feat(android): unify local reliability reporting

fix(android): stabilize chat identity and issue labeling

.github/workflows/issue-triage.yml

@@ -1,65 +0,0 @@
-name: Issue Triage
-
-on:
-  issues:
-    types: [opened]
-  workflow_dispatch:
-    inputs:
-      issue_number:
-        description: "Issue number to label again"
-        required: true
-        type: string
-
-concurrency:
-  group: issue-triage-${{ github.event.issue.number || github.event.inputs.issue_number }}
-  cancel-in-progress: false
-
-permissions:
-  contents: read
-  issues: write
-
-jobs:
-  auto-label:
-    if: >
-      github.event_name == 'workflow_dispatch' ||
-      (github.event_name == 'issues' && github.event.issue.user.type != 'Bot')
-    runs-on: ubuntu-latest
-    steps:
-      - name: Label from title prefix and issue area
-        uses: actions/github-script@v8
-        env:
-          ISSUE_NUMBER: ${{ github.event.issue.number || github.event.inputs.issue_number }}
-        with:
-          script: |
-            const issue_number = Number(process.env.ISSUE_NUMBER);
-            const { data: issue } = await github.rest.issues.get({
-              owner: context.repo.owner, repo: context.repo.repo, issue_number,
-            });
-            const title = (issue.title || '').toLowerCase();
-            const body = (issue.body || '').toLowerCase();
-            const haystack = `${title}\n${body}`;
-            const labels = [];
-
-            if (title.startsWith('[bug]')) labels.push('bug');
-            else if (title.startsWith('[feature]') || title.startsWith('[feat]')) labels.push('enhancement');
-            else if (title.startsWith('[docs]')) labels.push('documentation');
-
-            if (/\b(cli|desktop|terminal|daemon|pty|hermes-relay (install|binary|tray))\b/.test(haystack)) labels.push('area:cli');
-            else if (/\b(dashboard|plugin ui|react)\b/.test(haystack)) labels.push('area:dashboard');
-            else if (/\b(relay|plugin|aiohttp|python|pairing|voice (transcribe|synthesize)|bridge (endpoint|route))\b/.test(haystack)) labels.push('area:plugin');
-            else if (/\b(readme|user-?docs|documentation)\b/.test(haystack)) labels.push('area:docs');
-            else if (/\b(android|app|compose|apk|phone|samsung|gradle|chat|voice|notification|sphere|keystore)\b/.test(haystack)) labels.push('area:android');
-
-            if (!labels.length) {
-              core.info('No deterministic label matched; leaving the issue for maintainer triage.');
-              return;
-            }
-
-            try {
-              await github.rest.issues.addLabels({
-                owner: context.repo.owner, repo: context.repo.repo, issue_number, labels,
-              });
-              core.info(`Applied labels: ${labels.join(', ')}`);
-            } catch (error) {
-              core.warning(`Could not apply ${labels.join(', ')}: ${error.message}`);
-            }

.github/workflows/release-android.yml

@@ -191,6 +191,19 @@ jobs:
         #   app/build/outputs/bundle/sideloadRelease/hermes-relay-<version>-sideload-release.aab
         run: ./gradlew bundleRelease assembleRelease
 
+      # The Play AAB carries its mapping for Play Console deobfuscation, but
+      # sideload issue reports need the exact mapping from this immutable build.
+      # Keep both variants as a workflow artifact (not a public release asset).
+      - name: Retain R8 mappings for retrace
+        uses: actions/upload-artifact@v7
+        with:
+          name: android-r8-mappings-${{ needs.validate.outputs.version }}-${{ github.sha }}
+          path: |
+            app/build/outputs/mapping/googlePlayRelease/mapping.txt
+            app/build/outputs/mapping/sideloadRelease/mapping.txt
+          if-no-files-found: error
+          retention-days: 90
+
       - name: Scan release DEX for unsupported collection APIs
         run: |
           python3 scripts/check-android-collection-apis.py \

CHANGELOG.md

@@ -6,15 +6,28 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/), and this
 
 ## [Unreleased]
 
+### Added
+
+- **Android support information is local, redacted, and reviewable.** Fatal crashes and handled failures share a bounded on-device record, Diagnostics can copy or share the exact reviewed text, and nothing is uploaded automatically.
+
+### Fixed
+
+- **Android chat and Voice keep one render identity through recovery.** Checkpoint restore, streamed callbacks, server-ID adoption, and replay now resolve the same owned transcript row before publication, preventing recurring Compose duplicate-key crashes.
+- **Issue area labels require maintainer review.** The unreliable keyword-based auto-labeling workflow no longer assigns ownership from ambiguous issue text.
+- **Android crash reports retain actionable release context.** Reports identify the Android surface, avoid exposing hosts and credentials, migrate earlier local crash records, and release automation retains exact Play and sideload R8 mappings for retrace.
+- **Windows-trusted certificates work in the desktop CLI.** The packaged Windows binary and newer Node runtimes add the Windows certificate store without dropping bundled or operator-supplied roots, while TLS verification and Relay certificate pinning remain enforced.
+
+## [Android 1.6.1] - 2026-08-03
+
 ### Fixed
 
 - **Voice capture waits for the microphone to be released.** Manual recording no longer races barge-in teardown, and AudioRecord startup failures now explain how to free or permit the microphone before retrying.
 - **Android text selection stays stable as streamed replies finish.** Chat resets an active selection when live text becomes rich Markdown, preventing selection-handle drags from retaining removed text nodes.
 - **Android session history follows the upstream page-size contract.** The drawer keeps its 200-session window through bounded 100-row requests, avoiding HTTP 422 errors from current dashboard servers while preserving active-profile isolation.
-- **Windows-trusted certificates work in the desktop CLI.** The packaged Windows binary and newer Node runtimes add the Windows certificate store without dropping bundled or operator-supplied roots, while TLS verification and Relay certificate pinning remain enforced.
 - **Android no longer mistakes optional-surface auth failures for expired Relay pairing.** Background session refreshes stay out of the global snackbar, Dashboard and API authorization errors name their owning credential, and Relay-only surfaces use consistent Optional, Ready, Reconnecting, Unavailable, and Needs re-pair states. Foreground recovery retries ordinary Relay backoff immediately while preserving server rate limits, and recovery prioritizes Dashboard or host session management while retained credentials are labeled as stored details instead of active pairing.
+- **Voice controls no longer collide with new-chat coaching.** The clean-view hint yields while Voice owns the composer so it cannot cover the expanding Voice drawer.
 
-## [Server 1.5.1] - 2026-08-03
+## [1.5.1] - 2026-08-03
 
 ### Fixed
 

DEVLOG.md

@@ -1,5 +1,40 @@
 # Hermes-Relay — Dev Log
 
+## 2026-08-04 — Android transcript identity ownership
+
+ChatHandler now owns one render identity for every published transcript row.
+Checkpoint recovery and all streamed message mutations resolve both the mutable
+server/domain ID and the stable UI identity, so history adoption cannot leave a
+stale client reference that appends a second row. The publication boundary also
+coalesces repeated render identities before Chat or Voice can observe them,
+while keeping the first transcript position and latest state.
+
+Focused coverage composes history reconciliation with checkpoint restore,
+exercises stale post-adoption callbacks, and runs deterministic transition
+sequences across restore, replay, deltas, thinking, and usage updates. Voice's
+temporary transcript row now occupies an auxiliary key namespace disjoint from
+real message rows.
+
+## 2026-08-04 — Android reliability and support foundation
+
+Android fatal capture and centrally classified handled failures now converge on
+a versioned, allowlisted reliability record. Reports are redacted before local
+persistence, capped at 20 records with 14-day retention, written atomically,
+and correlated only with random app/report identifiers. Expected cancellation
+and permission denial remain non-reportable. The pre-existing one-file crash
+format migrates locally on first launch.
+
+Crash recovery leads with the recovery outcome and no-upload guarantee, then
+requires an explicit review before copy, share, or GitHub actions. Diagnostics
+adds an offline support-information review using the same exact redacted text.
+Android issue prefills now request the Android area while repository-wide issue
+ownership remains maintainer-reviewed, and the release workflow retains both
+variant R8 mappings for deterministic retrace.
+
+The architecture audit defers an ANR watchdog, richer allowlisted breadcrumbs,
+hashed product correlation, and OOM emergency writing until their lifecycle,
+privacy, and false-positive behavior can be validated on devices.
+
 ## 2026-08-02 — Android Russian localization
 
 Android now ships complete Russian catalogs for the main and sideload builds.

RELEASE.md

@@ -494,6 +494,14 @@ the new app version and a higher `appVersionCode`.
   in `app/build.gradle.kts`. Never rename the sideload APK — the
   in-app update checker matches assets by `.apk` + `sideload` in the
   name, and user-docs verify steps cite the filename.
+  The release workflow also retains
+  `app/build/outputs/mapping/{googlePlayRelease,sideloadRelease}/mapping.txt`
+  for 90 days in the `android-r8-mappings-<version>-<sha>` workflow
+  artifact. It is intentionally not a GitHub Release asset. To symbolicate an
+  in-app or sideload report, download the artifact for the exact version/SHA and
+  run Android's retrace tool with the matching flavor mapping:
+  `retrace <mapping.txt> <obfuscated-trace.txt>`. Play reports can additionally
+  use the mapping bundled into the uploaded AAB through Play Console.
 - `app/src/main/assets/whats_new.txt` — in-app "What's New" content
   shown in the settings/about screen. Update with the version number
   and a brief feature summary. Gets stale silently if forgotten

RELEASE_NOTES.md

@@ -1,10 +1,10 @@
-# Hermes-Relay-Android v1.6.0
+# Hermes-Relay-Android v1.6.1
 
-**Release Date:** August 2, 2026
+**Release Date:** August 3, 2026
 
 ## Download
 
-> Installing on your phone? Download `hermes-relay-1.6.0-sideload-release.apk` and tap it for the full feature set, or install the conservative build from [Google Play](https://play.google.com/store/apps/details?id=com.axiomlabs.hermesrelay).
+> Installing on your phone? Download `hermes-relay-1.6.1-sideload-release.apk` and tap it for the full feature set, or install the conservative build from [Google Play](https://play.google.com/store/apps/details?id=com.axiomlabs.hermesrelay).
 
 The `.aab` file is a Play Console upload bundle and cannot be installed by tapping it on a phone.
 
@@ -12,34 +12,19 @@ Verify the download against `SHA256SUMS.txt`. See the [sideload guide](https://h
 
 ## Summary
 
-This minor release brings personality and extensibility to Android: floating Petdex companions can explore the interface, Hermes plugins can contribute safe native pages, and Hermes can become the optional Android Digital Assistant. Voice, route failover, live-list identity, and Russian localization are also substantially improved.
-
-## Added
-
-- Choose, preview, and install Petdex companions from Appearance, or import your own pet. Pets remain separate from agent avatars and the background Sphere.
-- Hold and drag a pet anywhere, or enable optional UI-aware roaming across measured chat bubbles, the composer, settings cards, and other safe ledges.
-- Open native Android pages contributed by installed Hermes plugins. Pages use a host-rendered declarative schema, and scoped writes remain disabled until explicitly granted.
-- Use Relay 1.5.0 to review, keep, or remove approval-gated agent-created plugin-page drafts.
-- Select Hermes as Android’s default Digital Assistant, with an optional local “Hey Hermes” listener that keeps pre-activation audio on the device.
-- Use the complete AI-assisted Russian Android catalog from the in-app language picker.
-
-## Improved
-
-- Assistant and floating Voice controls start compact, expand for transcript and response detail, and hand off to full Voice without restarting the turn.
-- Voice interruption now covers generation and playback with upstream-aligned calibration, stop phrases, and private next-turn interruption context.
-- The Agent Passport presents profile configuration, skills, routing, reasoning, and scoped credentials more clearly.
-- Pet roaming follows measured terrain, bubble edges, scroll movement, obstacle recovery, animation capabilities, temperament, and reduced-motion/accessibility pauses.
+This patch clarifies optional Relay recovery, restores the full session drawer, and fixes several chat and Voice regressions.
 
 ## Fixed
 
-- Streaming voice output falls back when no first audio arrives, and long Standard Voice recordings upload without duplicate in-memory encoding.
-- Relay failover no longer allows competing reconnect loops to bounce rapidly between LAN and remote routes.
-- Streamed chat rows retain stable UI identity while server IDs and background-process state reconcile.
-- Pets recover from occupied or scrolling terrain, avoid text and the jump-to-latest control, and preserve walk, jump, held, and drop animation states.
-- OEM assistant picker activation, local wake completion, and empty-speech recovery are reliable across the supported lifecycle.
+- Optional Relay failures stay within Relay-only surfaces, use consistent status labels, and only request re-pairing when the stored Relay credential actually needs it.
+- Foreground recovery reconnects immediately after ordinary backoff, while retained credentials are described as stored details rather than an active in-memory session.
+- Session history loads its 200-row drawer window through upstream-compatible 100-row pages instead of failing with HTTP 422.
+- Selecting text remains stable when a streamed response changes from live text to rendered Markdown.
+- Manual Voice recording waits for barge-in microphone teardown and gives a useful recovery message when the microphone is unavailable.
+- New-chat coaching yields while Voice owns the composer, so it no longer covers the expanding Voice drawer.
 
 ## Install / Verify
 
-- App version: **1.6.0** (versionCode **37**).
+- App version: **1.6.1** (versionCode **38**).
 - Standard Chat and Vanilla Hermes voice continue to work against unmodified upstream Hermes.
-- Petdex installation is built into Android. Native pages from ordinary installed plugins use the authenticated Dashboard; agent-created page drafts require the optional Relay 1.5.0 plugin.
+- Same-device Relay re-pair replacement requires the optional Server 1.5.1 plugin; Dashboard and `/relay revoke <token-prefix>` remain available for explicit cleanup.

app/src/googlePlay/play/release-notes/en-US/default.txt

@@ -1 +1 @@
-Add floating Petdex companions that can roam across the interface, safe native pages from installed Hermes plugins, and an optional Android Digital Assistant with local “Hey Hermes.” This release also adds Russian and improves voice recovery, route failover, live chat stability, and pet movement.
+Optional Relay recovery now stays in the right surfaces with clear status labels and immediate foreground retry. Session history again loads its full window through upstream-compatible paging. Streamed text selection, Voice microphone handoff, and the expanding Voice drawer are also more reliable.

app/src/main/assets/changelog.json

@@ -1,5 +1,33 @@
 {
  "versions": [
+  {
+   "version": "1.6.1",
+   "title": "Clearer recovery, steadier chat",
+   "date": "2026-08-03",
+   "sections": [
+    {
+     "header": "Relay stays optional",
+     "bullets": [
+      "Relay-only surfaces now use consistent Optional, Ready, Reconnecting, Unavailable, and Needs re-pair states without nagging from background session refreshes.",
+      "Foreground recovery retries ordinary reconnect backoff immediately and explains whether Relay credentials are merely stored or actually need re-pairing."
+     ]
+    },
+    {
+     "header": "Sessions and chat stay stable",
+     "bullets": [
+      "The session drawer restores its 200-row window through upstream-compatible 100-row pages.",
+      "Selecting streamed text stays stable when a completed response changes to rendered Markdown."
+     ]
+    },
+    {
+     "header": "Voice controls stay reachable",
+     "bullets": [
+      "Manual recording waits for the previous microphone owner to release it and gives a useful recovery message if capture cannot start.",
+      "New-chat coaching yields while Voice owns the composer so it cannot cover the expanding Voice drawer."
+     ]
+    }
+   ]
+  },
   {
    "version": "1.6.0",
    "title": "Pets, plugins, and voice",

app/src/main/assets/whats_new.txt

@@ -1,6 +1,6 @@
-v1.6.0 - Pets, plugins, and voice
+v1.6.1 - Clearer recovery, steadier chat
 
-* Add floating Petdex companions that can roam across the interface.
-* Add safe native pages contributed by installed Hermes plugins.
-* Use Hermes as the optional Android Digital Assistant with local “Hey Hermes.”
-* Add Russian and improve voice, routing, chat, and pet stability.
+* Keep optional Relay recovery scoped to Relay surfaces with clear status labels.
+* Restore the 200-session drawer through upstream-compatible paging.
+* Stabilize streamed text selection and Voice microphone handoff.
+* Keep new-chat coaching clear of the expanding Voice drawer.

app/src/main/kotlin/com/hermesandroid/relay/diagnostics/DiagnosticsLog.kt

@@ -3,6 +3,8 @@ package com.hermesandroid.relay.diagnostics
 import kotlinx.coroutines.flow.MutableStateFlow
 import kotlinx.coroutines.flow.StateFlow
 import kotlinx.coroutines.flow.asStateFlow
+import com.hermesandroid.relay.reliability.ReliabilityCenter
+import com.hermesandroid.relay.reliability.ReliabilityRedactor
 
 enum class DiagnosticCategory(val label: String) {
     Api("API"),
@@ -124,6 +126,7 @@ object DiagnosticsLog {
         endpointRole: String? = null,
         url: String? = null,
         elapsedMs: Long? = null,
+        reliabilityContext: String? = null,
     ) {
         record(
             category = category,
@@ -135,6 +138,17 @@ object DiagnosticsLog {
             elapsedMs = elapsedMs,
             stacktrace = throwable?.let { stackTraceText(it) },
         )
+        if (throwable != null) {
+            runCatching {
+                ReliabilityCenter.recordHandled(
+                    title = title,
+                    detail = detail ?: throwable.message,
+                    throwable = throwable,
+                    context = reliabilityContext,
+                    routeRole = endpointRole,
+                )
+            }
+        }
     }
 
     private fun stackTraceText(t: Throwable): String =
@@ -167,10 +181,8 @@ object DiagnosticsLog {
             val prefix = noQuery.substring(0, schemeEnd + 3)
             val rest = noQuery.substring(schemeEnd + 3)
             val slash = rest.indexOf('/').let { if (it < 0) rest.length else it }
-            val authority = rest.substring(0, slash)
             val path = rest.substring(slash)
-            val safeAuthority = authority.substringAfterLast('@')
-            prefix + safeAuthority + path
+            prefix + "[host]" + path
         } else {
             noQuery
         }
@@ -197,7 +209,7 @@ object DiagnosticsLog {
      */
     private fun redactTrace(value: String?): String? {
         val trimmed = value?.trim()?.takeIf { it.isNotBlank() } ?: return null
-        val redacted = redact(trimmed)
+        val redacted = ReliabilityRedactor.redact(trimmed, MAX_TRACE_LENGTH)
         return if (redacted.length > MAX_TRACE_LENGTH) {
             redacted.take(MAX_TRACE_LENGTH) + "\n… (truncated)"
         } else {
@@ -205,8 +217,5 @@ object DiagnosticsLog {
         }
     }
 
-    private fun redact(value: String): String =
-        value.replace(Regex("""(?i)(bearer|token|api[_-]?key|session[_-]?token)\s*[:=]\s*\S+""")) {
-            "${it.groupValues[1]}=[hidden]"
-        }
+    private fun redact(value: String): String = ReliabilityRedactor.redact(value, MAX_TRACE_LENGTH)
 }

app/src/main/kotlin/com/hermesandroid/relay/network/upstream/ChatHandler.kt

@@ -218,8 +218,14 @@ class ChatHandler {
      */
     private val activeAnnotationTools = mutableMapOf<String, String>()
 
-    private val _messages = MutableStateFlow<List<ChatMessage>>(emptyList())
-    val messages: StateFlow<List<ChatMessage>> = _messages.asStateFlow()
+    // All Chat and Voice transcript publications pass through this invariant
+    // boundary. A caller may address a row by its mutable server/domain id or
+    // its retained client uiKey, but Compose must never observe both aliases.
+    private val _messages = RenderedMessageState(emptyList())
+    val messages: StateFlow<List<ChatMessage>> = _messages.flow
+
+    private fun ChatMessage.matchesIdentity(reference: String): Boolean =
+        id == reference || uiKey == reference
 
     /**
      * Latest gateway `status.update` lifecycle line for the in-flight turn
@@ -324,8 +330,8 @@ class ChatHandler {
         // message.started can replace that domain id with the server id while
         // uiKey deliberately retains the client id. Resolve the current domain
         // id before every event so the tail keeps mutating the same visible row.
-        val currentMessageId = _messages.value.findLast { message ->
-            message.id == messageId || message.uiKey == messageId
+        val currentMessageId = _messages.value.findLast {
+            it.matchesIdentity(messageId)
         }?.id ?: messageId
 
         when (envelope.event) {
@@ -392,7 +398,7 @@ class ChatHandler {
      */
     fun updateDeliveryStatus(messageId: String, status: MessageDeliveryStatus) {
         _messages.update { list ->
-            list.map { if (it.id == messageId) it.copy(deliveryStatus = status) else it }
+            list.map { if (it.matchesIdentity(messageId)) it.copy(deliveryStatus = status) else it }
         }
     }
 
@@ -400,7 +406,7 @@ class ChatHandler {
     fun setBackgroundTask(messageId: String, task: BackgroundTaskState) {
         _messages.update { list ->
             list.map { message ->
-                if (message.id == messageId) message.copy(backgroundTask = task) else message
+                if (message.matchesIdentity(messageId)) message.copy(backgroundTask = task) else message
             }
         }
     }
@@ -412,7 +418,7 @@ class ChatHandler {
     ) {
         _messages.update { list ->
             list.map { message ->
-                if (message.id == messageId && message.backgroundTask != null) {
+                if (message.matchesIdentity(messageId) && message.backgroundTask != null) {
                     message.copy(backgroundTask = transform(message.backgroundTask))
                 } else {
                     message
@@ -493,7 +499,7 @@ class ChatHandler {
      */
     fun appendAskCardMessage(messageId: String, card: HermesCard) {
         _messages.update { list ->
-            if (list.any { it.id == messageId }) return@update list
+            if (list.any { it.matchesIdentity(messageId) }) return@update list
             val msg = ChatMessage(
                 id = messageId,
                 role = MessageRole.ASSISTANT,
@@ -515,7 +521,7 @@ class ChatHandler {
      */
     fun truncateMessagesFrom(messageId: String) {
         _messages.update { list ->
-            val idx = list.indexOfFirst { it.id == messageId }
+            val idx = list.indexOfFirst { it.matchesIdentity(messageId) }
             if (idx < 0) list else list.take(idx)
         }
     }
@@ -523,7 +529,7 @@ class ChatHandler {
     fun replaceMessageContent(messageId: String, content: String) {
         _messages.update { messages ->
             messages.map { message ->
-                if (message.id == messageId) {
+                if (message.matchesIdentity(messageId)) {
                     message.copy(content = content)
                 } else {
                     message
@@ -543,8 +549,9 @@ class ChatHandler {
         content: String,
     ) {
         _messages.update { messages ->
-            val interim = messages.firstOrNull { it.id == interimMessageId } ?: return@update messages
-            val current = messages.firstOrNull { it.id == currentMessageId }
+            val interim = messages.firstOrNull { it.matchesIdentity(interimMessageId) }
+                ?: return@update messages
+            val current = messages.firstOrNull { it.matchesIdentity(currentMessageId) }
             val mergedTools = (interim.toolCalls + current?.toolCalls.orEmpty())
                 .distinctBy { it.id ?: "${it.name}:${it.startedAt}" }
             val merged = interim.copy(
@@ -563,14 +570,18 @@ class ChatHandler {
                 backgroundTask = current?.backgroundTask ?: interim.backgroundTask,
             )
             messages
-                .filterNot { it.id == currentMessageId && currentMessageId != interimMessageId }
-                .map { if (it.id == interimMessageId) merged else it }
+                .filterNot {
+                    current != null &&
+                        current.uiKey != interim.uiKey &&
+                        it.matchesIdentity(currentMessageId)
+                }
+                .map { if (it.matchesIdentity(interimMessageId)) merged else it }
         }
     }
 
     /** Remove a provisional client-side message that never became a real turn. */
     fun removeMessage(messageId: String) {
-        _messages.update { messages -> messages.filterNot { it.id == messageId } }
+        _messages.update { messages -> messages.filterNot { it.matchesIdentity(messageId) } }
     }
 
     /**
@@ -752,7 +763,7 @@ class ChatHandler {
         _messages.update { messages ->
             var changed = false
             val mapped = messages.map { msg ->
-                if (msg.id == messageId && msg.role == MessageRole.ASSISTANT) {
+                if (msg.matchesIdentity(messageId) && msg.role == MessageRole.ASSISTANT) {
                     changed = true
                     // A realtimeTurn trace is attached ONLY for provider-only
                     // (non-Hermes-backed) turns — Hermes-backed ones leave it
@@ -971,7 +982,12 @@ class ChatHandler {
         val user = checkpoint.user
         val assistant = checkpoint.assistant
         val upstreamText = upstreamAssistantText.orEmpty()
-        val currentAssistant = _messages.value.lastOrNull { it.id == assistant.id }
+        // A history poll may already have adopted the server id while the
+        // checkpoint still names the original client identity. They are one
+        // logical row, resolved through either side of that alias.
+        val currentAssistant = _messages.value.lastOrNull {
+            it.matchesIdentity(assistant.id) && it.role == MessageRole.ASSISTANT
+        }
         val restoredContent = listOf(
             assistant.content,
             upstreamText,
@@ -1053,7 +1069,8 @@ class ChatHandler {
             ?.takeIf { it.isNotEmpty() }
             ?: checkpointMoaReferences
         val restoredAssistant = ChatMessage(
-            id = assistant.id,
+            id = currentAssistant?.id ?: assistant.id,
+            uiKey = currentAssistant?.uiKey ?: assistant.id,
             role = MessageRole.ASSISTANT,
             content = restoredContent,
             timestamp = assistant.timestamp,
@@ -1080,10 +1097,12 @@ class ChatHandler {
 
         activeAgentName = restoredAssistant.agentName ?: activeAgentName
         _messages.update { current ->
-            val withoutOldAssistant = current.filterNot { it.id == assistant.id }
+            val withoutOldAssistant = current.filterNot {
+                it.matchesIdentity(assistant.id) && it.role == MessageRole.ASSISTANT
+            }
             val users = withoutOldAssistant.filter { it.role == MessageRole.USER }
             val positionalUser = users.getOrNull(checkpoint.priorUserMessageCount)
-            val hasUser = withoutOldAssistant.any { it.id == user.id } ||
+            val hasUser = withoutOldAssistant.any { it.matchesIdentity(user.id) } ||
                 positionalUser?.content?.trim() == user.content.trim()
             val withUser = if (hasUser) {
                 withoutOldAssistant
@@ -1100,7 +1119,7 @@ class ChatHandler {
             // those corrections as ordinary user bubbles before the assistant
             // row. Consume matching already-present rows first so repeated
             // resume/checkpoint passes cannot duplicate them.
-            val originalUserIndex = withUser.indexOfFirst { it.id == user.id }
+            val originalUserIndex = withUser.indexOfFirst { it.matchesIdentity(user.id) }
                 .takeIf { it >= 0 }
                 ?: withUser.indexOfFirst {
                     it.role == MessageRole.USER && it.content.trim() == user.content.trim()
@@ -1213,7 +1232,7 @@ class ChatHandler {
     fun replaceMessageId(oldId: String, newId: String) {
         _messages.update { messages ->
             messages.map { msg ->
-                if (msg.id == oldId && msg.content.isBlank() && msg.isStreaming) {
+                if (msg.matchesIdentity(oldId) && msg.content.isBlank() && msg.isStreaming) {
                     msg.copy(id = newId)
                 } else msg
             }
@@ -1236,7 +1255,7 @@ class ChatHandler {
     fun mutateMessage(messageId: String, transform: (ChatMessage) -> ChatMessage) {
         _messages.update { messages ->
             messages.map { msg ->
-                if (msg.id == messageId) transform(msg) else msg
+                if (msg.matchesIdentity(messageId)) transform(msg) else msg
             }
         }
     }
@@ -2024,12 +2043,12 @@ class ChatHandler {
 
         _messages.update { messages ->
             val existing = messages.findLast {
-                it.id == messageId && it.role == MessageRole.ASSISTANT
+                it.matchesIdentity(messageId) && it.role == MessageRole.ASSISTANT
             }
 
             if (existing != null) {
                 messages.map { msg ->
-                    if (msg.id == messageId) {
+                    if (msg.matchesIdentity(messageId)) {
                         msg.copy(content = msg.content + processedDelta)
                     } else {
                         msg
@@ -2262,7 +2281,7 @@ class ChatHandler {
 
         _messages.update { messages ->
             messages.map { msg ->
-                if (msg.id == messageId && msg.role == MessageRole.ASSISTANT) {
+                if (msg.matchesIdentity(messageId) && msg.role == MessageRole.ASSISTANT) {
                     msg.copy(cards = msg.cards + card)
                 } else msg
             }
@@ -2288,7 +2307,7 @@ class ChatHandler {
 
         _messages.update { messages ->
             messages.map { msg ->
-                if (msg.id != messageId || msg.role != MessageRole.ASSISTANT) return@map msg
+                if (!msg.matchesIdentity(messageId) || msg.role != MessageRole.ASSISTANT) return@map msg
                 var cleaned = msg.content
                 var changed = false
                 for (rawLine in msg.content.lines()) {
@@ -2355,7 +2374,7 @@ class ChatHandler {
     private fun stripLineFromContent(messageId: String, line: String) {
         _messages.update { messages ->
             messages.map { msg ->
-                if (msg.id == messageId && msg.role == MessageRole.ASSISTANT) {
+                if (msg.matchesIdentity(messageId) && msg.role == MessageRole.ASSISTANT) {
                     // Remove the line (with surrounding newlines) from content
                     val cleaned = msg.content
                         .replace("\n$line\n", "\n")
@@ -2492,7 +2511,7 @@ class ChatHandler {
         // that raced with stripLineFromContent during streaming.
         _messages.update { messages ->
             messages.map { msg ->
-                if (msg.id != messageId || msg.role != MessageRole.ASSISTANT) return@map msg
+                if (!msg.matchesIdentity(messageId) || msg.role != MessageRole.ASSISTANT) return@map msg
                 var cleaned = msg.content
                 var changed = false
                 for (rawLine in msg.content.lines()) {
@@ -2546,7 +2565,7 @@ class ChatHandler {
     private fun finalizeAnnotations(messageId: String) {
         _messages.update { messages ->
             messages.map { msg ->
-                if (msg.id != messageId || msg.role != MessageRole.ASSISTANT) return@map msg
+                if (!msg.matchesIdentity(messageId) || msg.role != MessageRole.ASSISTANT) return@map msg
 
                 val existingToolNames = msg.toolCalls.map { it.name }.toSet()
                 val newToolCalls = mutableListOf<ToolCall>()
@@ -2629,7 +2648,7 @@ class ChatHandler {
             .take(4)
         _messages.update { messages ->
             messages.map { msg ->
-                if (msg.id == messageId && msg.role == MessageRole.ASSISTANT) {
+                if (msg.matchesIdentity(messageId) && msg.role == MessageRole.ASSISTANT) {
                     msg.copy(badges = cleaned)
                 } else {
                     msg
@@ -2645,7 +2664,7 @@ class ChatHandler {
         if (cleaned.isEmpty()) return
         _messages.update { messages ->
             messages.map { msg ->
-                if (msg.id == messageId && msg.role == MessageRole.ASSISTANT) {
+                if (msg.matchesIdentity(messageId) && msg.role == MessageRole.ASSISTANT) {
                     msg.copy(badges = (msg.badges + cleaned).distinct().take(4))
                 } else {
                     msg
@@ -2679,11 +2698,11 @@ class ChatHandler {
         )
         _messages.update { messages ->
             val target = messages.findLast {
-                it.id == messageId && it.role == MessageRole.ASSISTANT
+                it.matchesIdentity(messageId) && it.role == MessageRole.ASSISTANT
             }
             if (target != null) {
                 messages.map { msg ->
-                    if (msg.id == messageId) {
+                    if (msg.matchesIdentity(messageId)) {
                         msg.copy(toolCalls = msg.toolCalls + placeholder)
                     } else {
                         msg
@@ -2714,7 +2733,7 @@ class ChatHandler {
 
         _messages.update { messages ->
             val target = messages.findLast {
-                it.id == messageId && it.role == MessageRole.ASSISTANT
+                it.matchesIdentity(messageId) && it.role == MessageRole.ASSISTANT
             }
             if (target != null) {
                 // Adopt a pending "preparing" placeholder for this name
@@ -2728,7 +2747,7 @@ class ChatHandler {
                         .indexOfFirst { it.isGenerating && !it.isComplete && it.name.isEmpty() }
                         .takeIf { it >= 0 }
                 messages.map { msg ->
-                    if (msg.id != messageId) return@map msg
+                    if (!msg.matchesIdentity(messageId)) return@map msg
                     if (genIdx != null) {
                         val calls = msg.toolCalls.toMutableList()
                         calls[genIdx] = calls[genIdx].copy(
@@ -2786,7 +2805,7 @@ class ChatHandler {
     fun onMoaReference(messageId: String, event: GatewayMoaReference) {
         _messages.update { messages ->
             val targetIndex = messages.indexOfLast {
-                it.id == messageId && it.role == MessageRole.ASSISTANT
+                it.matchesIdentity(messageId) && it.role == MessageRole.ASSISTANT
             }
             if (targetIndex < 0) return@update messages
             _isStreaming.value = true
@@ -2861,11 +2880,11 @@ class ChatHandler {
                 )
                 _messages.update { messages ->
                     val target = messages.findLast {
-                        it.id == messageId && it.role == MessageRole.ASSISTANT
+                        it.matchesIdentity(messageId) && it.role == MessageRole.ASSISTANT
                     }
                     if (target != null) {
                         messages.map { msg ->
-                            if (msg.id != messageId) return@map msg
+                            if (!msg.matchesIdentity(messageId)) return@map msg
                             val closed = msg.toolCalls.map { call ->
                                 if (call.taskIndex == event.taskIndex && !call.isComplete) {
                                     call.copy(
@@ -2900,7 +2919,7 @@ class ChatHandler {
                 val summaryId = "subagent-${event.taskIndex}-${syntheticToolSeq++}"
                 _messages.update { messages ->
                     messages.map { msg ->
-                        if (msg.id != messageId || msg.role != MessageRole.ASSISTANT) return@map msg
+                        if (!msg.matchesIdentity(messageId) || msg.role != MessageRole.ASSISTANT) return@map msg
                         val hasLaneCalls = msg.toolCalls.any { it.taskIndex == event.taskIndex }
                         val closed = msg.toolCalls.map { call ->
                             if (call.taskIndex == event.taskIndex && !call.isComplete) {
@@ -2951,14 +2970,14 @@ class ChatHandler {
         // Snapshot the matching tool call's name BEFORE mutating — we need it
         // to decide whether to emit a phone-action result bubble below.
         val toolName = _messages.value
-            .firstOrNull { it.id == messageId && it.role == MessageRole.ASSISTANT }
+            .firstOrNull { it.matchesIdentity(messageId) && it.role == MessageRole.ASSISTANT }
             ?.toolCalls
             ?.firstOrNull { it.id == toolCallId }
             ?.name
 
         _messages.update { messages ->
             messages.map { msg ->
-                if (msg.id == messageId && msg.role == MessageRole.ASSISTANT) {
+                if (msg.matchesIdentity(messageId) && msg.role == MessageRole.ASSISTANT) {
                     val updatedCalls = msg.toolCalls.map { call ->
                         if (call.id == toolCallId && !call.isComplete) {
                             call.copy(
@@ -2995,14 +3014,14 @@ class ChatHandler {
         // Snapshot tool name before the update so the phone-action bubble
         // can label the failure correctly.
         val toolName = _messages.value
-            .firstOrNull { it.id == messageId && it.role == MessageRole.ASSISTANT }
+            .firstOrNull { it.matchesIdentity(messageId) && it.role == MessageRole.ASSISTANT }
             ?.toolCalls
             ?.firstOrNull { it.id == toolCallId }
             ?.name
 
         _messages.update { messages ->
             messages.map { msg ->
-                if (msg.id == messageId && msg.role == MessageRole.ASSISTANT) {
+                if (msg.matchesIdentity(messageId) && msg.role == MessageRole.ASSISTANT) {
                     val updatedCalls = msg.toolCalls.map { call ->
                         if (call.id == toolCallId && !call.isComplete) {
                             call.copy(
@@ -3035,7 +3054,7 @@ class ChatHandler {
     fun onToolOutputRisk(messageId: String, outputRisk: GatewayToolOutputRisk) {
         _messages.update { messages ->
             messages.map { msg ->
-                if (msg.id != messageId || msg.role != MessageRole.ASSISTANT) return@map msg
+                if (!msg.matchesIdentity(messageId) || msg.role != MessageRole.ASSISTANT) return@map msg
                 val updatedCalls = msg.toolCalls.map { call ->
                     if (call.id == outputRisk.toolCallId) {
                         call.copy(
@@ -3066,7 +3085,7 @@ class ChatHandler {
 
         _messages.update { messages ->
             messages.map { msg ->
-                if (msg.id == messageId) {
+                if (msg.matchesIdentity(messageId)) {
                     msg.copy(isStreaming = false, isThinkingStreaming = false)
                 } else {
                     msg
@@ -3095,7 +3114,7 @@ class ChatHandler {
     fun markStopped(messageId: String) {
         _messages.update { messages ->
             messages.map { msg ->
-                if (msg.id == messageId && "Stopped" !in msg.badges) {
+                if (msg.matchesIdentity(messageId) && "Stopped" !in msg.badges) {
                     msg.copy(badges = msg.badges + "Stopped")
                 } else {
                     msg
@@ -3122,7 +3141,7 @@ class ChatHandler {
     fun markError(messageId: String) {
         _messages.update { messages ->
             messages.map { msg ->
-                if (msg.id == messageId && "Error" !in msg.badges) {
+                if (msg.matchesIdentity(messageId) && "Error" !in msg.badges) {
                     msg.copy(badges = msg.badges + "Error", clientOnly = true)
                 } else {
                     msg
@@ -3148,7 +3167,7 @@ class ChatHandler {
         _messages.update { messages ->
             messages
                 .filterNot { msg ->
-                        msg.id == messageId &&
+                        msg.matchesIdentity(messageId) &&
                         msg.role == MessageRole.ASSISTANT &&
                         msg.toolCalls.isEmpty() &&
                         msg.backgroundTask == null &&
@@ -3156,7 +3175,7 @@ class ChatHandler {
                         (msg.content.isBlank() || isIntentionalSilenceMarker(msg.content))
                 }
                 .map { msg ->
-                    if (msg.id == messageId || msg.isStreaming) {
+                    if (msg.matchesIdentity(messageId) || msg.isStreaming) {
                         msg.copy(isStreaming = false, isThinkingStreaming = false)
                     } else {
                         msg
@@ -3220,10 +3239,12 @@ class ChatHandler {
     fun onThinkingDelta(messageId: String, delta: String) {
         _isStreaming.value = true
         _messages.update { messages ->
-            val existing = messages.findLast { it.id == messageId && it.role == MessageRole.ASSISTANT }
+            val existing = messages.findLast {
+                it.matchesIdentity(messageId) && it.role == MessageRole.ASSISTANT
+            }
             if (existing != null) {
                 messages.map { msg ->
-                    if (msg.id == messageId) {
+                    if (msg.matchesIdentity(messageId)) {
                         msg.copy(
                             thinkingContent = msg.thinkingContent + delta,
                             isThinkingStreaming = true
@@ -3248,7 +3269,7 @@ class ChatHandler {
     fun onUsageReceived(messageId: String, inputTokens: Int?, outputTokens: Int?, totalTokens: Int?, cost: Double?) {
         _messages.update { messages ->
             messages.map { msg ->
-                if (msg.id == messageId) {
+                if (msg.matchesIdentity(messageId)) {
                     msg.copy(
                         inputTokens = inputTokens,
                         outputTokens = outputTokens,
@@ -3281,7 +3302,7 @@ class ChatHandler {
         )
         _messages.update { messages ->
             messages.map { msg ->
-                if (msg.id != messageId) return@map msg
+                if (!msg.matchesIdentity(messageId)) return@map msg
                 val alreadyDispatched = msg.cardDispatches.any {
                     it.cardKey == cardKey && it.actionValue == actionValue
                 }

app/src/main/kotlin/com/hermesandroid/relay/network/upstream/RenderedMessageState.kt

@@ -0,0 +1,52 @@
+package com.hermesandroid.relay.network.upstream
+
+import com.hermesandroid.relay.data.ChatMessage
+import kotlinx.coroutines.flow.MutableStateFlow
+import kotlinx.coroutines.flow.StateFlow
+import kotlinx.coroutines.flow.asStateFlow
+import kotlinx.coroutines.flow.update
+
+/**
+ * The publication boundary for Chat and Voice transcript rows.
+ *
+ * [ChatMessage.id] may change when the server adopts a client-created row,
+ * while [ChatMessage.uiKey] is that row's stable render identity. Every value
+ * emitted from this state therefore has exactly one row per render identity.
+ */
+internal class RenderedMessageState(initialValue: List<ChatMessage>) {
+    private val mutable = MutableStateFlow(normalizeRenderedMessages(initialValue))
+    val flow: StateFlow<List<ChatMessage>> = mutable.asStateFlow()
+
+    var value: List<ChatMessage>
+        get() = mutable.value
+        set(value) {
+            mutable.value = normalizeRenderedMessages(value)
+        }
+
+    fun update(transform: (List<ChatMessage>) -> List<ChatMessage>) {
+        mutable.update { current -> normalizeRenderedMessages(transform(current)) }
+    }
+}
+
+/**
+ * Coalesce aliases before they can escape to keyed Compose consumers.
+ *
+ * The first slot owns transcript position and the latest snapshot owns row
+ * state. This is the same ordering contract used for replayed server history.
+ */
+internal fun normalizeRenderedMessages(messages: List<ChatMessage>): List<ChatMessage> {
+    if (messages.size < 2) return messages
+
+    val firstSlotByUiKey = HashMap<String, Int>()
+    val normalized = ArrayList<ChatMessage>(messages.size)
+    for (message in messages) {
+        val existingSlot = firstSlotByUiKey[message.uiKey]
+        if (existingSlot == null) {
+            firstSlotByUiKey[message.uiKey] = normalized.size
+            normalized += message
+        } else {
+            normalized[existingSlot] = message
+        }
+    }
+    return if (normalized.size == messages.size) messages else normalized
+}

app/src/main/kotlin/com/hermesandroid/relay/reliability/ReliabilityCenter.kt

@@ -0,0 +1,123 @@
+package com.hermesandroid.relay.reliability
+
+import android.content.Context
+import android.os.Build
+import com.hermesandroid.relay.BuildConfig
+import java.io.PrintWriter
+import java.io.StringWriter
+import java.time.Instant
+import java.util.concurrent.Executors
+
+/**
+ * Android boundary for the local reliability store. Nothing in this object has
+ * a network path; writes stay in app-private storage until a user explicitly
+ * reviews and shares text through the UI.
+ */
+object ReliabilityCenter {
+    private val writer = Executors.newSingleThreadExecutor { runnable ->
+        Thread(runnable, "hermes-reliability-writer").apply { isDaemon = true }
+    }
+    private val appSessionId = ReliabilityReport.newId("app")
+
+    @Volatile
+    private var store: ReliabilityStore? = null
+
+    fun initialize(context: Context) {
+        if (store != null) return
+        synchronized(this) {
+            if (store == null) {
+                store = ReliabilityStore(
+                    java.io.File(context.applicationContext.filesDir, "reliability/reports-v1.json"),
+                )
+            }
+        }
+    }
+
+    fun recordFatal(
+        context: Context,
+        throwable: Throwable,
+        threadName: String,
+        timeIso: String = Instant.now().toString(),
+    ): ReliabilityReport {
+        initialize(context)
+        val summary = buildString {
+            append(throwable.javaClass.simpleName.ifBlank { "Unexpected crash" })
+            throwable.message?.takeIf { it.isNotBlank() }?.let { append(": ").append(it) }
+        }
+        val report = ReliabilityReport(
+            reportId = ReliabilityReport.newId(),
+            appSessionId = appSessionId,
+            timeIso = timeIso,
+            kind = ReliabilityKind.FatalCrash,
+            owner = ReliabilityOwner.Android,
+            severity = ReliabilitySeverity.Fatal,
+            summary = summary,
+            recovery = "The app restarted. Work already running on Hermes may still be active.",
+            reportRecommended = true,
+            technicalDetail = "Thread: $threadName\n${stackTraceText(throwable)}",
+            environment = environment(),
+            pendingReview = true,
+        )
+        // Fatal capture must complete before the platform terminates the process.
+        store?.append(report)
+        return report
+    }
+
+    fun recordHandled(
+        title: String,
+        detail: String?,
+        throwable: Throwable,
+        context: String?,
+        routeRole: String? = null,
+    ) {
+        val target = store ?: return
+        val classification = ReliabilityClassifier.classify(throwable, context)
+        if (!classification.shouldPersist) return
+        val report = ReliabilityReport(
+            reportId = ReliabilityReport.newId(),
+            appSessionId = appSessionId,
+            timeIso = Instant.now().toString(),
+            kind = classification.kind,
+            owner = classification.owner,
+            severity = ReliabilitySeverity.Error,
+            summary = title,
+            recovery = detail ?: "The failure was handled; retry or review Diagnostics if it continues.",
+            reportRecommended = classification.reportRecommended,
+            technicalDetail = stackTraceText(throwable),
+            routeRole = routeRole,
+            environment = environment(),
+        )
+        writer.execute { runCatching { target.append(report) } }
+    }
+
+    fun reports(context: Context): List<ReliabilityReport> {
+        initialize(context)
+        return store?.readAll().orEmpty()
+    }
+
+    fun pendingCrash(context: Context): ReliabilityReport? =
+        reports(context).lastOrNull { it.kind == ReliabilityKind.FatalCrash && it.pendingReview }
+
+    fun markReviewed(context: Context, reportId: String) {
+        initialize(context)
+        store?.markReviewed(reportId)
+    }
+
+    fun import(context: Context, report: ReliabilityReport) {
+        initialize(context)
+        store?.append(report)
+    }
+
+    fun environment(): ReliabilityEnvironment = ReliabilityEnvironment(
+        versionName = BuildConfig.VERSION_NAME,
+        versionCode = BuildConfig.VERSION_CODE,
+        flavor = BuildConfig.FLAVOR,
+        manufacturer = Build.MANUFACTURER.orEmpty().ifBlank { "?" },
+        model = Build.MODEL.orEmpty().ifBlank { "?" },
+        androidRelease = Build.VERSION.RELEASE.orEmpty().ifBlank { "?" },
+        sdkInt = Build.VERSION.SDK_INT,
+    )
+
+    private fun stackTraceText(throwable: Throwable): String =
+        StringWriter().also { throwable.printStackTrace(PrintWriter(it)) }.toString().trim()
+}

app/src/main/kotlin/com/hermesandroid/relay/reliability/ReliabilityReport.kt

@@ -0,0 +1,361 @@
+package com.hermesandroid.relay.reliability
+
+import kotlinx.serialization.Serializable
+import kotlinx.serialization.decodeFromString
+import kotlinx.serialization.encodeToString
+import kotlinx.serialization.json.Json
+import java.io.File
+import java.time.Instant
+import java.util.UUID
+import java.util.concurrent.CancellationException
+
+const val RELIABILITY_SCHEMA_VERSION = 1
+
+@Serializable
+enum class ReliabilityKind {
+    FatalCrash,
+    AnrSignal,
+    RecoverableProductError,
+    Connectivity,
+    Authentication,
+    RateLimit,
+    ServiceUnavailable,
+    ExpectedCancellation,
+    UserDenial,
+}
+
+@Serializable
+enum class ReliabilityOwner(val label: String) {
+    Android("Android"),
+    Dashboard("Dashboard"),
+    Api("API"),
+    Relay("Relay"),
+    UpstreamGateway("Upstream Gateway"),
+    Voice("Voice"),
+    Unknown("Unknown"),
+}
+
+@Serializable
+enum class ReliabilitySeverity { Info, Warning, Error, Fatal }
+
+@Serializable
+data class ReliabilityEnvironment(
+    val versionName: String,
+    val versionCode: Int,
+    val flavor: String,
+    val manufacturer: String,
+    val model: String,
+    val androidRelease: String,
+    val sdkInt: Int,
+)
+
+/**
+ * Allowlisted local reliability record. There are deliberately no fields for
+ * prompts, messages, profile names, product session IDs, URLs, media, or paths.
+ */
+@Serializable
+data class ReliabilityReport(
+    val schemaVersion: Int = RELIABILITY_SCHEMA_VERSION,
+    val reportId: String,
+    val appSessionId: String,
+    val timeIso: String,
+    val kind: ReliabilityKind,
+    val owner: ReliabilityOwner,
+    val severity: ReliabilitySeverity,
+    val summary: String,
+    val recovery: String,
+    val reportRecommended: Boolean,
+    val technicalDetail: String? = null,
+    val routeRole: String? = null,
+    val environment: ReliabilityEnvironment,
+    val pendingReview: Boolean = false,
+) {
+    fun shortTitle(): String = summary.lineSequence().firstOrNull().orEmpty().ifBlank {
+        kind.name
+    }.take(90)
+
+    fun versionLine(): String =
+        "${environment.versionName} (code ${environment.versionCode}) ${environment.flavor}"
+
+    fun environmentBlock(): String = buildString {
+        appendLine("- Hermes-Relay version/tag: ${environment.versionName} (code ${environment.versionCode})")
+        appendLine(
+            "- Install surface: " +
+                if (environment.flavor.equals("sideload", ignoreCase = true)) "sideload APK" else "Google Play",
+        )
+        appendLine(
+            "- Android device and OS: ${environment.manufacturer} ${environment.model} — " +
+                "Android ${environment.androidRelease} (SDK ${environment.sdkInt})",
+        )
+        append("- Connection mode: ${routeRole ?: "unknown"}")
+    }
+
+    /** Exact local review/copy/share payload. Redaction is repeated for legacy defense in depth. */
+    fun toPlainText(): String = ReliabilityRedactor.redact(
+        buildString {
+            appendLine("Hermes-Relay support information")
+            appendLine("Report:  $reportId")
+            appendLine("Session: $appSessionId")
+            appendLine("Time:    $timeIso")
+            appendLine("Type:    ${kind.name}")
+            appendLine("Owner:   ${owner.label}")
+            appendLine("App:     ${versionLine()}")
+            appendLine(
+                "Device:  ${environment.manufacturer} ${environment.model} — " +
+                    "Android ${environment.androidRelease} (SDK ${environment.sdkInt})",
+            )
+            routeRole?.let { appendLine("Route:   $it") }
+            appendLine()
+            appendLine("What happened: $summary")
+            appendLine("Recovery:      $recovery")
+            technicalDetail?.let {
+                appendLine()
+                appendLine("Technical detail (redacted)")
+                append(it)
+            }
+        },
+    )
+
+    companion object {
+        fun newId(prefix: String = "rpt"): String =
+            "$prefix-${UUID.randomUUID().toString().replace("-", "").take(16)}"
+    }
+}
+
+/** Old `files/crash/last-crash.json` shape, retained only for one-way migration. */
+@Serializable
+data class LegacyCrashSnapshot(
+    val timeIso: String,
+    val versionName: String,
+    val versionCode: Int,
+    val flavor: String,
+    val manufacturer: String,
+    val model: String,
+    val androidRelease: String,
+    val sdkInt: Int,
+    val threadName: String,
+    val exceptionSummary: String,
+    val stackTrace: String,
+)
+
+fun migrateLegacyCrash(
+    old: LegacyCrashSnapshot,
+    reportId: String = ReliabilityReport.newId(),
+    appSessionId: String = ReliabilityReport.newId("legacy"),
+): ReliabilityReport = ReliabilityReport(
+    reportId = reportId,
+    appSessionId = appSessionId,
+    timeIso = runCatching { Instant.parse(old.timeIso).toString() }.getOrDefault(old.timeIso),
+    kind = ReliabilityKind.FatalCrash,
+    owner = ReliabilityOwner.Android,
+    severity = ReliabilitySeverity.Fatal,
+    summary = ReliabilityRedactor.redact(old.exceptionSummary, 240),
+    recovery = "The app restarted. Work already running on Hermes may still be active.",
+    reportRecommended = true,
+    technicalDetail = ReliabilityRedactor.redact("Thread: ${old.threadName}\n${old.stackTrace}"),
+    environment = ReliabilityEnvironment(
+        old.versionName, old.versionCode, old.flavor, old.manufacturer, old.model,
+        old.androidRelease, old.sdkInt,
+    ),
+    pendingReview = true,
+)
+
+data class ReliabilityClassification(
+    val kind: ReliabilityKind,
+    val owner: ReliabilityOwner,
+    val reportRecommended: Boolean,
+    val shouldPersist: Boolean,
+)
+
+object ReliabilityClassifier {
+    fun classify(throwable: Throwable, context: String? = null): ReliabilityClassification {
+        val message = throwable.message.orEmpty().lowercase()
+        val owner = ownerForContext(context)
+        return when {
+            throwable is CancellationException -> ReliabilityClassification(
+                ReliabilityKind.ExpectedCancellation, owner, reportRecommended = false, shouldPersist = false,
+            )
+            throwable is SecurityException && ("denied" in message || "permission" in message) ->
+                ReliabilityClassification(
+                    ReliabilityKind.UserDenial, ReliabilityOwner.Android,
+                    reportRecommended = false, shouldPersist = false,
+                )
+            "429" in message || "rate limit" in message || "too many requests" in message ->
+                ReliabilityClassification(
+                    ReliabilityKind.RateLimit, owner, reportRecommended = false, shouldPersist = true,
+                )
+            "401" in message || "403" in message || "unauthorized" in message || "forbidden" in message ->
+                ReliabilityClassification(
+                    ReliabilityKind.Authentication, owner, reportRecommended = false, shouldPersist = true,
+                )
+            throwable is java.net.UnknownHostException ||
+                throwable is java.net.ConnectException ||
+                throwable is java.net.SocketTimeoutException ||
+                "timeout" in message -> ReliabilityClassification(
+                ReliabilityKind.Connectivity, owner, reportRecommended = false, shouldPersist = true,
+            )
+            "503" in message || "service unavailable" in message || "gateway_draining" in message ->
+                ReliabilityClassification(
+                    ReliabilityKind.ServiceUnavailable, owner,
+                    reportRecommended = false, shouldPersist = true,
+                )
+            else -> ReliabilityClassification(
+                ReliabilityKind.RecoverableProductError, owner,
+                reportRecommended = true, shouldPersist = true,
+            )
+        }
+    }
+
+    fun ownerForContext(context: String?): ReliabilityOwner = when (context?.lowercase()) {
+        "dashboard", "manage", "dashboard_auth" -> ReliabilityOwner.Dashboard
+        "gateway", "gateway_chat", "upstream_gateway" -> ReliabilityOwner.UpstreamGateway
+        "transcribe", "synthesize", "voice_config", "record", "voice" -> ReliabilityOwner.Voice
+        "pair", "save_and_test", "media_fetch", "relay" -> ReliabilityOwner.Relay
+        "send_message", "load_sessions", "create_session", "api" -> ReliabilityOwner.Api
+        "android", "permission", "ui" -> ReliabilityOwner.Android
+        else -> ReliabilityOwner.Unknown
+    }
+}
+
+/** Local, deterministic redaction. It runs before persistence and again before export. */
+object ReliabilityRedactor {
+    const val MAX_TECHNICAL_LENGTH = 8_000
+    private const val HIDDEN = "[hidden]"
+
+    private val secretAssignment = Regex(
+        """(?i)\b(authorization|bearer|cookie|set-cookie|token|api[_-]?key|session[_-]?token|pairing[_-]?code|password|secret|oauth[_-]?code)\s*[:=]\s*((?:Bearer\s+)?[^\s,;]+)""",
+    )
+    private val sensitiveHeader = Regex("""(?im)^\s*(authorization|cookie|set-cookie)\s*:\s*.+$""")
+    private val standaloneBearer = Regex("""(?i)\bBearer\s+[A-Za-z0-9._~+/=-]+""")
+    private val sensitivePayload = Regex(
+        """(?i)\b(prompt|message|content|transcript|reasoning|tool[_-]?(args|result)|profile[_-]?name)\s*[:=]\s*([^\r\n]+)""",
+    )
+    private val url = Regex("""(?i)\b(?:https?|wss?)://[^\s)\]}>,]+""")
+    private val ipv4 = Regex("""(?<![\w.])(?:\d{1,3}\.){3}\d{1,3}(?::\d+)?(?![\w.])""")
+    private val uuid = Regex("""(?i)\b[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}\b""")
+    private val email = Regex("""(?i)\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}\b""")
+    private val namedHost = Regex("""(?i)\b(host|hostname)\s*[:=]\s*[^\s,;]+""")
+    private val unresolvedHost = Regex("""(?i)(?:resolve|resolved|host)\s+[\"']([^\"']+)[\"']""")
+    private val windowsPath = Regex("""(?i)\b[A-Z]:\\(?:[^\s\\]+\\)+[^\s]+""")
+    private val unixPrivatePath = Regex("""(?i)(?:/home/|/Users/|/data/user/\d+/|/sdcard/)[^\s]+""")
+
+    fun redact(value: String, maxLength: Int = MAX_TECHNICAL_LENGTH): String {
+        var result = value
+        result = sensitiveHeader.replace(result) { "${it.groupValues[1]}: $HIDDEN" }
+        result = secretAssignment.replace(result) { "${it.groupValues[1]}=$HIDDEN" }
+        result = standaloneBearer.replace(result, "Bearer $HIDDEN")
+        result = sensitivePayload.replace(result) { "${it.groupValues[1]}=$HIDDEN" }
+        result = url.replace(result, "[url hidden]")
+        result = ipv4.replace(result, "[host hidden]")
+        result = uuid.replace(result, "[id hidden]")
+        result = email.replace(result, "[email hidden]")
+        result = namedHost.replace(result) { "${it.groupValues[1]}=$HIDDEN" }
+        result = unresolvedHost.replace(result, "host \"$HIDDEN\"")
+        result = windowsPath.replace(result, "[path hidden]")
+        result = unixPrivatePath.replace(result, "[path hidden]")
+        return if (result.length > maxLength) {
+            result.take(maxLength) + "\n… (truncated)"
+        } else {
+            result
+        }
+    }
+}
+
+@Serializable
+private data class ReliabilityEnvelope(
+    val schemaVersion: Int = RELIABILITY_SCHEMA_VERSION,
+    val reports: List<ReliabilityReport> = emptyList(),
+)
+
+/** Pure file store so retention, bounds, and migration behavior are JVM-testable. */
+class ReliabilityStore(
+    private val file: File,
+    private val maxReports: Int = 20,
+    private val retentionDays: Long = 14,
+) {
+    private val json = Json { encodeDefaults = true; ignoreUnknownKeys = true }
+    private val lock = Any()
+
+    fun readAll(now: Instant = Instant.now()): List<ReliabilityReport> = synchronized(lock) {
+        val decoded = decode()
+        val retained = prune(decoded, now)
+        if (retained != decoded) write(retained)
+        retained
+    }
+
+    fun append(report: ReliabilityReport, now: Instant = Instant.now()) = synchronized(lock) {
+        write(prune(decode() + sanitize(report), now))
+    }
+
+    fun markReviewed(reportId: String, now: Instant = Instant.now()) = synchronized(lock) {
+        write(
+            prune(
+                decode().map { if (it.reportId == reportId) it.copy(pendingReview = false) else it },
+                now,
+            ),
+        )
+    }
+
+    private fun sanitize(report: ReliabilityReport): ReliabilityReport = report.copy(
+        summary = ReliabilityRedactor.redact(report.summary, 240),
+        recovery = ReliabilityRedactor.redact(report.recovery, 240),
+        technicalDetail = report.technicalDetail?.let(ReliabilityRedactor::redact),
+        routeRole = report.routeRole?.let { ReliabilityRedactor.redact(it, 40) },
+    )
+
+    private fun prune(reports: List<ReliabilityReport>, now: Instant): List<ReliabilityReport> {
+        val cutoff = now.minusSeconds(retentionDays * 24 * 60 * 60)
+        return reports
+            .distinctBy { it.reportId }
+            .filter { report -> runCatching { Instant.parse(report.timeIso) >= cutoff }.getOrDefault(true) }
+            .sortedBy { it.timeIso }
+            .takeLast(maxReports.coerceAtLeast(1))
+    }
+
+    private fun decode(): List<ReliabilityReport> = runCatching {
+        if (!file.isFile) return emptyList()
+        json.decodeFromString<ReliabilityEnvelope>(file.readText()).reports
+    }.getOrDefault(emptyList())
+
+    private fun write(reports: List<ReliabilityReport>) {
+        file.parentFile?.mkdirs()
+        val temp = File(file.parentFile, "${file.name}.tmp")
+        temp.writeText(json.encodeToString(ReliabilityEnvelope(reports = reports)))
+        runCatching {
+            java.nio.file.Files.move(
+                temp.toPath(),
+                file.toPath(),
+                java.nio.file.StandardCopyOption.ATOMIC_MOVE,
+                java.nio.file.StandardCopyOption.REPLACE_EXISTING,
+            )
+        }.recoverCatching {
+            java.nio.file.Files.move(
+                temp.toPath(),
+                file.toPath(),
+                java.nio.file.StandardCopyOption.REPLACE_EXISTING,
+            )
+        }.getOrThrow()
+    }
+}
+
+object SupportBundleBuilder {
+    const val MAX_REPORTS = 10
+
+    fun build(reports: List<ReliabilityReport>): String {
+        val selected = reports.sortedByDescending { it.timeIso }.take(MAX_REPORTS)
+        return ReliabilityRedactor.redact(
+            buildString {
+                appendLine("Hermes-Relay support bundle")
+                appendLine("Local-only export · review before sharing")
+                appendLine("Reports: ${selected.size}")
+                selected.forEachIndexed { index, report ->
+                    appendLine()
+                    appendLine("===== Report ${index + 1} =====")
+                    append(report.toPlainText())
+                    appendLine()
+                }
+            },
+            maxLength = 64_000,
+        )
+    }
+}

app/src/main/kotlin/com/hermesandroid/relay/ui/components/CrashReportDialog.kt

@@ -46,7 +46,7 @@ import androidx.compose.ui.unit.sp
 import androidx.compose.ui.window.Dialog
 import androidx.compose.ui.window.DialogProperties
 import com.hermesandroid.relay.R
-import com.hermesandroid.relay.util.CrashReport
+import com.hermesandroid.relay.reliability.ReliabilityReport
 import com.hermesandroid.relay.util.CrashReporter
 import com.hermesandroid.relay.util.IssueReport
 import kotlinx.coroutines.Dispatchers
@@ -57,16 +57,16 @@ import kotlinx.coroutines.withContext
  * crashed). Render it inside the app theme so the dialog picks up Material
  * colors — see RelayApp.
  *
- * Peeks the report on first composition (does NOT delete on read) and clears it
- * only when the user acknowledges it (Dismiss/Report). A report the user merely
+ * Peeks the report on first composition (does not mark it reviewed on read) and
+ * acknowledges it only on Dismiss/Report. A report the user merely
  * glanced at — or never reached because the app was backgrounded — therefore
- * survives relaunches instead of being lost after one view; once acknowledged
- * it's deleted and won't reappear.
+ * survives relaunches instead of being lost after one view. Once acknowledged,
+ * it remains in bounded Diagnostics history but does not interrupt startup again.
  */
 @Composable
 fun CrashReportGate() {
     val context = LocalContext.current
-    var report by remember { mutableStateOf<CrashReport?>(null) }
+    var report by remember { mutableStateOf<ReliabilityReport?>(null) }
     var checked by remember { mutableStateOf(false) }
 
     LaunchedEffect(Unit) {
@@ -79,19 +79,26 @@ fun CrashReportGate() {
     CrashReportDialog(
         report = pending,
         onDismiss = {
-            // Acknowledged (Dismiss/Report) → delete so it won't reappear.
+            // Acknowledged (Dismiss/Report) → retain as reviewed history without showing again.
             // Copy does NOT route through here, so the report stays available
             // across relaunches until the user actually dismisses or reports it.
-            CrashReporter.clearPending(context)
+            CrashReporter.clearPending(context, pending.reportId)
             report = null
         },
     )
 }
 
 @Composable
-private fun CrashReportDialog(report: CrashReport, onDismiss: () -> Unit) {
+private fun CrashReportDialog(report: ReliabilityReport, onDismiss: () -> Unit) {
     val context = LocalContext.current
     val reportText = remember(report) { report.toPlainText() }
+    var showDetails by remember(report.reportId) { mutableStateOf(false) }
+    val copiedMessage = stringResource(R.string.crash_toast_copied)
+    val noShareMessage = stringResource(R.string.crash_toast_no_share)
+    val shareTitle = stringResource(R.string.crash_share_title)
+    val reportSubject = stringResource(R.string.crash_share_subject, report.shortTitle())
+    val openedMessage = stringResource(R.string.crash_toast_opened)
+    val noBrowserMessage = stringResource(R.string.crash_toast_no_browser)
 
     Dialog(
         onDismissRequest = onDismiss,
@@ -126,25 +133,34 @@ private fun CrashReportDialog(report: CrashReport, onDismiss: () -> Unit) {
                     color = MaterialTheme.colorScheme.onSurfaceVariant,
                 )
 
-                Spacer(Modifier.height(14.dp))
-                Box(
-                    modifier = Modifier
-                        .fillMaxWidth()
-                        .heightIn(min = 120.dp, max = 300.dp)
-                        .clip(RoundedCornerShape(12.dp))
-                        .background(MaterialTheme.colorScheme.surfaceVariant.copy(alpha = 0.45f)),
-                ) {
-                    SelectionContainer {
-                        Text(
-                            text = reportText,
-                            fontFamily = FontFamily.Monospace,
-                            fontSize = 11.sp,
-                            lineHeight = 15.sp,
-                            color = MaterialTheme.colorScheme.onSurfaceVariant,
-                            modifier = Modifier
-                                .verticalScroll(rememberScrollState())
-                                .padding(12.dp),
-                        )
+                Text(
+                    text = stringResource(R.string.crash_privacy),
+                    style = MaterialTheme.typography.bodySmall,
+                    color = MaterialTheme.colorScheme.onSurfaceVariant,
+                    modifier = Modifier.padding(top = 6.dp),
+                )
+
+                if (showDetails) {
+                    Spacer(Modifier.height(14.dp))
+                    Box(
+                        modifier = Modifier
+                            .fillMaxWidth()
+                            .heightIn(min = 120.dp, max = 300.dp)
+                            .clip(RoundedCornerShape(12.dp))
+                            .background(MaterialTheme.colorScheme.surfaceVariant.copy(alpha = 0.45f)),
+                    ) {
+                        SelectionContainer {
+                            Text(
+                                text = reportText,
+                                fontFamily = FontFamily.Monospace,
+                                fontSize = 11.sp,
+                                lineHeight = 15.sp,
+                                color = MaterialTheme.colorScheme.onSurfaceVariant,
+                                modifier = Modifier
+                                    .verticalScroll(rememberScrollState())
+                                    .padding(12.dp),
+                            )
+                        }
                     }
                 }
 
@@ -157,45 +173,45 @@ private fun CrashReportDialog(report: CrashReport, onDismiss: () -> Unit) {
                     verticalArrangement = Arrangement.spacedBy(4.dp),
                 ) {
                     TextButton(onClick = onDismiss) { Text(stringResource(R.string.common_dismiss)) }
-                    OutlinedButton(
-                        onClick = {
-                            IssueReport.copyToClipboard(context, reportText)
-                            toast(context, "Crash report copied")
-                        },
-                    ) { Text(stringResource(R.string.common_copy)) }
+                    if (!showDetails) {
+                        Button(onClick = { showDetails = true }) {
+                            Text(stringResource(R.string.crash_review))
+                        }
+                    } else {
+                        OutlinedButton(
+                            onClick = {
+                                IssueReport.copyToClipboard(context, reportText)
+                                toast(context, copiedMessage)
+                            },
+                        ) { Text(stringResource(R.string.common_copy)) }
                     // Universal, GitHub-free path: hand the full report to the
                     // system share sheet (email, chat apps, notes, Drive…). The
                     // user picks the destination, so nothing leaves the device
                     // until they choose to send it — same privacy posture as Copy.
-                    OutlinedButton(
-                        onClick = {
-                            val shared = IssueReport.share(
-                                context,
-                                "Hermes-Relay crash report — ${report.shortTitle()}",
-                                reportText,
-                                chooserTitle = "Share crash report",
-                            )
-                            if (!shared) {
+                        OutlinedButton(
+                            onClick = {
+                                val shared = IssueReport.share(
+                                    context,
+                                    reportSubject,
+                                    reportText,
+                                    chooserTitle = shareTitle,
+                                )
+                                if (!shared) {
+                                    IssueReport.copyToClipboard(context, reportText)
+                                    toast(context, noShareMessage)
+                                }
+                                onDismiss()
+                            },
+                        ) { Text(stringResource(R.string.common_share)) }
+                        Button(
+                            onClick = {
                                 IssueReport.copyToClipboard(context, reportText)
-                                toast(context, "Report copied — no app found to share to")
-                            }
-                            onDismiss()
-                        },
-                    ) { Text(stringResource(R.string.common_share)) }
-                    Button(
-                        onClick = {
-                            // Copy the FULL report first; the URL only carries the
-                            // head of the trace, so the user can paste the rest.
-                            IssueReport.copyToClipboard(context, reportText)
-                            val opened = IssueReport.openUrl(context, CrashReporter.buildGithubIssueUrl(report))
-                            toast(
-                                context,
-                                if (opened) "Full report copied — paste into the issue if it's truncated"
-                                else "Report copied — no browser found to open GitHub",
-                            )
-                            onDismiss()
-                        },
-                    ) { Text(stringResource(R.string.common_report)) }
+                                val opened = IssueReport.openUrl(context, CrashReporter.buildGithubIssueUrl(report))
+                                toast(context, if (opened) openedMessage else noBrowserMessage)
+                                onDismiss()
+                            },
+                        ) { Text(stringResource(R.string.common_report)) }
+                    }
                 }
             }
         }

app/src/main/kotlin/com/hermesandroid/relay/ui/components/SupportBundleDialog.kt

@@ -0,0 +1,130 @@
+package com.hermesandroid.relay.ui.components
+
+import android.widget.Toast
+import androidx.compose.foundation.background
+import androidx.compose.foundation.layout.Arrangement
+import androidx.compose.foundation.layout.Box
+import androidx.compose.foundation.layout.Column
+import androidx.compose.foundation.layout.FlowRow
+import androidx.compose.foundation.layout.Spacer
+import androidx.compose.foundation.layout.fillMaxWidth
+import androidx.compose.foundation.layout.height
+import androidx.compose.foundation.layout.heightIn
+import androidx.compose.foundation.layout.padding
+import androidx.compose.foundation.rememberScrollState
+import androidx.compose.foundation.shape.RoundedCornerShape
+import androidx.compose.foundation.text.selection.SelectionContainer
+import androidx.compose.foundation.verticalScroll
+import androidx.compose.material3.Button
+import androidx.compose.material3.MaterialTheme
+import androidx.compose.material3.OutlinedButton
+import androidx.compose.material3.Surface
+import androidx.compose.material3.Text
+import androidx.compose.material3.TextButton
+import androidx.compose.runtime.Composable
+import androidx.compose.ui.Alignment
+import androidx.compose.ui.Modifier
+import androidx.compose.ui.platform.LocalContext
+import androidx.compose.ui.res.stringResource
+import androidx.compose.ui.text.font.FontFamily
+import androidx.compose.ui.unit.dp
+import androidx.compose.ui.unit.sp
+import androidx.compose.ui.window.Dialog
+import androidx.compose.ui.window.DialogProperties
+import com.hermesandroid.relay.R
+import com.hermesandroid.relay.reliability.ReliabilityReport
+import com.hermesandroid.relay.reliability.SupportBundleBuilder
+import com.hermesandroid.relay.util.IssueReport
+
+data class SupportReviewState(
+    val reportCount: Int,
+    val text: String,
+    val shareEnabled: Boolean,
+)
+
+internal fun buildSupportReviewState(reports: List<ReliabilityReport>): SupportReviewState =
+    SupportReviewState(
+        reportCount = reports.takeLast(SupportBundleBuilder.MAX_REPORTS).size,
+        text = SupportBundleBuilder.build(reports),
+        shareEnabled = reports.isNotEmpty(),
+    )
+
+/** Exact review surface for the local text handed to clipboard/share. */
+@Composable
+fun SupportBundleDialog(state: SupportReviewState, onDismiss: () -> Unit) {
+    val context = LocalContext.current
+    val copied = stringResource(R.string.support_bundle_copied)
+    val noShare = stringResource(R.string.support_bundle_no_share)
+    val chooser = stringResource(R.string.support_bundle_share_title)
+
+    Dialog(
+        onDismissRequest = onDismiss,
+        properties = DialogProperties(usePlatformDefaultWidth = false),
+    ) {
+        Surface(
+            modifier = Modifier.fillMaxWidth(0.94f),
+            shape = RoundedCornerShape(24.dp),
+            tonalElevation = 6.dp,
+        ) {
+            Column(modifier = Modifier.padding(20.dp)) {
+                Text(stringResource(R.string.support_bundle_title), style = MaterialTheme.typography.titleMedium)
+                Spacer(Modifier.height(6.dp))
+                Text(
+                    stringResource(R.string.support_bundle_privacy, state.reportCount),
+                    style = MaterialTheme.typography.bodySmall,
+                    color = MaterialTheme.colorScheme.onSurfaceVariant,
+                )
+                Spacer(Modifier.height(14.dp))
+                Box(
+                    modifier = Modifier
+                        .fillMaxWidth()
+                        .heightIn(min = 160.dp, max = 420.dp)
+                        .background(
+                            MaterialTheme.colorScheme.surfaceVariant.copy(alpha = 0.45f),
+                            RoundedCornerShape(12.dp),
+                        ),
+                ) {
+                    SelectionContainer {
+                        Text(
+                            text = state.text,
+                            fontFamily = FontFamily.Monospace,
+                            fontSize = 11.sp,
+                            lineHeight = 15.sp,
+                            modifier = Modifier.verticalScroll(rememberScrollState()).padding(12.dp),
+                        )
+                    }
+                }
+                Spacer(Modifier.height(18.dp))
+                FlowRow(
+                    modifier = Modifier.fillMaxWidth(),
+                    horizontalArrangement = Arrangement.spacedBy(8.dp, Alignment.End),
+                    verticalArrangement = Arrangement.spacedBy(4.dp),
+                ) {
+                    TextButton(onClick = onDismiss) { Text(stringResource(R.string.common_close)) }
+                    OutlinedButton(
+                        enabled = state.shareEnabled,
+                        onClick = {
+                            IssueReport.copyToClipboard(context, state.text)
+                            Toast.makeText(context, copied, Toast.LENGTH_LONG).show()
+                        },
+                    ) { Text(stringResource(R.string.common_copy)) }
+                    Button(
+                        enabled = state.shareEnabled,
+                        onClick = {
+                            if (!IssueReport.share(
+                                    context,
+                                    subject = chooser,
+                                    text = state.text,
+                                    chooserTitle = chooser,
+                                )
+                            ) {
+                                IssueReport.copyToClipboard(context, state.text)
+                                Toast.makeText(context, noShare, Toast.LENGTH_LONG).show()
+                            }
+                        },
+                    ) { Text(stringResource(R.string.common_share)) }
+                }
+            }
+        }
+    }
+}

app/src/main/kotlin/com/hermesandroid/relay/ui/components/VoiceModeOverlay.kt

@@ -427,7 +427,7 @@ fun VoiceModeOverlay(
                                 )
                             }
                             if (pendingTranscriptText != null) {
-                                item(key = "pending-voice-transcript") {
+                                item(key = "aux:pending-voice-transcript") {
                                     CompactTranscriptRow(
                                         message = ChatMessage(
                                             id = "pending-voice-transcript",
@@ -741,7 +741,8 @@ internal fun pendingVoiceTranscriptText(
     return if (alreadyRendered) null else transcribed
 }
 
-internal fun voiceTranscriptItemKey(message: ChatMessage): String = message.uiKey
+/** Message rows and Voice-only auxiliary rows occupy disjoint key namespaces. */
+internal fun voiceTranscriptItemKey(message: ChatMessage): String = "message:${message.uiKey}"
 
 /**
  * Conversation-mode voice controls that live inside the chat composer.

app/src/main/kotlin/com/hermesandroid/relay/ui/screens/DiagnosticsScreen.kt

@@ -3,6 +3,7 @@ package com.hermesandroid.relay.ui.screens
 import androidx.compose.foundation.layout.Arrangement
 import androidx.compose.foundation.layout.Column
 import androidx.compose.foundation.layout.fillMaxSize
+import androidx.compose.foundation.layout.fillMaxWidth
 import androidx.compose.foundation.layout.padding
 import androidx.compose.foundation.rememberScrollState
 import androidx.compose.foundation.verticalScroll
@@ -10,6 +11,7 @@ import androidx.compose.material.icons.Icons
 import androidx.compose.material.icons.automirrored.filled.ArrowBack
 import androidx.compose.material.icons.filled.Refresh
 import androidx.compose.material3.CircularProgressIndicator
+import androidx.compose.material3.OutlinedButton
 import androidx.compose.material3.ExperimentalMaterial3Api
 import androidx.compose.material3.Icon
 import androidx.compose.material3.IconButton
@@ -24,6 +26,7 @@ import androidx.compose.runtime.getValue
 import androidx.compose.runtime.mutableStateOf
 import androidx.compose.runtime.remember
 import androidx.compose.runtime.setValue
+import androidx.compose.runtime.rememberCoroutineScope
 import androidx.compose.ui.Modifier
 import androidx.compose.ui.res.stringResource
 import androidx.compose.ui.unit.dp
@@ -42,6 +45,13 @@ import com.hermesandroid.relay.network.upstream.ServerCapabilities
 import com.hermesandroid.relay.ui.components.DiagnosticDetailDialog
 import com.hermesandroid.relay.ui.components.DiagnosticsLogPanel
 import com.hermesandroid.relay.ui.components.StatusCheckTimeline
+import com.hermesandroid.relay.ui.components.SupportBundleDialog
+import com.hermesandroid.relay.ui.components.SupportReviewState
+import com.hermesandroid.relay.ui.components.buildSupportReviewState
+import com.hermesandroid.relay.reliability.ReliabilityCenter
+import kotlinx.coroutines.Dispatchers
+import kotlinx.coroutines.launch
+import kotlinx.coroutines.withContext
 import com.hermesandroid.relay.viewmodel.ChatRuntimeStatus
 import com.hermesandroid.relay.viewmodel.ChatTransportPath
 import com.hermesandroid.relay.viewmodel.ChatTransportReadiness
@@ -118,6 +128,8 @@ fun DiagnosticsScreen(
 
     // Tapping a check backed by a concrete log entry opens its full detail.
     var selectedEntry by remember { mutableStateOf<DiagnosticLogEntry?>(null) }
+    var supportReview by remember { mutableStateOf<SupportReviewState?>(null) }
+    val scope = rememberCoroutineScope()
 
     Scaffold(
         topBar = {
@@ -232,6 +244,19 @@ fun DiagnosticsScreen(
                 },
             )
 
+            OutlinedButton(
+                onClick = {
+                    scope.launch {
+                        supportReview = withContext(Dispatchers.IO) {
+                            buildSupportReviewState(ReliabilityCenter.reports(context))
+                        }
+                    }
+                },
+                modifier = Modifier.fillMaxWidth(),
+            ) {
+                Text(stringResource(R.string.support_bundle_review))
+            }
+
             Text(
                 text = stringResource(R.string.diag_recent_diagnostics),
                 style = MaterialTheme.typography.titleMedium,
@@ -256,6 +281,9 @@ fun DiagnosticsScreen(
     selectedEntry?.let { entry ->
         DiagnosticDetailDialog(entry = entry, onDismiss = { selectedEntry = null })
     }
+    supportReview?.let { state ->
+        SupportBundleDialog(state = state, onDismiss = { supportReview = null })
+    }
 }
 
 // -----------------------------------------------------------------------------

app/src/main/kotlin/com/hermesandroid/relay/util/CrashReporter.kt

@@ -1,81 +1,43 @@
 package com.hermesandroid.relay.util
 
 import android.content.Context
-import android.os.Build
 import android.os.Process
 import android.util.Log
-import com.hermesandroid.relay.BuildConfig
-import kotlinx.serialization.Serializable
+import com.hermesandroid.relay.reliability.ReliabilityCenter
+import com.hermesandroid.relay.reliability.LegacyCrashSnapshot
+import com.hermesandroid.relay.reliability.ReliabilityRedactor
+import com.hermesandroid.relay.reliability.ReliabilityReport
+import com.hermesandroid.relay.reliability.migrateLegacyCrash
 import kotlinx.serialization.decodeFromString
-import kotlinx.serialization.encodeToString
 import kotlinx.serialization.json.Json
 import java.io.File
-import java.io.PrintWriter
-import java.io.StringWriter
-import java.time.OffsetDateTime
-import java.time.ZoneOffset
-import java.time.temporal.ChronoUnit
 import kotlin.system.exitProcess
 
-/**
- * Lightweight, privacy-respecting crash capture — no Firebase/Crashlytics, no
- * network, no third-party SDK.
- *
- * On a fatal uncaught exception we persist a structured report to the app's
- * private storage, then **re-raise to the platform's previous handler** so the
- * system "app stopped" dialog still shows and Google Play Android vitals still
- * records the crash. We only observe; we never swallow.
- *
- * On the next launch [CrashReportGate] reads the pending report and offers the
- * user three GitHub-free-friendly actions (see [CrashReportDialog]): copy the
- * full report, **share** it via the system sheet (email / chat / notes — the
- * path for users without a GitHub account and for sideload installs Play vitals
- * never sees), or open a pre-filled `bug_report.yml` issue. The GitHub path
- * turns a one-star "it keeps crashing" review into an actionable issue with a
- * stack trace attached; share/copy cover everyone else. Every outbound path is
- * user-initiated — nothing is transmitted automatically.
- */
+/** Local-only fatal capture. The platform handler still owns termination and Play vitals. */
 object CrashReporter {
-
     private const val TAG = "CrashReporter"
-    private const val DIR = "crash"
-    private const val FILE = "last-crash.json"
-
-    /**
-     * Cap the stack trace we inline into the GitHub URL. Browsers + GitHub
-     * truncate very long URLs, so we ship the head of the trace in the form and
-     * copy the *full* report to the clipboard for the user to paste if needed.
-     */
-    private const val MAX_TRACE_FOR_URL = 3000
-
-    private val json = Json {
-        encodeDefaults = true
-        ignoreUnknownKeys = true
-        prettyPrint = false
-    }
+    private const val LEGACY_DIR = "crash"
+    private const val LEGACY_FILE = "last-crash.json"
+    private const val MAX_TRACE_FOR_URL = 3_000
+    private val json = Json { ignoreUnknownKeys = true }
 
     @Volatile
     private var installed = false
 
-    /**
-     * Install the process-wide uncaught-exception handler. Idempotent; call as
-     * early as possible in [com.hermesandroid.relay.HermesRelayApp.onCreate] so
-     * crashes during the rest of app init are captured too.
-     */
     fun install(context: Context) {
+        ReliabilityCenter.initialize(context)
+        migrateLegacy(context)
         if (installed) return
         installed = true
         val appContext = context.applicationContext
         val previous = Thread.getDefaultUncaughtExceptionHandler()
         Thread.setDefaultUncaughtExceptionHandler { thread, throwable ->
             try {
-                persist(appContext, thread, throwable)
-            } catch (t: Throwable) {
-                // Never let the reporter itself worsen the crash.
-                Log.e(TAG, "Failed to persist crash report", t)
+                ReliabilityCenter.recordFatal(appContext, throwable, thread.name.orEmpty().ifBlank { "?" })
+            } catch (captureFailure: Throwable) {
+                // Never let the reporter worsen or replace the original crash.
+                Log.e(TAG, "Failed to persist local crash report", captureFailure)
             }
-            // Re-raise so the platform behaves exactly as it would without us:
-            // system dialog + Play vitals collection.
             if (previous != null) {
                 previous.uncaughtException(thread, throwable)
             } else {
@@ -85,155 +47,70 @@ object CrashReporter {
         }
     }
 
-    private fun persist(context: Context, thread: Thread, throwable: Throwable) {
-        val trace = StringWriter().also { throwable.printStackTrace(PrintWriter(it)) }.toString().trim()
-        val report = CrashReport(
-            timeIso = isoNow(),
-            versionName = BuildConfig.VERSION_NAME,
-            versionCode = BuildConfig.VERSION_CODE,
-            flavor = BuildConfig.FLAVOR,
-            manufacturer = Build.MANUFACTURER.orEmpty().ifBlank { "?" },
-            model = Build.MODEL.orEmpty().ifBlank { "?" },
-            androidRelease = Build.VERSION.RELEASE.orEmpty().ifBlank { "?" },
-            sdkInt = Build.VERSION.SDK_INT,
-            threadName = thread.name.orEmpty().ifBlank { "?" },
-            exceptionSummary = "${throwable.javaClass.name}: ${throwable.message.orEmpty()}".trim(),
-            stackTrace = trace,
-        )
-        val dir = File(context.filesDir, DIR).apply { mkdirs() }
-        File(dir, FILE).writeText(json.encodeToString(report))
+    fun peekPending(context: Context): ReliabilityReport? {
+        migrateLegacy(context)
+        return ReliabilityCenter.pendingCrash(context)
     }
 
-    /** Read the pending report without clearing it. */
-    fun peekPending(context: Context): CrashReport? = readFile(context)
-
-    /** Read the pending report and delete it (show-once semantics). */
-    fun consumePending(context: Context): CrashReport? {
-        val report = readFile(context)
-        clearPending(context)
-        return report
+    fun clearPending(context: Context, reportId: String? = null) {
+        val target = reportId ?: peekPending(context)?.reportId ?: return
+        ReliabilityCenter.markReviewed(context, target)
     }
 
-    fun clearPending(context: Context) {
-        runCatching { reportFile(context).delete() }
-    }
-
-    private fun readFile(context: Context): CrashReport? = runCatching {
-        val file = reportFile(context)
-        if (!file.exists()) return null
-        json.decodeFromString<CrashReport>(file.readText())
-    }.getOrNull()
-
-    private fun reportFile(context: Context): File =
-        File(File(context.filesDir, DIR), FILE)
-
-    /**
-     * Build a pre-filled GitHub "new issue" URL.
-     *
-     * Uses the **stable** classic `title` + `body` + `labels` query params, NOT
-     * issue-form field-`id` prefilling (`template=...&<id>=...`). The latter is
-     * a GitHub public-preview feature and was observed to silently not apply
-     * (only `title` carried), which is unacceptable for a crash reporter that
-     * fires on devices we can't retry from. `blank_issues_enabled: true` in
-     * `.github/ISSUE_TEMPLATE/config.yml` guarantees `?body=` opens a prefilled
-     * issue. The body mirrors `bug_report.yml`'s sections in markdown so triage
-     * structure is preserved without depending on the preview path.
-     */
-    fun buildGithubIssueUrl(report: CrashReport): String = IssueReport.buildGithubIssueUrl(
-        title = "[Bug]: Crash — ${report.shortTitle()}",
+    fun buildGithubIssueUrl(report: ReliabilityReport): String = IssueReport.buildGithubIssueUrl(
+        title = "[Bug]: Android crash — ${ReliabilityRedactor.redact(report.shortTitle(), 90)}",
         bodyMarkdown = buildIssueBody(report),
-        labels = "bug",
+        labels = "bug,area:android",
     )
 
-    private fun buildIssueBody(report: CrashReport): String {
-        val trace = report.stackTrace.let {
+    private fun buildIssueBody(report: ReliabilityReport): String {
+        val trace = report.technicalDetail.orEmpty().let {
             if (it.length > MAX_TRACE_FOR_URL) {
-                it.take(MAX_TRACE_FOR_URL) + "\n… (truncated — full report copied to your clipboard)"
+                it.take(MAX_TRACE_FOR_URL) + "\n… (truncated — review/copy the local report for the remainder)"
             } else {
                 it
             }
         }
-        return buildString {
-            appendLine(
-                "> ⚠️ Before submitting: remove any secrets, tokens, real hostnames/IPs, " +
-                    "or personal data from the trace below.",
-            )
-            appendLine()
-            appendLine("### Affected area")
-            appendLine("Android app")
-            appendLine()
-            appendLine("### What happened?")
-            appendLine("The app closed unexpectedly. Auto-captured crash report below.")
-            appendLine()
-            appendLine("### Environment")
-            appendLine(report.environmentBlock())
-            appendLine()
-            appendLine("### Crash")
-            appendLine("```")
-            appendLine(trace)
-            appendLine("```")
-            appendLine()
-            append("<sub>Captured by the Hermes-Relay in-app crash reporter · ${report.timeIso}</sub>")
+        return ReliabilityRedactor.redact(
+            buildString {
+                appendLine("> No report was uploaded automatically. This is the locally reviewed, redacted copy.")
+                appendLine()
+                appendLine("### Affected area")
+                appendLine("Android app")
+                appendLine()
+                appendLine("### What happened?")
+                appendLine(report.summary)
+                appendLine()
+                appendLine("### Recovery")
+                appendLine(report.recovery)
+                appendLine()
+                appendLine("### Environment")
+                appendLine(report.environmentBlock())
+                appendLine("- Report ID: ${report.reportId}")
+                appendLine("- App session ID: ${report.appSessionId}")
+                appendLine()
+                appendLine("### Redacted technical detail")
+                appendLine("```")
+                appendLine(trace)
+                appendLine("```")
+                appendLine()
+                append("<sub>Captured locally by Hermes-Relay · ${report.timeIso}</sub>")
+            },
+            maxLength = 12_000,
+        )
+    }
+
+    /** Import the pre-v1 one-file crash format once, redacting before the new store sees it. */
+    private fun migrateLegacy(context: Context) {
+        val file = File(File(context.filesDir, LEGACY_DIR), LEGACY_FILE)
+        if (!file.isFile) return
+        runCatching {
+            val old = json.decodeFromString<LegacyCrashSnapshot>(file.readText())
+            val report = migrateLegacyCrash(old)
+            ReliabilityCenter.import(context, report)
+            file.delete()
+        }.onFailure {
+            Log.w(TAG, "Legacy crash report could not be migrated", it)
         }
     }
-
-    private fun isoNow(): String = runCatching {
-        OffsetDateTime.now(ZoneOffset.UTC).truncatedTo(ChronoUnit.SECONDS).toString()
-    }.getOrDefault(java.util.Date().toString())
-}
-
-/**
- * Structured, serializable crash snapshot. Persisted as JSON between the
- * crashing session and the next launch.
- */
-@Serializable
-data class CrashReport(
-    val timeIso: String,
-    val versionName: String,
-    val versionCode: Int,
-    val flavor: String,
-    val manufacturer: String,
-    val model: String,
-    val androidRelease: String,
-    val sdkInt: Int,
-    val threadName: String,
-    val exceptionSummary: String,
-    val stackTrace: String,
-) {
-    fun deviceLine(): String = "$manufacturer $model"
-
-    fun androidLine(): String = "Android $androidRelease (SDK $sdkInt)"
-
-    fun versionLine(): String = "$versionName (code $versionCode) $flavor"
-
-    /** A short, human title for the GitHub issue — class name + trimmed message. */
-    fun shortTitle(): String {
-        val firstLine = exceptionSummary.lineSequence().firstOrNull().orEmpty()
-        val simpleClass = firstLine.substringBefore(':').substringAfterLast('.').ifBlank { "crash" }
-        val message = firstLine.substringAfter(':', "").trim()
-        return (if (message.isBlank()) simpleClass else "$simpleClass: $message").take(90)
-    }
-
-    /** Full, copy-paste-ready report shown in the dialog and copied to clipboard. */
-    fun toPlainText(): String = buildString {
-        appendLine("Hermes-Relay crash report")
-        appendLine("Time:    $timeIso")
-        appendLine("App:     ${versionLine()}")
-        appendLine("Device:  ${deviceLine()}")
-        appendLine("Android: ${androidLine()}")
-        appendLine("Thread:  $threadName")
-        appendLine()
-        append(stackTrace)
-    }
-
-    /** Matches the `environment` textarea default in `bug_report.yml`. */
-    fun environmentBlock(): String = buildString {
-        appendLine("- Hermes-Relay version/tag: $versionName (code $versionCode)")
-        appendLine(
-            "- Install surface: " +
-                if (flavor.equals("sideload", ignoreCase = true)) "sideload APK" else "Google Play",
-        )
-        appendLine("- Android device and OS: ${deviceLine()} — ${androidLine()}")
-        append("- Connection mode: LAN / Tailscale / public TLS / other")
-    }
 }

app/src/main/kotlin/com/hermesandroid/relay/util/DiagnosticIssuePrefill.kt

@@ -36,12 +36,13 @@ object DiagnosticIssuePrefill {
     }
 
     /**
-     * `bug` for Error entries; `question` (an existing repo label) for
-     * Info/Warning so routine diagnostics don't pollute the bug queue.
+     * `bug,area:android` for Error entries; `question,area:android` for
+     * Info/Warning so routine diagnostics don't pollute the bug queue and all
+     * in-app reports reach the owning Android surface.
      */
     fun issueLabels(entry: DiagnosticLogEntry): String = when (entry.severity) {
-        DiagnosticSeverity.Error -> "bug"
-        else -> "question"
+        DiagnosticSeverity.Error -> "bug,area:android"
+        else -> "question,area:android"
     }
 
     /**
@@ -76,7 +77,7 @@ object DiagnosticIssuePrefill {
         val whatHappened = DiagnosticsLog.redactReportText(expectation)
             ?.takeIf { it.isNotBlank() }
             ?: DEFAULT_WHAT_HAPPENED
-        return buildString {
+        val body = buildString {
             appendLine(
                 "> ⚠️ Before submitting: remove any secrets, tokens, real hostnames/IPs, " +
                     "or personal data from the detail below.",
@@ -111,5 +112,6 @@ object DiagnosticIssuePrefill {
             appendLine()
             append("<sub>Captured by the Hermes-Relay in-app diagnostics log</sub>")
         }
+        return DiagnosticsLog.redactReportText(body).orEmpty()
     }
 }

app/src/main/kotlin/com/hermesandroid/relay/util/RelayErrorClassifier.kt

@@ -231,6 +231,7 @@ fun classifyError(t: Throwable?, context: String? = null, ctx: Context? = null):
                 title = human.title,
                 detail = human.body,
                 throwable = t,
+                reliabilityContext = context,
             )
         }
     }

app/src/main/res/values-b+pt+BR/strings.xml

@@ -2518,7 +2518,14 @@
     <string name="attachment_type_file">Arquivo</string>
     <!-- CrashReportDialog -->
     <string name="crash_title">O Hermes-Relay fechou inesperadamente</string>
-    <string name="crash_body">A última sessão falhou. Enviar este relatório ajuda a corrigir o problema mais rápido.</string>
+    <string name="crash_body">O Hermes-Relay reiniciou após um problema inesperado. Você pode continuar usando o app.</string>
+    <string name="crash_privacy">Nada foi enviado. Revise o relatório editado localmente antes de compartilhar.</string>
+    <string name="crash_review">Revisar relatório</string>
+    <string name="crash_share_title">Compartilhar relatório de falha</string>
+    <string name="crash_share_subject">Relatório de falha do Hermes-Relay — %1$s</string>
+    <string name="crash_toast_no_share">Relatório copiado — nenhum app encontrado para compartilhar</string>
+    <string name="crash_toast_opened">Relatório completo copiado — revise o problema no GitHub antes de enviar</string>
+    <string name="crash_toast_no_browser">Relatório copiado — nenhum navegador encontrado para abrir o GitHub</string>
     <string name="crash_dismiss">Dispensar</string>
     <string name="crash_copy">Copiar</string>
     <string name="crash_share">Compartilhar</string>
@@ -3679,4 +3686,10 @@
     <string name="plugins_keep">Manter</string>
     <string name="plugins_remove">Remover</string>
     <string name="plugins_remove_confirm">Remover “%1$s”? Esta página do plugin não aparecerá mais nos dispositivos Android conectados.</string>
+    <string name="support_bundle_review">Revisar informações de suporte</string>
+    <string name="support_bundle_title">Informações de suporte</string>
+    <string name="support_bundle_privacy">Nada é enviado automaticamente. Revise a exportação local com até %1$d relatórios.</string>
+    <string name="support_bundle_copied">Informações de suporte copiadas</string>
+    <string name="support_bundle_no_share">Informações de suporte copiadas — nenhum app encontrado para compartilhar</string>
+    <string name="support_bundle_share_title">Compartilhar informações de suporte do Hermes-Relay</string>
 </resources>

app/src/main/res/values-b+zh+Hans/strings.xml

@@ -2636,7 +2636,14 @@
 
     <!-- CrashReportDialog -->
     <string name="crash_title">Hermes-Relay 意外关闭</string>
-    <string name="crash_body">上次会话崩溃了。发送此报告有助于更快修复问题。</string>
+    <string name="crash_body">Hermes-Relay 在意外问题后已重新启动。你可以继续使用应用。</string>
+    <string name="crash_privacy">未发送任何内容。分享前请查看在本地脱敏的报告。</string>
+    <string name="crash_review">查看报告</string>
+    <string name="crash_share_title">分享崩溃报告</string>
+    <string name="crash_share_subject">Hermes-Relay 崩溃报告 — %1$s</string>
+    <string name="crash_toast_no_share">报告已复制 — 未找到可分享的应用</string>
+    <string name="crash_toast_opened">完整报告已复制 — 提交前请检查 GitHub 问题</string>
+    <string name="crash_toast_no_browser">报告已复制 — 未找到可打开 GitHub 的浏览器</string>
     <string name="crash_dismiss">忽略</string>
     <string name="crash_copy">复制</string>
     <string name="crash_share">分享</string>
@@ -3767,4 +3774,10 @@
     <string name="plugins_keep">保留</string>
     <string name="plugins_remove">移除</string>
     <string name="plugins_remove_confirm">要移除“%1$s”吗？此插件页面将不再显示在已连接的 Android 设备上。</string>
+    <string name="support_bundle_review">查看支持信息</string>
+    <string name="support_bundle_title">支持信息</string>
+    <string name="support_bundle_privacy">不会自动上传任何内容。请查看最多包含 %1$d 个报告的本地导出。</string>
+    <string name="support_bundle_copied">支持信息已复制</string>
+    <string name="support_bundle_no_share">支持信息已复制 — 未找到可分享的应用</string>
+    <string name="support_bundle_share_title">分享 Hermes-Relay 支持信息</string>
 </resources>

app/src/main/res/values-de/strings.xml

@@ -2640,7 +2640,14 @@
 
     <!-- CrashReportDialog -->
     <string name="crash_title">Hermes-Relay wurde unerwartet beendet</string>
-    <string name="crash_body">Die letzte Sitzung ist abgestürzt. Dieser Bericht hilft, den Fehler schneller zu beheben.</string>
+    <string name="crash_body">Hermes-Relay wurde nach einem unerwarteten Problem neu gestartet. Sie können die App weiter verwenden.</string>
+    <string name="crash_privacy">Es wurde nichts gesendet. Prüfen Sie den lokal bereinigten Bericht vor dem Teilen.</string>
+    <string name="crash_review">Bericht prüfen</string>
+    <string name="crash_share_title">Absturzbericht teilen</string>
+    <string name="crash_share_subject">Hermes-Relay-Absturzbericht — %1$s</string>
+    <string name="crash_toast_no_share">Bericht kopiert — keine App zum Teilen gefunden</string>
+    <string name="crash_toast_opened">Vollständiger Bericht kopiert — GitHub-Problem vor dem Senden prüfen</string>
+    <string name="crash_toast_no_browser">Bericht kopiert — kein Browser für GitHub gefunden</string>
     <string name="crash_dismiss">Schließen</string>
     <string name="crash_copy">Kopieren</string>
     <string name="crash_share">Teilen</string>
@@ -3839,4 +3846,10 @@
     <string name="plugins_keep">Behalten</string>
     <string name="plugins_remove">Entfernen</string>
     <string name="plugins_remove_confirm">„%1$s“ entfernen? Diese Plugin-Seite wird auf verbundenen Android-Geräten nicht mehr angezeigt.</string>
+    <string name="support_bundle_review">Supportinformationen prüfen</string>
+    <string name="support_bundle_title">Supportinformationen</string>
+    <string name="support_bundle_privacy">Nichts wird automatisch hochgeladen. Prüfen Sie den lokalen Export mit bis zu %1$d Berichten.</string>
+    <string name="support_bundle_copied">Supportinformationen kopiert</string>
+    <string name="support_bundle_no_share">Supportinformationen kopiert — keine App zum Teilen gefunden</string>
+    <string name="support_bundle_share_title">Hermes-Relay-Supportinformationen teilen</string>
 </resources>

app/src/main/res/values-es/strings.xml

@@ -2393,7 +2393,14 @@
     <string name="attachment_type_text">Texto</string>
     <string name="attachment_type_file">Archivo</string>
     <string name="crash_title">Hermes-Relay cerró inesperadamente</string>
-    <string name="crash_body">La última sesión fracasó. Enviar este informe ayuda a solucionarlo más rápido.</string>
+    <string name="crash_body">Hermes-Relay se reinició tras un problema inesperado. Puedes seguir usando la aplicación.</string>
+    <string name="crash_privacy">No se envió nada. Revisa el informe redactado localmente antes de compartirlo.</string>
+    <string name="crash_review">Revisar informe</string>
+    <string name="crash_share_title">Compartir informe de fallo</string>
+    <string name="crash_share_subject">Informe de fallo de Hermes-Relay — %1$s</string>
+    <string name="crash_toast_no_share">Informe copiado — no se encontró una aplicación para compartir</string>
+    <string name="crash_toast_opened">Informe completo copiado — revisa la incidencia de GitHub antes de enviarla</string>
+    <string name="crash_toast_no_browser">Informe copiado — no se encontró un navegador para GitHub</string>
     <string name="crash_dismiss">Descartar</string>
     <string name="crash_copy">Copiar</string>
     <string name="crash_share">Compartir</string>
@@ -3524,4 +3531,10 @@
     <string name="plugins_keep">Conservar</string>
     <string name="plugins_remove">Eliminar</string>
     <string name="plugins_remove_confirm">¿Eliminar «%1$s»? Esta página del plugin dejará de aparecer en los dispositivos Android conectados.</string>
+    <string name="support_bundle_review">Revisar información de soporte</string>
+    <string name="support_bundle_title">Información de soporte</string>
+    <string name="support_bundle_privacy">Nada se sube automáticamente. Revisa la exportación local con hasta %1$d informes.</string>
+    <string name="support_bundle_copied">Información de soporte copiada</string>
+    <string name="support_bundle_no_share">Información de soporte copiada — no se encontró una aplicación para compartir</string>
+    <string name="support_bundle_share_title">Compartir información de soporte de Hermes-Relay</string>
 </resources>

app/src/main/res/values-ja/strings.xml

@@ -2650,7 +2650,14 @@
 
     <!-- CrashReportDialog -->
     <string name="crash_title">Hermes-Relay が予期せず終了しました</string>
-    <string name="crash_body">最後のセッションがクラッシュしました。このレポートを送信すると、問題をより早く修正できます。</string>
+    <string name="crash_body">予期しない問題の後、Hermes-Relay が再起動しました。アプリは引き続き使用できます。</string>
+    <string name="crash_privacy">何も送信されていません。共有する前に端末内で編集されたレポートを確認してください。</string>
+    <string name="crash_review">レポートを確認</string>
+    <string name="crash_share_title">クラッシュレポートを共有</string>
+    <string name="crash_share_subject">Hermes-Relay クラッシュレポート — %1$s</string>
+    <string name="crash_toast_no_share">レポートをコピーしました — 共有できるアプリがありません</string>
+    <string name="crash_toast_opened">完全なレポートをコピーしました — 送信前に GitHub の内容を確認してください</string>
+    <string name="crash_toast_no_browser">レポートをコピーしました — GitHub を開けるブラウザがありません</string>
     <string name="crash_dismiss">却下する</string>
     <string name="crash_copy">コピー</string>
     <string name="crash_share">共有</string>
@@ -3838,4 +3845,10 @@
     <string name="plugins_keep">保持</string>
     <string name="plugins_remove">削除</string>
     <string name="plugins_remove_confirm">「%1$s」を削除しますか？接続された Android 端末にこのプラグインページは表示されなくなります。</string>
+    <string name="support_bundle_review">サポート情報を確認</string>
+    <string name="support_bundle_title">サポート情報</string>
+    <string name="support_bundle_privacy">自動アップロードはありません。最大 %1$d 件のレポートを含む端末内エクスポートを確認してください。</string>
+    <string name="support_bundle_copied">サポート情報をコピーしました</string>
+    <string name="support_bundle_no_share">サポート情報をコピーしました — 共有できるアプリがありません</string>
+    <string name="support_bundle_share_title">Hermes-Relay サポート情報を共有</string>
 </resources>

app/src/main/res/values-ru/strings.xml

@@ -2600,7 +2600,14 @@
     <string name="attachment_type_text">Текст</string>
     <string name="attachment_type_file">Файл</string>
     <string name="crash_title">Hermes-Relay неожиданно закрылся</string>
-    <string name="crash_body">Последняя сессия завершилась аварийно. Отправка этого отчета поможет быстрее исправить проблему.</string>
+    <string name="crash_body">Hermes-Relay перезапустился после непредвиденной проблемы. Приложением можно продолжать пользоваться.</string>
+    <string name="crash_privacy">Ничего не отправлено. Перед отправкой проверьте локально обезличенный отчёт.</string>
+    <string name="crash_review">Проверить отчёт</string>
+    <string name="crash_share_title">Поделиться отчётом о сбое</string>
+    <string name="crash_share_subject">Отчёт о сбое Hermes-Relay — %1$s</string>
+    <string name="crash_toast_no_share">Отчёт скопирован — приложение для отправки не найдено</string>
+    <string name="crash_toast_opened">Полный отчёт скопирован — проверьте проблему GitHub перед отправкой</string>
+    <string name="crash_toast_no_browser">Отчёт скопирован — браузер для GitHub не найден</string>
     <string name="crash_dismiss">Закрыть</string>
     <string name="crash_copy">Скопировать</string>
     <string name="crash_share">Поделиться</string>
@@ -3560,4 +3567,10 @@
     <string name="plugins_keep">Оставить</string>
     <string name="plugins_remove">Удалить</string>
     <string name="plugins_remove_confirm">Удалить «%1$s»? Эта страница плагина больше не будет отображаться на подключённых устройствах Android.</string>
+    <string name="support_bundle_review">Проверить сведения для поддержки</string>
+    <string name="support_bundle_title">Сведения для поддержки</string>
+    <string name="support_bundle_privacy">Ничего не загружается автоматически. Проверьте локальный экспорт с не более чем %1$d отчётами.</string>
+    <string name="support_bundle_copied">Сведения для поддержки скопированы</string>
+    <string name="support_bundle_no_share">Сведения для поддержки скопированы — приложение для отправки не найдено</string>
+    <string name="support_bundle_share_title">Поделиться сведениями поддержки Hermes-Relay</string>
 </resources>

app/src/main/res/values/strings.xml

@@ -2772,7 +2772,14 @@
 
     <!-- CrashReportDialog -->
     <string name="crash_title">Hermes-Relay closed unexpectedly</string>
-    <string name="crash_body">The last session crashed. Sending this report helps get it fixed faster.</string>
+    <string name="crash_body">Hermes-Relay restarted after an unexpected problem. You can continue using the app.</string>
+    <string name="crash_privacy">Nothing was sent. Review the locally redacted report before choosing copy, share, or GitHub.</string>
+    <string name="crash_review">Review report</string>
+    <string name="crash_share_title">Share crash report</string>
+    <string name="crash_share_subject">Hermes-Relay crash report — %1$s</string>
+    <string name="crash_toast_no_share">Report copied — no app found to share to</string>
+    <string name="crash_toast_opened">Full report copied — review the GitHub issue before submitting</string>
+    <string name="crash_toast_no_browser">Report copied — no browser found to open GitHub</string>
     <string name="crash_dismiss">Dismiss</string>
     <string name="crash_copy">Copy</string>
     <string name="crash_share">Share</string>
@@ -3845,4 +3852,10 @@
     <string name="plugins_keep">Keep</string>
     <string name="plugins_remove">Remove</string>
     <string name="plugins_remove_confirm">Remove “%1$s”? This plugin page will no longer appear on connected Android devices.</string>
+    <string name="support_bundle_review">Review support information</string>
+    <string name="support_bundle_title">Support information</string>
+    <string name="support_bundle_privacy">Nothing is uploaded automatically. Review the exact local export below. It contains up to %1$d recent reports.</string>
+    <string name="support_bundle_copied">Support information copied</string>
+    <string name="support_bundle_no_share">Support information copied — no app found to share to</string>
+    <string name="support_bundle_share_title">Share Hermes-Relay support information</string>
 </resources>

app/src/test/kotlin/com/hermesandroid/relay/diagnostics/DiagnosticsLogTest.kt

@@ -8,9 +8,9 @@ import org.junit.Test
 
 class DiagnosticsLogTest {
     @Test
-    fun sanitizeUrlDropsSecretsAndKeepsRoute() {
+    fun sanitizeUrlDropsSecretsAndHostWhileKeepingPath() {
         assertEquals(
-            "https://relay.example.test:8767/health",
+            "https://[host]/health",
             DiagnosticsLog.sanitizeUrl(
                 "https://user:secret@relay.example.test:8767/health?token=abc#frag",
             ),

app/src/test/kotlin/com/hermesandroid/relay/network/upstream/ChatHandlerTest.kt

@@ -28,6 +28,7 @@ import org.junit.Assert.assertNull
 import org.junit.Assert.assertTrue
 import org.junit.Before
 import org.junit.Test
+import kotlin.random.Random
 
 /**
  * Unit tests for ChatHandler message state management.
@@ -2189,6 +2190,165 @@ class ChatHandlerTest {
         assertEquals("Running terminal", handler.turnStatus.value)
     }
 
+    @Test
+    fun loadMessageHistory_thenRestoreCheckpoint_mergesReboundAssistantWithoutDuplicateUiIdentity() {
+        val clientId = "c32c93a8-b54b-4943-87b0-dfd36adb9c3f"
+        val serverId = "server-assistant-id"
+        handler.addPlaceholderMessage(
+            ChatMessage(
+                id = clientId,
+                role = MessageRole.ASSISTANT,
+                content = "partial answer",
+                timestamp = 2L,
+                isStreaming = true,
+            ),
+        )
+        handler.loadMessageHistory(
+            listOf(
+                MessageItem(
+                    id = serverId,
+                    role = "assistant",
+                    content = JsonPrimitive("partial answer"),
+                    timestamp = 2.0,
+                ),
+            ),
+        )
+        assertEquals(serverId, handler.messages.value.single().id)
+        assertEquals(clientId, handler.messages.value.single().uiKey)
+
+        handler.restoreInFlightTurn(
+            ChatTurnCheckpoint(
+                contextKey = "connection/profile",
+                sessionId = "session-1",
+                liveSessionId = "session-1",
+                transport = "gateway",
+                user = ChatTurnUserCheckpoint("user-client-id", "question", 1L),
+                assistant = ChatTurnAssistantCheckpoint(
+                    id = clientId,
+                    content = "partial answer",
+                    timestamp = 2L,
+                    thinkingContent = "checkpoint reasoning",
+                ),
+                priorUserMessageCount = 0,
+                baselineAssistantCount = 0,
+                startedAt = 1L,
+                updatedAt = 3L,
+            ),
+        )
+
+        val assistants = handler.messages.value.filter { it.role == MessageRole.ASSISTANT }
+        assertEquals(1, assistants.size)
+        assertEquals(serverId, assistants.single().id)
+        assertEquals(clientId, assistants.single().uiKey)
+        assertEquals("checkpoint reasoning", assistants.single().thinkingContent)
+        assertEquals(
+            handler.messages.value.size,
+            handler.messages.value.map(ChatMessage::uiKey).distinct().size,
+        )
+    }
+
+    @Test
+    fun staleClientCallbacks_afterServerIdAdoption_mutateTheReboundRow() {
+        val clientId = "b229a0f6-4f15-4f86-bce3-a939d5acce82"
+        val serverId = "server-assistant-id"
+        handler.addPlaceholderMessage(
+            ChatMessage(
+                id = clientId,
+                role = MessageRole.ASSISTANT,
+                content = "",
+                timestamp = 1L,
+                isStreaming = true,
+            ),
+        )
+        handler.replaceMessageId(clientId, serverId)
+
+        // Gateway recovery callbacks retain the checkpoint/client id even
+        // after history or message.started has adopted the server id.
+        handler.onTextDelta(clientId, "answer")
+        handler.onThinkingDelta(clientId, "reasoning")
+        handler.onToolGenerating(clientId, "terminal")
+
+        val assistant = handler.messages.value.single()
+        assertEquals(serverId, assistant.id)
+        assertEquals(clientId, assistant.uiKey)
+        assertEquals("answer", assistant.content)
+        assertEquals("reasoning", assistant.thinkingContent)
+        assertEquals(1, assistant.toolCalls.size)
+    }
+
+    @Test
+    fun recoveryTransitionModel_neverPublishesDuplicateRenderIdentity() {
+        repeat(64) { seed ->
+            val modelHandler = ChatHandler()
+            val clientId = "client-$seed"
+            val serverId = "server-$seed"
+            val checkpoint = ChatTurnCheckpoint(
+                contextKey = "connection/profile",
+                sessionId = "session-$seed",
+                liveSessionId = "session-$seed",
+                transport = "gateway",
+                user = ChatTurnUserCheckpoint("user-$seed", "question", 1L),
+                assistant = ChatTurnAssistantCheckpoint(
+                    id = clientId,
+                    content = "partial",
+                    timestamp = 2L,
+                    thinkingContent = "checkpoint",
+                ),
+                priorUserMessageCount = 0,
+                baselineAssistantCount = 0,
+                startedAt = 1L,
+                updatedAt = 2L,
+            )
+            modelHandler.addPlaceholderMessage(
+                ChatMessage(
+                    id = clientId,
+                    role = MessageRole.ASSISTANT,
+                    content = "partial",
+                    timestamp = 2L,
+                    isStreaming = true,
+                ),
+            )
+
+            var serverIdAdopted = false
+            val random = Random(seed)
+            repeat(20) { step ->
+                when (random.nextInt(5)) {
+                    0 -> {
+                        val content = modelHandler.messages.value
+                            .last { it.role == MessageRole.ASSISTANT }
+                            .content
+                        modelHandler.loadMessageHistory(
+                            listOf(
+                                MessageItem(
+                                    id = serverId,
+                                    role = "assistant",
+                                    content = JsonPrimitive(content),
+                                    timestamp = 2.0,
+                                ),
+                            ),
+                        )
+                        serverIdAdopted = true
+                    }
+                    1 -> modelHandler.restoreInFlightTurn(checkpoint)
+                    2 -> modelHandler.onTextDelta(clientId, ".$step")
+                    3 -> modelHandler.onThinkingDelta(clientId, "t$step")
+                    else -> modelHandler.onUsageReceived(clientId, step, step + 1, null, null)
+                }
+
+                val snapshot = modelHandler.messages.value
+                assertEquals(
+                    "seed=$seed step=$step keys=${snapshot.map(ChatMessage::uiKey)}",
+                    snapshot.size,
+                    snapshot.map(ChatMessage::uiKey).distinct().size,
+                )
+                val assistants = snapshot.filter { it.role == MessageRole.ASSISTANT }
+                assertEquals("seed=$seed step=$step", 1, assistants.size)
+                assertEquals(clientId, assistants.single().uiKey)
+                if (serverIdAdopted) assertEquals(serverId, assistants.single().id)
+            }
+        }
+    }
+
     @Test
     fun onMoaReference_upsertsByCanonicalIndexAndResetsOnNewSequence() {
         handler.addPlaceholderMessage(

app/src/test/kotlin/com/hermesandroid/relay/network/upstream/RenderedMessageStateTest.kt

@@ -0,0 +1,45 @@
+package com.hermesandroid.relay.network.upstream
+
+import com.hermesandroid.relay.data.ChatMessage
+import com.hermesandroid.relay.data.MessageRole
+import org.junit.Assert.assertEquals
+import org.junit.Test
+
+class RenderedMessageStateTest {
+
+    @Test
+    fun publicationBoundary_keepsFirstPositionAndLatestSnapshotForEachUiIdentity() {
+        val state = RenderedMessageState(emptyList())
+        val first = message(id = "client-a", uiKey = "row-a", content = "partial")
+        val middle = message(id = "server-b", uiKey = "row-b", content = "other")
+        val replay = message(id = "server-a", uiKey = "row-a", content = "final")
+
+        state.update { listOf(first, middle, replay) }
+
+        assertEquals(listOf("row-a", "row-b"), state.value.map(ChatMessage::uiKey))
+        assertEquals(listOf("server-a", "server-b"), state.value.map(ChatMessage::id))
+        assertEquals("final", state.value.first().content)
+    }
+
+    @Test
+    fun publicationBoundary_normalizesEveryMutationApi() {
+        val first = message(id = "client", uiKey = "stable", content = "partial")
+        val latest = message(id = "server", uiKey = "stable", content = "final")
+        val state = RenderedMessageState(listOf(first, latest))
+        assertEquals(1, state.value.size)
+
+        state.value = listOf(first, latest)
+        assertEquals(1, state.value.size)
+
+        state.update { listOf(first, latest) }
+        assertEquals(1, state.value.size)
+    }
+
+    private fun message(id: String, uiKey: String, content: String) = ChatMessage(
+        id = id,
+        uiKey = uiKey,
+        role = MessageRole.ASSISTANT,
+        content = content,
+        timestamp = 1L,
+    )
+}

app/src/test/kotlin/com/hermesandroid/relay/reliability/ReliabilityReportTest.kt

@@ -0,0 +1,171 @@
+package com.hermesandroid.relay.reliability
+
+import java.io.File
+import java.net.SocketTimeoutException
+import java.time.Instant
+import java.util.concurrent.CancellationException
+import java.net.URLDecoder
+import com.hermesandroid.relay.util.CrashReporter
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertFalse
+import org.junit.Assert.assertTrue
+import org.junit.Test
+
+class ReliabilityReportTest {
+    private val environment = ReliabilityEnvironment(
+        versionName = "1.6.1",
+        versionCode = 38,
+        flavor = "sideload",
+        manufacturer = "Example",
+        model = "Phone",
+        androidRelease = "16",
+        sdkInt = 36,
+    )
+
+    @Test
+    fun redactorRemovesSecretsHostsIdentifiersPathsAndContent() {
+        val raw = """
+            authorization: Bearer-secret
+            token=abc123
+            https://private.example.test:8767/path?q=secret
+            host 192.168.1.4:8642
+            session 123e4567-e89b-12d3-a456-426614174000
+            C:\Users\person\private\file.txt
+            prompt=private words from a conversation
+        """.trimIndent()
+
+        val redacted = ReliabilityRedactor.redact(raw)
+
+        listOf(
+            "Bearer-secret", "abc123", "private.example.test", "192.168.1.4",
+            "123e4567-e89b-12d3-a456-426614174000", "person", "private words",
+        ).forEach { assertFalse("leaked $it", redacted.contains(it)) }
+        assertTrue(redacted.contains("[url hidden]"))
+        assertTrue(redacted.contains("prompt=[hidden]"))
+    }
+
+    @Test
+    fun classifierSeparatesCancellationConnectivityAuthRateLimitAndProductErrors() {
+        assertEquals(
+            ReliabilityKind.ExpectedCancellation,
+            ReliabilityClassifier.classify(CancellationException(), "gateway").kind,
+        )
+        assertFalse(ReliabilityClassifier.classify(CancellationException(), "gateway").shouldPersist)
+        assertEquals(
+            ReliabilityKind.Connectivity,
+            ReliabilityClassifier.classify(SocketTimeoutException("slow"), "gateway").kind,
+        )
+        assertEquals(
+            ReliabilityOwner.UpstreamGateway,
+            ReliabilityClassifier.classify(SocketTimeoutException("slow"), "gateway").owner,
+        )
+        assertEquals(
+            ReliabilityKind.Authentication,
+            ReliabilityClassifier.classify(IllegalStateException("HTTP 401"), "dashboard").kind,
+        )
+        assertEquals(
+            ReliabilityKind.RateLimit,
+            ReliabilityClassifier.classify(IllegalStateException("HTTP 429"), "api").kind,
+        )
+        assertTrue(
+            ReliabilityClassifier.classify(IllegalArgumentException("duplicate key"), "ui")
+                .reportRecommended,
+        )
+    }
+
+    @Test
+    fun storeEnforcesAgeCountRedactionAndReviewedState() {
+        val dir = kotlin.io.path.createTempDirectory("reliability-store").toFile()
+        val store = ReliabilityStore(File(dir, "reports.json"), maxReports = 3, retentionDays = 14)
+        val now = Instant.parse("2026-08-04T12:00:00Z")
+
+        store.append(report("old", "2026-07-01T00:00:00Z"), now)
+        store.append(report("one", "2026-08-01T00:00:00Z"), now)
+        store.append(report("two", "2026-08-02T00:00:00Z"), now)
+        store.append(report("three", "2026-08-03T00:00:00Z"), now)
+        store.append(
+            report("four", "2026-08-04T00:00:00Z").copy(summary = "token=do-not-store"),
+            now,
+        )
+
+        val stored = store.readAll(now)
+        assertEquals(listOf("two", "three", "four"), stored.map { it.reportId })
+        assertFalse(stored.last().summary.contains("do-not-store"))
+        assertTrue(stored.last().pendingReview)
+
+        store.markReviewed("four", now)
+        assertFalse(store.readAll(now).last().pendingReview)
+    }
+
+    @Test
+    fun legacyMigrationIsVersionedPendingAndRedacted() {
+        val migrated = migrateLegacyCrash(
+            LegacyCrashSnapshot(
+                timeIso = "2026-08-03T15:12:26Z",
+                versionName = "1.6.0",
+                versionCode = 37,
+                flavor = "googlePlay",
+                manufacturer = "Example",
+                model = "Phone",
+                androidRelease = "17",
+                sdkInt = 37,
+                threadName = "main",
+                exceptionSummary = "Crash token=secret-value",
+                stackTrace = "at Example https://private.example.test/path",
+            ),
+            reportId = "rpt-test",
+            appSessionId = "legacy-test",
+        )
+
+        assertEquals(RELIABILITY_SCHEMA_VERSION, migrated.schemaVersion)
+        assertEquals(ReliabilityKind.FatalCrash, migrated.kind)
+        assertTrue(migrated.pendingReview)
+        assertFalse(migrated.toPlainText().contains("secret-value"))
+        assertFalse(migrated.toPlainText().contains("private.example.test"))
+    }
+
+    @Test
+    fun supportBundleIsBoundedAndUsesExactRedactedReports() {
+        val reports = (1..12).map { index ->
+            report("r$index", "2026-08-${index.toString().padStart(2, '0')}T00:00:00Z")
+                .copy(technicalDetail = "token=secret-$index")
+        }
+        val bundle = SupportBundleBuilder.build(reports)
+
+        assertFalse(bundle.contains("secret-"))
+        assertFalse(bundle.contains("Report:  r1\n"))
+        assertTrue(bundle.contains("Report:  r12"))
+        assertEquals(10, Regex("===== Report ").findAll(bundle).count())
+    }
+
+    @Test
+    fun crashIssuePrefillTargetsAndroidAndContainsOnlyRedactedDetail() {
+        val report = report("rpt-prefill", "2026-08-04T00:00:00Z").copy(
+            summary = "Crash token=private-value",
+            technicalDetail = "at Example https://private.example.test/path",
+        )
+
+        val url = CrashReporter.buildGithubIssueUrl(report)
+        val decoded = URLDecoder.decode(url, "UTF-8")
+
+        assertTrue(decoded.contains("labels=bug,area:android"))
+        assertTrue(decoded.contains("### Affected area\nAndroid app"))
+        assertFalse(decoded.contains("private-value"))
+        assertFalse(decoded.contains("private.example.test"))
+    }
+
+    private fun report(id: String, time: String): ReliabilityReport = ReliabilityReport(
+        reportId = id,
+        appSessionId = "app-test",
+        timeIso = time,
+        kind = ReliabilityKind.FatalCrash,
+        owner = ReliabilityOwner.Android,
+        severity = ReliabilitySeverity.Fatal,
+        summary = "Unexpected problem",
+        recovery = "The app restarted",
+        reportRecommended = true,
+        technicalDetail = "java.lang.IllegalStateException",
+        environment = environment,
+        pendingReview = true,
+    )
+}

app/src/test/kotlin/com/hermesandroid/relay/ui/components/SupportBundleDialogTest.kt

@@ -0,0 +1,43 @@
+package com.hermesandroid.relay.ui.components
+
+import com.hermesandroid.relay.reliability.ReliabilityEnvironment
+import com.hermesandroid.relay.reliability.ReliabilityKind
+import com.hermesandroid.relay.reliability.ReliabilityOwner
+import com.hermesandroid.relay.reliability.ReliabilityReport
+import com.hermesandroid.relay.reliability.ReliabilitySeverity
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertFalse
+import org.junit.Assert.assertTrue
+import org.junit.Test
+
+class SupportBundleDialogTest {
+    @Test
+    fun emptyStateCannotShare() {
+        val state = buildSupportReviewState(emptyList())
+        assertEquals(0, state.reportCount)
+        assertFalse(state.shareEnabled)
+    }
+
+    @Test
+    fun populatedStateShowsExactlyTheBundleThatCanBeShared() {
+        val report = ReliabilityReport(
+            reportId = "rpt-visible",
+            appSessionId = "app-visible",
+            timeIso = "2026-08-04T12:00:00Z",
+            kind = ReliabilityKind.RecoverableProductError,
+            owner = ReliabilityOwner.Voice,
+            severity = ReliabilitySeverity.Error,
+            summary = "Focus controls stopped responding",
+            recovery = "Voice closed and chat remained available",
+            reportRecommended = true,
+            environment = ReliabilityEnvironment("1.6.1", 38, "googlePlay", "Example", "Phone", "13", 33),
+        )
+
+        val state = buildSupportReviewState(listOf(report))
+
+        assertEquals(1, state.reportCount)
+        assertTrue(state.shareEnabled)
+        assertTrue(state.text.contains("Focus controls stopped responding"))
+        assertTrue(state.text.contains("Owner:   Voice"))
+    }
+}

app/src/test/kotlin/com/hermesandroid/relay/ui/components/VoiceModeOverlayStateTest.kt

@@ -16,6 +16,7 @@ import com.hermesandroid.relay.viewmodel.realtimeTranscriptState
 import com.hermesandroid.relay.viewmodel.realtimeTurnActiveAfterPromotion
 import com.hermesandroid.relay.viewmodel.voiceSessionExitState
 import org.junit.Assert.assertEquals
+import org.junit.Assert.assertNotEquals
 import org.junit.Assert.assertNull
 import org.junit.Test
 
@@ -63,29 +64,19 @@ class VoiceModeOverlayStateTest {
     }
 
     @Test
-    fun transcriptKeys_remainDistinctWhenRowsShareReconciledServerId() {
+    fun transcriptKey_staysStableAcrossServerIdAdoption() {
         val serverId = "7c4af8b7-1bb2-4830-a4e5-0332d5ddcd1f"
-        val messages = listOf(
-            ChatMessage(
-                id = serverId,
-                uiKey = "persisted-assistant-row",
-                role = MessageRole.ASSISTANT,
-                content = "Earlier snapshot",
-                timestamp = 1L,
-            ),
-            ChatMessage(
-                id = serverId,
-                uiKey = "live-assistant-row",
-                role = MessageRole.ASSISTANT,
-                content = "Reconciled live snapshot",
-                timestamp = 2L,
-            ),
+        val live = ChatMessage(
+            id = "client-assistant-id",
+            role = MessageRole.ASSISTANT,
+            content = "Earlier snapshot",
+            timestamp = 1L,
         )
+        val reconciled = live.copy(id = serverId, content = "Reconciled snapshot")
 
-        assertEquals(
-            listOf("persisted-assistant-row", "live-assistant-row"),
-            messages.map(::voiceTranscriptItemKey),
-        )
+        assertEquals(voiceTranscriptItemKey(live), voiceTranscriptItemKey(reconciled))
+        assertEquals("message:client-assistant-id", voiceTranscriptItemKey(reconciled))
+        assertNotEquals("aux:pending-voice-transcript", voiceTranscriptItemKey(reconciled))
     }
 
     @Test

app/src/test/kotlin/com/hermesandroid/relay/util/IssueReportAndDiagnosticsTest.kt

@@ -115,7 +115,7 @@ class IssueReportAndDiagnosticsTest {
     fun errorEntriesKeepBugTitleAndLabel() {
         val entry = sampleEntry(DiagnosticSeverity.Error, title = "API key rejected")
         assertEquals("[Bug]: API key rejected", DiagnosticIssuePrefill.issueTitle(entry))
-        assertEquals("bug", DiagnosticIssuePrefill.issueLabels(entry))
+        assertEquals("bug,area:android", DiagnosticIssuePrefill.issueLabels(entry))
     }
 
     @Test
@@ -124,7 +124,7 @@ class IssueReportAndDiagnosticsTest {
             val entry = sampleEntry(severity)
             assertEquals("[Diagnostic]: Testing API connection", DiagnosticIssuePrefill.issueTitle(entry))
             // "question" already exists on the repo — the prefill must not invent labels.
-            assertEquals("question", DiagnosticIssuePrefill.issueLabels(entry))
+            assertEquals("question,area:android", DiagnosticIssuePrefill.issueLabels(entry))
         }
     }
 
@@ -161,6 +161,7 @@ class IssueReportAndDiagnosticsTest {
         )
         assertTrue(body.contains("- Connection mode: tailscale"))
         assertFalse(body.contains("LAN / Tailscale / public TLS / other"))
+        assertFalse(body.contains("10.0.0.5"))
     }
 
     @Test

docs/audits/2026-08-04-android-reliability-audit.md

@@ -0,0 +1,269 @@
+# Android reliability and support audit
+
+**Date:** 2026-08-04
+**Scope:** Android fatal crashes, handled failures, diagnostics, symbolication,
+privacy, recovery, and user-initiated support submission.
+
+## Executive summary
+
+Hermes-Relay already has the right product posture: crash capture is local,
+reports are never uploaded automatically, the platform crash handler still runs,
+and users can copy, share, or open GitHub themselves. The implementation is not
+yet one reliability system, however. Fatal crashes use a private one-file JSON
+format, handled errors use an in-memory diagnostics ring, issue builders duplicate
+environment and truncation rules, and release mappings are not retained outside
+the transient build workspace. The UI therefore asks users to review developer
+traces without enough interaction context while maintainers receive obfuscated or
+truncated reports that cannot always be retraced.
+
+The foundational change should align those seams without adding telemetry:
+
+1. use one allowlisted, versioned reliability event contract for fatal and handled
+   failures;
+2. redact locally before persistence, display, copy, share, or issue prefill;
+3. retain a small deterministic local history and build a support export entirely
+   on device;
+4. make the recovery UI lead with outcome and next steps, with technical detail
+   behind an explicit review action;
+5. retain release mapping files outside public release assets by immutable
+   version/SHA and make Android's own issue prefills request the Android area.
+
+No automatic upload, analytics SDK, remote crash service, prompt/message capture,
+or background logcat collection is justified.
+
+## Current end-to-end architecture
+
+### Fatal crashes
+
+- `HermesRelayApp.onCreate()` installs `CrashReporter` before other app setup.
+- The process-wide uncaught-exception handler synchronously writes
+  `files/crash/last-crash.json`, then delegates to Android's previous handler.
+  This preserves the platform crash path and Google Play Android vitals.
+- The next main-app launch displays `CrashReportGate`. The report remains until
+  the user dismisses, shares, or opens GitHub; copy alone does not acknowledge it.
+- The persisted record contains time, version/code/flavor, manufacturer/model,
+  Android release/API, thread, exception summary, and the full Java trace.
+- GitHub prefill truncates the trace to 3,000 characters because it is encoded in
+  a browser URL. Copy/share use the full persisted trace.
+
+Failure modes:
+
+- the raw exception message and trace are written before privacy redaction;
+- a single non-atomic file means a second crash replaces the first and an
+  interrupted write can leave no readable report;
+- the format has no explicit schema version, retention period, size bound, report
+  identifier, or migration contract;
+- the primary recovery experience is a large stack trace rather than what
+  happened, what recovered, and what the user can do;
+- a crash in a secondary process can compete for the same file;
+- fatal OOM may leave too little memory for serialization or file I/O.
+
+### Handled errors and coroutine failures
+
+- `classifyError()` maps common network, auth, HTTP, SSL, permission, and voice
+  failures to `HumanError`, then records every non-null throwable in
+  `DiagnosticsLog`.
+- `DiagnosticsLog` is an in-memory 200-entry ring. List fields are capped at 180
+  characters and error traces at 8,000 characters. It is cleared on process death.
+- Network ownership is partially represented by `DiagnosticCategory` (`API`,
+  `Relay`, `Session`, `Voice`, `Route`, `Auth`), but `send_message` defaults to
+  API even when Gateway owns the turn. Dashboard and upstream Gateway do not have
+  first-class categories.
+- Multiple long-lived `SupervisorJob` scopes exist in services, clients, and the
+  process runtime. There is no process-wide `CoroutineExceptionHandler`; failures
+  are visible only where a caller catches/classifies them or where they become
+  uncaught exceptions.
+- Expected cancellation and user denial are not a first-class taxonomy. A caught
+  cancellation passed to `classifyError()` can appear as an error and become
+  reportable noise.
+
+### Connectivity, auth, HTTP, WebSocket, and voice
+
+- Typed DNS, connection-refused, timeout, TLS, permission, and generic I/O
+  failures receive humane copy and retry/repair hints.
+- HTTP status handling is message-based. 401/403/404/413/500/503 have distinct
+  outcomes, but rate limiting is not first-class and ownership depends on a small
+  caller-provided context string.
+- Gateway, Dashboard, API fallback, optional Relay, and Voice have separate live
+  checks in Diagnostics, but the captured error data contract cannot represent
+  all five owners precisely.
+- `isConnectivityError()` lets startup UI avoid duplicate scary snackbars, but
+  those failures are still recorded as generic errors.
+
+### OOM and ANR boundaries
+
+- OOM is only captured if the uncaught handler has enough memory and storage to
+  finish. The current reporter allocates a `StringWriter` containing the complete
+  trace, which is specifically fragile during OOM.
+- ANRs do not throw through the uncaught handler. Google Play can observe Play
+  builds, while sideload builds currently have no local ANR signal.
+- Adding a main-thread watchdog immediately would introduce false positives during
+  debugger pauses, device sleep, startup, and legitimate long frames. It belongs
+  in a later opt-in/bounded phase after lifecycle-aware design and device testing.
+
+### Diagnostics, breadcrumbs, and correlation
+
+- Diagnostics has read-only subsystem checks plus the in-memory activity ring.
+- Relay envelopes and some bridge/TUI paths have request IDs, and chat has durable
+  session/run/message IDs. These identifiers are not joined to crash reports.
+- Raw session, profile, and connection identifiers may themselves be sensitive.
+  The safe foundation is a new random per-launch app-session ID and per-event
+  report ID. Product/session IDs should only be added later as short local hashes
+  after a demonstrated diagnostic need.
+- There is no bounded breadcrumb contract. Capturing arbitrary diagnostic detail
+  would risk prompts, message text, media paths, profile names, and host data.
+
+### R8, ProGuard, and symbolication
+
+- Release builds enable R8 and preserve `SourceFile`/`LineNumberTable`; source file
+  names are normalized to `SourceFile`.
+- AGP writes `mapping.txt` under `app/build/outputs/mapping/<variant>/`. The file
+  is overwritten by subsequent builds.
+- The Play AAB contains its mapping, so Play reports can be deobfuscated in Play
+  Console. Sideload reports need the exact locally retained variant mapping.
+- The release workflow publishes the sideload APK and Play AAB but does not retain
+  either release mapping as a versioned workflow artifact. A GitHub issue containing
+  a sideload trace therefore may be practically irretrievable after the runner is
+  gone.
+- Maintainer procedure should be deterministic:
+  `retrace <mapping-for-exact-version-and-flavor> <trace-file>`.
+
+### Recent-report evidence
+
+- #289 (`1.6.0`, Play) contains a `NoSuchElementException` trace with application
+  frames reduced to names such as `gn5.g(SourceFile:2)` and is truncated mid-frame.
+  The interaction that preceded the crash is absent.
+- #292 (`1.6.0-sideload`) contains a duplicate Compose lazy-list key but only
+  obfuscated application frames and a trace truncated by URL limits.
+- #298 (`1.6.1`, Play) shows the same duplicate-key class on another device, again
+  with obfuscated application frames. There is no route/session/interaction
+  context to distinguish the owning list.
+- #299 (`1.6.1`, Play) provides the missing human context—Focus-mode controls
+  animate but taps usually do not complete—but has no diagnostic event, app-session
+  correlation, or technical trail.
+- All four Android issues received `area:plugin`. The former issue-triage workflow
+  tested broad `relay|plugin|...` keywords before Android terms, so the
+  repository/app name won before `Android app`, device, Compose, or voice context
+  was considered. Current `dev` has since retired that unreliable keyword
+  labeler in favor of maintainer review; it should not be reintroduced.
+
+The reports demonstrate both halves of the gap: traces without interaction context
+and interaction context without a safe technical trail.
+
+## Privacy threat review
+
+The following must never be collected by the reliability contract:
+
+- authentication headers, cookies, API keys, Relay/session/pairing tokens, OAuth
+  codes, or signed URLs;
+- prompt, response, transcript, reasoning, tool arguments/results, or notification
+  content;
+- real hostnames, IP addresses, full URLs, SSIDs, proxy routes, or private
+  infrastructure names;
+- profile/agent/person names, raw connection/session/run/message IDs, contacts, or
+  account identifiers;
+- local/media/workspace paths, attachment names, clipboard contents, screenshots,
+  audio, or camera data.
+
+The contract should allow only enumerated owner/kind/status values, version/device
+metadata, random local correlation IDs, bounded redacted summaries/traces, route
+roles (for example `lan` or `public TLS`, never the host), and bounded allowlisted
+breadcrumbs with no arbitrary payload.
+
+Redaction is defense in depth, not permission to collect prohibited fields. It
+must run before disk persistence and again when rendering/exporting legacy data.
+
+## Shared taxonomy and data contract
+
+### Kinds
+
+| Kind | Persistence / UI policy |
+|---|---|
+| Fatal crash | Persist synchronously; show recovery once; reporting is useful |
+| ANR/watchdog signal | Contract reserved; later lifecycle-aware implementation |
+| Recoverable product error | Persist bounded history; show owned recovery action |
+| Connectivity | Low-noise; retry/offline guidance; do not nag for reports |
+| Authentication | Name owning surface; repair/sign-in guidance |
+| Rate limit | Show retry timing when safely known; do not report by default |
+| Service unavailable | Retry guidance; report only if repeated/unexpected |
+| Expected cancellation | Do not persist or offer reporting |
+| User denial | Do not persist or offer reporting; explain how to change permission |
+
+### Owners
+
+`Android`, `Dashboard`, `API`, `Relay`, `Upstream Gateway`, `Voice`, and `Unknown`.
+Standard Dashboard/Gateway/API ownership remains upstream; Relay is optional and
+must never be presented as required for standard recovery.
+
+### Versioned record
+
+Each record contains: schema version, random report ID, random app-session ID,
+timestamp, kind, owner, severity, humane summary, recovery outcome, whether a
+report is recommended, bounded redacted technical detail, and allowlisted app /
+OS / device / flavor metadata. Optional context contains route role and bounded
+allowlisted breadcrumbs only.
+
+## UX recommendation
+
+### Post-crash recovery
+
+Lead with “Hermes-Relay restarted after an unexpected problem.” Explain that work
+on the Hermes server may still be running, no report was sent, and the user can
+continue. Technical information stays collapsed behind “Review report.” Copy,
+share, and GitHub use the same reviewed redacted payload. Dismiss remains the
+lowest-friction path and never nags again for that event.
+
+### Inline handled errors
+
+Use owner + outcome + action: “Dashboard sign-in expired — chat can use API
+fallback” or “Relay unavailable — standard Chat and Manage are unaffected.” Do not
+offer reporting for connectivity, expected cancellation, user denial, or a missing
+optional Relay feature. Keep report actions in Diagnostics rather than snackbars.
+
+### Settings / About / Diagnostics
+
+Diagnostics should expose “Review support information,” showing exactly the
+bounded text that copy/share will receive. It should work offline and include no
+new probe. About should continue to show version/flavor; duplicating export entry
+points there is unnecessary in the foundation.
+
+### Accessibility and localization
+
+The crash dialog must support narrow/foldable layouts, scrolling, screen-reader
+labels, large text, and an explicit technical-detail toggle. All new visible copy
+must use resources across supported locales. Clipboard/share/browser absence must
+fall back without losing the local report.
+
+## Phased plan
+
+### Immediate coherent foundation
+
+- Add the versioned taxonomy/record and centralized local redactor.
+- Persist fatal and centrally classified handled failures in a bounded atomic
+  local store; migrate the legacy one-file crash record.
+- Suppress persistence/report prompting for expected cancellation and user denial.
+- Build crash/support text and GitHub prefill from the same redacted contract.
+- Add explicit review-before-sharing UI and a Diagnostics support export.
+- Route Android crash and Diagnostics issue prefills to `area:android`; keep the
+  unreliable repository-wide keyword labeler disabled.
+- Retain Play and sideload `mapping.txt` files as non-release version/SHA workflow
+  artifacts and document retrace.
+- Add focused privacy, bounds, classification, migration, issue-prefill, and UI
+  state tests.
+
+### Later, evidence-gated follow-up
+
+- Lifecycle-aware ANR watchdog with debugger/sleep/startup suppression and device
+  false-positive testing.
+- Strict allowlisted breadcrumbs at high-value transitions (screen/feature owner,
+  route transition, retry outcome), never user content.
+- Hashed product correlation IDs only where a concrete diagnosis requires them.
+- OOM emergency record preallocation / minimal writer.
+- Broader structured error adoption at WebSocket, coroutine-scope, and service
+  boundaries that currently bypass `classifyError()`.
+- Maintainer tooling that downloads the exact release mapping and runs retrace from
+  a report's version/code/flavor tuple.
+
+Automatic telemetry, remote upload, full logcat collection, prompt/transcript
+capture, and third-party crash SDKs remain out of scope unless separately proposed
+and approved.

docs/dev-loop.md

@@ -1,7 +1,7 @@
 # Issue → fix dev-loop
 
 How an incoming issue becomes a worktree you (or a local agent) can start working
-in. This documents deterministic issue labeling, subscription-backed Codex review,
+in. This documents maintainer issue labeling, subscription-backed Codex review,
 path-aware required CI, and the local bridge `scripts/start-issue.sh`.
 
 It complements — does not replace — `RELEASE.md` (how a fix ships) and `CLAUDE.md`
@@ -11,7 +11,7 @@ public-repo writing hygiene).
 ## The loop at a glance
 
 ```
-issue opened ──▶ deterministic type + area labels ──▶ maintainer triage
+issue opened ──▶ maintainer triage + labels
                                                         │
                                                         ▼
                          scripts/start-issue.sh <N>   ── local bridge
@@ -25,15 +25,12 @@ issue opened ──▶ deterministic type + area labels ──▶ maintainer tri
                                                   └─▶ Codex review
 ```
 
-## Deterministic issue triage
+## Manual issue triage
 
-`.github/workflows/issue-triage.yml` runs a no-LLM keyword classifier when an
-issue opens. It applies a title-derived type label and, when the issue text is
-clear, one `area:*` label. It never closes an issue, edits its body, diagnoses a
-root cause, or posts an automated opinion.
-
-To label an older issue again, use the workflow's `workflow_dispatch` input or
-run `gh workflow run issue-triage.yml -f issue_number=NNN`.
+Maintainers review new issues and apply the appropriate type and `area:*` labels.
+Area labels are deliberately manual: generic words such as “relay”, “plugin”,
+“chat”, and “voice” cross product boundaries and cannot reliably identify the
+owning implementation surface from issue text alone.
 
 ## PR review
 
@@ -99,9 +96,7 @@ gh label create "area:docs"               -c "bfd4f2" -d "docs/ or user-docs/"
 
 ## Operational notes
 
-- **Activation lag.** Issue-triggered workflows run the copy on the default branch
-  (`main`). Changes stay dormant on `dev` until a release merge lands them on main.
-- **No model cost for issue labeling.** The issue workflow is deterministic
-  `github-script`; Codex review usage is accounted through the connected Codex plan.
-- **No write-access escalation here.** Issue triage cannot push code or open PRs.
-  Auto-attempting a fix from untrusted issue text remains intentionally out of scope.
+- **Manual issue labels.** Type and area labels are applied during maintainer
+  triage; no issue-open workflow guesses ownership from keywords.
+- **No write-access escalation from issues.** Auto-attempting a fix from
+  untrusted issue text remains intentionally out of scope.

docs/localization-status.json

@@ -13,7 +13,7 @@
       "verification": "ai-translated",
       "review_refs": [],
       "source_sha256": {
-        "main": "25f5a4ef506b35ec0ba2dbde89b87c13908b037f9c4e889b8a4e64a1ee8103cc",
+        "main": "e26a371ee7d835b718706bef24f4b21773897c1b6537728136d4879468722ffe",
         "sideload": "4abff4f1069091ec2de735c3037a7ec7d77699cb4321e8511a622437bceaf7c2"
       },
       "surfaces": {
@@ -48,7 +48,7 @@
       "verification": "ai-translated",
       "review_refs": [],
       "source_sha256": {
-        "main": "25f5a4ef506b35ec0ba2dbde89b87c13908b037f9c4e889b8a4e64a1ee8103cc",
+        "main": "e26a371ee7d835b718706bef24f4b21773897c1b6537728136d4879468722ffe",
         "sideload": "4abff4f1069091ec2de735c3037a7ec7d77699cb4321e8511a622437bceaf7c2"
       },
       "surfaces": {
@@ -72,7 +72,7 @@
       "verification": "ai-translated",
       "review_refs": [],
       "source_sha256": {
-        "main": "25f5a4ef506b35ec0ba2dbde89b87c13908b037f9c4e889b8a4e64a1ee8103cc",
+        "main": "e26a371ee7d835b718706bef24f4b21773897c1b6537728136d4879468722ffe",
         "sideload": "4abff4f1069091ec2de735c3037a7ec7d77699cb4321e8511a622437bceaf7c2"
       },
       "surfaces": {
@@ -96,7 +96,7 @@
       "verification": "ai-translated",
       "review_refs": [],
       "source_sha256": {
-        "main": "25f5a4ef506b35ec0ba2dbde89b87c13908b037f9c4e889b8a4e64a1ee8103cc",
+        "main": "e26a371ee7d835b718706bef24f4b21773897c1b6537728136d4879468722ffe",
         "sideload": "4abff4f1069091ec2de735c3037a7ec7d77699cb4321e8511a622437bceaf7c2"
       },
       "surfaces": {
@@ -120,7 +120,7 @@
       "verification": "ai-translated",
       "review_refs": [],
       "source_sha256": {
-        "main": "25f5a4ef506b35ec0ba2dbde89b87c13908b037f9c4e889b8a4e64a1ee8103cc",
+        "main": "e26a371ee7d835b718706bef24f4b21773897c1b6537728136d4879468722ffe",
         "sideload": "4abff4f1069091ec2de735c3037a7ec7d77699cb4321e8511a622437bceaf7c2"
       },
       "surfaces": {
@@ -135,7 +135,7 @@
       "verification": "ai-translated",
       "review_refs": [],
       "source_sha256": {
-        "main": "25f5a4ef506b35ec0ba2dbde89b87c13908b037f9c4e889b8a4e64a1ee8103cc",
+        "main": "e26a371ee7d835b718706bef24f4b21773897c1b6537728136d4879468722ffe",
         "sideload": "4abff4f1069091ec2de735c3037a7ec7d77699cb4321e8511a622437bceaf7c2"
       },
       "surfaces": {

docs/play-store-listing.md

@@ -89,12 +89,12 @@ This app is a community project and is not affiliated with or endorsed by NousRe
 Paste into Play Console → **What's new** (≤500 characters):
 
 ```
-v1.6.0 - Pets, plugins, and voice
+v1.6.1 - Clearer recovery, steadier chat
 
-* Floating Petdex companions that can roam across the UI.
-* Safe native pages from installed Hermes plugins.
-* Optional Android Digital Assistant with local "Hey Hermes."
-* Russian plus voice, route, chat, and pet stability improvements.
+* Clear optional Relay status and recovery guidance.
+* Full session history through compatible paging.
+* Stable streamed text selection and Voice microphone handoff.
+* New-chat coaching stays clear of Voice controls.
 ```
 
 ## Category

docs/privacy.md

@@ -31,6 +31,7 @@ All app data is stored on-device in the app's private sandbox:
 | Relay session token | EncryptedSharedPreferences | Same encryption as API key |
 | Theme and display preferences | DataStore preferences | Tool display mode, reasoning toggle, voice preferences |
 | Stats for Nerds counters | DataStore preferences | Response times, token counts, health stats — local only |
+| Reliability reports | App-private JSON | Up to 20 locally redacted crash/handled-error records, retained for 14 days; no prompts, messages, profile names, hosts, tokens, or media |
 
 Chat messages are **not cached locally**. They are loaded from the Hermes API server on demand and exist only in memory while the app is running.
 
@@ -74,6 +75,9 @@ Notification companion is opt-in. The app only forwards notification metadata af
 
 From Settings, users can:
 
+- **Review support information** in Diagnostics, then explicitly copy or share
+  the exact redacted local text. Nothing is uploaded automatically.
+
 - **Export** a full connection backup. The file includes server URLs,
   preferences, API keys, relay session tokens, device IDs, and dashboard
   cookies so restored connections can work without manual re-entry. Keep it

gradle/libs.versions.toml

@@ -1,6 +1,6 @@
 [versions]
-appVersionName = "1.6.0"
-appVersionCode = "37"
+appVersionName = "1.6.1"
+appVersionCode = "38"
 agp = "9.3.1"
 kotlin = "2.4.10"
 compose-bom = "2026.06.01"

scripts/start-issue.sh

@@ -177,7 +177,7 @@ BRIEF="${WTDIR}/ISSUE-BRIEF.md"
   if [ -n "$BOTNOTES" ]; then
     printf '%s\n' "$BOTNOTES"
   else
-    echo "_No automated triage comments yet. Add the \`triage:deep\` label on the issue for a code-level analysis, or run the triage workflow._"
+    echo "_No automated triage comments yet. Add the \`triage:deep\` label on the issue for a code-level analysis._"
   fi
 } > "$BRIEF"