -150,7 +150,7 @@ fun PairedDevicesScreen(
                 )
             )
         },
-        snackbarHost = { SnackbarHost(snackbarHostState) }
+        snackbarHost = { ThemedMessageHost(snackbarHostState) }
     ) { inner ->
         Box(
             modifier = Modifier

app/src/main/kotlin/com/hermesandroid/relay/ui/screens/PetdexBrowseScreen.kt

@@ -36,7 +36,7 @@ import androidx.compose.material3.IconButton
 import androidx.compose.material3.MaterialTheme
 import androidx.compose.material3.OutlinedTextField
 import androidx.compose.material3.Scaffold
-import androidx.compose.material3.SnackbarHost
+import com.hermesandroid.relay.ui.components.ThemedMessageHost
 import androidx.compose.material3.SnackbarHostState
 import androidx.compose.material3.Text
 import androidx.compose.material3.TextButton
@@ -189,7 +189,7 @@ fun PetdexBrowseScreen(
                 ),
             )
         },
-        snackbarHost = { SnackbarHost(snackbarHostState) },
+        snackbarHost = { ThemedMessageHost(snackbarHostState) },
     ) { innerPadding ->
         LazyVerticalGrid(
             columns = GridCells.Adaptive(156.dp),

app/src/main/kotlin/com/hermesandroid/relay/util/MediaCacheWriter.kt

@@ -6,6 +6,7 @@ import androidx.core.content.FileProvider
 import kotlinx.coroutines.Dispatchers
 import kotlinx.coroutines.withContext
 import java.io.File
+import java.io.InputStream
 import java.security.MessageDigest
 
 /**
@@ -98,7 +99,7 @@ class MediaCacheWriter(
     suspend fun cache(bytes: ByteArray, contentType: String, fileName: String?): Uri =
         withContext(Dispatchers.IO) {
             val dir = cacheRoot
-            val targetName = buildFilename(bytes, contentType, fileName)
+            val targetName = buildFilename(bytes.sha1(), contentType, fileName)
             val file = File(dir, targetName)
             file.writeBytes(bytes)
             // Best-effort LRU enforcement — never fatal on a cache operation.
@@ -113,6 +114,45 @@ class MediaCacheWriter(
             )
         }
 
+    /**
+     * Move a completed streaming download into the media cache without ever
+     * materializing the file as a ByteArray. The caller retains ownership of
+     * [source] when this throws; successful calls consume or copy it.
+     */
+    suspend fun cache(source: File, contentType: String, fileName: String?): Uri {
+        val target = cacheFile(source, contentType, fileName)
+        return withContext(Dispatchers.IO) {
+            FileProvider.getUriForFile(
+                context,
+                "${context.packageName}.fileprovider",
+                target,
+            )
+        }
+    }
+
+    internal suspend fun cacheFile(source: File, contentType: String, fileName: String?): File =
+        withContext(Dispatchers.IO) {
+            require(source.isFile) { "Media cache source does not exist" }
+            val dir = cacheRoot
+            val target = File(dir, buildFilename(source.sha1(), contentType, fileName))
+            if (source.canonicalFile != target.canonicalFile) {
+                if (target.exists()) {
+                    source.delete()
+                    target.setLastModified(System.currentTimeMillis())
+                } else if (!source.renameTo(target)) {
+                    source.inputStream().use { input ->
+                        target.outputStream().use { output -> input.copyTo(output) }
+                    }
+                    source.delete()
+                }
+            }
+            try {
+                enforceCap()
+            } catch (_: Exception) { /* swallow */ }
+
+            target
+        }
+
     /**
      * Wipe the entire `hermes-media/` directory. Returns the number of bytes
      * freed so the caller can show a "Freed X MB" snackbar/toast.
@@ -133,15 +173,8 @@ class MediaCacheWriter(
 
     // --- internals ---
 
-    private fun buildFilename(bytes: ByteArray, contentType: String, fileName: String?): String {
+    private fun buildFilename(sha1: String, contentType: String, fileName: String?): String {
         val ext = mimeToExt[contentType.lowercase().substringBefore(';').trim()] ?: "bin"
-        // SHA-1 of the bytes — stable + collision-resistant enough for cache keys.
-        val sha1 = try {
-            MessageDigest.getInstance("SHA-1").digest(bytes).joinToString("") { "%02x".format(it) }
-        } catch (_: Exception) {
-            // fallback to a weaker but always-available hash
-            bytes.contentHashCode().toUInt().toString(16)
-        }
 
         // If the server supplied a filename, keep the base (sanitized) but
         // force the extension we derived from the MIME. This keeps the
@@ -162,6 +195,33 @@ class MediaCacheWriter(
         }
     }
 
+    private fun ByteArray.sha1(): String = try {
+        MessageDigest.getInstance("SHA-1").digest(this).toHexString()
+    } catch (_: Exception) {
+        contentHashCode().toUInt().toString(16)
+    }
+
+    private fun File.sha1(): String = try {
+        inputStream().use { input ->
+            val digest = MessageDigest.getInstance("SHA-1")
+            input.updateDigest(digest)
+            digest.digest().toHexString()
+        }
+    } catch (_: Exception) {
+        "${length().toUInt().toString(16)}-${lastModified().toUInt().toString(16)}"
+    }
+
+    private fun InputStream.updateDigest(digest: MessageDigest) {
+        val buffer = ByteArray(DEFAULT_BUFFER_SIZE)
+        while (true) {
+            val read = read(buffer)
+            if (read < 0) return
+            digest.update(buffer, 0, read)
+        }
+    }
+
+    private fun ByteArray.toHexString(): String = joinToString("") { "%02x".format(it) }
+
     /**
      * Delete oldest-mtime files until the cache directory fits under the cap.
      * Called after every write; safe to call more often.

app/src/main/kotlin/com/hermesandroid/relay/util/MediaSaver.kt

@@ -14,6 +14,9 @@ import kotlinx.coroutines.withContext
 import okhttp3.OkHttpClient
 import okhttp3.Request
 import java.io.File
+import java.io.ByteArrayOutputStream
+import java.io.IOException
+import java.io.InputStream
 import java.util.concurrent.TimeUnit
 
 /**
@@ -39,6 +42,7 @@ object MediaSaver {
 
     private const val SAVE_SUBDIR = "Hermes-Relay"
     private const val SHARE_CACHE_DIR = "hermes-media"
+    private const val MAX_IN_MEMORY_MEDIA_BYTES = 25L * 1024L * 1024L
 
     private val httpClient: OkHttpClient by lazy {
         OkHttpClient.Builder()
@@ -70,7 +74,10 @@ object MediaSaver {
             httpClient.newCall(request).execute().use { resp ->
                 if (!resp.isSuccessful) error("HTTP ${resp.code}")
                 val contentType = resp.header("Content-Type")?.substringBefore(';')?.trim()
-                val body = resp.body.bytes()
+                val responseBody = resp.body
+                val body = responseBody.byteStream().use { input ->
+                    readBoundedBytes(input, responseBody.contentLength())
+                }
                 body to contentType
             }
         }
@@ -78,11 +85,42 @@ object MediaSaver {
     /** Read the bytes behind a `content://` (or `file://`) [uri]. */
     suspend fun readUriBytes(context: Context, uri: Uri): ByteArray? =
         withContext(Dispatchers.IO) {
-            runCatching {
-                context.contentResolver.openInputStream(uri)?.use { it.readBytes() }
-            }.getOrNull()
+            try {
+                val declaredLength = context.contentResolver.openAssetFileDescriptor(uri, "r")
+                    ?.use { it.length }
+                    ?.takeIf { it >= 0L }
+                    ?: -1L
+                context.contentResolver.openInputStream(uri)?.use { input ->
+                    readBoundedBytes(input, declaredLength)
+                }
+            } catch (_: Exception) {
+                null
+            }
         }
 
+    private fun readBoundedBytes(input: InputStream, declaredLength: Long): ByteArray {
+        if (declaredLength > MAX_IN_MEMORY_MEDIA_BYTES) {
+            throw IOException("Media exceeds Android's in-memory export limit")
+        }
+        val initialSize = when {
+            declaredLength in 1..MAX_IN_MEMORY_MEDIA_BYTES -> declaredLength.toInt()
+            else -> DEFAULT_BUFFER_SIZE
+        }
+        val output = ByteArrayOutputStream(initialSize)
+        val buffer = ByteArray(DEFAULT_BUFFER_SIZE)
+        var total = 0L
+        while (true) {
+            val read = input.read(buffer)
+            if (read < 0) break
+            total += read
+            if (total > MAX_IN_MEMORY_MEDIA_BYTES) {
+                throw IOException("Media exceeds Android's in-memory export limit")
+            }
+            output.write(buffer, 0, read)
+        }
+        return output.toByteArray()
+    }
+
     // --- Save ---------------------------------------------------------------
 
     suspend fun saveImage(

app/src/main/kotlin/com/hermesandroid/relay/util/RelayErrorClassifier.kt

@@ -5,6 +5,7 @@ import com.hermesandroid.relay.R
 import com.hermesandroid.relay.diagnostics.DiagnosticCategory
 import com.hermesandroid.relay.diagnostics.DiagnosticsLog
 import com.hermesandroid.relay.diagnostics.NetworkDiagnosticGuidance
+import com.hermesandroid.relay.network.upstream.DashboardHttpException
 import java.io.IOException
 import java.net.ConnectException
 import java.net.SocketTimeoutException
@@ -86,6 +87,8 @@ private fun nullFallback(context: String?, ctx: Context?): HumanError {
     return HumanError(title = titlePrefix(context, ctx), body = base, retryable = false)
 }
 
+private val LEGACY_HTTP_STATUS = Regex("""^(?:http(?: error)?|api error|relay responded http) ([1-5]\d{2})(?=\s|:|$)""")
+
 private fun classifyIoMessage(msg: String, context: String?, ctx: Context?): HumanError? {
     // Ordered most-specific-first; callers have already handled the typed
     // SSL / timeout / connect exceptions so this only runs on generic IOs.
@@ -149,11 +152,9 @@ private fun classifyIoMessage(msg: String, context: String?, ctx: Context?): Hum
                 "server. Update the relay, then try again.",
             retryable = false,
         )
-        "404" in msg -> HumanError(
+        LEGACY_HTTP_STATUS.find(msg.trim())?.groupValues?.get(1) == "404" -> HumanError(
             title = ctx?.getString(R.string.error_classify_endpoint) ?: "Endpoint not found",
-            body = if (context == "voice_config")
-                "The relay doesn't have voice endpoints — it may be an older version"
-            else "The relay doesn't have this endpoint — it may be an older version",
+            body = "The requested resource or endpoint is unavailable on this server.",
             retryable = false,
         )
         "413" in msg -> HumanError(
@@ -255,6 +256,30 @@ private fun String.diagnosticOperation(): String =
 private fun classifyErrorInternal(t: Throwable?, context: String?, ctx: Context?): HumanError {
     if (t == null) return nullFallback(context, ctx)
 
+    // Preserve the actual transport and status instead of inferring them from
+    // a response body, resource identifier, or unrelated number in an error.
+    if (t is DashboardHttpException) {
+        return when (t.statusCode) {
+            401 -> HumanError(
+                title = ctx?.getString(R.string.power_feature_dashboard_signin_label) ?: "Dashboard sign-in required",
+                body = "Sign in to the Hermes Dashboard to continue this action.",
+            )
+            403 -> HumanError(
+                title = ctx?.getString(R.string.error_classify_not_allowed) ?: "Not allowed",
+                body = "The Dashboard refused this action.",
+            )
+            404 -> HumanError(
+                title = ctx?.getString(R.string.error_classify_endpoint) ?: "Endpoint not found",
+                body = "The requested Dashboard resource or endpoint is unavailable.",
+            )
+            else -> HumanError(
+                title = titlePrefix(context, ctx),
+                body = "The Dashboard request failed (HTTP ${t.statusCode}).",
+                retryable = t.statusCode == 408 || t.statusCode == 429 || t.statusCode >= 500,
+            )
+        }
+    }
+
     val msg = t.message.orEmpty().lowercase()
 
     if ("cannot create audiorecord" in msg ||

app/src/main/kotlin/com/hermesandroid/relay/viewmodel/ChatActivityController.kt

@@ -0,0 +1,286 @@
+package com.hermesandroid.relay.viewmodel
+
+import com.hermesandroid.relay.data.ChatActivityChild
+import com.hermesandroid.relay.data.ChatActivityKind
+import com.hermesandroid.relay.data.ChatActivityPhase
+import com.hermesandroid.relay.data.ChatActivityRecord
+import com.hermesandroid.relay.data.ChatActivityStore
+import com.hermesandroid.relay.data.InMemoryChatActivityStore
+import com.hermesandroid.relay.data.boundChatActivities
+import com.hermesandroid.relay.network.upstream.GatewayProcess
+import java.io.IOException
+import kotlinx.coroutines.CoroutineScope
+import kotlinx.coroutines.flow.MutableStateFlow
+import kotlinx.coroutines.flow.StateFlow
+import kotlinx.coroutines.flow.asStateFlow
+import kotlinx.coroutines.launch
+import kotlinx.coroutines.sync.Mutex
+import kotlinx.coroutines.sync.withLock
+
+/** Session-owned history metadata. Call capture only with events/snapshots owned by the selected session. */
+internal class ChatActivityController(
+    private val scope: CoroutineScope,
+    private var store: ChatActivityStore = InMemoryChatActivityStore(),
+    private val clock: () -> Long = System::currentTimeMillis,
+) {
+    private val mutableRecords = MutableStateFlow<List<ChatActivityRecord>>(emptyList())
+    val records: StateFlow<List<ChatActivityRecord>> = mutableRecords.asStateFlow()
+    private var owner: Pair<String, String>? = null
+    private var generation = 0L
+    private var deletedOwner: Pair<String, String>? = null
+    private val retiredIds = mutableSetOf<String>()
+    private val writes = Mutex()
+
+    fun bindStore(store: ChatActivityStore) {
+        if (this.store === store) return
+        this.store = store
+        generation++
+        load(migrate = true)
+    }
+
+    fun selectSession(scopeKey: String?, sessionId: String?) {
+        val next = if (!scopeKey.isNullOrBlank() && !sessionId.isNullOrBlank()) scopeKey to sessionId else null
+        if (next != null && next == deletedOwner) return
+        if (next != null && next != deletedOwner) deletedOwner = null
+        if (next == owner) return
+        owner = next
+        generation++
+        mutableRecords.value = emptyList()
+        retiredIds.clear()
+        load()
+    }
+
+    private fun load(migrate: Boolean = false) {
+        val selected = owner ?: return
+        val selectedStore = store
+        val selectedGeneration = generation
+        scope.launch {
+            val loaded = try {
+                selectedStore.read(selected.first, selected.second)
+            } catch (_: IOException) {
+                emptyList()
+            }
+            if (selectedGeneration != generation || owner != selected || selectedStore !== store) return@launch
+            val fresh = mutableRecords.value.associateBy(ChatActivityRecord::id)
+            val merged = loaded.filter { it.scopeKey == selected.first && it.sessionId == selected.second && it.id !in retiredIds }
+                .map { restored -> fresh[restored.id]?.let { live -> mergeRestored(restored, live) } ?: restored }
+                .associateByTo(linkedMapOf(), ChatActivityRecord::id)
+            fresh.forEach { (id, record) -> if (id !in merged) merged[id] = record }
+            // A lazy disk read can reveal a fallback only after its live event supplied delegation identity.
+            merged.values.filter { it.kind == ChatActivityKind.SUBAGENTS && !it.isFallback() }.toList()
+                .forEach { target ->
+                    val fallbacks = merged.values.filter { candidate ->
+                        candidate.isFallback() && candidate.children.any { old ->
+                            target.children.any { child -> old.id == child.id ||
+                                (child.childSessionId != null && old.childSessionId == child.childSessionId) }
+                        }
+                    }
+                    var consolidated = target
+                    fallbacks.forEach { fallback ->
+                        consolidated = mergeRestored(fallback, consolidated)
+                        merged.remove(fallback.id)
+                        retire(fallback)
+                    }
+                    merged[target.id] = consolidated
+                }
+            publish(merged.values.toList())
+            mutableRecords.value.filter { it.id in fresh }.forEach { record ->
+                if (migrate || fresh[record.id] != record) persist(record)
+            }
+        }
+    }
+
+    private fun mergeRestored(restored: ChatActivityRecord, fresh: ChatActivityRecord): ChatActivityRecord {
+        if (fresh.kind != ChatActivityKind.SUBAGENTS) return fresh.copy(createdAt = minOf(restored.createdAt, fresh.createdAt))
+        val children = mergeChildren(restored.children, fresh.children)
+        val count = maxOf(restored.taskCount, fresh.taskCount, children.size)
+        return fresh.copy(
+            createdAt = minOf(restored.createdAt, fresh.createdAt), children = children,
+            phase = aggregate(children, count), taskCount = count,
+        )
+    }
+
+    fun captureSubagents(activities: List<SubagentActivity>) {
+        val selected = owner ?: return
+        val identifiable = activities.mapNotNull { activity ->
+            val childId = activity.subagentId?.takeIf(String::isNotBlank)
+                ?: activity.childSessionId?.takeIf(String::isNotBlank) ?: return@mapNotNull null
+            val delegation = activity.delegationId?.takeIf(String::isNotBlank)
+            val identityKind = when {
+                delegation != null -> "delegation"
+                !activity.subagentId.isNullOrBlank() -> "subagent"
+                else -> "session"
+            }
+            val existing = if (delegation == null) mutableRecords.value.firstOrNull { record ->
+                record.kind == ChatActivityKind.SUBAGENTS && record.children.any { it.matches(activity) }
+            } else null
+            val id = existing?.id ?: identity("subagents", identityKind, delegation ?: childId)
+            Triple(id, existing?.sourceId ?: delegation ?: childId, activity)
+        }
+        identifiable.groupBy { it.first }.forEach { (id, group) ->
+            val previous = mutableRecords.value.firstOrNull { it.id == id }
+            val migrated = mutableRecords.value.filter { record ->
+                record.id != id && record.isFallback() && group.any { (_, _, activity) ->
+                    record.children.any { it.matches(activity) }
+                }
+            }
+            val inherited = mergeChildren(migrated.flatMap { it.children }, previous?.children.orEmpty())
+            val children = inherited.associateByTo(linkedMapOf(), ChatActivityChild::id)
+            group.forEach { (_, _, activity) ->
+                val childId = activity.subagentId?.takeIf(String::isNotBlank) ?: activity.childSessionId!!
+                val old = children.values.firstOrNull { it.matches(activity) }
+                if (old != null && old.id != childId) children.remove(old.id)
+                children[childId] = ChatActivityChild(
+                    id = childId,
+                    childSessionId = activity.childSessionId ?: old?.childSessionId,
+                    goal = activity.goal.take(512).ifBlank { old?.goal.orEmpty() },
+                    phase = activity.phase.toHistoryPhase(),
+                    // Terminal summary is bounded metadata; progress/tool-event bodies are never copied.
+                    summary = if (activity.isTerminal) activity.summary?.take(512) ?: old?.summary else old?.summary,
+                )
+            }
+            val now = clock()
+            val values = children.values.toList()
+            val count = maxOf(previous?.taskCount ?: 0, migrated.maxOfOrNull { it.taskCount } ?: 0,
+                group.maxOf { it.third.taskCount }, values.size).coerceIn(0, 10_000)
+            migrated.forEach(::retire)
+            update(ChatActivityRecord(
+                id = id, scopeKey = selected.first, sessionId = selected.second,
+                kind = ChatActivityKind.SUBAGENTS, sourceId = group.first().second,
+                title = "Subagents", phase = aggregate(values, count),
+                createdAt = minOf(previous?.createdAt ?: now, migrated.minOfOrNull { it.createdAt } ?: now),
+                updatedAt = previous?.updatedAt ?: now,
+                children = values, taskCount = count,
+            ))
+        }
+    }
+
+    /** An authoritative session-scoped process.list snapshot, including an empty successful snapshot. */
+    fun captureProcesses(processes: List<GatewayProcess>) {
+        val selected = owner ?: return
+        val seen = mutableSetOf<String>()
+        processes.filter { it.id.isNotBlank() }.forEach { process ->
+            val id = identity("process", process.id, process.startedAt)
+            seen += id
+            val previous = mutableRecords.value.firstOrNull { it.id == id }
+            val now = clock()
+            update(ChatActivityRecord(
+                id = id, scopeKey = selected.first, sessionId = selected.second, kind = ChatActivityKind.PROCESS,
+                sourceId = process.id, title = "Background command", phase = process.toHistoryPhase(),
+                createdAt = previous?.createdAt ?: now, updatedAt = previous?.updatedAt ?: now,
+                processId = process.id, processStartedAt = process.startedAt, exitCode = process.exitCode,
+            ))
+        }
+        mutableRecords.value.filter {
+            it.kind == ChatActivityKind.PROCESS && it.phase == ChatActivityPhase.RUNNING && it.id !in seen
+        }.forEach { update(it.copy(phase = ChatActivityPhase.UNKNOWN)) }
+    }
+
+    fun removeSession(scopeKey: String, sessionId: String) {
+        if (owner == (scopeKey to sessionId)) {
+            deletedOwner = owner
+            owner = null
+            generation++
+            mutableRecords.value = emptyList()
+        }
+        val selectedStore = store
+        scope.launch { writes.withLock { selectedStore.removeSession(scopeKey, sessionId) } }
+    }
+
+    fun markUnavailable() {
+        mutableRecords.value.toList().forEach { record ->
+            val children = record.children.map {
+                if (it.phase == ChatActivityPhase.RUNNING) it.copy(phase = ChatActivityPhase.UNKNOWN) else it
+            }
+            val phase = if (record.phase == ChatActivityPhase.RUNNING) ChatActivityPhase.UNKNOWN else record.phase
+            update(record.copy(phase = phase, children = children))
+        }
+    }
+
+    private fun retire(record: ChatActivityRecord) {
+        retiredIds += record.id
+        mutableRecords.value = mutableRecords.value.filterNot { it.id == record.id }
+        val selectedStore = store
+        scope.launch {
+            try {
+                writes.withLock { selectedStore.removeRecord(record.scopeKey, record.sessionId, record.id) }
+            } catch (_: IOException) {
+                // The live selection still suppresses the superseded entry.
+            }
+        }
+    }
+
+    private fun update(candidate: ChatActivityRecord) {
+        val previous = mutableRecords.value.firstOrNull { it.id == candidate.id }
+        if (previous == candidate) return
+        val updated = candidate.copy(updatedAt = maxOf(clock(), (previous?.updatedAt ?: -1L) + 1L))
+        publish(mutableRecords.value.filterNot { it.id == updated.id } + updated)
+        mutableRecords.value.firstOrNull { it.id == updated.id }?.let(::persist)
+    }
+
+    private fun publish(records: List<ChatActivityRecord>) {
+        // Logical timestamps can advance within one wall-clock millisecond.
+        mutableRecords.value = boundChatActivities(records, maxOf(clock(), records.maxOfOrNull { it.updatedAt } ?: 0L))
+            .sortedWith(compareBy<ChatActivityRecord> { it.createdAt }.thenBy { it.id })
+    }
+
+    private fun persist(record: ChatActivityRecord) {
+        val selectedStore = store
+        scope.launch {
+            try {
+                writes.withLock { selectedStore.upsert(record) }
+            } catch (_: IOException) {
+                // Keep the session's visible metadata when local persistence is temporarily unavailable.
+            }
+        }
+    }
+}
+
+private fun identity(vararg parts: String?): String = parts.joinToString("") {
+    if (it == null) "-1:" else "${it.length}:$it"
+}
+
+private fun SubagentActivityPhase.toHistoryPhase(): ChatActivityPhase = when (this) {
+    SubagentActivityPhase.STARTED, SubagentActivityPhase.THINKING, SubagentActivityPhase.TOOL,
+    SubagentActivityPhase.PROGRESS -> ChatActivityPhase.RUNNING
+    SubagentActivityPhase.COMPLETED -> ChatActivityPhase.COMPLETE
+    SubagentActivityPhase.FAILED -> ChatActivityPhase.FAILED
+    SubagentActivityPhase.INTERRUPTED -> ChatActivityPhase.CANCELLED
+    SubagentActivityPhase.ENDED_WITH_PARENT -> ChatActivityPhase.UNKNOWN
+}
+
+private fun aggregate(children: List<ChatActivityChild>, taskCount: Int): ChatActivityPhase = when {
+    children.any { it.phase == ChatActivityPhase.RUNNING } -> ChatActivityPhase.RUNNING
+    children.isEmpty() || children.size < taskCount || children.any { it.phase == ChatActivityPhase.UNKNOWN } -> ChatActivityPhase.UNKNOWN
+    children.any { it.phase == ChatActivityPhase.FAILED } -> ChatActivityPhase.FAILED
+    children.any { it.phase == ChatActivityPhase.CANCELLED } -> ChatActivityPhase.CANCELLED
+    else -> ChatActivityPhase.COMPLETE
+}
+
+private fun ChatActivityChild.matches(activity: SubagentActivity): Boolean =
+    (!activity.subagentId.isNullOrBlank() && id == activity.subagentId) ||
+        (!activity.childSessionId.isNullOrBlank() && childSessionId == activity.childSessionId)
+
+private fun ChatActivityRecord.isFallback(): Boolean = kind == ChatActivityKind.SUBAGENTS &&
+    (id == identity("subagents", "subagent", sourceId) || id == identity("subagents", "session", sourceId))
+
+private fun mergeChildren(old: List<ChatActivityChild>, fresh: List<ChatActivityChild>): List<ChatActivityChild> {
+    val merged = old.associateByTo(linkedMapOf(), ChatActivityChild::id)
+    fresh.forEach { child ->
+        val alias = merged.values.firstOrNull {
+            it.id == child.id || (child.childSessionId != null && it.childSessionId == child.childSessionId)
+        }
+        if (alias != null && alias.id != child.id) merged.remove(alias.id)
+        merged[child.id] = child
+    }
+    return merged.values.toList()
+}
+
+private fun GatewayProcess.toHistoryPhase(): ChatActivityPhase = when {
+    isRunning -> ChatActivityPhase.RUNNING
+    status.lowercase() in setOf("cancelled", "canceled", "killed", "interrupted") -> ChatActivityPhase.CANCELLED
+    status.equals("failed", ignoreCase = true) || (exitCode != null && exitCode != 0) -> ChatActivityPhase.FAILED
+    exitCode == 0 -> ChatActivityPhase.COMPLETE
+    status.lowercase() in setOf("completed", "complete", "exited", "finished", "done") -> ChatActivityPhase.COMPLETE
+    else -> ChatActivityPhase.UNKNOWN
+}

app/src/main/kotlin/com/hermesandroid/relay/viewmodel/ChatActivityPreview.kt

@@ -0,0 +1,43 @@
+package com.hermesandroid.relay.viewmodel
+
+import com.hermesandroid.relay.data.AgentDisplay
+import com.hermesandroid.relay.data.ChatActivityPhase
+import com.hermesandroid.relay.data.ChatActivityRecord
+import com.hermesandroid.relay.network.upstream.GatewayProcess
+
+internal data class RetainedChatActivityPreview(
+    val record: ChatActivityRecord,
+    val processes: List<GatewayProcess> = emptyList(),
+)
+
+/** Historical rows contain references and bounded summaries, never an invented live transcript. */
+internal fun ChatActivityRecord.previewActivities(): List<SubagentActivity> = children.mapIndexed { index, child ->
+    val phase = when (child.phase) {
+        ChatActivityPhase.RUNNING -> SubagentActivityPhase.STARTED
+        ChatActivityPhase.COMPLETE -> SubagentActivityPhase.COMPLETED
+        ChatActivityPhase.FAILED -> SubagentActivityPhase.FAILED
+        ChatActivityPhase.CANCELLED -> SubagentActivityPhase.INTERRUPTED
+        ChatActivityPhase.UNKNOWN -> SubagentActivityPhase.ENDED_WITH_PARENT
+    }
+    SubagentActivity(
+        laneId = 0,
+        turnId = "record:$id:${child.id}",
+        taskIndex = index,
+        taskCount = maxOf(taskCount, children.size),
+        goal = child.goal,
+        subagentId = child.id,
+        childSessionId = child.childSessionId,
+        profile = AgentDisplay.parseProfileContextKey(scopeKey)?.requestProfileName,
+        phase = phase,
+        summary = child.summary,
+        events = child.summary?.let { summary -> listOf(SubagentActivityEvent(
+            sequence = 0,
+            kind = SubagentActivityEventKind.COMPLETED,
+            text = summary,
+            phase = phase,
+            observedAtMillis = updatedAt,
+        )) }.orEmpty(),
+        partialAfterGap = true,
+        revision = updatedAt,
+    )
+}

app/src/main/kotlin/com/hermesandroid/relay/viewmodel/ChatViewModel.kt

@@ -1,5 +1,7 @@
 package com.hermesandroid.relay.viewmodel
 
+import com.hermesandroid.relay.data.BusyMessageAction
+import com.hermesandroid.relay.data.canCorrectBusyMessage
 import android.content.Context
 import android.net.ConnectivityManager
 import android.net.NetworkCapabilities
@@ -92,6 +94,10 @@ import com.hermesandroid.relay.network.upstream.GatewayModelOptions
 import com.hermesandroid.relay.network.upstream.GatewayProcess
 import com.hermesandroid.relay.network.upstream.GatewayProcessCapability
 import com.hermesandroid.relay.network.upstream.GatewayProcessEvent
+import com.hermesandroid.relay.data.ChatActivityRecord
+import com.hermesandroid.relay.data.ChatActivityKind
+import com.hermesandroid.relay.data.ChatActivityStore
+import com.hermesandroid.relay.data.DataStoreChatActivityStore
 import com.hermesandroid.relay.network.upstream.GatewaySessionModel
 import com.hermesandroid.relay.network.upstream.ReasoningEffortAvailability
 import com.hermesandroid.relay.network.upstream.ReasoningEffortIdentity
@@ -173,6 +179,8 @@ import kotlinx.serialization.json.contentOrNull
 import kotlinx.serialization.json.intOrNull
 import kotlinx.serialization.json.longOrNull
 import okhttp3.sse.EventSource
+import java.io.File
+import java.io.IOException
 import java.io.InterruptedIOException
 import java.util.UUID
 import java.util.concurrent.ConcurrentHashMap
@@ -743,6 +751,7 @@ class ChatViewModel : ViewModel() {
         private const val CHECKPOINT_WRITE_INTERVAL_MS = 750L
         private const val SESSION_REFRESH_RETRY_DELAY_MS = 1_000L
         private const val SESSION_REFRESH_MAX_READINESS_RETRIES = 2
+        private const val MAX_COALESCED_SESSION_REFRESH_PASSES = 2
         private const val SESSION_DRAWER_FRESHNESS_WINDOW_MS = 5_000L
         private const val PROFILE_SESSION_CACHE_CONTEXTS = 24
         private const val PROFILE_SESSION_CACHE_ROWS = 50
@@ -909,6 +918,10 @@ class ChatViewModel : ViewModel() {
     )
 
     private val queuedMessageItems = mutableListOf<QueuedMessage>()
+    private val pausedQueueDestinations = mutableSetOf<Pair<String, String>>()
+    private val retainedQueueCheckpoints = mutableMapOf<Pair<String, String>, ChatTurnCheckpoint>()
+    private val _queuePaused = MutableStateFlow(false)
+    val queuePaused: StateFlow<Boolean> = _queuePaused.asStateFlow()
     private val completedQueueOwnerRuns = ConcurrentHashMap.newKeySet<String>()
     private val _queuedMessages = MutableStateFlow<List<String>>(emptyList())
     val queuedMessages: StateFlow<List<String>> = _queuedMessages.asStateFlow()
@@ -2226,6 +2239,11 @@ class ChatViewModel : ViewModel() {
     private var gatewayProcessSource: GatewayProcessSource? = null
     private val gatewayProcessController = GatewayProcessController(viewModelScope)
     private val subagentActivityController = SubagentActivityController()
+    private val chatActivityController = ChatActivityController(viewModelScope)
+    internal val activityRecords = chatActivityController.records
+    private var activityStoreInitialized = false
+    private val _retainedActivityPreview = MutableStateFlow<RetainedChatActivityPreview?>(null)
+    internal val retainedActivityPreview = _retainedActivityPreview.asStateFlow()
     private val subagentChildPreviewController = SubagentChildPreviewController(viewModelScope)
     internal val subagentChildPreview: StateFlow<SubagentChildPreview?> =
         subagentChildPreviewController.state
@@ -2245,7 +2263,10 @@ class ChatViewModel : ViewModel() {
         subagentActivityController.activities
 
     fun openSubagentChildPreview(activityKey: String) {
-        val activity = subagentActivities.value.firstOrNull { it.stableKey == activityKey } ?: return
+        if (supervisedModePolicy.enabled) return
+        val history = _retainedActivityPreview.value
+        val candidates = history?.record?.previewActivities() ?: subagentActivities.value
+        val activity = candidates.firstOrNull { it.stableKey == activityKey } ?: return
         val parentSessionId = chatHandler?.currentSessionId?.value ?: return
         val parentScopeKey = activeProfileContextKey
         val client = gatewayClient
@@ -2267,6 +2288,49 @@ class ChatViewModel : ViewModel() {
         subagentChildPreviewController.close()
     }
 
+    internal fun setChatActivityStore(store: ChatActivityStore) {
+        activityStoreInitialized = true
+        chatActivityController.bindStore(store)
+    }
+
+    fun openCurrentActivityPreview() {
+        _retainedActivityPreview.value = null
+        closeSubagentChildPreview()
+        subagentActivityController.setPreviewOpen(true)
+    }
+
+    internal fun openRetainedActivity(record: ChatActivityRecord, processDetail: String? = null): Boolean {
+        if (record.scopeKey != activeProfileContextKey || record.sessionId != chatHandler?.currentSessionId?.value) return false
+        if (supervisedModePolicy.enabled && !supervisedModePolicy.visibility.resolved().showWorkingStatus) return false
+        closeSubagentChildPreview()
+        subagentActivityController.setPreviewOpen(false)
+        val process = if (record.kind == ChatActivityKind.PROCESS) {
+            val exact = backgroundProcesses.value.singleOrNull {
+                !supervisedModePolicy.enabled && record.processStartedAt != null &&
+                    it.id == record.processId && it.startedAt == record.processStartedAt
+            }
+            exact ?: GatewayProcess(
+                id = record.processId ?: record.sourceId,
+                command = if (supervisedModePolicy.enabled) {
+                    appContext?.getString(R.string.chat_activity_receipt_process) ?: "Background command"
+                } else record.title,
+                status = record.phase.name.lowercase(),
+                outputTail = if (supervisedModePolicy.enabled) null else processDetail?.take(4_000)
+                    ?: appContext?.getString(R.string.chat_activity_output_unavailable)
+                    ?: "Output is no longer available. This entry preserves the recorded process status.",
+                exitCode = record.exitCode,
+            )
+        } else null
+        _retainedActivityPreview.value = RetainedChatActivityPreview(record, listOfNotNull(process))
+        return true
+    }
+
+    fun closeActivityPreview() {
+        closeSubagentChildPreview()
+        subagentActivityController.setPreviewOpen(false)
+        _retainedActivityPreview.value = null
+    }
+
     private val _messageReactionsSupported = MutableStateFlow(true)
     val messageReactionsSupported: StateFlow<Boolean> = _messageReactionsSupported.asStateFlow()
 
@@ -2682,10 +2746,12 @@ class ChatViewModel : ViewModel() {
             previousClient?.setColdPrewarmSessionReadyListener(null)
             previousClient?.setUnmatchedTurnCompleteListener(null)
             previousClient?.setBackgroundInteractionListener(null)
+            previousClient?.setSubagentEventListener(null)
             previousClient?.setSessionDirectoryInvalidationListener(null)
         }
         gatewayClient = client
         if (changed) {
+            chatActivityController.markUnavailable()
             dismissChatFailure()
             resetApprovalModeState()
             _messageReactionsSupported.value = true
@@ -2728,6 +2794,29 @@ class ChatViewModel : ViewModel() {
         client?.setUnsolicitedTurnProvider { storedSessionId ->
             createGatewayInboundTurnRegistration(client, storedSessionId)
         }
+        client?.setSubagentEventListener { sessionId, profile, event ->
+            if (gatewayClient === client && streamingEndpoint == "gateway" &&
+                chatHandler?.currentSessionId?.value == sessionId &&
+                currentSessionProfileName() == profile
+            ) {
+                val owner = AgentDisplay.parseProfileContextKey(activeProfileContextKey)
+                val checkpointProfileKey = activeTurnCheckpointSeed?.takeIf {
+                    it.sessionId == sessionId && it.contextKey == activeProfileContextKey
+                }?.profileKey
+                val previousRevisions = subagentActivities.value.associate { it.stableKey to it.revision }
+                subagentActivityController.onSessionEvent(
+                    sessionId, activeProfileContextKey, event,
+                    when {
+                        checkpointProfileKey != null -> AgentDisplay.profileRequestName(checkpointProfileKey)
+                        owner != null -> owner.requestProfileName
+                        else -> profile
+                    },
+                )
+                chatActivityController.captureSubagents(subagentActivities.value.filter {
+                    previousRevisions[it.stableKey] != it.revision
+                })
+            }
+        }
         client?.setSessionDirectoryInvalidationListener {
             // Gateway emits this only after durable session state changes. It
             // is also a useful liveness edge after a Dashboard timeout: retry
@@ -2817,6 +2906,8 @@ class ChatViewModel : ViewModel() {
         if (changed) {
             gatewayStateSyncJob?.cancel()
             gatewayStateSyncJob = null
+            _gatewayPreparingSessionId.value = null
+            _gatewaySocketState.value = GatewayConnectionState.Idle
             client?.let { startGatewayStateSync(it) }
             if (client != null) {
                 gatewayVisibleReattachJob = viewModelScope.launch {
@@ -2960,7 +3051,6 @@ class ChatViewModel : ViewModel() {
     ): GatewayInboundTurnRegistration? {
         val handler = chatHandler ?: return null
         val eventScopeKey = activeProfileContextKey
-        val eventProfile = currentSessionProfileName()
         fun matchesAdmissionContext(): Boolean =
             gatewayClient === client &&
                 streamingEndpoint == "gateway" &&
@@ -3119,13 +3209,6 @@ class ChatViewModel : ViewModel() {
             },
             onSubagentEvent = { event ->
                 if (acceptsEvent()) {
-                    subagentActivityController.onEvent(
-                        sessionId = storedSessionId,
-                        eventScopeKey = eventScopeKey,
-                        turnId = messageId,
-                        event = event,
-                        profile = eventProfile,
-                    )
                     handler.onSubagentEvent(messageId, event)
                 }
             },
@@ -3400,8 +3483,6 @@ class ChatViewModel : ViewModel() {
                     }
                     if (visibleSignature != serverSignature) {
                         handler.loadMessageHistory(serverMessages)
-                        refreshSessions()
-                        scheduleTitleReconcile(storedSessionId)
                         return@launch
                     }
                     if (attempt < 7 && retryUntilChanged) delay(250L)
@@ -3866,6 +3947,10 @@ class ChatViewModel : ViewModel() {
         sessionId: String?,
         scopeKey: String? = activeProfileContextKey,
     ) {
+        _retainedActivityPreview.value?.record?.let {
+            if (it.sessionId != sessionId || it.scopeKey != scopeKey) closeActivityPreview()
+        }
+        chatActivityController.selectSession(scopeKey, sessionId)
         subagentChildPreview.value?.let { preview ->
             if (preview.parentSessionId != sessionId || preview.parentScopeKey != scopeKey) {
                 closeSubagentChildPreview()
@@ -4035,7 +4120,7 @@ class ChatViewModel : ViewModel() {
     private suspend fun loadSessionHistory(
         sessionId: String,
         requireProfileScope: Boolean = false,
-        mode: SessionMessageLoadMode = SessionMessageLoadMode.COMPLETE,
+        mode: SessionMessageLoadMode = SessionMessageLoadMode.LATEST,
         profileName: String? = currentSessionProfileName(),
     ): List<MessageItem> {
         if (profileMessageLoader != null) {
@@ -4061,7 +4146,7 @@ class ChatViewModel : ViewModel() {
     private suspend fun loadGatewaySessionHistory(
         sessionId: String,
         requireProfileScope: Boolean = false,
-        mode: SessionMessageLoadMode = SessionMessageLoadMode.COMPLETE,
+        mode: SessionMessageLoadMode = SessionMessageLoadMode.LATEST,
         profileName: String? = currentSessionProfileName(),
     ): List<MessageItem> {
         val scoped = profileMessageLoader?.invoke(profileName, sessionId, mode)
@@ -4129,6 +4214,10 @@ class ChatViewModel : ViewModel() {
     }
 
     private var gatewayStateSyncJob: Job? = null
+    private val _gatewayPreparingSessionId = MutableStateFlow<String?>(null)
+    val gatewayPreparingSessionId = _gatewayPreparingSessionId.asStateFlow()
+    private val _gatewaySocketState = MutableStateFlow(GatewayConnectionState.Idle)
+    val gatewaySocketState = _gatewaySocketState.asStateFlow()
 
     /**
      * Last credential_warning already surfaced as a system notice, so the
@@ -4151,7 +4240,18 @@ class ChatViewModel : ViewModel() {
     private fun startGatewayStateSync(client: GatewayChatClient) {
         gatewayStateSyncJob?.cancel()
         lastSurfacedCredentialWarning = null
+        gatewayProcessController.setSnapshotListener { processes ->
+            val sessionId = chatHandler?.currentSessionId?.value
+            if (gatewayClient === client && sessionId != null &&
+                gatewayProcessController.ownsSnapshot(sessionId, activeProfileContextKey)
+            ) chatActivityController.captureProcesses(processes)
+        }
         gatewayStateSyncJob = viewModelScope.launch {
+            launch {
+                client.preparingSessionId.collect {
+                    if (gatewayClient === client) _gatewayPreparingSessionId.value = it
+                }
+            }
             launch {
                 backgroundProcesses.collect {
                     if (gatewayClient !== client) return@collect
@@ -4165,6 +4265,10 @@ class ChatViewModel : ViewModel() {
             launch {
                 client.connectionState.collect { state ->
                     if (gatewayClient !== client) return@collect
+                    if (_gatewaySocketState.value == GatewayConnectionState.Ready && state != GatewayConnectionState.Ready) {
+                        chatActivityController.markUnavailable()
+                    }
+                    _gatewaySocketState.value = state
                     subagentActivityController.onConnectionReady(
                         state == com.hermesandroid.relay.network.upstream.GatewayConnectionState.Ready,
                     )
@@ -4655,6 +4759,7 @@ class ChatViewModel : ViewModel() {
         dashboardMediaClientProvider: () -> DashboardApiClient? = { null },
     ) {
         this.appContext = context.applicationContext
+        if (!activityStoreInitialized) setChatActivityStore(DataStoreChatActivityStore(context.applicationContext))
         if (chatTurnCheckpointStore == null) {
             chatTurnCheckpointStore = DataStoreChatTurnCheckpointStore(context.applicationContext)
         }
@@ -4682,6 +4787,7 @@ class ChatViewModel : ViewModel() {
     /** Route-owned Gateway chat setup without borrowing the active connection's Relay/media clients. */
     fun initializeGatewayOnly(context: Context) {
         appContext = context.applicationContext
+        if (!activityStoreInitialized) setChatActivityStore(DataStoreChatActivityStore(context.applicationContext))
         if (chatTurnCheckpointStore == null) {
             chatTurnCheckpointStore = DataStoreChatTurnCheckpointStore(context.applicationContext)
         }
@@ -4799,6 +4905,8 @@ class ChatViewModel : ViewModel() {
                 publishBackgroundSessionActivity()
                 queuedMessageItems.clear()
                 completedQueueOwnerRuns.clear()
+                pausedQueueDestinations.clear()
+                retainedQueueCheckpoints.clear()
                 publishQueuedMessages()
                 _steerableTurn.value = false
                 _steerNotice.value = null
@@ -5329,11 +5437,13 @@ class ChatViewModel : ViewModel() {
     val sessionPageLoadFailed: StateFlow<Boolean> = _sessionPageLoadFailed.asStateFlow()
     val sessionListUnavailable: StateFlow<Boolean> = _sessionListUnavailable.asStateFlow()
 
-    fun refreshSessions() = refreshSessions(
-        allowReadinessRetry = true,
-        preserveFailurePresentation = false,
-        readinessRetryAttempt = 0,
-    )
+    fun refreshSessions() {
+        refreshSessions(
+            allowReadinessRetry = true,
+            preserveFailurePresentation = false,
+            readinessRetryAttempt = 0,
+        )
+    }
 
     /**
      * Drawer-open freshness gate. Process-owned startup binding may already be
@@ -5458,8 +5568,10 @@ class ChatViewModel : ViewModel() {
 
             var retryUnavailable = false
             var retryReadiness = false
+            var refreshPass = 0
             try {
                 do {
+                    refreshPass += 1
                     sessionRefreshPending = false
                     // A queued trailing refresh owns a new outcome. Never let
                     // an earlier timeout overwrite a later successful list.
@@ -5557,7 +5669,7 @@ class ChatViewModel : ViewModel() {
                         )
                     } catch (e: CancellationException) {
                         throw e
-                    } catch (e: Throwable) {
+                    } catch (e: Exception) {
                         if (isCurrentRefresh()) {
                             android.util.Log.w(
                                 "ChatViewModel",
@@ -5580,7 +5692,11 @@ class ChatViewModel : ViewModel() {
                             }
                         }
                     }
-                } while (sessionRefreshPending && isCurrentRefresh())
+                } while (
+                    refreshPass < MAX_COALESCED_SESSION_REFRESH_PASSES &&
+                    sessionRefreshPending &&
+                    isCurrentRefresh()
+                )
             } finally {
                 val shouldRetry = allowReadinessRetry &&
                     retryReadiness &&
@@ -6142,6 +6258,7 @@ class ChatViewModel : ViewModel() {
             } else {
                 client?.deleteSession(sessionId) == true
             }
+            if (success && contextKey != null) chatActivityController.removeSession(contextKey, sessionId)
             if (
                 activeProfileContextKey != contextKey ||
                 currentSessionProfileName() != profileName
@@ -6301,7 +6418,11 @@ class ChatViewModel : ViewModel() {
 
     // --- Message sending ---
 
-    fun sendMessage(text: String) {
+    fun sendMessage(
+        text: String,
+        busyAction: BusyMessageAction =
+            BusyMessageAction.CorrectNow,
+    ) {
         if (text.isBlank()) return
         supervisedMessageBlockReason(supervisedModePolicy, text)?.let { reason ->
             chatHandler?.addSystemNotice(reason)
@@ -6388,9 +6509,13 @@ class ChatViewModel : ViewModel() {
         // Mid-turn: redirect on the gateway transport, queue everywhere else.
         if (activeStream != null) {
             if (
-                _steerableTurn.value &&
+                busyAction == BusyMessageAction.CorrectNow &&
+                (!supervisedModePolicy.enabled || supervisedModePolicy.capabilities.steerResponse) &&
                 streamingEndpoint == "gateway" &&
-                _pendingAttachments.value.isEmpty()
+                canCorrectBusyMessage(
+                    _steerableTurn.value, _pendingAttachments.value.isNotEmpty(),
+                    _pendingAsk.value != null, chatHandler?.turnStatus?.value, text,
+                )
             ) {
                 steerActiveTurn(text.trim())
             } else {
@@ -7570,8 +7695,7 @@ class ChatViewModel : ViewModel() {
             queuedMessages = queuedMessageItems
                 .filter {
                     it.contextKey == contextKey &&
-                        it.sessionId == sessionId &&
-                        it.ownerRunId == seed.userMessageId
+                        it.sessionId == sessionId
                 }
                 .map { item ->
                     ChatQueuedMessageCheckpoint(
@@ -7583,17 +7707,22 @@ class ChatViewModel : ViewModel() {
                         hadAttachments = item.attachments.isNotEmpty(),
                     )
                 },
+            queuePaused = (contextKey to sessionId) in pausedQueueDestinations,
             startedAt = seed.startedAt,
             updatedAt = now,
         )
     }
 
     private fun restoreQueuedMessages(checkpoint: ChatTurnCheckpoint) {
+        val destination = checkpoint.contextKey to checkpoint.sessionId
+        if (checkpoint.queuePaused || checkpoint.queueOnly) pausedQueueDestinations += destination
         var droppedAttachmentQueue = false
+        val droppedOwners = mutableMapOf<String, String>()
         checkpoint.queuedMessages.forEach { saved ->
             if (queuedMessageItems.any { it.id == saved.id }) return@forEach
             if (saved.hadAttachments) {
                 droppedAttachmentQueue = true
+                droppedOwners[saved.id] = droppedOwners[saved.ownerRunId] ?: saved.ownerRunId
                 return@forEach
             }
             queuedMessageItems += QueuedMessage(
@@ -7602,11 +7731,16 @@ class ChatViewModel : ViewModel() {
                 contextKey = checkpoint.contextKey,
                 sessionId = checkpoint.sessionId,
                 transport = saved.transport,
-                ownerRunId = saved.ownerRunId,
+                ownerRunId = droppedOwners[saved.ownerRunId] ?: saved.ownerRunId,
                 attachments = emptyList(),
                 interfaceContextPrompt = saved.interfaceContextPrompt,
             )
         }
+        if (checkpoint.queueOnly) {
+            val ids = queuedMessageItems.mapTo(mutableSetOf()) { it.id }
+            queuedMessageItems.filter { it.contextKey == checkpoint.contextKey && it.sessionId == checkpoint.sessionId }
+                .map { it.ownerRunId }.filterNot { it in ids }.forEach { completedQueueOwnerRuns += it }
+        }
         publishQueuedMessages()
         if (droppedAttachmentQueue) {
             _transientNotice.tryEmit(
@@ -7641,10 +7775,12 @@ class ChatViewModel : ViewModel() {
         }
     }
 
-    private fun clearTurnCheckpoint() {
+    private fun clearTurnCheckpoint(preserveQueue: Boolean = false) {
+        val queueSnapshot = if (preserveQueue) buildQueueOnlyCheckpoint() else null
+        queueSnapshot?.let { retainedQueueCheckpoints[it.contextKey to it.sessionId] = it }
         val key = activeTurnCheckpointSeed?.let { seed ->
             seed.contextKey?.let { TurnCheckpointKey(it, seed.sessionId) }
-        }
+        } ?: queueSnapshot?.let { TurnCheckpointKey(it.contextKey, it.sessionId) }
         activeTurnCheckpointSeed = null
         activeQueueOwnerRunId = null
         val generation = checkpointGeneration.incrementAndGet()
@@ -7661,7 +7797,8 @@ class ChatViewModel : ViewModel() {
         viewModelScope.launch {
             checkpointMutex.withLock {
                 if (generation == checkpointGeneration.get() && activeTurnCheckpointSeed == null) {
-                    if (key != null) runCatching { store.remove(key.contextKey, key.sessionId) }
+                    if (queueSnapshot != null) runCatching { store.write(queueSnapshot) }
+                    else if (key != null) runCatching { store.remove(key.contextKey, key.sessionId) }
                 }
             }
         }
@@ -7791,6 +7928,11 @@ class ChatViewModel : ViewModel() {
         backgroundNeedsInputKeys -= key
         publishBackgroundSessionActivity()
         if (checkpoint.transport !in setOf("gateway", "sessions")) return false
+        if (checkpoint.queueOnly) {
+            retainedQueueCheckpoints[contextKey to sessionId] = checkpoint
+            restoreQueuedMessages(checkpoint)
+            return false
+        }
         if (activeStream != null) return true
         if (streamRecovery != null) {
             if (checkpoint.transport == "gateway" && client != null) {
@@ -7804,7 +7946,13 @@ class ChatViewModel : ViewModel() {
         }
 
         adoptTurnCheckpoint(checkpoint)
-        val initialHistory = runCatching { loadSessionHistory(sessionId) }.getOrDefault(emptyList())
+        val initialHistory = try {
+            loadSessionHistory(sessionId)
+        } catch (error: CancellationException) {
+            throw error
+        } catch (_: Exception) {
+            emptyList()
+        }
         if (!ownsTurnCheckpoint(checkpoint, handler)) return true
         if (initialHistory.isNotEmpty()) handler.loadMessageHistory(initialHistory)
         handler.restoreInFlightTurn(checkpoint)
@@ -8073,18 +8221,6 @@ class ChatViewModel : ViewModel() {
             },
             onSubagentEvent = { event ->
                 if (owns()) {
-                    subagentActivityController.onEvent(
-                        sessionId = checkpoint.sessionId,
-                        eventScopeKey = checkpoint.contextKey,
-                        turnId = messageId,
-                        event = event,
-                        profile = if (checkpoint.profileKey != null) {
-                            AgentDisplay.profileRequestName(checkpoint.profileKey)
-                        } else {
-                            AgentDisplay.parseProfileContextKey(checkpoint.contextKey)
-                                ?.requestProfileName
-                        },
-                    )
                     handler.onSubagentEvent(messageId, event)
                     scheduleCheckpointWrite(immediate = true)
                 }
@@ -8217,7 +8353,7 @@ class ChatViewModel : ViewModel() {
         if (completedOwner != null && queuedMessageItems.any { it.ownerRunId == completedOwner }) {
             completedQueueOwnerRuns += completedOwner
         }
-        clearTurnCheckpoint()
+        clearTurnCheckpoint(preserveQueue = true)
         activeStream = null
         _steerableTurn.value = false
         _steerNotice.value = null
@@ -8461,6 +8597,106 @@ class ChatViewModel : ViewModel() {
                 it.contextKey == destination.first && it.sessionId == destination.second
             }.map(QueuedMessage::text)
         }
+        _queuePaused.value = _queuedMessages.value.isNotEmpty() && destination in pausedQueueDestinations
+    }
+
+    private fun persistQueueChanges() {
+        scheduleCheckpointWrite(immediate = true)
+        val destination = currentQueueDestination() ?: return
+        if (activeTurnCheckpointSeed?.let { it.contextKey to it.sessionId } == destination) return
+        val template = retainedQueueCheckpoints[destination] ?: return
+        val items = queuedMessageItems.filter { it.contextKey to it.sessionId == destination }
+        val snapshot = template.copy(
+            queuePaused = destination in pausedQueueDestinations,
+            queuedMessages = items.map { item ->
+                ChatQueuedMessageCheckpoint(
+                    id = item.id,
+                    text = item.text.take(MAX_CHECKPOINT_TEXT_CHARS),
+                    transport = item.transport,
+                    ownerRunId = item.ownerRunId,
+                    interfaceContextPrompt = item.interfaceContextPrompt,
+                    hadAttachments = item.attachments.isNotEmpty(),
+                )
+            },
+            updatedAt = System.currentTimeMillis(),
+        )
+        if (items.isEmpty()) retainedQueueCheckpoints.remove(destination)
+        else retainedQueueCheckpoints[destination] = snapshot
+        val generation = checkpointGeneration.get()
+        val store = chatTurnCheckpointStore ?: return
+        viewModelScope.launch {
+            checkpointMutex.withLock {
+                if (generation != checkpointGeneration.get()) return@withLock
+                runCatching {
+                    if (items.isEmpty()) store.remove(destination.first, destination.second)
+                    else store.write(snapshot)
+                }
+            }
+        }
+    }
+
+    private fun buildQueueOnlyCheckpoint(): ChatTurnCheckpoint? {
+        val destination = currentQueueDestination() ?: return null
+        val items = queuedMessageItems.filter { (it.contextKey to it.sessionId) == destination }
+        if (items.isEmpty()) return null
+        buildTurnCheckpoint()?.let { return it.copy(queueOnly = true, pendingAsk = null) }
+        // A server-initiated turn has no outgoing user checkpoint. Retain only
+        // queue ownership metadata; queueOnly restoration never renders these
+        // empty turn fields or attempts to reattach the cancelled runtime.
+        val now = System.currentTimeMillis()
+        return ChatTurnCheckpoint(
+            contextKey = destination.first,
+            sessionId = destination.second,
+            transport = items.first().transport,
+            user = ChatTurnUserCheckpoint(items.first().ownerRunId, "", now),
+            assistant = ChatTurnAssistantCheckpoint(id = items.first().ownerRunId, timestamp = now, isStreaming = false),
+            priorUserMessageCount = 0,
+            baselineAssistantCount = 0,
+            queuedMessages = items.map { item ->
+                ChatQueuedMessageCheckpoint(
+                    item.id, item.text.take(MAX_CHECKPOINT_TEXT_CHARS), item.transport,
+                    item.ownerRunId, item.interfaceContextPrompt, item.attachments.isNotEmpty(),
+                )
+            },
+            queuePaused = destination in pausedQueueDestinations,
+            queueOnly = true,
+            startedAt = now,
+            updatedAt = now,
+        )
+    }
+
+    /** Stop preserves pending work. Resume is explicit and always keeps its destination. */
+    fun resumeQueue() {
+        val destination = currentQueueDestination() ?: return
+        val first = queuedMessageItems.firstOrNull { it.contextKey to it.sessionId == destination } ?: return
+        if (activeStream != null) {
+            val owner = activeQueueOwnerRunId ?: return
+            val index = queuedMessageItems.indexOf(first)
+            queuedMessageItems[index] = first.copy(ownerRunId = owner)
+        } else {
+            completedQueueOwnerRuns += first.ownerRunId
+        }
+        pausedQueueDestinations -= destination
+        publishQueuedMessages()
+        persistQueueChanges()
+        drainQueue()
+    }
+
+    private fun removeQueuedItem(item: QueuedMessage) {
+        queuedMessageItems.removeAll { it.id == item.id }
+        // Splice the run chain: successors now wait for the removed item's
+        // predecessor, never for a deleted turn that can no longer complete.
+        queuedMessageItems.replaceAll { next ->
+            if (next.contextKey == item.contextKey && next.sessionId == item.sessionId && next.ownerRunId == item.id) {
+                next.copy(ownerRunId = item.ownerRunId)
+            } else next
+        }
+        if (queuedMessageItems.none { it.ownerRunId == item.ownerRunId }) completedQueueOwnerRuns -= item.ownerRunId
+        if (queuedMessageItems.none { it.contextKey == item.contextKey && it.sessionId == item.sessionId }) {
+            pausedQueueDestinations -= item.contextKey to item.sessionId
+        }
+        publishQueuedMessages()
+        persistQueueChanges()
     }
 
     private fun removeQueuedMessagesFor(contextKey: String?, sessionId: String): Int {
@@ -8486,6 +8722,9 @@ class ChatViewModel : ViewModel() {
     fun clearQueue() {
         val destination = currentQueueDestination() ?: return
         removeQueuedMessagesFor(destination.first, destination.second)
+        pausedQueueDestinations -= destination
+        publishQueuedMessages()
+        persistQueueChanges()
     }
 
     /** Drop a single queued message by index (no-op if out of range). */
@@ -8495,11 +8734,7 @@ class ChatViewModel : ViewModel() {
             it.contextKey == destination.first && it.sessionId == destination.second
         }
         val item = visible.getOrNull(index) ?: return
-        queuedMessageItems.removeAll { it.id == item.id }
-        if (queuedMessageItems.none { it.ownerRunId == item.ownerRunId }) {
-            completedQueueOwnerRuns -= item.ownerRunId
-        }
-        publishQueuedMessages()
+        removeQueuedItem(item)
     }
 
     /**
@@ -8507,14 +8742,15 @@ class ChatViewModel : ViewModel() {
      * the composer can prefill it. Null if the index is out of range.
      */
     fun takeQueuedForEdit(index: Int): String? {
+        if (_pendingAttachments.value.isNotEmpty()) {
+            _transientNotice.tryEmit("Finish the current attachment draft before editing a queued message.")
+            return null
+        }
         val destination = currentQueueDestination() ?: return null
         val item = queuedMessageItems.filter {
             it.contextKey == destination.first && it.sessionId == destination.second
         }.getOrNull(index) ?: return null
-        queuedMessageItems.removeAll { it.id == item.id }
-        if (queuedMessageItems.none { it.ownerRunId == item.ownerRunId }) {
-            completedQueueOwnerRuns -= item.ownerRunId
-        }
+        removeQueuedItem(item)
         _pendingAttachments.value = item.attachments
         nextInterfaceContextPrompt = item.interfaceContextPrompt
         publishQueuedMessages()
@@ -8528,6 +8764,7 @@ class ChatViewModel : ViewModel() {
         if (streamingEndpoint == "gateway" && gatewayClient == null && client == null) return
         if (activeStream != null || streamRecovery != null) return
         val destination = currentQueueDestination() ?: return
+        if (destination in pausedQueueDestinations) return
         val next = queuedMessageItems.firstOrNull {
             it.contextKey == destination.first &&
                 it.sessionId == destination.second &&
@@ -9758,6 +9995,11 @@ class ChatViewModel : ViewModel() {
             handler.onTurnComplete(currentMessageId)
             gatewayInterimMessageId = currentMessageId
             gatewayInterimSealedCurrentMessage = true
+            // `message.interim` closes one assistant segment but not the
+            // agent run. Create the next blank owner immediately so the chat
+            // retains its in-conversation working indicator even when the
+            // next tool/reasoning event is delayed or suppressed upstream.
+            ensurePostInterimMessage()
             scheduleCheckpointWrite(immediate = true)
         }
         val onInterimReconciledCb = { text: String ->
@@ -10123,12 +10365,16 @@ class ChatViewModel : ViewModel() {
                     (streamingEndpoint == "sessions" || streamingEndpoint == "gateway")
                 ) {
                     viewModelScope.launch {
-                        runCatching {
+                        try {
                             // Profile-aware read — see onCompleteCb: a bare
                             // getMessages 404s for a non-default-profile session
                             // and silently empties the transcript.
                             val serverMessages = loadSessionHistory(errorSessionId)
                             handler.loadMessageHistory(serverMessages)
+                        } catch (error: CancellationException) {
+                            throw error
+                        } catch (_: Exception) {
+                            // The existing local failure remains authoritative.
                         }
                     }
                 }
@@ -10506,13 +10752,6 @@ class ChatViewModel : ViewModel() {
                         onSubagentEvent = { event ->
                             ensurePostInterimMessage()
                             streamDeltas.flushNow()
-                            subagentActivityController.onEvent(
-                                sessionId = handler.currentSessionId.value,
-                                eventScopeKey = activeProfileContextKey,
-                                turnId = currentMessageId,
-                                event = event,
-                                profile = currentSessionProfileName(),
-                            )
                             handler.onSubagentEvent(currentMessageId, event)
                             scheduleCheckpointWrite(immediate = true)
                         },
@@ -10531,6 +10770,10 @@ class ChatViewModel : ViewModel() {
                             _steerableTurn.value = false
                             onPreflightErrorCb(Exception(reason))
                         },
+                        onSubmitRejected = { reason ->
+                            _steerableTurn.value = false
+                            onPreflightErrorCb(Exception(reason))
+                        },
                         onFailure = { failure ->
                             val confirmedModel = gateway.serverModel.value
                                 ?.takeIf { it.isNotBlank() }
@@ -10580,7 +10823,7 @@ class ChatViewModel : ViewModel() {
                         _steerableTurn.value = false
                         onPreflightErrorCb(Exception(reason))
                     },
-                    onPreflightFailure = {
+                    onPreflightFailure = { reason ->
                         _steerableTurn.value = false
                         if (intentionallyCancelled) {
                             // User cancelled while preflight was in flight —
@@ -10592,11 +10835,11 @@ class ChatViewModel : ViewModel() {
                             // Nothing started server-side. Keep this turn bound
                             // to Gateway and settle it as retryable local state;
                             // API sessions are a different owner/database.
-                            onPreflightErrorCb(
-                                IllegalStateException(
-                                    "Hermes Dashboard chat is unavailable. Sign in or reconnect, then retry.",
-                                ),
-                            )
+                            // Preserve the authoritative Gateway explanation.
+                            // Inference initialization failures happen before
+                            // prompt.submit, and replacing them with generic
+                            // reconnect advice hides the actual operator fix.
+                            onPreflightErrorCb(IllegalStateException(reason))
                         }
                     },
                 )
@@ -10669,6 +10912,17 @@ class ChatViewModel : ViewModel() {
 
     fun cancelStream() {
         intentionallyCancelled = true
+        if (activeStream != null) {
+            subagentActivityController.interrupt()
+            chatActivityController.captureSubagents(subagentActivities.value)
+        }
+        currentQueueDestination()?.let { destination ->
+            if (queuedMessageItems.any { it.contextKey to it.sessionId == destination }) {
+                pausedQueueDestinations += destination
+                activeQueueOwnerRunId?.let { completedQueueOwnerRuns += it }
+            }
+        }
+        publishQueuedMessages()
         // User Stop also aborts a dropped-stream answer recovery. settleUi
         // false: the Stopped-badge block below finalizes the placeholder
         // itself (completing it here first would hide it from findLast).
@@ -10679,13 +10933,12 @@ class ChatViewModel : ViewModel() {
         activeStream = null
         imageActivityJob?.cancel()
         imageActivityJob = null
-        clearQueue()
         _steerableTurn.value = false
         _steerNotice.value = null
         // Gateway cancel issues session.interrupt, which force-denies any
         // blocked approval server-side — stamp the card to match.
         clearPendingAskAfterInterrupt()
-        clearTurnCheckpoint()
+        clearTurnCheckpoint(preserveQueue = true)
         AppAnalytics.onStreamCancelled()
         chatHandler?.let { handler ->
             val streamingMsg = handler.messages.value.findLast { it.isStreaming }
@@ -10723,7 +10976,7 @@ class ChatViewModel : ViewModel() {
      *     placeholder as actionable FAILED with [MEDIA_TAP_TO_DOWNLOAD] in
      *     [Attachment.errorMessage]. The UI renders a retry card.
      *  4. Otherwise → kick off a background fetch, enforce the max size cap,
-     *     cache the bytes via [MediaCacheWriter], and update the attachment
+     *     stream into [MediaCacheWriter], and update the attachment
      *     to LOADED (or FAILED on any error).
      *
      * Note: the matching happens by (messageId + relayToken). If the same
@@ -10787,7 +11040,10 @@ class ChatViewModel : ViewModel() {
                 expectedHistoryGeneration = historyGeneration,
             ) { _ ->
                 if (relay.mediaUrlConfigured()) {
-                    relay.fetchMedia(token, maxBytes = settings.maxInboundSizeMb.toLong().coerceAtLeast(1L) * 1024L * 1024L)
+                    relay.fetchMedia(
+                        token,
+                        maxBytes = settings.maxInboundSizeMb.toLong().coerceAtLeast(1L) * 1024L * 1024L,
+                    ).asInboundFetchedMedia()
                 } else {
                     Result.failure(MediaRouteUnavailableException())
                 }
@@ -10850,7 +11106,7 @@ class ChatViewModel : ViewModel() {
                     fetchServerPath(fetchKey, maxBytes, upstreamMediaClient)
                 } else {
                     if (relay.mediaUrlConfigured()) {
-                        relay.fetchMedia(fetchKey, maxBytes = maxBytes)
+                        relay.fetchMedia(fetchKey, maxBytes = maxBytes).asInboundFetchedMedia()
                     } else {
                         Result.failure(MediaRouteUnavailableException())
                     }
@@ -10909,7 +11165,22 @@ class ChatViewModel : ViewModel() {
             return ServerImageResult.Failure("Connection changed while loading image")
         }
         return result.fold(
-            onSuccess = { ServerImageResult.Success(it.bytes, it.sensitive) },
+            onSuccess = { fetched ->
+                try {
+                    val cachedUri = fetched.cachedUri ?: mediaCacheWriter?.cache(
+                        requireNotNull(fetched.bytes),
+                        fetched.contentType,
+                        fetched.fileName,
+                    )?.toString()
+                    if (cachedUri == null) {
+                        ServerImageResult.Failure("Media cache is unavailable")
+                    } else {
+                        ServerImageResult.Success(cachedUri, fetched.sensitive)
+                    }
+                } catch (error: Exception) {
+                    ServerImageResult.Failure(error.message ?: "Image cache failed")
+                }
+            },
             onFailure = { ServerImageResult.Failure(it.message ?: "Image unavailable") },
         )
     }
@@ -11031,17 +11302,39 @@ class ChatViewModel : ViewModel() {
         serverPath: String,
         maxBytes: Long,
         upstream: DashboardApiClient?,
-    ): Result<RelayHttpClient.FetchedMedia> {
+    ): Result<InboundFetchedMedia> {
         if (upstream != null) {
-            val upstreamResult = upstream.downloadManagedFile(serverPath, maxBytes)
-                .map { fetched ->
-                    RelayHttpClient.FetchedMedia(
-                        contentType = fetched.contentType,
-                        bytes = fetched.bytes,
-                        fileName = fetched.fileName,
-                        sensitive = false,
+            val cache = mediaCacheWriter
+                ?: return Result.failure(IOException("Media cache is unavailable"))
+            val context = appContext
+                ?: return Result.failure(IOException("Application context is unavailable"))
+            val staging = File.createTempFile("hermes-media-", ".part", context.cacheDir)
+            val upstreamResult = try {
+                val fetchedResult = staging.outputStream().buffered().use { output ->
+                    upstream.downloadManagedFile(serverPath, maxBytes, output)
+                }
+                if (fetchedResult.isFailure) {
+                    Result.failure(fetchedResult.exceptionOrNull()!!)
+                } else {
+                    val fetched = fetchedResult.getOrThrow()
+                    val uri = cache.cache(staging, fetched.contentType, fetched.fileName)
+                    Result.success(
+                        InboundFetchedMedia(
+                            contentType = fetched.contentType,
+                            fileName = fetched.fileName,
+                            sensitive = false,
+                            sizeBytes = fetched.sizeBytes,
+                            cachedUri = uri.toString(),
+                        ),
                     )
                 }
+            } catch (error: CancellationException) {
+                throw error
+            } catch (error: Exception) {
+                Result.failure(error)
+            } finally {
+                staging.delete()
+            }
             if (upstreamResult.isSuccess) return upstreamResult
             val upstreamFailure = upstreamResult.exceptionOrNull()
             if (upstreamFailure?.isDashboardManagedFilesUnsupported() != true) {
@@ -11050,13 +11343,14 @@ class ChatViewModel : ViewModel() {
             val relay = relayHttpClient
             if (relay?.mediaUrlConfigured() == true) {
                 return relay.fetchMediaByPath(serverPath, maxBytes = maxBytes)
+                    .asInboundFetchedMedia()
             }
             return Result.failure(MediaRouteUnavailableException(upstreamFailure))
         }
 
         val relay = relayHttpClient
         return if (relay?.mediaUrlConfigured() == true) {
-            relay.fetchMediaByPath(serverPath, maxBytes = maxBytes)
+            relay.fetchMediaByPath(serverPath, maxBytes = maxBytes).asInboundFetchedMedia()
         } else {
             Result.failure(MediaRouteUnavailableException())
         }
@@ -11096,7 +11390,7 @@ class ChatViewModel : ViewModel() {
         expectedRole: MessageRole = MessageRole.ASSISTANT,
         expectedContextKey: String? = activeProfileContextKey,
         expectedHistoryGeneration: Int = historyLoadGeneration.get(),
-        fetch: suspend (maxBytes: Long) -> Result<RelayHttpClient.FetchedMedia>,
+        fetch: suspend (maxBytes: Long) -> Result<InboundFetchedMedia>,
     ) {
         val cache = mediaCacheWriter ?: return
         val maxBytes = settings.maxInboundSizeMb.toLong().coerceAtLeast(1) * 1024L * 1024L
@@ -11117,8 +11411,8 @@ class ChatViewModel : ViewModel() {
         ) return
         result.fold(
             onSuccess = { fetched ->
-                if (fetched.bytes.size > maxBytes) {
-                    val sizeMb = fetched.bytes.size / (1024.0 * 1024.0)
+                if (fetched.sizeBytes > maxBytes) {
+                    val sizeMb = fetched.sizeBytes / (1024.0 * 1024.0)
                     updateAttachmentByToken(handler, messageId, fetchKey, expectedRole = expectedRole) { att ->
                         att.copy(
                             state = AttachmentState.FAILED,
@@ -11127,22 +11421,26 @@ class ChatViewModel : ViewModel() {
                             ),
                             contentType = fetched.contentType,
                             fileName = fetched.fileName ?: att.fileName,
-                            fileSize = fetched.bytes.size.toLong()
+                            fileSize = fetched.sizeBytes
                         )
                     }
                     return
                 }
 
                 try {
-                    val uri = cache.cache(fetched.bytes, fetched.contentType, fetched.fileName)
+                    val cachedUri = fetched.cachedUri ?: cache.cache(
+                        requireNotNull(fetched.bytes),
+                        fetched.contentType,
+                        fetched.fileName,
+                    ).toString()
                     updateAttachmentByToken(handler, messageId, fetchKey, expectedRole = expectedRole) { att ->
                         att.copy(
                             state = AttachmentState.LOADED,
                             errorMessage = null,
                             contentType = fetched.contentType,
                             fileName = fetched.fileName ?: att.fileName,
-                            fileSize = fetched.bytes.size.toLong(),
-                            cachedUri = uri.toString(),
+                            fileSize = fetched.sizeBytes,
+                            cachedUri = cachedUri,
                             // Carry the relay-authoritative sensitivity bit
                             // (X-Media-Sensitive header) onto the LOADED
                             // attachment so the renderer can blur per the
@@ -11153,9 +11451,8 @@ class ChatViewModel : ViewModel() {
                         )
                     }
                 } catch (e: Exception) {
-                    // Classifier produces a specific label (disk full, bad
-                    // URI, permission, …) for both the in-card text and the
-                    // global snackbar — same event, two surfaces.
+                    // Attachment owns failure and retry. History hydration can
+                    // fetch many files; never queue a global popup per file.
                     val human = classifyError(e, context = "media_fetch", ctx = appContext)
                     updateAttachmentByToken(handler, messageId, fetchKey, expectedRole = expectedRole) { att ->
                         att.copy(
@@ -11163,7 +11460,6 @@ class ChatViewModel : ViewModel() {
                             errorMessage = human.body
                         )
                     }
-                    _errorEvents.tryEmit(human)
                 }
             },
             onFailure = { err ->
@@ -11183,11 +11479,30 @@ class ChatViewModel : ViewModel() {
                         errorMessage = human.body
                     )
                 }
-                _errorEvents.tryEmit(human)
             }
         )
     }
 
+    private data class InboundFetchedMedia(
+        val contentType: String,
+        val fileName: String?,
+        val sensitive: Boolean,
+        val sizeBytes: Long,
+        val bytes: ByteArray? = null,
+        val cachedUri: String? = null,
+    )
+
+    private fun Result<RelayHttpClient.FetchedMedia>.asInboundFetchedMedia(): Result<InboundFetchedMedia> =
+        map { fetched ->
+            InboundFetchedMedia(
+                contentType = fetched.contentType,
+                fileName = fetched.fileName,
+                sensitive = fetched.sensitive,
+                sizeBytes = fetched.bytes.size.toLong(),
+                bytes = fetched.bytes,
+            )
+        }
+
     /**
      * Append an attachment to a specific assistant message, matched by id.
      * No-ops if the message can't be found (e.g. it was trimmed from the
@@ -11428,6 +11743,7 @@ class ChatViewModel : ViewModel() {
         gatewayClient?.setColdPrewarmSessionReadyListener(null)
         gatewayClient?.setUnmatchedTurnCompleteListener(null)
         gatewayClient?.setBackgroundInteractionListener(null)
+        gatewayClient?.setSubagentEventListener(null)
         backgroundPendingInteractions.clear()
         backgroundNeedsInputKeys.clear()
         publishBackgroundSessionActivity()

app/src/main/kotlin/com/hermesandroid/relay/viewmodel/ConnectionViewModel.kt

@@ -1,5 +1,6 @@
 package com.hermesandroid.relay.viewmodel
 
+import com.hermesandroid.relay.data.BusyMessageAction
 import android.app.Application
 import android.os.Build
 import android.content.Context
@@ -516,11 +517,22 @@ internal fun resolveEffectiveDashboardUrl(
     connection.authenticatedDashboardOrigin
         ?.let(::normalizeCredentialFreeAuthenticatedDashboardOrigin)
         ?.let { return it }
-    endpoint?.pluginProxyRoutesOrNull()?.dashboardBaseUrl?.let { return it }
-    endpoint?.dashboard?.url
+    // The resolver publishes independently of the active connection. During a
+    // switch its last winner can still belong to the outgoing installation.
+    // Never use that winner as authority for the incoming connection's bearer.
+    val routes = connection.routeCandidates.ifEmpty {
+        Connection.buildRouteCandidates(
+            apiServerUrl = connection.apiServerUrl,
+            relayUrl = connection.relayUrl,
+            dashboardUrl = connection.configuredDashboardUrl,
+        )
+    }
+    val ownedEndpoint = endpoint?.takeIf { it in routes }
+    ownedEndpoint?.pluginProxyRoutesOrNull()?.dashboardBaseUrl?.let { return it }
+    ownedEndpoint?.dashboard?.url
         ?.takeIf { it.isNotBlank() }
         ?.let { return it }
-    endpoint?.api?.url?.let { apiUrl ->
+    ownedEndpoint?.api?.url?.let { apiUrl ->
         connection.dashboardUrl
             ?.takeIf { it.isNotBlank() && Connection.urlsShareHost(it, apiUrl) }
             ?.let { return it }
@@ -1746,15 +1758,20 @@ class ConnectionViewModel(application: Application) : AndroidViewModel(applicati
 
     /**
      * Dashboard URL for the active connection **on the currently-resolved
-     * route** — snapshot twin of [effectiveDashboardUrl], which it delegates
-     * to. Standard voice and the availability probe read this per call, so
+     * route**. Read the authoritative id/list synchronously, not the combined
+     * [effectiveDashboardUrl] StateFlow: its previous emission can outlive a
+     * connection switch and must not authorize the new owner's credentials.
+     * Standard voice and the availability probe read this per call, so
      * an auto-managed dashboard URL follows LAN/Tailscale handoffs the same
      * way Manage does; an explicit dashboard override stays pinned. (This
      * used to read the persisted `resolvedDashboardUrl`, which kept voice
      * aimed at the LAN host after the resolver had moved chat to Tailscale.)
      */
     fun activeDashboardUrl(): String? =
-        effectiveDashboardUrl.value.takeIf { it.isNotBlank() }
+        resolveEffectiveDashboardUrl(
+            connection = activeConnectionSnapshot(),
+            endpoint = connectionManager.activeEndpoint.value,
+        ).takeIf { it.isNotBlank() }
 
     /**
      * Promote the exact reviewed Dashboard origin that completed cookie/OIDC
@@ -2387,13 +2404,13 @@ class ConnectionViewModel(application: Application) : AndroidViewModel(applicati
 
     suspend fun loadProfileScopedMessages(
         sessionId: String,
-        mode: SessionMessageLoadMode = SessionMessageLoadMode.COMPLETE,
+        mode: SessionMessageLoadMode = SessionMessageLoadMode.LATEST,
     ): Result<List<MessageItem>>? = profileController.loadProfileScopedMessages(sessionId, mode)
 
     suspend fun loadProfileScopedMessages(
         profileName: String?,
         sessionId: String,
-        mode: SessionMessageLoadMode = SessionMessageLoadMode.COMPLETE,
+        mode: SessionMessageLoadMode = SessionMessageLoadMode.LATEST,
     ): Result<List<MessageItem>>? =
         profileController.loadProfileScopedMessages(profileName, sessionId, mode)
 
@@ -3090,6 +3107,13 @@ class ConnectionViewModel(application: Application) : AndroidViewModel(applicati
         }
     }
 
+    val busyMessageAction = chatInputPreferencesRepository.busyMessageAction
+        .stateIn(viewModelScope, SharingStarted.Eagerly, BusyMessageAction.CorrectNow)
+
+    fun setBusyMessageAction(action: BusyMessageAction) {
+        viewModelScope.launch { chatInputPreferencesRepository.setBusyMessageAction(action) }
+    }
+
     val physicalKeyboardEnterBehavior: StateFlow<PhysicalKeyboardEnterBehavior> =
         chatInputPreferencesRepository.physicalKeyboardEnterBehavior
             .stateIn(

app/src/main/kotlin/com/hermesandroid/relay/viewmodel/GatewayProcessController.kt

@@ -62,6 +62,10 @@ internal class GatewayProcessController(
     private var generation = 0L
     private var refreshSequence = 0L
     private var allProcesses: List<GatewayProcess> = emptyList()
+    private var snapshotListener: ((List<GatewayProcess>) -> Unit)? = null
+
+    /** Only successful process.list results, never cached output-tail changes. */
+    fun setSnapshotListener(listener: ((List<GatewayProcess>) -> Unit)?) { snapshotListener = listener }
 
     /** A dismissal applies only to this concrete process identity. */
     private val dismissedIdentities = mutableMapOf<String, ProcessIdentity>()
@@ -179,6 +183,7 @@ internal class GatewayProcessController(
     }
 
     fun close() {
+        snapshotListener = null
         source?.setEventListener(null)
         source = null
         capabilityJob?.cancel()
@@ -229,6 +234,7 @@ internal class GatewayProcessController(
         allProcesses = coalesced
         publishVisibleSnapshot()
         updatePoller()
+        snapshotListener?.invoke(coalesced)
     }
 
     private fun publishVisibleSnapshot() {

app/src/main/kotlin/com/hermesandroid/relay/viewmodel/SubagentActivityController.kt

@@ -30,9 +30,8 @@ internal data class SubagentActivityEvent(
 /**
  * A bounded, ephemeral projection of parent-session `subagent.*` events.
  *
- * This is intentionally not a child transcript. Upstream currently exposes no
- * durable child-session key or child-history route, so the projection is owned
- * by the exact profile-scoped parent session and parent turn that emitted it.
+ * The owning profile/session outlives individual parent turns. Child identity
+ * keeps detached work visible until its own terminal event arrives.
  */
 internal data class SubagentActivity(
     val laneId: Long,
@@ -41,6 +40,7 @@ internal data class SubagentActivity(
     val taskCount: Int,
     val goal: String,
     val subagentId: String? = null,
+    val delegationId: String? = null,
     val childSessionId: String? = null,
     val parentId: String? = null,
     val depth: Int? = null,
@@ -91,6 +91,9 @@ internal class SubagentActivityController(
     private var laneSequence = 0L
     private var connectionWasReady = false
     private var pendingGap = false
+    private var interrupted = false
+    private var previewOpen = false
+    private val retiredChildIds = linkedSetOf<String>()
 
     fun selectSession(sessionId: String?, newScopeKey: String?) {
         if (storedSessionId == sessionId && scopeKey == newScopeKey) return
@@ -101,10 +104,16 @@ internal class SubagentActivityController(
         laneSequence = 0L
         connectionWasReady = false
         pendingGap = false
+        interrupted = false
+        previewOpen = false
+        retiredChildIds.clear()
         _activities.value = emptyList()
     }
 
     fun resetConnection() {
+        interrupted = false
+        previewOpen = false
+        retiredChildIds.clear()
         activeTurnId = null
         sequence = 0L
         laneSequence = 0L
@@ -133,9 +142,34 @@ internal class SubagentActivityController(
         if (sessionId == null || sessionId != storedSessionId || eventScopeKey != scopeKey) return
         if (activeTurnId == turnId) return
         activeTurnId = turnId
-        sequence = 0L
-        laneSequence = 0L
-        _activities.value = emptyList()
+        interrupted = false
+        _activities.value.filter { it.isTerminal }.forEach { activity ->
+            activity.subagentId?.let(retiredChildIds::add)
+            activity.childSessionId?.let(retiredChildIds::add)
+        }
+        while (retiredChildIds.size > 256) retiredChildIds.remove(retiredChildIds.first())
+        val visibleTerminalKeys = _activities.value.filter { it.isTerminal }.takeLast(32)
+            .mapTo(HashSet()) { it.stableKey }
+        _activities.value = _activities.value.filter {
+            (previewOpen && it.stableKey in visibleTerminalKeys) ||
+                (!it.isTerminal && (!it.subagentId.isNullOrBlank() || !it.childSessionId.isNullOrBlank()))
+        }
+    }
+
+    fun setPreviewOpen(open: Boolean) {
+        previewOpen = open
+        if (!open) _activities.value = _activities.value.filterNot { it.isTerminal }
+    }
+
+    fun onSessionEvent(sessionId: String, eventScopeKey: String?, event: GatewaySubagentEvent, profile: String?) {
+        onEvent(sessionId, eventScopeKey, activeTurnId ?: "session", event, profile)
+    }
+
+    fun interrupt() {
+        interrupted = true
+        _activities.value = _activities.value.map {
+            if (it.isTerminal) it else it.copy(phase = SubagentActivityPhase.INTERRUPTED, revision = it.revision + 1)
+        }
     }
 
     fun onEvent(
@@ -146,18 +180,21 @@ internal class SubagentActivityController(
         profile: String? = null,
     ) {
         if (sessionId == null || sessionId != storedSessionId || eventScopeKey != scopeKey) return
-        if (activeTurnId != turnId) return
+        if (interrupted) return
 
         val taskIndex = event.taskIndex.coerceAtLeast(0)
         val eventIdentity = event.subagentId?.takeIf(String::isNotBlank)
             ?: event.childSessionId?.takeIf(String::isNotBlank)
+        if (eventIdentity != null && eventIdentity in retiredChildIds) return
         val identityMatch = eventIdentity?.let { identity ->
             _activities.value.firstOrNull {
                 it.subagentId == identity || it.childSessionId == identity
             }
         }
         val compatibleIndexMatches = _activities.value.filter { activity ->
-            activity.taskIndex == taskIndex &&
+            activity.turnId == turnId && activity.taskIndex == taskIndex &&
+                (event.delegationId.isNullOrBlank() || activity.delegationId.isNullOrBlank() ||
+                    event.delegationId == activity.delegationId) &&
                 (event.subagentId.isNullOrBlank() || activity.subagentId.isNullOrBlank() ||
                     event.subagentId == activity.subagentId) &&
                 (event.childSessionId.isNullOrBlank() || activity.childSessionId.isNullOrBlank() ||
@@ -167,13 +204,14 @@ internal class SubagentActivityController(
                 (event.depth == null || activity.depth == null || event.depth == activity.depth)
         }
         val current = identityMatch ?: compatibleIndexMatches.singleOrNull()
-        if (
-            current?.isTerminal == true &&
-            event.phase != GatewaySubagentEvent.Phase.SPAWN_REQUESTED &&
+        if (activeTurnId != turnId && identityMatch == null && eventIdentity == null) return
+        if (current?.isTerminal == true) return
+        // Progress and completion cannot invent children when their start was missed.
+        if (current == null && event.phase != GatewaySubagentEvent.Phase.SPAWN_REQUESTED &&
             event.phase != GatewaySubagentEvent.Phase.START
         ) return
 
-        val base = if (current?.isTerminal == true) null else current
+        val base = current
         val phase = event.toActivityPhase()
         val goal = sanitize(event.goal, MAX_GOAL_CHARS)
         val preview = sanitize(event.preview, MAX_EVENT_TEXT_CHARS).ifBlank { null }
@@ -206,16 +244,17 @@ internal class SubagentActivityController(
         val (boundedEvents, truncated) = boundEvents(appended)
         val next = SubagentActivity(
             laneId = base?.laneId ?: laneSequence++,
-            turnId = turnId,
+            turnId = base?.turnId ?: turnId,
             taskIndex = taskIndex,
             taskCount = maxOf(1, event.taskCount, base?.taskCount ?: 1),
             goal = goal.ifBlank { base?.goal.orEmpty() },
             subagentId = event.subagentId?.takeIf(String::isNotBlank) ?: base?.subagentId,
+            delegationId = event.delegationId?.takeIf(String::isNotBlank) ?: base?.delegationId,
             childSessionId = event.childSessionId?.takeIf(String::isNotBlank) ?: base?.childSessionId,
             parentId = event.parentId?.takeIf(String::isNotBlank) ?: base?.parentId,
             depth = event.depth ?: base?.depth,
             model = event.model?.takeIf(String::isNotBlank) ?: base?.model,
-            profile = profile?.takeIf(String::isNotBlank) ?: base?.profile,
+            profile = if (base != null) base.profile else profile?.takeIf(String::isNotBlank),
             phase = phase,
             summary = summary ?: base?.summary,
             durationSeconds = event.durationSeconds ?: base?.durationSeconds,
@@ -231,7 +270,9 @@ internal class SubagentActivityController(
     fun endTurn(turnId: String) {
         if (activeTurnId != turnId) return
         _activities.value = _activities.value.map { activity ->
-            if (activity.isTerminal) activity else activity.copy(
+            if (activity.isTerminal || !activity.subagentId.isNullOrBlank() ||
+                !activity.childSessionId.isNullOrBlank()
+            ) activity else activity.copy(
                 phase = SubagentActivityPhase.ENDED_WITH_PARENT,
                 partialAfterGap = true,
                 revision = activity.revision + 1,
@@ -261,9 +302,9 @@ private fun GatewaySubagentEvent.toActivityPhase(): SubagentActivityPhase = when
     GatewaySubagentEvent.Phase.TOOL -> SubagentActivityPhase.TOOL
     GatewaySubagentEvent.Phase.PROGRESS -> SubagentActivityPhase.PROGRESS
     GatewaySubagentEvent.Phase.COMPLETE -> when (status?.trim()?.lowercase()) {
-        "failed", "error" -> SubagentActivityPhase.FAILED
+        "completed", "complete" -> SubagentActivityPhase.COMPLETED
         "interrupted", "cancelled", "canceled" -> SubagentActivityPhase.INTERRUPTED
-        else -> SubagentActivityPhase.COMPLETED
+        else -> SubagentActivityPhase.FAILED
     }
 }
 

app/src/main/kotlin/com/hermesandroid/relay/viewmodel/VoiceViewModel.kt

@@ -4,7 +4,8 @@ import android.app.Application
 import android.content.Context
 import android.os.SystemClock
 import android.util.Log
-import android.widget.Toast
+import com.hermesandroid.relay.ui.UiMessageBus
+import com.hermesandroid.relay.ui.UiMessageSeverity
 import androidx.lifecycle.AndroidViewModel
 import androidx.lifecycle.viewModelScope
 import com.hermesandroid.relay.R
@@ -2639,28 +2640,23 @@ class VoiceViewModel(application: Application) : AndroidViewModel(application) {
     // route is unavailable. Runs outside the turn state machine so it
     // doesn't disturb uiState.
     //
-    // Three toasts so the user knows what's happening: "Testing voice…" on
-    // trigger, "Voice test successful" on completion, "Voice test failed" on
-    // any error. The trigger toast is held in [triggerToast] so it can be
-    // cancelled the moment the result toast fires — without that the two
-    // would briefly overlap on screen. viewModelScope.launch defaults to
-    // Main.immediate so Toast.show() is safe inline without a dispatcher
-    // switch.
+    // Keyed progress feedback is cleared before an outcome replaces it.
+    // Classified failures retain their existing error event/overlay flow.
     fun testVoice(
         sample: String = "Hello, this is Hermes. Voice mode is working.",
         onResult: (Result<Unit>) -> Unit = {},
     ) {
-        val app = getApplication<Application>()
         val audioClient = voiceAudioClient
         val relayClient = voiceClient
         val p = player
         if (audioClient == null || p == null) {
             onResult(Result.failure(IllegalStateException("Voice pipeline not initialized")))
-            Toast.makeText(app, "Voice test failed: pipeline not initialized", Toast.LENGTH_SHORT).show()
+            UiMessageBus.error("Voice test failed: pipeline not initialized")
             setError("Voice pipeline not initialized")
             return
         }
-        val triggerToast = Toast.makeText(app, "Testing voice…", Toast.LENGTH_SHORT).also { it.show() }
+        val feedbackKey = "voice-test-${System.nanoTime()}"
+        UiMessageBus.post("Testing voice…", severity = UiMessageSeverity.Status, ttlMillis = 0L, key = feedbackKey)
         viewModelScope.launch {
             val profileAwareResult = if (audioClient.route == VoiceAudioRoute.Relay && relayClient != null) {
                 testVoiceViaVoiceOutput(relayClient, sample)
@@ -2669,9 +2665,9 @@ class VoiceViewModel(application: Application) : AndroidViewModel(application) {
             }
             val result = if (profileAwareResult != null) {
                 if (profileAwareResult.isSuccess) {
-                    triggerToast.cancel()
+                    UiMessageBus.clear(feedbackKey)
                     onResult(Result.success(Unit))
-                    Toast.makeText(app, "Voice test successful", Toast.LENGTH_SHORT).show()
+                    UiMessageBus.success("Voice test successful")
                     return@launch
                 }
                 Log.w(TAG, "profile-aware voice test failed; falling back to legacy synthesize: ${profileAwareResult.exceptionOrNull()?.message}")
@@ -2680,34 +2676,35 @@ class VoiceViewModel(application: Application) : AndroidViewModel(application) {
                 audioClient.synthesize(sample)
             }
             if (result.isFailure) {
-                triggerToast.cancel()
+                UiMessageBus.clear(feedbackKey)
                 val msg = result.exceptionOrNull()?.message ?: "synthesize failed"
                 onResult(Result.failure(result.exceptionOrNull() ?: IllegalStateException(msg)))
-                Toast.makeText(app, "Voice test failed: $msg", Toast.LENGTH_LONG).show()
                 surfaceError(result.exceptionOrNull(), context = "synthesize")
                 return@launch
             }
             val file = result.getOrNull()
             if (file == null) {
-                triggerToast.cancel()
+                UiMessageBus.clear(feedbackKey)
                 onResult(Result.failure(IllegalStateException("No audio returned")))
-                Toast.makeText(app, "Voice test failed: no audio returned", Toast.LENGTH_LONG).show()
+                UiMessageBus.error("Voice test failed: no audio returned")
                 return@launch
             }
             trackTtsFile(file)
             try {
                 p.play(file)
                 p.awaitCompletion()
-                triggerToast.cancel()
+                UiMessageBus.clear(feedbackKey)
                 onResult(Result.success(Unit))
-                Toast.makeText(app, "Voice test successful", Toast.LENGTH_SHORT).show()
+                UiMessageBus.success("Voice test successful")
+            } catch (cancelled: CancellationException) {
+                throw cancelled
             } catch (e: Exception) {
                 Log.w(TAG, "test playback failed: ${e.message}")
-                triggerToast.cancel()
+                UiMessageBus.clear(feedbackKey)
                 onResult(Result.failure(e))
-                Toast.makeText(app, "Voice test failed: ${e.message ?: "playback error"}", Toast.LENGTH_LONG).show()
+                UiMessageBus.error("Voice test failed: ${e.message ?: "playback error"}")
             }
-        }
+        }.invokeOnCompletion { UiMessageBus.clear(feedbackKey) }
     }
 
     /**
@@ -2930,17 +2927,16 @@ class VoiceViewModel(application: Application) : AndroidViewModel(application) {
         sample: String = "Say a short confirmation that Hermes Realtime Agent is working.",
         onResult: (Result<Unit>) -> Unit = {},
     ) {
-        val app = getApplication<Application>()
         val client = voiceClient
         val pcmPlayer = realtimePcmPlayer
         if (client == null || pcmPlayer == null) {
             onResult(Result.failure(IllegalStateException("Voice pipeline not initialized")))
-            Toast.makeText(app, "Realtime test failed: pipeline not initialized", Toast.LENGTH_SHORT).show()
+            UiMessageBus.error("Realtime test failed: pipeline not initialized")
             setError("Voice pipeline not initialized")
             return
         }
-        val triggerToast = Toast.makeText(app, "Testing Realtime Agent...", Toast.LENGTH_SHORT)
-            .also { it.show() }
+        val feedbackKey = "realtime-test-${System.nanoTime()}"
+        UiMessageBus.post("Testing Realtime Agent...", severity = UiMessageSeverity.Status, ttlMillis = 0L, key = feedbackKey)
         viewModelScope.launch {
             DiagnosticsLog.record(
                 category = DiagnosticCategory.Voice,
@@ -2970,12 +2966,11 @@ class VoiceViewModel(application: Application) : AndroidViewModel(application) {
                 audioBytes.addAndGet(audio.size)
                 pcmPlayer.write(audio, rate)
             }
-            triggerToast.cancel()
+            UiMessageBus.clear(feedbackKey)
             if (result.isFailure) {
                 pcmPlayer.stop()
                 val msg = result.exceptionOrNull()?.message ?: "realtime agent failed"
                 onResult(Result.failure(result.exceptionOrNull() ?: IllegalStateException(msg)))
-                Toast.makeText(app, "Realtime test failed: $msg", Toast.LENGTH_LONG).show()
                 DiagnosticsLog.record(
                     category = DiagnosticCategory.Voice,
                     severity = DiagnosticSeverity.Error,
@@ -2988,7 +2983,7 @@ class VoiceViewModel(application: Application) : AndroidViewModel(application) {
             if (audioBytes.get() <= 0) {
                 pcmPlayer.stop()
                 onResult(Result.failure(IllegalStateException("Provider returned no audio")))
-                Toast.makeText(app, "Realtime test failed: no audio returned", Toast.LENGTH_LONG).show()
+                UiMessageBus.error("Realtime test failed: no audio returned")
                 DiagnosticsLog.record(
                     category = DiagnosticCategory.Voice,
                     severity = DiagnosticSeverity.Error,
@@ -3002,14 +2997,14 @@ class VoiceViewModel(application: Application) : AndroidViewModel(application) {
             delay(drainMs)
             pcmPlayer.stop()
             onResult(Result.success(Unit))
-            Toast.makeText(app, "Realtime test successful", Toast.LENGTH_SHORT).show()
+            UiMessageBus.success("Realtime test successful")
             DiagnosticsLog.record(
                 category = DiagnosticCategory.Voice,
                 severity = DiagnosticSeverity.Info,
                 title = getApplication<Application>().getString(R.string.voice_status_test_complete),
                 detail = "${audioBytes.get()} bytes streamed",
             )
-        }
+        }.invokeOnCompletion { UiMessageBus.clear(feedbackKey) }
     }
 
     private suspend fun testVoiceViaVoiceOutput(
@@ -6673,7 +6668,7 @@ class VoiceViewModel(application: Application) : AndroidViewModel(application) {
         _uiState.update {
             voiceNoSpeechState(it)
         }
-        Toast.makeText(context, message, Toast.LENGTH_SHORT).show()
+        UiMessageBus.warning(message)
     }
 
     /**